77 commits

Author	SHA1	Message	Date
Gergő Magyar	997fc05b83	fix(resolution): resolve calls through a generic-typed field receiver in every language (#2833) (#2855) ... * test(resolution): pin generic-typed field receivers across languages (#2833) A field whose declared type carries a type argument (`repo: Repo<User>`) emits zero CALLS edges — not a truncated chain, not an edge to the interface declaration, nothing. This adds the cross-language matrix that measures it, modelled on the #2807 inferred-field matrix: every language runs the same two calls, one through a generic-typed field and one through a non-generic control field, and each language is compared against its OWN control row rather than an absolute edge count. Measured state, pinned here as `known-gap` so the file is green on main and flipping a row is a visible edit: affected TypeScript, C#, C++, Python unaffected Java, Kotlin, Go, Rust, Swift, Dart The unaffected six erase type arguments at interpret time (Java's `stripGeneric`, F41 #1928; Swift likewise). TypeScript, C# and Python instead run a container ALLOW-LIST that returns the type ARGUMENT, so a user-defined `Repo<User>` survives verbatim into a lookup that binds nothing. The `ts-local-vs-field` case is the bug in one file: `viaLocal` and `viaParam` both resolve for the identical type, and only `viaField` loses every edge — a bare name reaches Case 4 and its generic-aware lookup, a dotted field receiver does not. Negative controls pin what erasure must NOT do: an unbounded type parameter denotes no declaration, and a C++ explicit specialization is a different class from its primary template. The `Box2<T>` row pins a PRE-EXISTING false edge (a workspace class named `T`) so it cannot later be mistaken for fallout from this work. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * refactor(resolution): move resolveClassBindingForName to the shared walkers (#2833) Pure relocation, no behaviour change: the generic-aware class lookup moves from `passes/receiver-bound-calls.ts` to `scope/walkers.ts`, beside the bare `findClassBindingInScope` it wraps. Its two existing callers — `classifyReceiverOrigin` and Case 4 — import it from the new home and are otherwise untouched. The move is required rather than cosmetic: `receiver-bound-calls.ts` already imports from `compound-receiver.ts`, so having the compound receiver call into the pass would close an import cycle. `walkers.ts` is the shared floor both already depend on. Verified behaviour-neutral: the #2833 matrix is 44/44 identical before and after, across all fifteen fixtures. detect_changes attributes `resolveInheritanceBaseInScope`, `resolveQualifiedInheritanceBase` and `EMPTY_BINDINGS` to this commit; those are line-shift artifacts of inserting a function above them, and their bodies are byte-identical. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * fix(resolution): type generic field receivers through the generic-aware lookup (#2833) A field receiver is spelled `this.repo` — dotted — so it types through the receiver-chain fold and the text cascade, both of which reach `findClassBindingInScope`. That function has no notion of type arguments, so a field declared `Repo<User>` resolved to nothing and the call site emitted NO edge at all: not the interface declaration, not the implementation fan-out, nothing. A local or parameter of the identical type is a bare name, reaches Case 4 and its generic-aware `resolveClassBindingForName`, and resolved fine. The bug was the asymmetry, not the generics. Three receiver-typing lookups now call the generic-aware helper instead: `typeOfMemberOnClass`'s primary and module-hoist branches, and the cascade's bare-identifier type-binding read. Every other one of the 38 `findClassBindingInScope` call sites is untouched — its own docstring records that widening it globally suppresses the `?? otherResolver(...)` fallbacks two dozen callers rely on, which would retarget inheritance edges, and impact rates it CRITICAL with 12 direct dependents. Order matters and is preserved: the helper tries the exact name, then an arity- and token-exact match against `def.templateArguments`, and only then falls back to the base name. Erasing first would collapse a C++ explicit specialization onto its primary template — `Vec<bool>` really is a different class. A bare type parameter carries no type arguments, so it never enters the generic branch and cannot be erased into a class that happens to share its name. Measured: TypeScript and C# generic-typed fields now emit exactly what their non-generic control rows emit, primary plus interface-dispatch fan-out. Java, Kotlin, Go, Rust, Swift and Dart are byte-identical. Both type-parameter negative controls are unchanged. C++ and Python are still open and stay pinned as known-gaps — they fail for different reasons and get their own commits. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * fix(cpp,python): bind generic-typed member fields so their calls resolve (#2833) Completes #2833 for the two languages the shared resolution change could not reach. Each failed for its own reason, and both were found by measurement rather than assumed. C++ — a CAPTURE gap, not a resolution one. All three `field_declaration` type-binding rules required `type: (type_identifier)`, so a member declared `Repo<User> repo;` is a `template_type` and matched none of them: the field got no type binding at all, and every call through it lost its edge in both the bare and `this->` spellings. A LOCAL of the identical type resolved the whole time, because the local declaration rules gained their `template_type` variant long ago. Three mirrored rules close it, one per declarator shape (plain, pointer, reference). Written as separate patterns rather than one alternation: a node-type alternation in a field position is a tree-sitter 0.21 hazard this repo has been bitten by before. Python — the bracket spelling never entered the generic branch. Its `stripGeneric` is a container allow-list over `[...]` that returns the type ARGUMENT (`list[User]` to `User`), so a user-defined `Repo[User]` matched nothing and survived verbatim, and the shared lookup's generic branch is gated on `<`. It now reduces a subscripted type neither allow-list claims to its base name — the same rule Java and Swift already apply to `<...>`. Deliberately the LAST resort: a container must reach its own rule first, or `list[User]` would type the receiver as the container and retarget every call in a for-loop chain. The as-written spelling survives on `TypeRef.declaredSpelling`, which is what the fold's index step reads. Both are parse-time and land in the cached ParsedFile, so SCHEMA_BUMP goes 45 -> 46 with its pin test. Verified free against origin/main; the ledger in that file records three prior EXACT clashes, so re-check again immediately before merge. The matrix now covers the spellings real code writes, all measured: a nullable generic, a bounded wildcard, a raw type, a nested generic and a multi-argument one. None needed work beyond the shared lookup, which is the evidence that base-name erasure is the right primitive. The C++ specialization control now asserts what it was written for: `Vec<bool>.save` and `Vec.save` are DIFFERENT target ids, so the arity/token match still wins over erasure. scope-capture is byte-identical for cpp and c, so no rebaseline — the bench corpus contains no generic-typed member field, which is worth its own coverage issue. Two pre-existing gaps were measured and are deliberately NOT fixed here, because in both cases the language's own non-generic CONTROL row fails identically: C++ `this->field.m()` emits nothing, and JavaScript/PHP docblock-declared field types bind nothing at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * fix(python): do not reduce containers or typing special forms to a base name (#2833) Review finding on this branch's own Python change, caught by probing the interpreter directly rather than by reading it. The base-name reduction was reached by FALLTHROUGH: "neither container rule matched" was treated as "not a container". It is not, and two measured shapes proved it: dict[str, list[User]] -> dict (was: the annotation, intact) Dict[str, Repo[User]] -> Dict Callable[[int], User] -> Callable Literal["a"] -> Literal Union[A, B] -> Union tuple[int, ...] -> tuple The dict rule's value group cannot span a nested `]`, so a nested value declines and falls through — and the dict rule's own comment says that shape is deliberately "left for a downstream strip pass". Collapsing it to `dict` destroyed the value type instead. The typing SPECIAL FORMS are worse: `Callable`, `Literal`, `Annotated` and `Union` are not classes, and reducing them to a bare name binds any workspace class that happens to share it — a fabricated edge, which is strictly worse than the missing edge #2833 set out to fix, and those names are ordinary enough for a real codebase to declare. Reduction is now guarded by an explicit deny set covering the containers the two allow-lists already own and the typing special forms. Everything named there keeps its as-written text and resolves exactly as it did before #2833. `arr[0]` also reduces to `arr` in isolation, but that is unreachable and is now documented as such: every Python `@type-binding.type` capture is a `(type)`, `(identifier)`, `(attribute)` or `(dotted_name)` node, so a subscripted VALUE expression never reaches the interpreter. Pinned by a new unit test that asserts all four groups — user generic reduces, container reduces to its ELEMENT, declined container shape stays intact, special form untouched. Reverting the deny set fails three of its five cases. Also corrects `resolveClassBindingForName`'s docstring, which this branch had made false: it claimed only `classifyReceiverOrigin` passes the decoration stripper, while the three receiver-typing lookups in compound-receiver.ts now pass it too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * fix(resolution): rank base-name candidates lexically and refuse arg-pinned defs (#2833) Review of #2855 found that this PR turned a MISSING C++ edge into a CONFIDENTLY WRONG one — the direction this subsystem calls unrecoverable. `resolveClassBindingForName` ended with an unguarded base-name fallback that returned the first same-named class the scope chain reached. A C++ primary template carries `templateArguments === undefined`, so it can never satisfy the exact-args branch, and every non-specialized instantiation fell through to that fallback. Measured through the real pipeline: with the primary forward-declared and the specialization defined first, `Vec<int> vi; vi.save()` emitted `Vec<bool>::save`. Declaring the primary first gave the correct target — selection was SOURCE-ORDER DEPENDENT. Two more triggers behaved the same way: a partial specialization (`Vec<int*>` against `Vec<T*>`), and lexical shadowing between a global `Box<bool>` and a namespaced `N::Box<bool>`. Two changes, neither of which is any of the three remediations the review proposed — each was rejected on measured evidence: - Exact-argument matching is now LEXICAL-FIRST. Candidates come from the scope chain, and the workspace-wide qualified-name bucket is consulted only when the chain produced no exact match, so cross-file specializations still bind. - The base-name route refuses a definition that pinned its own template arguments: if the fallback's answer carries `templateArguments`, the visible candidates are re-decided with those removed — exactly one, or decline. Why not the filed options. "If specializations exist and none matches exactly, return undefined" deletes a green committed row (`neg-cpp-specialization/runInt` legitimately resolves to the primary). "Resolve all defs for the base name, return only on exactly one" deletes a working edge for C# `partial class Repo<T>` split across files — two unspecialized defs under one name is legitimate, and `QualifiedNameIndex`'s own docstring names that case. Preferring the primary alone fixes nothing about shadowing, which is a ranking bug. The guard is expressed as `carriesOwnTemplateArguments`, not as "specialization", so shared pipeline code still names no language (AGENTS.md R6). It can only fire where a declared name carries concrete arguments — measured `undefined` for `class Repo<T>` in TypeScript and C# and for a C++ primary template — so the blast radius is bounded to C++-style specializations. Partial-specialization SELECTION is deliberately not implemented: choosing `Vec<T*>` for `Vec<int*>` needs template-argument deduction, which is a semantics expansion and cannot live in language-neutral shared code. The source-order dependence is what is fixed; the answer is now deterministically the primary. Also in this commit: dropped an unreachable `?? []` (QualifiedNameIndex returns a frozen empty array on miss by contract) whose comment was wrong on both clauses; made the docstring true about argument ERASURE being what widens what binds, rather than only the decoration stripper; and corrected a stale pointer that still placed `resolveClassBindingForName` in `receiver-bound-calls`. `findClassBindingInScope` itself is untouched — 38 call sites, CRITICAL. Verified: matrix 56/56, cpp.test.ts 334, unit scope-resolution 1505. Mutation proof: reverting this file fails the three trigger cases and passes the non-regression cases; restoring it passes all five. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * fix(python): close the deny-set drift axis by case-folding, not by vigilance (#2833) Review of #2855 found `NOT_A_USER_GENERIC` was a closed list over an open universe: four review lanes each escaped it with a DIFFERENT set of names. `Deque` was the sharpest — its lowercase twin `deque` was already listed, so the omission was an internal inconsistency rather than a judgement call, and with a workspace `class Deque` present `self.dq: Deque[User]` fabricated a `Deque.appendleft` edge. The structural cause is PEP 585: nearly every container has two spellings differing only in case (`deque`/`typing.Deque`, `frozenset`/`FrozenSet`). Exact matching forced every pair to be listed twice, so any half-pair was a silent escape. The deny lookup is now CASE-FOLDED, which closes that axis by construction — `Deque` becomes impossible rather than remembered. `SINGLE_ARG_CONTAINERS` and `MAPPING_CONTAINERS` are now the single source of truth: they build the two container regexes (verified byte-identical `.source` and `.flags`, so zero behaviour change) and feed the property test. The deny set is re-scoped to a closed, auditable universe — the documented Python stdlib type-system surface — and grew 39 -> 65 concepts: the `collections.abc` views, `contextlib` managers, `re.Pattern`/`Match`, the `IO` family, ordinary-named stdlib generics (`Queue`, `Task`, `Future`, `PathLike`), the remaining typing special forms, and the generic machinery (`Generic`, `Protocol`, `TypeVar`...). Third-party generics (`Mapped`, `QuerySet`, `Model`) are deliberately NOT added and are pinned as a decision: that universe is open, enumerating it only chases the last escape, and declining `Model` would cost real edges in the many projects that declare one. The review's suggested property test — derive the names from the `single`/`dict` regex sources — would NOT have caught `Deque`: `deque` appears in neither regex, only in the deny set. Both properties are implemented, since they catch different drift. The unit test was also TAUTOLOGICAL: it asserted members OF the deny set, so it structurally could not detect an omission. It now asserts case-fold closure and PEP 585 alias coverage, and the capture fixture drops its `as unknown as` cast for the fully-typed helper pattern the sibling `java-interpret.test.ts` already uses. Still at interpret time, so no further SCHEMA_BUMP (already 45 -> 46). Proving the base is a class the FILE can see — the real fix for the remaining exposure, since `findClassBindingInScope` binds any name with exactly one workspace def regardless of scope or imports — is a follow-up, not reachable from this file. Mutation proof: restoring HEAD's deny-set contents and exact-match lookup fails four assertions including the `Deque` pair, with the pre-existing guard rows still passing; restoring gives 125/125. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * fix(cpp): capture qualified generic member fields, and make the bench gate see them (#2833) Review of #2855 found that the three `field_declaration` rules this PR added only matched a DIRECT `template_type`, so the common real-world spelling still bound nothing: `std::vector<Item> items;`, `ns::Repo<User> r;` and `std::unique_ptr<Repo> p;` parse as a `qualified_identifier` WRAPPING a `template_type`. "C++ fixed" was overstated. Six new patterns — three declarator shapes (plain, pointer, reference) by two qualifier depths — written as separate patterns rather than one alternation, keeping the tree-sitter 0.21 field-position discipline the existing rules follow. The design choice was measured, not assumed. Codex suggested preserving the full qualified spelling and normalizing `::`; preserving resolves NOTHING, because `findClassBindingInScope`'s dotted-tail fallback splits on `.` while C++ writes `::`, and `ns::Repo` is not an index key either (C++ emits no `@declaration.qualified_name`). Measured: `ns::Repo<User>` resolves to nothing, `ns.Repo<User>` resolves to `Repo`. Since a tree-sitter capture is a NODE and not synthesized text, the only lever is which node to capture — so `@type-binding.type` goes on the INNER `template_type`, dropping the qualifier and landing on the same single-match-or-decline path the bare spelling already takes. Qualifier depth 3+ (`a:🅱️:c::Repo<User>`) remains uncaptured. Stated as a limit and pinned by a test row, not claimed as fixed. The bench blindness the review identified is also closed. The `scope-capture` C++ corpus contained ZERO template-typed member fields — confirmed a fourth way by applying six demonstrably behaviour-changing patterns and getting a byte-identical fingerprint. The corpus now carries generic and qualified-generic members, and the gate is load bearing for the first time: three states that all hashed to 856d02f3 before now differ (pre-#2833 0e7cbda7, +this PR's 3 rules de07d8b5, +these 6 rules bd47c82d). Rebaselined for cpp only; c is unchanged. Histogram diff: only 5 tags move with the fields, each by exactly +40 (20 entities x 2), and every `@reference.*` count is unchanged. Over-match is preserved: 20 shapes still produce no field capture, including the 8 original method/pointer/reference/function-pointer/ using/typedef/friend/operator forms plus their `std::`- and `a:🅱️:`-qualified variants. Not fixed here, deliberately: NON-generic qualified fields (`ns::Address addr;`, `std::string name;`) still capture nothing. Closing that needs six more patterns and would newly bind every `std::string`/`std::mutex` member repo-wide, changing edges far outside #2833. Separate issue. The template-template-parameter hazard the review filed against these rules is NOT capture-side: a tree-sitter query has no scope knowledge, so it cannot know `Map` is bound by the enclosing `template <...>` header, and the PRE-EXISTING `type: (type_identifier)` rule already captures a bare `T item;` and erases it the same way. It is handled by the lexical ranking in `walkers.ts` in this series. Mutation proof: reverting this file fails 9 of 32 assertions (all eight qualified spellings return no capture) while every over-match negative still passes; restoring gives ALL PASS. Bench `--check` passes for all 15 languages. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * test(resolution): pin specialization order, shadowing and the untested spellings (#2833) Grows the generic-field matrix 56 -> 114 tests, closing every coverage gap the #2855 review named and turning the fix-agents' scratch evidence into permanent rows. The rows that discriminate against the resolver fix (they fail if `walkers.ts` is reverted): - C++ specialization must not depend on DECLARATION ORDER: the forward-declared-primary/specialization-first arrangement must land on the primary, same as the mirror arrangement. Plus a cross-case property asserting the two independently built fixtures agree. - Partial specialization is deterministic in both orders. The note says explicitly that selecting `Vec<T*>` would need argument deduction and that flipping this row later is a deliberate expansion, not a regression fix. - Lexical shadowing: the namespace-local `N::Box<bool>` wins for a field inside `N`, and the global specialization wins at global scope. The NON-REGRESSION rows are load-bearing — they are why two of the three proposed remediations were rejected: cross-file C++ specialization binding, and C# `partial class Repo<T>` split across two files with the field in a third (two legitimate unspecialized defs under one name). Coverage the review found missing: C++ pointer and reference generic fields (two of this PR's three original rules had ZERO coverage); all six qualified patterns plus the depth-3 boundary pinned as empty; TS/C# multi-arg container collision; an anti-vacuity sibling for `neg-bounded-type-parameter`; Swift/Dart rows restructured so the ANNOTATION is the only possible source (the old rows gave the field an initializer of the same generic type and could not tell which resolved); and cross-file, inheritance/MRO, import-alias, static-member and the TypeScript module-hoist branch. Six things were measured and pinned AS MEASURED rather than asserted as wishes, each flagged in its row note: a static/class-level member emits nothing for generic AND non-generic alike (a static gap, not a generics one); a cross-file C++ primary template does not bind while the cross-file specialization does; `std::unique_ptr<Payload>` types to `unique_ptr` rather than `Payload` (smart-pointer transparency is not applied on the qualified path); two same-named C++ specializations in one file collapse to one node id; and the container-name collision (`Map<string, User>` binding a workspace `class Map`) is recorded as INTENDED, since the annotation does name that class. The `new Set(...)` dedup was kept rather than narrowed: a per-case surplus-edge sweep measured ZERO duplicate edges anywhere in this file, Swift included, so the quirk that justified a blanket dedup does not reproduce. The sweep now pins zero surplus per case, so a real double-emit fails instead of being absorbed. The file is deliberately NOT split: four assertions compare cases against each other, cost is linear in cases, and the 1,800,000 ms `beforeAll` is kept because the same run measured 271-428 s depending on host load — a tighter bound converts contention into a red suite. The reasoning is recorded in the file header. Also corrects the SCHEMA_BUMP pin-test title, which still said (#2766). Mutation proof: reverting `walkers.ts` fails exactly the five order and shadowing assertions and passes the other 109; restoring gives 114/114. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * feat(resolution): capture declared type parameters so a type variable is not a class (#2833) Three review findings were blocked on one missing fact. `templateArguments` records the arguments a declaration was written AGAINST (`struct Vec<bool>`); nothing recorded the parameter list a declaration DECLARES (`template <class T>`, `class Box<T extends Repo>`). So the resolver could not tell a type variable from a class, and: - `class Box2<T> { t: T }` beside a workspace `class T` emitted a FALSE edge `run2 -> T.foo`. `T` carries no type arguments, so it never entered the generic branch — the plain lookup simply bound a same-named class. The lexical grounding added elsewhere in this series cannot help, because `export class T` IS lexically bound. - `class Box<T extends Repo> { t: T }` resolved to nothing: no recorded bound to resolve through. - A full specialization `template<> struct Vec<T*>` and a partial `template<class T> struct Vec<T*>` were byte-identical (`['T*']`). `SymbolDefinition.typeParameters` now records `{ name, bound? }` in declaration order (substitution is positional). `bound` is kept verbatim and un-split, so `Repo & Closeable` stays whole; ABSENT means UNKNOWN, never "unbounded", which is what keeps unconverted languages behaving exactly as before. Transport is the raw parameter-list node via `@declaration.type-parameters`, read by a language-neutral parser that recognizes TOKENS, not languages: `extends`/`:` introduce a bound, the name is the trailing identifier, so `class T`, `typename T`, `in T`, `out T`, `reified T` and `class... Ts` are one rule. Populated for TypeScript, C++, Java, Kotlin, C# and Rust. JavaScript, C, COBOL, PHP and Ruby have no declared type parameters to capture; Go and Python spell them with SQUARE brackets, which this parser deliberately rejects as ambiguous against subscript and array spellings (Go already has a working main-thread sidecar in this series); Dart and Swift are straightforward follow-ups. Two latent hazards found and closed on the way: - The new capture was not in `KNOWN_SUB_TAGS`, so it could out-span its own declaration and become the anchor — silently DROPPING the whole class def. - A templated C++ struct matches both the standalone and `template_declaration` patterns, minting two defs under one id, and only one twin could see the parameter list. `buildDefIndex` is first-write-wins, so MATCH ORDER decided whether `Vec` remembered `T`. A narrow duplicate-declaration backfill gives both twins the list. Also fixed by its own test: a Rust lifetime `'a` parsed as a parameter named `a`, which would have shadowed a real class. Parse-time output lands in the cached ParsedFile, so SCHEMA_BUMP goes 46 -> 47. Re-checked against origin/main at write time: main is on 45; 46 was taken by this same branch, and a warm cache stamped 46 carries ParsedFiles with no `typeParameters` at all. The csharp and rust capture goldens were regenerated with the tests' own documented `UPDATE_GOLDEN=1`; only digests moved, no captureGroups. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * fix(resolution): ground erased base names, and stop a class name from being enough (#2833) The review's central risk was that this PR converts MISSING edges into CONFIDENTLY WRONG ones. Base-name erasure (`Repo<User>` -> `Repo`, `Repo[User]` -> `Repo`) bound through a workspace-wide qualified-name fallback that consults NO scope, NO import and NO module — it bound any name with exactly one workspace def. That is why a Python `Mapped[User]` could bind an unrelated `class Mapped`, and why the language deny lists were papering over an open universe. `resolveErasedBaseName` now admits an erased base on one of four grounds, strongest first: the scope chain binds it; the declaration is in the SAME FILE; the index proves the name is a template family; or the file binds no cross-file class at all, so its silence is no evidence. The last ground fails toward permissive on purpose — every way it can be wrong costs a wrong edge that already existed, never a working one. Two measurements drove that design and refuted the simpler rule. A C++ `#include` materializes NO binding whatever, and C# resolves cross-namespace without `using` through the index — so a pure "require lexical grounding" rule would have deleted every cross-file C++ generic member. Both are now pinned. Python erases at CAPTURE time, so by resolution there is no `<` and the grounded route was never entered. `erasedTypeApplication` rebuilds the application from `TypeRef.declaredSpelling` — strictly: the raw name must be the base and the argument list the whole balanced remainder, so `User[]`, `vector<Item>` and `Repo<User>?` decline and behave exactly as before. Closing it took finding FOUR emitters, not one. Three were in Case 4; the fourth was `emitReferencesViaLookup` re-emitting the refused edge from the pre-resolved reference index, which needed the site marked handled with a recorded `receiver-unresolved`. A fifth lived in the text cascade: a declined fold falls THROUGH by design, and the cascade held its own ungrounded copy of the member-typing lookup. This file typed a receiver from a `TypeRef` in five places and the PR had wired three; all five now go through one `classOfDeclaredType`. Also here, from the same review: - Type parameters no longer bind a same-named class (uses the new `typeParameters`), and a BOUNDED parameter resolves through its bound. - A cross-file C++ PRIMARY template now binds: a ranking bug, not a capture one — the index fallback needs exactly one candidate and `Vec` held two, so removing the argument-pinned declaration leaves one. - `this->field.m()` resolved to nothing for generic AND non-generic alike. A language that declares `this` IS the enclosing class (`resolveThisViaEnclosingClass`) synthesizes no `this` typeBinding, so a chain whose BASE is `this` could never seed its head. Reading the provider flag keeps the rule language-free. - Class-level (static) member receivers emit nothing in TypeScript and Kotlin — for the non-generic control too. Case 6 types them from the DEF side (`isStatic` + `declaredType` on the field node), which needs no capture change; the target lookup stays the ordinary instance walk, so a static field HOLDING an instance still binds an instance method and a genuine static call is untouched. Partial-specialization SELECTION is deliberately not implemented: it needs argument deduction against a parameter list, and full C++ partial ordering is a real algorithm with no measured driving case. The discriminator now exists if someone wants it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * fix(cpp,js,php,go): close the remaining per-language generic-field gaps (#2833) Four language gaps the review measured, each with a different cause. **C++ qualified member fields.** `std::vector<Item> items;`, `ns::Repo<User> r;` and `ns::Address addr;` captured NOTHING: every field rule required the type node to BE a `type_identifier` or `template_type`, and a qualified member type is neither — tree-sitter wraps both in a `qualified_identifier`. Three depth-agnostic rules (one per declarator shape) now match the outer node, which also REMOVES the depth boundary rather than raising it: depths 1-4 capture, generic and non-generic alike. Preserving the qualifier resolves nothing — measured: `ns::Repo<User>` binds neither way, because the dotted-tail fallback splits on `.` while C++ writes `::`, and `ns::Repo` is not an index key. Since a capture is a NODE and not synthesized text, the qualifier is dropped in `interpret.ts` by a top-level-only `::` split, so `std::vector<std::string>` reduces to `vector<std::string>`, not `string`. Measured cost of the non-generic half, which was the reason to hesitate: field captures go 8 -> 32 across the C++ bench corpus, but the resolution-level census over those 13 repos is 32 CALLS edges before and 32 after, BYTE-IDENTICAL. It fabricates only where a workspace class shares a std name (`class string` beside `std::string name;`), which is the same accepted policy the already-landed qualified-generic rules carry, pinned in the matrix as intended. **JavaScript `@type {Repo<User>}` and PHP `@var Repo<User>`.** Neither bound a field type — and neither did the NON-generic control, so this was a docblock gap rather than a generics one. PHP needed TWO captures, not one: with only the type binding, `$this->repo->save()` resolved until a second class declared `save` and then went unresolved, because narrowing a same-named method needs the receiver's member owned. Generics do NOT come free in PHP — `normalizePhpType('Repo<User>')` returns `'User'` by the container-element convention, so passing the raw spelling through would have emitted `User::save`; type arguments are erased at capture instead. In JavaScript they DO come free, verified byte-identical to the TypeScript control. Both decline what they cannot prove: arrays, `list<User>`, unions, `Promise`/`Array` wrappers (via an exported predicate rather than a copied name list), statics, and any property that already has a native type. **Go generic interfaces.** `UserRepo` genuinely DOES implement `Repo[User]` — the spec says a generic type must be instantiated, that instantiation substitutes type arguments and yields a new non-generic type, and that a type implements an interface when it is in its type set. So the old behaviour was a FALSE NEGATIVE and the matrix note calling it "already correct" was wrong. Satisfaction is now checked against POSITIONALLY SUBSTITUTED method sets, so `Repo[Order]` does not match a `Save(x User)` implementor — substitution, not erasure. #2829's exact method-set model is untouched: pointer receivers still follow MS(*T), unexported names stay package-scoped, the declaration's own method set is still checked first, and the harvest is gated so a repo with no generic interface never runs it. `go.test.ts` is unchanged at 296 passing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * test(resolution): pin every fix from the review, 114 -> 155 rows (#2833) Eight rows in this matrix pinned gaps that the fixes in this series close, so each asserted the opposite of the new truth. All eight are flipped, and the prose describing them as open gaps is corrected. Nine new cases cover the fixes that would otherwise have shipped unpinned. Flipped, each measured: the type-parameter FALSE edge (`run2`) is gone; a bounded parameter now resolves through its bound with fan-out; the cross-file C++ primary binds; the C++ qualifier depth boundary is removed rather than raised; Go gains its two structural implementors and JOINS the paired sweep, which had quietly excluded it — that exclusion was the taxonomy admitting a bug; and both static-member rows resolve. Added: JS `@type` and PHP `@var` docblock fields with three PHP declines; a Kotlin `companion object` receiver (given an INTERFACE control so the paired sweep can check it, which `ts-reach-shapes` cannot — its two sides are not count-comparable); the Python third-party grounding refusal plus the ground that still ADMITS, so an empty row can never be read as "erased names never resolve"; the four mirrors that would break if grounding were tightened (same-file and imported Python, a C++ `#include`, C# cross-namespace without `using`); C++ qualified non-generic fields including the fabrication policy and its absence case; `this->field.m()` for generic and non-generic with bare controls; and a Go negative proving substitution is positional, not erasure. Three shapes are pinned AS MEASURED with notes saying they are deliberate limits so nobody "fixes" them by accident: C++ partial-specialization selection is deterministically the primary (real selection needs argument deduction); `std::unique_ptr<T>` types to the pointer, not the pointee (`.` and `->` are indistinguishable to the resolver, so transparency would trade a recoverable miss for a confident wrong edge); and two same-named C++ specializations in one file collapse to one node id, which is why the shadowing fixture uses two files. One row pins a REMAINING wrong edge rather than hiding it: `m.inner.ping()` on a `Mapped[User]` head still binds the unrelated workspace class, while the one-segment-shallower `m.save(u)` correctly declines. The obvious one-line guard was written and MEASURED not to close it, so the surviving route is elsewhere and wants its own diagnosis — a broader refusal would change chain-head resolution for every language without pinning the shape it is meant to fix. `bench/scope-capture` is rebaselined for the six languages whose captures moved, regenerated from a fresh measurement rather than pasted; `--check` passes for all 15. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * perf(resolution): remove three measured hot-path regressions this series added (#2833) A quality pass over the #2833 series found three performance defects it had introduced, all measured, plus dead code and stale docs from six agents having appended to the same files across four rounds. No behaviour change: the resolver suite is identical before and after, and every scope-capture fingerprint is byte-identical. **An accidental quadratic in Go instantiation harvesting.** `collectGoInstantiations` calls `record()` for every type binding and every declared, return and parameter type in every Go file, and the `includes('[')` gate does not filter Go's most common types — `map[string]string`, `[]map[string]*v1.Pod` and `map[string]map[string]int` all produce a `map` candidate. Each false base then failed a full scope-chain walk and fell through to a LINEAR SCAN OF EVERY INTERFACE IN THE PROGRAM, with no dedupe on the spelling, so the same `map[string]string` written 10,000 times paid 10,000 scans. Now a qualified-name index built in `buildDetectionIndexes` (one probe, ambiguity semantics preserved exactly) plus a per-scope base memo: 8,000 interfaces / 80,000 spellings: 6,662 ms -> 104 ms (64x) `resolveEmbeddedInterface` held a byte-identical copy of that scan and now shares the helper. `GoInstantiation` was a single-field wrapper and collapses to the array it wrapped; its two parallel maps fold into one whose inner key IS the dedupe. `candidateStructIdsFor` was rebuilt per instantiation although every substituted method set has the same key set — hoisted, and materialized, because one branch returned a live iterator that would have yielded nothing on a second pass. **`scanForCrossFileClass` asked a name-keyed question that needs no name key.** It answered "does this file bind any cross-file class" by probing every accessible namespace once PER NAME. It now iterates the channels directly, taking whichever side is smaller so a large namespace table cannot reintroduce the product. Predicate and early exit preserved: 5,000 module names x 1,000 namespaces: 159.0 ms -> 1.2 ms (132x) **A duplicated scope walk on every generic receiver.** `resolveClassBindingForName` computed the lexical candidate list, then `resolveErasedBaseName` recomputed the identical `findAllBindingsInScope`. Computed once and passed: receiver at depth 8: 5,617 ns -> 3,091 ns (-45%) **A whole extra AST traversal per JavaScript and PHP file.** The docblock synthesis passes each added a full tree walk to find one node kind — the ninth in the JS emitter, the third in PHP. `node.namedChildren` materializes a wrapper array across the N-API boundary for every node, so one added pass cost 1.9x what parsing the entire file costs. Folded into the existing walks as one more node kind; capture output is byte-identical and every fingerprint is unchanged. Total emit time per file drops 4-7%. Hygiene, all verified stale rather than assumed: - `receiverOriginOpts` passed `resolveThisViaEnclosingClass`, which `classifyReceiverOrigin` never reads — the "both hooks" comment above it is true again. - The `stripDecoration` docstring's caller roll-call claimed the only edge-emitting caller "emits no edge and can only change a diagnostic label". Case 6 passes it and does emit edges. Replaced the roll-call with the rule; six rounds each appending a name to a list is how it went wrong. - A Python comment described the resolution-time grounding as a follow-up that "this parse-time pass cannot do" — it landed in this same branch and is pinned by `py-erased-grounding`. - `classOfDeclaredType` took a `scopeId` all five callers derived from the `TypeRef` they also passed. Dropped, so "these five are the same call" is enforced rather than asserted. - Three exports with no consumer outside their own file. - PHP had three copies of one preceding-comment sibling walk and two regexes for one tag, so a fix to either reader of `@var` would land on one and not the other — the symptom being a field typed differently from its own foreach element type. One walk, one regex. Tests: the new matrix leaked a fixture repo per case; it now carries the sibling suite's `cleanupTempDirSync` and the Windows EBUSY reasoning that goes with it. `PAIRED` was a second hand-maintained list and 19 of 41 cases had silently fallen out of it — it is derived from the cases now, with a new assertion that each case is either swept as a pair or carries a written reason it is not. That recovered one genuine omission (`php-typed-property`). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtNfG6EPn738Y51AYs7wDp * test(bench): rebaseline receiver-resolution for the #2833 this-> fix The `Receiver-resolution drop guards` CI step failed on this branch: shapeArm.cpp.fieldReceiverCall: "INVISIBLE-GAP" -> "RESOLVES" shapeArm.cpp.decoratedFieldType: "INVISIBLE-GAP" -> "RESOLVES" Both are the intended improvement. The guard is exact-match by design — the drop count cannot move without a deliberate rebaseline, and the rebaseline path demands the movement be explained — so this records the two shape flips and leaves the call-drop count arm untouched. BASELINE.md still claimed `this->repo.save()` and `this->repo->save()` were INVISIBLE-GAP. That is now false: the `resolveThisViaEnclosingClass` head seed added in this PR resolves both. Also notes what the control established — this was never a generics gap, since the non-generic control failed identically before the fix. * docs(parse-cache): narrow the SCHEMA_BUMP ledger to what the bump delivers The ledger claimed a warm cache would make "the whole fix ... a silent no-op on every incremental analyze". That overstates the constant. The bump invalidates the PARSE half; whether the re-parsed captures reach the graph is gated separately and does not move: - `isIncremental` (core/run-analyze.ts) tests `!options.force`, an existing meta, `!schemaFingerprintMismatch(...)`, feature parity, non-empty `fileHashes` and a git repo. SCHEMA_BUMP is in none of them. - the incremental branch writes back only `hashDiff.toWrite` and logs the rest as "unchanged file rows preserved". - SCHEMA_FINGERPRINT hashes node/relation DDL, untouched here, so it is byte-identical and moves nothing either. So an incremental analyze re-parses an unchanged file correctly but keeps its existing rows; the new edges land on the next full rebuild. That is the pre-existing contract for every capture change, not a regression in this PR — but the comment should not promise more than it delivers. Comment only; no behavior change. SCHEMA_BUMP stays 48. --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 17:14:13 +01:00
Gergő Magyar	cabd5b82f9	fix(go): model Go method sets exactly so interface satisfaction is decidable (#2813) (#2829) ... * test(go): pin calls through an interface-typed struct field (#2813) A call through an interface-typed struct field never reaches the implementation: the CALLS edge stops at the interface DECLARATION, so `impact()` on the implementing method reports 0 callers. This commit adds the executable statement of that defect; the fixes follow. Two stacked defects produce it, and either alone is enough to reproduce — which is why no existing fixture could observe it: D1 `buildDetectionIndexes` skips every POINTER-receiver method, so a struct whose methods are all `func (r *T)` has an empty method set, structurally satisfies nothing, and gets no IMPLEMENTS edge. Go's rule is that the method set of *T includes pointer-receiver methods, and idiomatic Go stores *T in an interface-typed field. D2 Case 0 (compound receiver) emits its primary edge and short-circuits without the interface-dispatch fan-out Case 4 performs. A struct field receiver `s.orderRepo` contains a dot and so always takes Case 0; a local or parameter receiver is a bare name and reaches Case 4. Every implementor in both pre-existing structural-dispatch fixtures uses a VALUE receiver, and the one pointer-receiver type is pinned as a negative (`not.toContain('PointerOnlyThing -> PointerOnly')`), so the corpus could not see D1 by construction. The new fixture is pointer-receiver throughout, cross-package, and carries concrete-field controls in the same structs. Failing-first, verified against this tree: 7 of the 11 new assertions fail and 4 pass. The 4 that pass are exactly the controls that must not regress — the primary edge to the interface declaration, the concrete-field call, the absence of fan-out on a concrete field, and the partial-signature negative — so the suite discriminates rather than merely failing. Two recorded artifacts move here because the FIXTURE was added, not because capture output changed: - test/fixtures/go-captures-golden/expected-captures.json — regenerated additively (32 insertions, 0 deletions). - bench/scope-capture/baselines.json — go fingerprint, fixture_count 102 -> 110. Both are regenerated in this commit rather than deferred to the end of the series: the fixture is their only cause, no later commit touches capture emission, so they cannot re-drift and every commit stays green. The check that this is corpus growth and not a capture regression is that go was the only one of 15 language fingerprints to move on the same run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(go): count pointer-receiver methods toward structural interface satisfaction (#2813) D1 of two stacked defects. `buildDetectionIndexes` skipped every method whose receiver is a pointer, so a struct declaring `func (r *OrderRepo) DeleteItem(...)` had an EMPTY method set, structurally satisfied nothing, and produced no IMPLEMENTS edge at all. Go's method-set rule is per-type, and there are two types involved: the method set of `T` holds only value-receiver methods, while the method set of `*T` holds both. #1966 implemented the `T` reading, which is exactly right for `T` — and leaves `*T` permanently empty. GitNexus models one Struct node per type with no separate `*T` node, so only one of the two can be represented, and the `T` reading is the one idiomatic Go almost never uses: methods take pointer receivers so they can mutate, and `*T` is what gets stored in an interface-typed field. The cost was silence rather than caution. With no IMPLEMENTS edge, a call through an interface-typed field resolved to the interface DECLARATION and `impact()` on the implementing method returned 0 callers — byte-identical to a symbol that genuinely has none, which is what made the reporter's blast-radius check unusable rather than merely incomplete. This picks the `*T` reading: the graph now answers "which types provide this interface's behaviour", and no longer proves `var x I = T{}` invalid. The trade is deliberate and was checked against every consumer of IMPLEMENTS before being made — MRO/METHOD_IMPLEMENTS derivation, community clustering, the receiver-dispatch fan-out index, and the epistemic heritage probe. None performs value-assignability checking. Two negative pins encoded the #1966 decision and are REVERSED here rather than deleted, each keeping a comment that explains why the polarity moved: - go.test.ts: `PointerOnlyThing -> PointerOnly` now expected to be emitted. - go-hooks.test.ts: the pointer-receiver-only unit case now expects the implementor instead of `undefined`. `goReceiverKind` is still stamped in method-owners.ts — it is the hook a future value/pointer-aware model would read — but is deliberately no longer a filter. Its now-dead local predicate and type alias are removed so the file no longer carries a helper asserting the reverted rule. Measured on the #2813 fixture, this commit alone: the two IMPLEMENTS assertions flip to passing (6 pass, up from 4) while the five interface-dispatch fan-out assertions still fail — those are D2, fixed in the next commit. Keeping the two commits separate is what makes that attribution visible. Go unit suite: 91 passed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(resolution): fan out interface dispatch from a compound receiver (#2813) D2 of two stacked defects, and the one that closes the issue. Case 0 (compound receiver) emitted its primary edge and short-circuited without the interface-dispatch fan-out that Case 4 performs, so a call whose receiver is a struct FIELD stopped at the interface's method DECLARATION and never reached any implementation. The gap was a property of receiver SYNTAX rather than of types. Case 0 is selected by `receiverName.includes('.')`, so a field receiver (`s.orderRepo`) always lands there, while the very same interface reached through a local or a parameter is a bare name and falls through to Case 4 — which fans out correctly. Field-held interfaces, i.e. dependency injection, were the half that silently lost every implementation edge; the pre-existing fixtures exercise the local and parameter forms only, which is why the suite was green. The fix is the call Case 4 already makes, placed after Case 0's primary `tryEmitEdge` and before its `handledSites.add`. It stays language-agnostic (AGENTS.md section 42): `emitInterfaceDispatchFor` self-gates on `ownerDef.type !== 'Interface'`, so a receiver that folds to a Struct emits nothing extra and no language check is needed. Confidence is Case 0's own 0.85 literal, not Case 4's site.kind-dependent value — Case 0 has no read/write arm to mirror. The case ladder itself is untouched: invariant I4 in contract/scope-resolver.ts makes the ordering a contract, so the fan-out is added INSIDE Case 0 rather than by reordering or merging cases. Also flips a second, previously unnoticed encoding of the #1966 value-only reading that the full sweep surfaced: the exact-set assertion at go.test.ts:361 enumerates every structural IMPLEMENTS edge, and D1 correctly adds `PointerOnlyThing -> PointerOnly` to it. It is D1 fallout rather than D2's, but D1 had already landed; recording it here with its reason beats amending a commit whose separate measurability is the point. Measured: - #2813 suite: 11 of 11 pass (was 7 failing after D1 alone, which fixed only the two IMPLEMENTS rows). - go.test.ts: 160 passed. - Full cross-language sweep, test/integration/resolvers: 3027 passed, 1 skipped, across 52 files. The single failure in that run was the exact-set assertion above, fixed here; no other language regressed. `detect_changes` rates this HIGH (6 affected flows, all EmitReceiverBoundCalls at step 1) — inherent to editing a hub symbol in the resolution pipeline. The sweep above is the empirical answer to that label. An existing index must be re-analyzed to show the new edges; this changes what the resolver produces, not how it is stored, so no SCHEMA_BUMP applies. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(go): pin the heritage edges that make impact() hedge an interface-bound count (#2813) The epistemic half of the issue, resolved by MEASUREMENT rather than by new code, and pinned at its mechanism. The reporter's disqualifying complaint was that `impact()` reported `impactedCount 0, epistemic "exact", risk LOW` for a method reachable only through an interface-typed field — byte-identical to what it reports for a symbol that genuinely has no callers. A zero therefore could not be used defensively, which was the entire use case. That verdict comes from `computeEpistemicBoundary`, which has two producers and neither fired: the call sites were not DROPPED (they resolved, just to the interface declaration, so the #2744 receiver-typing producer saw nothing), and its heritage probe walks IMPLEMENTS/METHOD_IMPLEMENTS edges out of the queried symbol — of which there were none, because the pointer-receiver exclusion (D1) meant no such edge was ever emitted. Restoring those edges fixes the epistemics as a side effect, so the planned conditional change to local-backend.ts is NOT needed. Measured on this fixture against the fixed tree: impact(OrderRepo.DeleteItem, upstream) before: impactedCount 0, epistemic "exact" after: impactedCount 3, epistemic "lower-bound", with an interface boundary note; the three callers are OrderHandlers.Delete, PickService.StartSession and WaveService.Release — all correct. impact(CartRepo.Get, upstream) [concrete receiver, no interface] after: impactedCount 1, epistemic "exact" The second row is the one that matters for trust: the hedge discriminates instead of firing on everything, so "exact" still means exact. This test asserts the METHOD_IMPLEMENTS edges the probe walks. Pinning the mechanism keeps the resolver suite from reaching into the MCP layer while still failing loudly if the edges regress; the impact() numbers above are recorded in the commit message and PR body rather than re-asserted here. #2813 suite: 12 passed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(go): model Go method sets exactly so interface satisfaction is decidable (#2813) Replaces the approximate structural-interface model with the rules the Go spec actually defines, so the graph answers what the compiler answers instead of a useful-but-wrong summary of it. Three answers were provably wrong before; all three are now exact and covered. Method sets (go.dev/ref/spec#Method_sets): MS(T) = methods declared with receiver T MS(*T) = methods declared with receiver *T OR T Promotion (#Struct_types): S embeds T -> MS(S) and MS(*S) get promoted methods with receiver T; MS(*S) ALSO gets those with receiver *T S embeds *T -> MS(S) AND MS(*S) both get receiver T or *T Identifier identity (#Uniqueness_of_identifiers): "Two identifiers are different if they are spelled differently, OR IF THEY APPEAR IN DIFFERENT PACKAGES AND ARE NOT EXPORTED." func (b *Base) Ping() // pointer receiver type ByValue struct{ Base } type ByPointer struct{ *Base } type before exact answer Base IMPLEMENTS only *Base implements ByValue IMPLEMENTS only *ByValue implements ByPointer IMPLEMENTS the VALUE type implements All three were the same edge. Two of the three were wrong, and nothing in the graph could tell them apart. Worse, in a different direction: package sealed; type Sealed interface { seal() } package foreign; func (t *T) seal() {} `foreign.T` cannot implement `sealed.Sealed` in Go — `seal` is unexported, so the two identifiers are DIFFERENT. Matching on the bare name emitted a FALSE IMPLEMENTS edge, and the interface-dispatch fan-out then turned it into an impossible CALLS edge. That is the entire basis of the sealed-interface idiom. - `methodSetKey` qualifies UNEXPORTED method names with their declaring package, leaving exported names unqualified (which is what makes cross-package satisfaction work at all). Exactness, not a heuristic: the sealed case now emits no edge, while the legitimate same-package implementor is retained. - `collectStructMethodEntries` builds MS(T) and MS(*T) together and applies the promotion table above. The embed FORM is load-bearing, so it is now captured: `@reference.embedded-pointer` records `*T` versus `T`, which the parser previously discarded (the `*` is an unnamed token). - Detection returns `{ structDefId, receiverForm }`. `receiverForm: 'pointer'` means the value type does NOT implement and only `*T` does — the fact `var x I = T{}` turns on. - The form rides in the edge `reason` (`-structural-implements-pointer`). Relationships carry no arbitrary properties, so a new field would change the relation DDL, move SCHEMA_FINGERPRINT and force a rebuild for a fact a string already expresses. Value-form implementors keep the ORIGINAL unsuffixed reason, so a consumer matching the old string now sees exactly the assignable set — which is what that string always claimed to mean. - `emitInterfaceDispatchFor` walks the SUBTYPE CLOSURE (IMPLEMENTS + EXTENDS) and skips bodiless declarations, instead of stopping at depth 1. Two reproduced Java shapes emitted an edge to a second abstract declaration while the only class with a body got nothing: a sub-interface that re-declares the method, and an abstract base between interface and implementation. Both now reach the implementation and neither emits the declaration edge. - The fan-out is bounded by `MAX_INTERFACE_DISPATCH_FANOUT` (32, `GITNEXUS_MAX_INTERFACE_DISPATCH_FANOUT`) and reports what it dropped, mirroring `MAX_PROPERTY_DISPATCH_FANOUT`. A bare cap would silently discard valid dispatch targets, which is the same false-safe silence this issue is about. - Corrects a rationale comment that was factually wrong about the code 70 lines above it (Case 0 DOES branch on `site.kind`, at :713-716; what it lacks is a read/write branch in its reason/confidence computation). - Updates both copies of the case-ladder contract, which still described the fan-out as Case-4-exclusive. The embed-pointer marker is PARSE-TIME capture emission, so a warm cache would replay the pre-marker capture set and the distinction would never appear — silently, the v27/v30 failure mode. 43 and not 40 because origin/main allocated 40, 41 and 42 while this branch was in review, which is exactly the window this file's history records both prior EXACT clashes landing in. Pin moved with it. RE-CHECK AGAINST origin/main IMMEDIATELY BEFORE MERGE. - Go unit: 93 passed, including new rows pinning that `populateGoOwners` stamps `goReceiverKind` (previously the field had no reader and could rot silently) and that a pointer-receiver-only type implements in POINTER form only. - Cross-language sweep, test/integration/resolvers: 3034 passed, 1 skipped, 52 files, zero regressions. - scope-capture bench: PASS (15 languages). Go is the ONLY fingerprint that moved, which is the check that this is a Go capture change and not a cross-language regression; rebaselined with rationale. - Also closes review gaps in this PR's own tests: the concrete-field control was vacuous with respect to the type gate (repointed at a struct that IS an implementor), the two-service-file row could not distinguish the two files it is named for (both ends now file-qualified), plus new rows for signature mismatch, emitted confidence, and an exact N-by-M fan-out bound. An existing index must be re-analyzed; the schema bump forces it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 21:52:37 +01:00
Gergő Magyar	561f913a32	fix(embeddings): retry unparseable 200 responses and survive partial embedding failures (#2790) (#2795) ... * fix(embeddings): retry unparseable 200 responses and survive partial embedding failures (#2790) A long-running embedding job against an OpenAI-compatible endpoint could lose hours of work to a single transient glitch, then refuse to recover on the next run. Four defects compounded: 1. An HTTP 200 carrying a truncated or non-JSON body was never retried. `classifyOutcome` treats any 2xx as success, and the `resp.json()` parse ran after `resilientFetch` had already returned, so the parse failure surfaced as a terminal error. Measured: a 503 got 3 attempts, a garbage 200 got 1. The parse and the response-shape check now run inside the `fetchImpl` callback, so a bad body is classified as a retryable failure and gets the same backoff as a 5xx. This also stops a garbage 200 from calling the circuit breaker's `recordSuccess()`, which previously erased accumulated failures and meant an endpoint alternating 5xx and garbage-200 could never trip it. 2. One failed `embedBatch` sub-batch aborted the entire pipeline. Failures are now tolerated: the sub-batch's node ids are collected and all of their embedding rows are deleted, so those nodes hold zero rows and are re-embedded later. Deleting rather than keeping partial rows is deliberate — chunk arrays are flat over a 16-node batch and sliced by 8, so a node's chunks can straddle a sub-batch boundary, and surviving rows carry the current content hash. The hash maps collapse per-chunk rows last-row-wins, so a partially embedded node would read as fresh forever and never regenerate its missing chunks. A run that fails 5 sub-batches in a row still aborts, and rethrows the first error of the streak rather than the last: after 3 failures the circuit breaker opens, so later errors degrade into "circuit open, retry in 30s" while the first still names the real defect. 3. The Phase 5 `embeddingCount === 0` fail-fast could not tell "wrote nothing" from "could not ask" — the count query's catch was silent. The count is now tri-state and only a known zero after real work is fatal. A non-numeric count previously bypassed the gate entirely, because `Number()` returns NaN and `NaN === 0` is false, and then serialized as `embeddings: null`. An unverified count no longer certifies `capabilities.vectorSearch.status`. 4. `saveEmbeddingCheckpoint` wrote a completion-shaped meta: it advanced `lastCommit`, wrote the new `fileHashes` and cleared `incrementalInProgress`. The first checkpoint window fires before a single embedding exists, and on a full rebuild the graph is still in a staging database that a crash discards. The next run then diffed against the advanced hashes, saw no changes and preserved the old graph — the "skipping wipe" symptom in the report. It now re-reads meta and replaces only the checkpoint, matching what the server endpoint already did. A partially failed run keeps its checkpoint with the failed ids in `pendingNodeIds`, so the next plain `analyze` regenerates them through the existing resume path. Clearing it would have been silent data loss: a plain run derives `shouldGenerateEmbeddings: false` once embeddings exist, so the pipeline would never have run again. The old crash-and-abort self-healed only by accident, via the checkpoint its crash left behind. `gitnexus status` reports the index incomplete until the nodes recover, and `--drop-embeddings` still abandons them. `POST /api/embed` is the pipeline's other caller and was discarding the result, reporting "Embeddings complete" for a partial run. It now persists the pending ids and reports the run as failed with the underlying endpoint error. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(embeddings): abort a run whose sub-batch failure ratio is too high (#2790) The consecutive-failure ceiling only catches a total outage, because any successful sub-batch resets it. An endpoint under load shedding that alternates success and failure never trips it, so the run walks the whole corpus, deletes every failed node's rows and exits 0 having dropped a large fraction of the index. The retained checkpoint made that visible in `gitnexus status`, but a run that drops a quarter of the corpus should tell the operator to fix their endpoint, not leave them to notice a status flag. Adds a cumulative guard: abort once more than 25% of attempted sub-batches have failed, evaluated as the run progresses and gated behind a floor of 20 attempted sub-batches. The shape follows Resilience4j's circuit breaker (failure rate plus a minimum-sample floor) because it is the only one of the surveyed designs that answers the small-repo case — a three node repo can fail one sub-batch and never accumulate enough sample for a ratio to mean anything. The rate sits below a live traffic breaker's 50% because a batch indexer's job is to index the whole corpus rather than serve degraded traffic, and above Hadoop's single-digit `failures.maxpercent` because tolerating transient hiccups is the point of the change this follows. The guard reuses the existing break-then-cleanup path, so the failed batch's DELETE still runs before the rethrow, and it wraps the retained first-error-of- streak rather than inventing a new one, so the message names both the ratio and the underlying endpoint failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(server): record the embedding count after /api/embed so the next analyze cannot wipe it `POST /api/embed` generated embeddings and wrote them to the database but never wrote `stats.embeddings` into meta.json. Its checkpoint writer replaced only `embeddingCheckpoint`, and the finalize write folded in nothing else. So a repo embedded purely through the server kept whatever count the last CLI `analyze` stamped, which is 0 for a repo analyzed without embeddings. The next CLI run read `existingEmbeddingCount = 0`, `deriveEmbeddingMode` returned `shouldLoadCache: false`, and `gitnexus analyze --force` wiped the database with no cache load. Every server generated embedding was silently destroyed, with no warning — the user just lost semantic search. The route now measures the live count with the same query the CLI uses and folds it into both meta writes. The measurement is tri-state and deliberately never falls back to 0: an unverified count is written as absent rather than as zero, because a wrong-low value is exactly what arms the wipe. It is taken after `flushWAL()` and inside `withLbugDb`, so it describes durable rows and the connection is still open. A partial run records its honest count too, alongside the retained checkpoint, so the next CLI run preserves the partial index instead of discarding it. Found while working #2790; not part of that issue. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(embeddings): retry short 200 bodies and stop laundering body-phase timeouts Two gaps in the #2790 retry fix, both found by review. A 200 carrying `{"data": []}` or fewer vectors than inputs passed the in-`fetchImpl` shape check, because `every(isEmbeddingItem)` is vacuously true for an empty array. `resilientFetch` then classified it `success` and called `recordSuccess()`, erasing the outage signal, and the cardinality check in `httpEmbed` threw terminally one attempt later. That is exactly the pair of properties #2790 was filed about, still broken for this body shape — and worse than before the fix, since the pipeline now tolerates the error by deleting those nodes' rows instead of aborting loudly. The count check moves inside the retried callback; the outer one stays as a backstop. The `.json()` catch also swallowed every rejection, not just parse errors. `AbortSignal.any([caller, timeout])` is wired to the body stream, so a stalled body rejects with a DOMException — which, wrapped in a plain Error, defeated `classifyOutcome`'s terminal-network test. Measured: the same TimeoutError got 3 attempts and "unparseable response" when raised during the body read, but 1 attempt and "timed out after 180000ms" when raised by fetch itself, and three such sub-batches opened the process-global breaker that `recordNeutral()` exists to protect. Abort-like DOMExceptions are now re-raised unchanged. The dimension check stays outside the loop deliberately: it validates against `config.dimensions ?? DEFAULT_DIMS`, not the request-dimensions argument, and a width mismatch is a configuration error where retrying only triples latency and books failures against a healthy endpoint. Adds the negative assertion the review found missing: response body text must never reach the user-facing error string. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(embeddings): scale the sub-batch failure-ratio floor to the run The cumulative guard needed 20 attempted sub-batches before a failure rate could abort anything — roughly 160 chunks, or ~80 embeddable nodes at the default subBatchSize of 8. A 50-node repo whose endpoint sheds every other sub-batch fails half of them and still exits 0: the ratio guard is below its floor, and every intervening success resets the consecutive ceiling. The floor was a good choice for a first run over a small repo, where one failure out of one sub-batch is 100% and means nothing. The defect is that every resume run has that shape by construction — its node set is only the pending ids — so the guard was structurally off in the one run whose entire purpose is retrying against the endpoint that already failed. The floor is now sized to the run: clamp(ceil(totalNodes / 16), 5, 20). The lower bound keeps the case the flat floor protected; the upper bound preserves today's behavior above 320 nodes and avoids a proportional-only floor perversely weakening the guard at scale, where a sixteenth of a 20k-node repo would be 1250 sub-batches of damage before a rate could fire. Resilience4j can use a constant minimumNumberOfCalls because a breaker sits on an unbounded call stream; a batch indexer has a finite budget, so a constant can exceed the whole run. The ratio is still evaluated only inside the catch. That is already its local maximum — both counters have just incremented — so sampling more often would only ever observe lower ratios. Also: a failing cleanup DELETE no longer swallows the abort, which was discarding the retained first-error-of-the-streak that names the real endpoint fault; `ceilingError` is renamed `abortError` since it carries the ratio abort too; and three `{ error }` log keys become `{ err }` (#2114 — an arbitrary key serializes to `{}`, losing message and stack). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(analyze): one tri-state embedding counter, and stop partial runs wedging later runs The tri-state count doctrine this branch introduced was applied at two of its three CLI sites, and the two implementations that were meant to mirror each other had already drifted. `measurePersistedEmbeddingCount` moves to `core/embedding-count.ts` — beside `embedding-mode.ts`, with the same no-native-imports property, and outside `core/embeddings/` so the lazy-embeddings convention (#2370) still holds. All three call sites now share it. - The mid-run `onCheckpoint` counter ran the query bare. A throw there — DB busy, connection closed, read-only, the VECTOR DML lock (#2623) — rejected the callback out of `runEmbeddingPipeline` and killed the analyze before Phase 5 could apply the tri-state that exists for exactly this case. A non-numeric cell wrote `stats.embeddings: null` to disk mid-run. - Phase 5 used `?? 0` while the server used `?? Number.NaN`, under a comment asserting both measured the field the same way. `Number.isFinite(0)` is true, so a no-row answer became a *measured* zero and hard-failed a run whose embeddings had all persisted. - The unknown-count fallback read `existingMeta`, assigned once at run start, so it republished the pre-run figure over the fresher count the terminal checkpoint had already written. With a prior count of 0 that armed the wipe chain: hasExisting false, shouldLoadCache false, and the next --force discards live embeddings. It now re-reads the latest on-disk meta, and an unverifiable count retains a recovery marker instead of clearing it. A completed-but-partial run also planted a landmine. Its checkpoint is stamped with the run's embedding identity, so a later plain `gitnexus analyze` from a hook, a CI job, or a shell without GITNEXUS_EMBEDDING_URL resolved provider 'local' and threw before any phase ran — after an exit-0 run, where previously only a visible crash left that state. `--force` did not help: the resume gate inspected only `--drop-embeddings`. `RepoMeta.embeddingCheckpoint` gains `kind` to tell the two situations apart. An 'interrupted' marker (or one with no kind, so markers already on disk keep the stricter path) still fails closed — its nodes may be half-written, and resuming under a foreign model would mix vector spaces. A 'partial' marker names nodes the pipeline already deleted to zero rows, so nothing is at risk: an identity mismatch drops the pending set with a warning and continues. `--force` now discards a checkpoint, and `attempts` bounds the retry at EMBEDDING_RESUME_MAX_ATTEMPTS (3, matching the HTTP embedder's and the WAL driver's existing per-operation budgets) so a node the endpoint deterministically rejects converges instead of keeping the repo incomplete forever. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(server): close the SSE stream on terminal job status, not a progress phase A tolerated partial run reached SSE clients as a clean success — a regression in this branch's own claim that /api/embed reports a partial run as failed. The pipeline emits `phase:'ready'` unconditionally before returning, including when it dropped nodes. The route mapped that to `'complete'`, and `mountSSEProgress` treated a terminal-looking *progress phase* as terminal: write the event, `res.end()`, `unsubscribe()`. The route's own `updateJob({status:'failed'})` then fired into a stream with no listener, and the web app had already shown "ready". Before this branch the pipeline threw, which produced `phase:'error'` and did reach the client. Pollers on GET /api/embed/:jobId were unaffected, so the two consumers disagreed. Terminality is a property of the job, so the relay now asks the job. Remapping `ready` alone would have left the trap armed: the `error -> 'failed'` mapping has the identical shape and would emit `event: failed` with `error: undefined` before the catch block fills the message in. `ready` is additionally remapped to `finalizing` so a poller no longer sees `status:'analyzing'` next to `progress.phase:'complete'`. The single-terminal-event property (#2264) is preserved on both the clean and partial paths, and /api/analyze is unaffected — its terminal progress phase is 'done', never 'complete'. `AnalyzeJob` gains an optional `partial` payload so a client can tell a partial run from a total failure without a new status member; it is absent on every other job, so existing payloads stay byte-identical. Consuming it in gitnexus-web is left to that app's owner — today it renders both as the same red retry chip. `resolveEmbedRunOutcome` moves to `embed-run-outcome.ts` and `mountSSEProgress` to `sse-progress.ts`, both free of Express/LadybugDB/MCP imports, and the local count copy is replaced by the shared `core/embedding-count.ts`. Reaching three pure functions previously meant importing the whole server: measured at ~20s against a 30s test timeout, with one observed timeout failure. That file is now 1.6s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: document the partial embedding index and its recovery A run can now finish exit 0 with a partial embedding index, which neither operator doc described. GUARDRAILS' "Embeddings vanished after analyze" Sign keys its trigger on `stats.embeddings` being 0 and lists "the only ways to end up at zero". A partial run stamps an honest non-zero count and sets `embeddingCheckpoint`, so the operator's actual symptom is `incompleteReasons: ["embedding-checkpoint-pending"]` — a state that Sign cannot match. Adds a Sign for it and drops the exhaustive framing from the existing one. RUNBOOK gains the recovery path: a plain `gitnexus analyze` is correct and needs no flag, because a retained checkpoint forces generation for the pending nodes regardless of flags. Also corrects two stale claims — that `stats.embeddings` is always freshly measured (it can carry forward when the count query cannot answer, which is why `capabilities.vectorSearch.status` is the certified read), and that later analyzes must always pass `--embeddings` or lose their vectors, which contradicts Non-negotiable 5. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(embeddings): one owner for the checkpoint record and the abort predicate Cleanup pass over the #2790 review fixes. No behavior change except where noted; the two exceptions are both cases where the code was lying to the operator or to the other half of itself. The previous pass extracted `core/embedding-count.ts` because two hand-copied bodies of "measure the embedding count" had drifted inside a single change. It then created a second pair of hand-copied publishers — of `RepoMeta.embeddingCheckpoint` — and those had drifted too: the CLI armed the attempt counter only after clearing its identity gate, the server derived it from the resumed marker alone. Only one of the two READERS implemented `kind` at all, so a 'partial' marker written by `gitnexus analyze` and resumed through POST /api/embed still hit the permanent wedge `kind` exists to remove. `core/embedding-checkpoint.ts` now owns the record: `checkpointKind` (the one home for absent-means-interrupted), the three minters, `nextAttemptCount`, and `decideEmbeddingResume`, which both gates route through. Five mint sites and two resume gates become one implementation each. `resilient-fetch.ts` exports `isTerminalNetworkError` and `classifyOutcome` calls it, replacing a caller-side copy of the same DOMException test whose docstring promised it "mirrors classifyOutcome exactly" — an invariant enforced by prose, where a divergence silently reverts body-phase timeouts to being retried three times and charged to the shared breaker. The ratio-guard floor now divides by the run's actual `subBatchSize` instead of a constant 16 that assumed the default of 8. At `subBatchSize: 32` the old formula demanded more sub-batches than the run contains, leaving the guard structurally off — the exact failure the scaled floor was introduced to fix, and sub-batch size is tuned mainly for the flaky endpoints it protects. Two operator-facing corrections: - The count-recovery marker was stamped `kind: 'partial'` with an empty pending set, so `gitnexus status` reported "N node(s) lost their embeddings" where N is zero. It gets its own kind and its own incomplete reason. - `decideEmbeddingResume` initially keyed its skip-the-identity-gate branch on an empty pending set, assuming that meant the count-recovery marker. It does not: `onCheckpoint` mints an 'interrupted' marker with no pending nodes after every post-window save. That silently cleared an interrupted marker under a foreign provider instead of failing closed. Keyed on `kind` now, with a regression test. Also: `isTerminalJobStatus` adopted at the seven sites that still hand-copied it, including the one gating the single-terminal-event emit; `mountSSEProgress` re-export dropped and `server-sse-payload.test.ts` repointed at the extracted module, which takes it from 24.60s to 0.408s — the test that motivated the extraction was still paying the cost it was meant to remove; the count-mismatch message and the SSE test harness deduplicated; per-batch error strings made lazy (~75k needless `new URL()` per large run); `retryable: true` dropped as a field that can never be false; ~110 lines of restated rationale reduced to pointers at their canonical home. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-02 20:43:59 +00:00
Gergő Magyar	911151e230	fix(resolution): resolve Go pointer-receiver calls, and report the program boundary instead of hedging (#2766) (#2782)	2026-08-01 22:42:18 +01:00
MyShining	1147646518	feat(spring): model AOP transactions, caching, and security (#2783) ... * feat(spring): model AOP advice and proxy behavior * fix(spring): address AOP review findings --------- Co-authored-by: Shining <xuenning@qiyi.com>	2026-08-01 17:22:12 +01:00
azizur100389	84f584449d	fix(python): resolve classes through module imports (#2770)	2026-08-01 06:02:47 +01:00
MyShining	de84ad6297	feat(spring): index @Bean factories and @Resource injection (#2740) ... * feat(spring): index Bean factories and Resource injection * fix(spring): address Bean and Resource review findings * refactor(lbug): keep relation pair parsing in router * test(lbug): preserve schema exports in WAL mocks * test(cache): align schema bump pin --------- Co-authored-by: Shining <xuenning@qiyi.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>	2026-07-31 10:33:42 +01:00
Gergő Magyar	27ab37c432	feat(resolution): type receiver chains from AST structure across all 14 languages (#2708) + epistemic lower-bound (#2744) (#2747)	2026-07-31 07:12:57 +01:00
Gergő Magyar	0ce7880290	fix(scope-resolution): a closure binding is a call SOURCE in every language, and function-local values carry their own identity (closes #2699) (#2718) ... * test(scope-resolution): audit the consumers of file-scoped node ids (#2699 part A) #2699 item 4 — "audit consumers that assume file-scoped ids" — after #2695/#2714 gave function-local CALLABLES position-bearing ids. Tests and findings only; no production change. That split is deliberate: `impact` reports `resolveDefGraphId` at CRITICAL with 23 DIRECT dependents across 7 modules (every language MRO builder, both Spring attachers, C++ member lookup, tryEmitEdge, emitReferencesViaLookup, buildGraphTargetIndex, emitFreeCallFallback, emitReceiverBoundCalls, preEmitInheritanceEdges, emitDetectedInterfaceImplementations, phpEmitUnresolvedReceiverEdges, emitRubyMixinEdges, emitRustTraitImplEdges, emitDartHeritageEdges), so changing that key chain is its own change, not a rider on an audit. A2 — detect_changes: CONCERN RESOLVED, now pinned. The worry was that an id containing `@row:col` re-keys whenever a declaration MOVES, making every edit look like symbol churn. It cannot: `local-backend.ts` maps diff hunks to symbols by LINE-RANGE OVERLAP (`n.startLine`/`n.endLine`) and merely REPORTS `n.id`. Node identity never participates in the match. New structural test asserts the WHERE clause never gains `n.id =` or `n.id IN`, keeps the one legitimate id-shaped predicate (the `BasicBlock:` prefix exclusion, #2082 U7), and confirms the id is returned rather than matched. Structural in the same idiom as `detect-changes-worktree.test.ts`, and labelled as not proving runtime behaviour. A1 — ANSWERED, and the answer is that #2699 is NOT fully closed by items 1-3. The fail-closed guard is gated on `isOverloadableCallable` (Function | Method | Constructor), so a function-local VALUE never reaches it. Measured on a fixture: a top-level `const handler` and a function-local `const handler` still produce ONE node, `Const:v.ts:handler`. That is the residual half of the issue's original complaint. Pinned as a KNOWN LIMIT with its reason (widening identity to values re-keys ~14,700 build-time nodes to change ~800 persisted ones — the decision recorded in `parse-worker.ts`), and deliberately NOT fixed here. A3 — id-persisting consumers, classified: - detect_changes ................ SAFE (position-keyed; pinned by A2) - MCP impact/context/trace ...... SAFE (resolve by name/uid at query time) - bench fingerprints ............ SAFE (digest capture shape, not node ids) - rust-captures golden .......... SAFE (digests captures, not ids) - cfg pipeline-pdg snapshot ..... AT RISK by design — pins exact edge ids, so it trips whenever attribution changes. That is the gate working; #2714 already exercised it. - wiki / group-contract links ... NOT id-keyed on locals (locals are never cross-file addressable, per the document-scoped contract of item 2). Verified: tsc clean; 14/14 across the two touched files; `detect_changes` reports 0 changed symbols (tests only). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(php): a closure binding is a call SOURCE, not only a TARGET (#2699 part B, S1) A call made inside a closure binding was attributed to the ENCLOSING scope, so the closure was a call TARGET but never a call SOURCE: impact(handler, direction:"downstream") reported nothing even though the closure calls out. Root cause, probe-measured rather than inferred. Instrumenting pickCallerCallableDef (graph-bridge/ids.ts) to log every rejection reason shows the closure's own scope EXISTS and its range DOES contain the call site, but its ownedDefs is EMPTY, so the ":94" owned-callable filter drops it and attribution falls through to the ":97" enclosing-scope fallback. The reason is one missing query rule. javascript/query.ts pairs the binding name with the closure via @declaration.function anchored on the INNER arrow node, so anchor.range equals the @scope.function range and pass2AttachDeclarations attaches the declaration to the CLOSURE's scope. No other language had that rule — PHP, Rust, Kotlin, Ruby and Dart all captured named function declarations only. That single omission is the entire empty-ownedDefs cause. This ports the rule to PHP with the same anchor discipline (@declaration.function on the inner anonymous_function / arrow_function, NOT on the assignment_expression wrapper). PHP needs nothing else: it already declares (anonymous_function) and (arrow_function) as @scope.function, so the rule alone completes it. Measured on a fixture: `$handler = function ($x) { return target($x); }` inside outer() now emits Function:src/a.php:outer.$handler@3:2 -> Function:src/a.php:target where it previously emitted `outer -> target`. The pinned test in closure-binding-labels.test.ts asserted the OLD, wrong behaviour by design ("to catch that asymmetry changing in EITHER direction"), so it is INVERTED here rather than deleted, per its own instruction. Its block comment is corrected to record the measured root cause, including that Kotlin and Ruby will need BOTH this rule AND a relaxed kind gate (their lambda_literal / do_block is @scope.block deliberately, #1757), and that Dart has no closure scope at all. Verification: closure-binding-labels 50/50; PHP resolver suites 221/221 (php, php-coverage, php-response-shapes). detect_changes {staged}: 1 changed symbol (PHP_SCOPE_QUERY), 0 affected processes, risk LOW. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(rust): emit a node for a closure binding and make it a call SOURCE (#2699 part B, S3) Rust was the one exception to #2687's "a closure bound to a name is a Function node in every language": `let handler = || target(1);` produced NO graph node at all, so the closure could be neither a call target nor a call source. Needed BOTH query channels, which is the finding worth recording. Porting only the scope-resolution rule (as S1 did for PHP) changed nothing measurable here, because there was no node to attribute anything to: - languages/rust/query.ts — closure-binding declaration, @declaration.function on the INNER closure_expression so anchor.range aligns with the existing (closure_expression) @scope.function. This is what gives the closure's own scope a callable in ownedDefs, which is what stops pickCallerCallableDef falling through to the enclosing fn. - tree-sitter-queries.ts — @definition.function on the OUTER let_declaration. This emits the Function NODE that Rust never had. Note the deliberate anchor asymmetry between the two channels: the graph-node channel anchors the WRAPPER (matching the existing (lexical_declaration (variable_declarator ... (arrow_function))) rule), while the scope-resolution channel anchors the INNER closure (to align with @scope.function). Getting these backwards silently produces either no node or an unattributable one, so both sites carry a comment saying so. Measured on a fixture — `let handler = || target(1);` inside outer(): Function:src/a.rs:outer CALLS Function:src/a.rs:outer.handler@2:4 Function:src/a.rs:outer.handler@2:4 CALLS Function:src/a.rs:target Previously the whole binding was absent and the call read as `outer -> target`. The rule also covers `move` closures: the closure_expression node spans the `move` keyword. Verification: closure-binding-labels 50/50; rust.test.ts 192/192; rust-coverage, rust-f70, rust-scope all pass; rust-captures-golden passes UNCHANGED, so no golden regeneration was required. detect_changes {staged}: 2 changed symbols (RUST_SCOPE_QUERY, RUST_QUERIES), 0 affected processes, risk LOW. One caveat on the suite runs: this host times out `beforeAll` hooks at the default 60s under load — rust.test.ts needed --hookTimeout=600000 to complete, and a concurrent second vitest run starves worker startup entirely (every test fails at ~5001ms). Both are host artifacts, not signal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(kotlin,ruby): a closure binding is a call SOURCE, via a Block-scope callable boundary (#2699 part B, S2) Kotlin and Ruby anchor a closure on a Block-kind scope — Kotlin lambda_literal and Ruby do_block/block are @scope.block DELIBERATELY (#1757 smart casts), so they must not be re-kinded. pickCallerCallableDef gated its child-scope walk on kind === 'Function', so a closure there could never become a call SOURCE. Both halves are required; neither alone changes anything: 1. kotlin/query.ts and ruby/query.ts gain the closure-binding declaration rule, with @declaration.function on the INNER lambda_literal / block so its range aligns with the @scope.block range (the anchor discipline documented in javascript/query.ts). Without this the closure scope owns no callable def. 2. pickCallerCallableDef accepts a Block-kind child as a callable boundary when the scope IS that callable's body. Without this the kind gate still rejects. The alignment test in (2) is the part worth scrutiny. Relaxing the kind gate to accept ANY Block owning a callable would be a real regression: a nested `fun foo()` declared inside a block is owned by that block, so a call made at BLOCK level — outside foo — would be misattributed to foo. Comparing the def's declaration position against the scope's start position discriminates them: for a closure the declaration and the scope sit on the SAME node, so the positions match; for a nested function the block starts at `{` while the def starts at the declaration, so they do not. Existing Function-kind behaviour is untouched, so every already-working language is unaffected by construction. The comparison is base-safe: scope-extractor.ts builds a def id as `def:<filePath>#<startLine>:<startCol>:<type>:<name>` from the same Range a scope carries, so both sides share one coordinate base. This is called out in the helper's docblock because `defStartLine` nearby documents its own output as 1-based, which invites a wrong "fix" (#2377 is exactly this class of hazard). Ruby's call forms are restricted to lambda/proc by name: an unrestricted (call block: (block)) would match ANY method call taking a block, so `mapped = items.map { |i| ... }` would wrongly declare `mapped` a callable. Verified against the parser: 3 matches (->, lambda, proc), map excluded. Separate #eq? patterns rather than one #match? alternation, which is a known hazard on this tree-sitter line. Measured on fixtures: Kotlin Function:src/A.kt:outer.handler@2:4 CALLS Function:src/A.kt:target Ruby Function:src/a.rb:outer.handler@4:2 CALLS Method:src/a.rb:target#1 previously `outer -> target` and `outer#0 -> target#1`. The pinned Kotlin test asserted the old behaviour by design and is INVERTED, not deleted. Ruby had NO pinned case, so a new one is added rather than inverted. The describe title no longer claimed something false ("not yet a call SOURCE" now holds only for Dart) and was retitled. Verification: closure-binding-labels 51/51; kotlin.test.ts, kotlin-coverage, ruby.test.ts, ruby-scope, ruby-namespaced all pass (478 passed / 1 expected inversion before the test was flipped). impact on pickCallerCallableDef: CRITICAL, 191 impacted, ONE d=1 (resolveCallerGraphId) — the return contract is unchanged, so that dependent is unaffected. detect_changes {staged}: 5 changed symbols, 2 affected processes (both EmitReferencesViaLookup, one of them the new ScopeIsCallableBody step), risk medium. Dart remains the last failing language: dart/query.ts declares no @scope.function at all, and dart/captures.ts synthesizes one only from a declaration WITH a body node, which an expression-bodied closure lacks. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(dart): give a closure binding a scope and a distinct identity (#2699 part B, S4) Dart was the last language where a closure binding could not be a call SOURCE, and fixing only that would have made the graph WORSE, not better. This lands both halves together for that reason. ## The attribution half A Dart closure had no scope at all. `dart/query.ts` declares no @scope.function anywhere — Dart's function scopes are SYNTHESIZED in `dart/captures.ts` from `declNode` + `findFunctionBody(declNode)`, and `findFunctionBody` looked only at the next named SIBLING for a `function_body`. A closure literal carries its body as a CHILD (`function_expression_body`), so it matched nothing and no scope was produced. `query.ts` gains the closure-binding declaration rule and `findFunctionBody` understands the child form. Deliberately NO @scope.function is added to the query: it would collide at identical range with the synthesized one, and duplicate scope ids make `buildScopeTree` throw, which DROPS THE WHOLE FILE. ## The identity half, and why it is not optional With attribution alone, two same-named closures in one file both keyed to the bare `Function:a.dart:handler`. One node then appeared to call BOTH targets — a CALLS edge present nowhere in the source. That is worse than the missing edge it replaced, so S4 could not ship without this. Root cause is not Dart-specific. `enclosingCallablePrefix` derives a SEMANTIC relation — what encloses this callable — by SYNTACTIC ancestor walk. Dart parses `int outer() { … }` as `function_signature` followed by `function_body` as SIBLINGS, so the enclosing callable is never an ancestor of code inside it and no membership set can fix that; the walk looks in the wrong direction. This is what SCIP and real compilers avoid by construction. SCIP keeps a local symbol opaque (`local <id>` — no name, no position, no chain) and models containment as a SEPARATE `enclosing_symbol` field; its spec says the local/global choice should follow ACCESSIBILITY, not the ability to name an enclosure. Dart's own analyzer answers this from `Element.enclosingElement` in the element model, never from AST ancestry. clang uses `name@offset` for a function-local; Kythe uses a document-scoped VName plus a `childof` edge. Identity is positional and opaque; enclosure is a relation. `findSplitBodyCallableAncestor` is the narrow fix at that seam: a fallback used ONLY when the ancestor walk finds nothing, recovering the callable from the body's preceding sibling. The sibling must be a BARE SIGNATURE, and that restriction is load-bearing — "any preceding callable sibling" is WRONG and was caught regressing PHP during this work. In `<?php function target($x) {…} $handler = function ($x) {…};` the closure is at FILE level, so the ancestor walk correctly finds nothing, the fallback runs, and an unrestricted version mis-qualified the file-level `$handler` as `target.$handler`. A preceding sibling is only an ENCLOSING callable when it cannot hold its own body. `SPLIT_SIGNATURE_NODE_TYPES` is exactly that set and is DERIVED, not listed: `LOCAL_SCOPE_BODY_NODE_TYPES` is already `FUNCTION_NODE_TYPES` minus the bare signature types, so the difference between them IS the split-signature set (`function_signature`, `method_signature` — verified at runtime). PHP's `function_definition` carries a body and is in both, so it is excluded. No language is named in shared code, and any future split-grammar language is covered for free. ## Verification Full resolver sweep — the gate that caught #2714's Rust regression — 2926 passed / 1 skipped / 0 failed across 51 files. closure-binding-labels 52/52; dart.test.ts, dart-coverage, callable-id-lockstep, function-local-identity, caller-identity-regression all pass (156/156 across 6 files). impact on `enclosingCallablePrefix`: LOW, 5 impacted, 3 d=1 all inside parse-worker. detect_changes {staged}: 5 changed symbols, 0 affected processes, risk LOW. Three existing Dart expectations FLIPPED rather than being deleted: Dart locals now carry the same enclosing-callable + position identity every other language got in #2695, so `local.dart:handler` became `local.dart:caller.handler@1:2`. A new test pins the actual defect — two same-named closures staying DISTINCT nodes — because the qualification assertions alone would not fail if the fabricated edge returned. One note for future work: an id-shape assertion here carries a call-site suffix on indirect invocations (`…handler@3:2:5:9`) but not on direct calls. That is the callable-value-flow pass keying its edge by invocation position, not part of the node id. Part B is now complete: PHP (S1), Rust (S3), Kotlin + Ruby (S2), Dart (S4). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(scope-resolution): close every deferred item on #2699 (A1 values, twin-list guard, schema bumps) Clears the limitations this PR had been carrying rather than leaving them as follow-ups. ## A1 — function-local VALUES now carry their own identity This was #2699's ORIGINAL complaint and the one a callable-only gate could never reach: a top-level `const handler` and a function-local `const handler` collapsed onto ONE `Const:v.ts:handler`. #2695 restricted position-qualified identity to Function|Method|Constructor because the collision that produced wrong CALLS edges was between callables, and widening churned ids for symbols the pruner mostly deletes. The churn is real and is accepted here deliberately. Widening needed THREE gates aligned, not one: - id-building — `parse-worker.ts` nestedCallablePrefix - resolution — `ids.ts` position key - registration — `node-lookup.ts` position-key registration Missing the third would register no position key for values, so every lookup misses and falls through silently. That is the #2714 failure mode: the caller attaches to a node that does not exist and the edge is DROPPED, which looks like "zero dangling edges" from outside. All three now route through ONE predicate, `isPositionQualifiedLocalLabel`, rather than repeating the label set a third time. Only LOCALS move. The prefix comes from `enclosingCallablePrefix`, which returns undefined when nothing encloses the declaration, so top-level and class-member ids are untouched — verified by the full resolver sweep, where a leak onto class members would have broken assertions in every language. `Property` is included on purpose: a class field stays unqualified because the prefix walk boundaries on class-likes, while an object-literal property inside a function is genuinely local and would otherwise keep the old collision. Measured: `Const:v.ts:handler` + `Const:v.ts:run.handler@3:2`, two distinct nodes. The KNOWN LIMIT test is FLIPPED per its own former instruction ("this test should be updated as part of it rather than deleted"). ## Schema bumps — required by Part B, not just by A1 INCREMENTAL_SCHEMA_VERSION 20 -> 21, parse-cache SCHEMA_BUMP 27 -> 29. SCHEMA_BUMP is 29, not 28, and that is the point of re-checking it against origin/main at MERGE time rather than branch time. This branch cut at 27 and bumped to 28; #2415 also bumped 27 -> 28 and merged first. The automated main-merge onto this branch surfaced the collision — leaving it at 28 would have shipped this whole change with NO parse-cache invalidation, so every warm cache keeps replaying the pre-fix captures and ids. This is the third instance of that collision recorded in parse-cache.ts (#2632/#2653 hit it at v21, and #2653/#2654 hit INCREMENTAL_SCHEMA_VERSION the same way). Part B already changed emitted node ids AND edges on files that did not themselves change (Dart locals re-keyed, Rust gained a node it never emitted, five languages gained closure-source attribution). A v20 index topped up incrementally keeps serving the old attribution, and a warm parse cache replays the old captures and ids verbatim. Shipping S1-S4 without these would have let every existing index silently keep the pre-fix graph. ## Twin-list drift guard — the sixth instance in this family `IMPLICIT_RECEIVERS` (gitnexus-shared lookup-core.ts) and `THIS_RECEIVERS` (type-env.ts) spell the same concept in two packages, and nothing enforced agreement — `$this` was added to the shared list in #2714 only because it was already in the other. New structural test asserts set equality plus the ONE deliberate asymmetry (`Me`, Visual Basic spelling, absent from the shared list because no SupportedLanguages entry uses it) in BOTH directions, so re-adding it there or dropping it here each fail loudly. Structural rather than value-imported: both constants are module-private, and exporting them purely to be testable would widen two public surfaces to satisfy a test. ## Two false comments corrected - `lookup-core.ts` said "see the drift guard noted in #2714", implying a guard existed when it was only a deferred follow-up. It exists now, and the comment points at it. - `callable-id-lockstep.test.ts` claimed its regex "fails if any site reconstructs the id". It matches ONE template spelling; a hand-rolled concatenation still slips past. Now stated as a tripwire for the known shape, not a proof. ## Skill learnings Four entries appended to eval/workflow_bench/learnings.jsonl from this run: the v9fs safe-writer failure, backticks silently terminating a query template literal (hit three times), a module-level TDZ const that passes tsc and then presents as N file failures with ZERO failing assertions, and concurrent vitest runs starving worker startup so a whole suite fails at ~5001ms. ## Verification Full resolver sweep 2926 passed / 1 skipped / 0 failed (51 files) — identical to pre-A1, which is the evidence that only locals moved. All EIGHT bench gates PASS with fingerprints UNCHANGED, so no regeneration was needed. function-local-identity, callable-id-lockstep, receiver-twin-list-drift and closure-binding-labels 71/71. tsc --noEmit clean. detect_changes {staged}: 9 changed symbols, 14 affected processes, risk HIGH — expected, and the reason the sweep above is the gate rather than a targeted list. Every affected process routes through `resolveDefGraphId`, the key chain Part A measured at CRITICAL with 23 direct dependents. Deliberately NOT done: the SCIP end state (opaque `local <id>` plus an explicit enclosure EDGE instead of containment encoded in the id string). It is a design direction, not a limitation of this work, and it is INCOMPATIBLE with A1 — A1 widens chain-encoded identity, that removes chain encoding entirely. Bundling both would re-key every local twice. Written up in the research notes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * test: update two assertions the #2699 changes correctly invalidated Both failed on CI at da3d8397 and are fixed here. Neither is a behaviour regression; both pinned values that this PR deliberately changed. 1. this-boundary.test.ts — "a Kotlin lambda still sees the receiver" The `this.m()` edge still exists and `this` still resolves to the enclosing receiver, which is the ONLY property this test exists to guard (its own comment said so: "what matters here is only that the `this.m()` edge still exists at all"). Only the SOURCE moved, from `run` to the lambda: Method:K.kt:K.run#0 -> Method:K.kt:K.run.f@2:16 Method:K.kt:K.run.f@2:16 -> Method:K.kt:K.m#0 The comment justifying the old expectation is now false and is corrected rather than left: it said the lambda "is not its own caller anchor" because Kotlin scopes `lambda_literal` as a BLOCK. Kotlin still scopes it as a block (#1757 is unchanged) — what changed in S2 is that a Block-kind scope is accepted as a caller anchor when the scope IS the callable's body. 2. call-summary-schema-version.test.ts — INCREMENTAL_SCHEMA_VERSION pin Moves 20 -> 21 with the bump, which is the point of pinning it: a change that alters emitted ids or edges without bumping would otherwise ship silently. Also adds the missing reuse-gate case. `passesReuseGate(20)` now asserts FALSE — a v20 index predates closure bindings becoming call SOURCES, the Rust node for `let f = || …`, the Dart closure scope + enclosing-callable identity, and position-qualified function-local values. Topping such an index up incrementally keeps serving the old attribution, including the Dart case where two same-named closures collapsed onto one node and asserted a CALLS edge present nowhere in the source. Why CI found these and local verification did not: the verification set was `test/integration/resolvers/` plus a hand-picked list, and both failures sat outside it — one integration test about `this` (which a caller-attribution change obviously touches) and one unit test pinning the exact constant that was bumped. Grepping for the changed constant, and for tests asserting closure attribution, would have found both. All 8 suites that reference the schema constants were then run: 177/177, no third pin. Verification: this-boundary + call-summary-schema-version 17/17; the 8 schema-referencing suites 177/177. detect_changes {staged}: 0 changed symbols, 0 affected processes, risk LOW (assertion-only edits). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(scope-resolution): resolve every finding from the multi-engine review of #2699 part B The first cut of Part B shipped four P1 defects. A two-engine review (Claude swarm + ce personas; Codex gpt-5.6-sol swarm + ce + adversarial) found all four, three of them because an independent engine disagreed with the authoring one. Each is fixed here and pinned in test/integration/closure-review-findings.test.ts. ## P1-1 — a multi-line closure binding fabricated a CALLS edge The worst of the four, because it reintroduced the exact defect class #2699 exists to remove. The two query channels anchor on DIFFERENT nodes by design (graph-node on the outer wrapper, scope-resolution on the inner closure) and the bridge joins them on line only. Same line, the join matches. Split across lines: $multi = function ($x) { return target($x); }; the join missed, `resolveDefGraphId` failed closed, and `resolveCallerGraphId` then CLIMBED to the parent scope — emitting `outer -> target` although `outer` calls nothing, while the real `outer.$multi` node sat with zero outgoing edges. `resolveCallerGraphId` now fails closed at the owning callable instead of climbing. If we have identified the callable that owns a call site and cannot name its graph node, crediting an ancestor is not graceful degradation — it invents a relationship. A missing edge is the correct failure direction for a graph whose consumers include `impact`. Getting there took two attempts, worth recording: the first guard keyed on the def's qualifiedName carrying the `@line:col` local marker, but that suffix is added by parse-worker for GRAPH NODE ids and scope-resolution defs do not have it, so the guard never fired. `pickCallerCallableDef` now reports whether the callable came from a child scope, and the fail-closed applies to the owning callable either way. ## P1-2 — TS constructor parameter properties were re-keyed as locals A REGRESSION against the base, not merely an incomplete fix. Admitting `Property` to the position-qualified set made the enclosing-callable walk reach the constructor's `method_definition` THROUGH the parameter list — a LOCAL_SCOPE_BODY hit that lands before any class boundary — so `constructor(private readonly port: Port)` produced `Property:svc.ts:Service.constructor.port@2:14` instead of `Service.port`. That silently empties the slot `impact`, `rename` and FTS address while the class still asserts HAS_PROPERTY against it, and it is the Angular/NestJS DI idiom. A real instance exists in this repo at src/core/group/service.ts:304. parse-worker.ts already computed the correct exemption (`isFunctionLocalProperty`, lines 2245-2257) two lines above; the new ternary discarded it. Now reused, so the owner-edge decision and the id decision cannot disagree. ## P1-3 — Dart top-level and `final` closures were never call sources The rule matched only `initialized_variable_definition`, Dart's FUNCTION-LOCAL shape. A top-level `var` is `initialized_identifier` and a top-level `final`/`const` is `static_final_declaration`; the second declarator of `var f = ..., g = ...` is also `initialized_identifier`. None got a declaration capture, so `findFunctionBody` never synthesized their scope. dart/captures.ts ALREADY listed all three in bindingNodeTypes for callable-flow — the declaration rule simply did not mirror it. It does now. ## P1-4 — Ruby `do ... end` and `Proc.new` closures were uncovered `do ... end` is the dominant MULTI-LINE Ruby style and produces `(do_block)`; all three patterns matched `(block)` only. The scope channel already covered both, so these closures got a Block scope owning nothing and their calls fell through to the enclosing method. The PR's own Ruby test used the brace form, so it passed. Fixing it needed BOTH channels — tree-sitter-queries.ts had no graph-node rule for the `(call)` forms either, exactly as Rust did. Verified: brace, do/end and Proc.new are now all sources. ## Also from the review - The split-signature fallback could fire on VALID TypeScript: a `declare namespace` containing a bodyless overload made the next declaration's `export_statement` a sibling of a `function_signature`, so `send` became `internalHelper.send@2:9`. The fallback now requires the matched node to be the signature's BODY (a body holds statements; a declaration wrapper holds another signature), which separates the two without naming a grammar. - `isCallableDef` re-spelled `Function | Method | Constructor` in the same file that imports `isOverloadableCallable` and calls it three times — a NEW twin list, in the PR whose headline is a twin-list drift guard. It now delegates. - A partial edit had left a self-contradictory comment in parse-worker.ts ("Restricted to CALLABLE labels: the / Applies to VALUES as well as callables"). - eval/workflow_bench/learnings.jsonl carried a "skill": "gitnexus-plan" entry, but that skill's SKILL.md:347 states feedback is chat-only and forbids appending learnings during a planning task. Dropped; the three gitnexus-work entries are sanctioned and stay. - Ruby's lambda/proc patterns tested the method NAME only, so `MyMod.lambda { }` was captured as a closure binding. `!receiver` now constrains them. - Rust's closure work (S3) had ZERO test coverage anywhere — verified once by a throwaway fixture and never pinned. Now covered. ## Verification Full resolver sweep plus the identity/closure suites: 3017 passed / 1 skipped / 0 failed across 58 files (up from 2997 — the new tests). This is the gate that mattered for P1-1: failing closed instead of climbing could have silently deleted real edges in any language, and ~2900 resolver assertions say it did not. All EIGHT bench fingerprint gates PASS with fingerprints UNCHANGED. tsc --noEmit clean. detect_changes {staged}: 14 changed symbols, 18 affected processes, risk CRITICAL — expected, since P1-1 changes the fallthrough of `resolveCallerGraphId`, the key chain Part A measured at CRITICAL with 23 direct dependents. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-28 18:25:19 +01:00
MyShining	ff86ccf1e7	feat(spring): model profiles, conditions, and auto-configuration (#2678) ... * feat(spring): model conditions and auto-configuration * fix(spring): align auto-configuration declarations * perf(spring): streamline auto-configuration indexing * test(spring): move timing benchmark out of vitest --------- Co-authored-by: Shining <xuenning@qiyi.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-07-28 07:05:41 +01:00
Gergő Magyar	e307286d52	fix(scope-resolution): a named receiver's member never resolves lexically, + two #2695 follow-ups (#2714) ... * fix(scope-resolution): a named receiver's member never resolves lexically (#2699) `lookupCore` Step 1 walked the lexical scope chain for every lookup, including explicit-receiver property reads. So `options.baseUrl` could bind to an unrelated function-local `const baseUrl` in the same file, and `config.extractVisibility(node)` to the enclosing class's own method. This is the residual half of the defect JS/TS block scopes narrowed in #2695. Blocks moved nested-block locals off the chain of a reference outside the block, which removed 114 false edges; a local declared directly in the function body stayed on it, and no amount of extra scopes reaches that case. Fixed at the cause instead: `recv.name` names a member of whatever `recv` denotes, so a binding of the bare tail name in an enclosing scope is never the right answer. Steps 2 and 3 (receiver type / owner members) are the legitimate routes. `this` and `self` are EXEMPT, and that exemption was measured, not assumed. Skipping Step 1 for every explicit receiver removed 711 edges on a 762-file corpus — but 2 of those were genuine: `self.srcIx` and `self.streamedAt(...)` after `const self = this`, reaching their own class's members through the class-body scope. For a self-receiver the members and the lexical chain legitimately overlap; for a named receiver they never do. Exempting the self names keeps both true edges and still removes 709 false ones, adding none. The removals were classified by reading source at the site, not by pattern- matching ids — an "is the target a member of the source's owner?" heuristic labelled 43 of them plausible and every one I then read was false: language = config.language; -> the class's own `language` dirMap.get(...) / exactMap.get(...) -> a sibling object-literal `get` return config.extractVisibility(n); -> the class's own method (self-edge) writer.close(); -> GraphEmitSink.close Residual, deliberately kept: a `this.x` read can still bind lexically to a same-named local. That is the price of the two true self-alias edges above. `INCREMENTAL_SCHEMA_VERSION` 19 -> 20: a v19 index holds these false CALLS/ACCESSES on every unchanged file and would keep serving them through the reuse gate. Test confirmed discriminating: it fails with the guard reverted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(typescript,javascript): a generator expression binding is a Function node (#2693) `const g = function* () {}` matched none of the closure-binding definition rules — they covered `arrow_function` and `function_expression` only — so the binding emitted a `Const` node. `buildGraphTargetIndex` admits callable nodes only, so `g()` resolved to nothing. Same defect shape as the `var` case #2693 already fixed: a different grammar node for the same construct, and the resulting graph node was not callable. Adds the four variable-binding shapes in both languages: `const`/`let` and `var`, each plain and exported. Purely additive — no existing pattern is reordered or rewritten, because the #2687 pre-scan dedup is order-dependent and collapsing the value/callable pair depends on which match wins. Deliberately NOT covered, and the query comment says so: a generator in an object-literal pair or a HOC wrapper still falls through anonymous. Those are rarer, and each additional pattern is another chance to disturb the dedup. `SCHEMA_BUMP` 26 -> 27: definition captures are parse-time, so a warm parse cache would replay the old ones verbatim — `--force` does not clear it. Two tests confirmed discriminating (they fail with the patterns reverted), plus a guard that the already-working generator DECLARATION form is unaffected, since it shares the emit path these were inserted beside. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(ingestion): keep caller attribution in lockstep with definition ids (#2699) The definition phase appends `localIdentity` to a nested callable's own name segment (`run.save@3:2`); `findEnclosingFunctionId` did not, so the two phases derived different ids for the same callable. The failure mode is silent — the caller id names a node that does not exist, so the edge is dropped rather than reported — which is why the parse-worker docblock calls this pair a lockstep guarantee and asks that both phases derive the prefix from one place. The condition is now byte-identical to the definition phase's (`nestedPrefix !== undefined`), so the two cannot diverge again. Scope of the claim, stated plainly: no reproducing case was found, and this changes nothing measurable on a 762-file TypeScript corpus. TS/JS resolve callers through `resolveCallerGraphId` in the graph bridge, not this path; `findEnclosingFunctionId` serves the `callExtractor` languages, and the corpus does not exercise a nested callable there. The review that raised it (P3) observed zero dangling edges, and "zero dangling" is also what silently dropped edges look like — so this closes a documented contract rather than a demonstrated bug, and carries no test of its own. Rides the `SCHEMA_BUMP` 26 -> 27 in the preceding commit: caller attribution runs in the worker, so a warm parse cache would replay the old ids. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * docs(test): correct the block-scope header that this PR made false (#2699) Review finding (MEDIUM). The file header still described `lookupCore` Step 1 as walking the lexical chain for EVERY lookup, and called the function-body-local case "unchanged and still mis-resolves ... pre-existing and tracked separately". Commit 59b892ca in this same PR falsified both, and the describe block added ~80 lines lower in this same file asserts the opposite — a reader scoping future work from the header would have concluded the case was still open. Rewritten to state what the code does: Step 1 is skipped for a NAMED explicit receiver, the function-body case is fixed here, and the surviving residual is that a `this`/`self` read can still bind lexically to a same-named local — with the reason those two names are exempt (they keep the genuine `const self = this; self.member` reads that Step 1 resolves correctly). Also corrects a PRE-EXISTING staleness inherited from #2695 in the same paragraph block: "the genuine bare read of that same local must still emit its edge" describes a test that no longer exists, because TypeScript emits no `@reference.read` for bare identifiers at all. Fixed here rather than left adjacent to a freshly corrected sentence. Comments only — `detect_changes` reports 0 changed symbols across 1 file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * refactor(ingestion): give the nested-callable id rule one definition (#2699) Review finding (LOW): the lockstep change in this PR shipped without a test. The plan called for a unit test asserting the two id-derivation phases agree. Two things changed that plan during execution, both recorded here. FIRST — there are THREE phases, not two. Re-verifying the plan's assumption (`grep -n localIdentity`) found a third call site: the worker-path node-id derivation in `processFileGroup` (parse-worker.ts:2316), whose own comment already acknowledged the coupling. `impact` on `localIdentity` corroborates: three direct dependents, all in the Workers module. So the invariant three phases must agree on is now ONE function, `nestedCallableQualifiedName`, and divergence requires deleting a call rather than editing a duplicated expression. SECOND — the planned `_forTest` alias seam does not work for this module. `parse-worker.ts` posts a `ready` message to `parentPort` at module scope, so value-importing it from a unit test throws before any test runs; the existing unit tests that reference it use `import type` only, which erases. The rules therefore move to a new pure module, `workers/callable-id.ts`. That is what makes them testable at all, rather than merely commented. Pure refactor — no id changes. Verified by the suites that assert exact node ids (`Function:svc.ts:run.save@7:2`, `Function:c.php:run.$save@3:2`): 74/74 green, and `detect_changes` reports only the three expected symbols and the two `processFileGroup` flows `impact` predicted. The test pins both halves: the rule's contract, and a structural assertion that no site has re-inlined `${prefix}.${localIdentity(...)}` — the unit assertions alone would still pass if a fourth phase spelled the rule out by hand, which is exactly how the divergence arose. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(scope-resolution): give PHP's `$this` the same self-receiver exemption (#2699) Review finding (LOW). The Step-1 skip added in this PR exempts `this`/`self`, but the receiver name arrives as the reference node's RAW SOURCE TEXT — `extractExplicitReceiver` returns `cap.text` verbatim — so PHP's `$this->x` presents as the string "$this" and matched neither entry. PHP was the one supported language whose self-receiver got no exemption at all. Measured, and the measurement is why this is framed as consistency rather than a bug fix: - Corpus delta ZERO. 762-file TypeScript corpus, CALLS+ACCESSES set diff: 13179 -> 13179, added 0, removed 0. So no INCREMENTAL_SCHEMA_VERSION bump (stays 20), per the plan's decision rule. - No PHP shape found that DISCRIMINATES. Both the simple `$this->prop` / `$this->helper()` shapes and a closure reading `$this->…` inside a method that also declares a same-named local produce byte-identical edge sets with `$this` present and absent — Step 2 resolves the receiver's type first. The added test is therefore labelled a COMPANION INVARIANT, exactly as the `this.baseUrl` case beside it is, and does not claim to prove the fix. It is still worth making: the exemption is protective, and the 709-removed / 0-true-lost measurement that justified the narrow guard was TypeScript-only, so PHP's safety was never established by evidence. This closes that by construction. Two corrections to what the plan assumed, both found by checking: - The plan (and my first draft of this comment) claimed the codebase had no precedent for handling a sigil'd receiver name. FALSE: `THIS_RECEIVERS` in `core/ingestion/type-env.ts:244` has always listed `$this`, and it is the ingestion-side twin of this very list. The precedent does not merely exist, it validates the approach chosen here — list the spelling as data, do not strip sigils. - That twin also lists `Me`. Deliberately NOT mirrored: no entry in `SupportedLanguages` is Visual Basic, so it could only ever exempt a variable that happens to be called `Me`. The two lists are otherwise the same set with nothing enforcing it — a fifth instance of the twin-list drift class this PR keeps meeting. A drift guard is the right fix and is out of scope here; noted for follow-up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(rust): resolve `Self` in scope-resolution type bindings (#2699) CI regression, caught by `tests / ubuntu / coverage` on 13d5e738 and traced to the named-receiver Step-1 skip earlier in this PR (59b892ca), not to the three commits above it — verified by reverting those three and reproducing the failure unchanged. `test/integration/resolvers/rust.test.ts > resolves fresh.validate() inside impl User via Self {} inference` failed: 192/192 on main, 191/192 on this branch. The fixture calls `fresh.validate()` where `let fresh = Self { .. }` inside `impl User` — a genuine call to `User::validate`, and a TRUE edge that the skip deleted. Root cause is a twin-channel disagreement, not the skip: - `type-extractors/rust.ts:142` substitutes `Self` -> the enclosing impl type into the TYPE-ENV channel via `findEnclosingImplType`. - `languages/rust/interpret.ts` recorded `@type-binding.type` verbatim, so the SCOPE-RESOLUTION channel bound `fresh: Self` — a type that does not exist, leaving the receiver's type unknown and Step 2 unable to resolve. `main` passed only because Step 1 still walked the lexical chain for named receivers: the impl scope binds `validate` by name, so the call resolved BY ACCIDENT. Stopping that walk turned a latent gap into a lost edge. The fix closes the gap rather than restoring the accident — `Self` is now substituted at capture-emit time in `languages/rust/captures.ts`, where the impl node is reachable, reusing the `findEnclosingImpl` + `syntheticCapture` idiom already in that file. CORRECTION to this PR's central claim. "709 removed / 0 added / 0 true edges lost" was measured on a 762-file TYPESCRIPT corpus and stated without that qualifier. Rust lost one true edge. The measurement stands for TypeScript; it did not generalise, and the PR body is being updated to say so. Scope of the breakage, measured rather than assumed: 1 failure in 2927 tests across all 51 resolver files. Every other language — Go, Java, C#, Kotlin, Swift, Python, PHP, Ruby, Dart, C++ — passes, which is why this is a targeted fix and not a revert of the skip. Re-baselined `bench/scope-capture` for RUST ONLY (655aed01 -> 7f1240b3); the other 14 language fingerprints are byte-identical. The drift is the intended output change and the reason is recorded in the baseline entry, per that file's own "explain, never re-baseline to make CI green" rule. Verified: rust resolvers 192/192; all 51 resolver files 2926 passed / 1 skipped / 0 failed; the 8 targeted suites 96/96; all 8 CI bench gates PASS; `tsc --noEmit` clean; `detect_changes` reports one touched symbol (`emitRustScopeCaptures`) and no affected flows. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * test(golden): refresh the Rust capture golden and the C# PDG snapshot (#2699) The two committed artifacts CI flagged after 5f55fe46. They drifted for OPPOSITE reasons, so each was inspected before regenerating rather than refreshed on sight. RUST GOLDEN — drifted because 5f55fe46 CORRECTS the output. A `Self` type binding now records the enclosing impl's type instead of the literal `Self`, in both the `let x = Self { .. }` and `fn new() -> Self` forms. Blast radius verified exact: 5 fixtures drifted, all 5 contain `Self`, and every `Self`-bearing rust fixture is among them (rust-self-struct-literal, rust-constructor-type-inference, rust-default-constructor, rust-method-enrichment, rust-scoped-multi-file). C# PDG SNAPSHOT — drifted because the named-receiver Step-1 skip (59b892ca) REMOVED A FALSE EDGE. CALLS 7 -> 6, and the edge that went is: Demo.Resolve.Parse@142:12#1 -> Demo.Resolve.Parse@142:12#1 a self-call, from `int Parse(string v) => int.Parse(v);`. `int.Parse(v)` is System.Int32.Parse; the lexical chain was binding it to the enclosing local function that happens to also be called `Parse`. Same defect class as `writer.close()` -> GraphEmitSink.close. The snapshot's own comment says it exists so "a future refactor that silently rewires the C-family graph trips this gate" — it tripped correctly, and the rewiring is an improvement. Both failures were PRE-EXISTING on this PR from 59b892ca, not from the three commits above it — verified by reverting those and reproducing unchanged. They went unseen because this PR's CI was never watched after its first push. Verified after regeneration, WITHOUT update flags so they must genuinely pass: rust-captures-golden 9/9; pipeline-pdg 31/31. The snapshot diff is 3 lines, all inside the C# entry — no other language's snapshot moved. `detect_changes` reports 0 changed symbols (test artifacts only). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 17:56:38 +01:00
Gergő Magyar	4906daf27b	fix(scope-resolution): resolve calls through a closure-valued binding across languages (#2693) (#2695) ... * fix(scope-resolution): resolve calls through a closure-valued binding (#2693) `val f = { }; f()` emitted no CALLS edge in Kotlin or Swift, so `impact` on such a symbol under-reported to zero — the same false all-clear as #2687. The cause was not, as first suspected, that these languages fail to feed `callable-value-flow`. They do: `synthesizeCallableFlowCaptures` is called from 15 language capture modules, and Kotlin already resolves reassignment through the pass (`var f = ::a; if (c) f = ::b; f(1)` reaches both targets). Their captures are already exactly right — the seed names the binding as its own callable, per the anonymous-callable convention in callable-flow-captures.ts. They died one layer later, at the `buildGraphTargetIndex` gate: if (!isCallable(def) && providerTarget?.(def) !== true) continue; `isCallable` is Function/Method/Constructor, but the scope-resolution layer declares a closure binding with its VALUE label (Kotlin/Swift `Property`), and `isCallableValueTarget` is implemented by exactly one provider — COBOL. So the binding never entered `graphTargets`; `lexicalCallableLookup` then returned `shadowed: true` with no targets, which also suppressed the workspace-wide fallback, and the seed resolved to nothing. Only the graph knows a value binding holds a callable — since #2687 it emits a single `Function` node for one. So value bindings now resolve their graph id first and are admitted on the label of the node they actually reach. This is self-limiting: a genuine constant keeps its own Const/Property node, so `resolveDefGraphId`'s qualified key hits before the label-agnostic `simpleKey` fallback can reach a same-named callable. Only a binding whose own value node was replaced by a callable one gets through. No scope kind changes — Kotlin's `lambda_literal` stays `@scope.block`, so #1757 smart-cast semantics are untouched by construction. The fix is language-neutral: it discriminates on the graph node label, never on a language name. Dart is fixed separately; its root cause is independent. * fix(dart): resolve calls through a closure-valued binding (#2693) Dart needed more than the shared gate fix: neither of its closure-binding forms could resolve, for two different reasons, and the plan's one-line diagnosis turned out to be incomplete. TOP-LEVEL `var f = (x) => x;` A graph Function node already existed (#2687), but no `@declaration.*` matched the binding, so scope resolution had no SymbolDefinition to attach a flow seed to. Adding the declaration exposed a second problem: Dart's `initialized_identifier` is FIELDLESS, so the shared field-based assignment fallback (`left`/`name`/`value`/…) decomposed nothing and the binding still emitted no flow captures at all. Kotlin's fieldless `assignment` node hit exactly this and took the same remedy — a provider `extractAssignment`. FUNCTION-LOCAL `void m() { var f = (x) => x; }` Locals parse as `initialized_variable_definition`, which the top-level graph-node rules are deliberately anchored under (program) to avoid, so a local closure had no graph node at all — nothing for the widened `buildGraphTargetIndex` gate to admit. Both new rules are restricted to a `function_expression` value. Declaring every Dart variable would mint defs and nodes repo-wide for no resolution benefit; ordinary locals stay unindexed exactly as before. The top-level declaration reuses the (program) anchor the graph-node query already relies on, so class-body fields — which share `initialized_identifier_list` and are already `@declaration.property` — are never matched twice. Also drops the now-false note in tree-sitter-queries.ts claiming `f()` does not resolve for Dart. That node is now the evidence that makes it resolve. * docs(scope-resolution): document the callable-flow capture contract (#2693) The module is 1200+ lines behind a nine-line docblock, and the only worked example was C. Both root causes fixed in this series were "the contract was discoverable only by reading the emitter": - the anonymous-callable convention (a seed whose source is a closure takes its DESTINATION's name) is what makes closure bindings resolvable at all, and is the reason the widened target gate is correct; - a fieldless binding node silently decomposes to nothing under the shared assignment fallback, which cost Kotlin one debugging cycle in #2522 and Dart another here; - captures alone are never enough — the bound name also needs a `@declaration.*` or there is no cell to key the seed on. Records the cell/site model, both traps, and points at the fullest and smallest worked examples. Bumps INCREMENTAL_SCHEMA_VERSION 15 → 16 and the parse-cache SCHEMA_BUMP 22 → 23: this series emits NEW CALLS edges and new Dart Function nodes, and the incremental write set only covers changed files, so an existing index would keep reporting a zero blast radius for exactly the symbols the fix is about. * perf(scope-resolution): pre-filter value bindings in the callable target index (#2693) Widening the `buildGraphTargetIndex` gate to consider VALUE bindings put the hot loop on a much larger def population — value bindings outnumber callables in real source — and the naive version paid full price per binding. Measured on a synthetic 800-file corpus (8 value bindings per file, 1 of them a closure binding), the widening cost 2.50-2.82x the pre-#2693 callable-only build. Two wastes, both provable rather than guessed: 1. `definitionAnchorKey` ran for every def, including value bindings. The anchor index is keyed by callable LABEL and the key is built from `def.type`, so a value def can never hit it — and the key costs a regex per def. 2. Every value binding paid the whole `resolveDefGraphId` key chain only to be rejected. It need not: every qualified key that function tries embeds `def.type`, so for a VALUE def those can only ever reach a value-labelled node. Its one route to a callable is the label-agnostic `simpleKey(filePath, simpleName)` fallback, which by construction requires a callable node with the SAME file and simple name. So a value binding with no such node cannot resolve to a callable, and one Set lookup decides it. That set is derived in the graph walk the anchor index already performs, so it costs no extra pass. large_ms 7.79-8.37 -> 4.90-5.02 (1.61x faster) widening_overhead 2.50-2.82 -> 1.45-1.50 The resolved target-set fingerprint is byte-identical across both, which is the point: this is a cost change, not a behaviour change. Adds bench/callable-value-flow/ (fingerprint + scaling + widening-overhead gates) and wires it into ci-tests.yml beside the other build-free benches. The overhead budget of 1.9 sits between the measured with-filter and without-filter bands, so it cannot be met if the pre-filter is removed. Timings use the MIN of 15 warmed reps, not the median: the same build reported 1.65 idle and 2.03 under load, and a median-based gate would have to be loosened past the point of detecting the regression it exists to catch. `buildGraphTargetIndex` is exported for the bench; it is pure and not part of the pass's public contract. * test(scope-resolution): assert the declaration route does not double-emit (#2693) Go, Python, C++ and TS/JS already resolved a closure-binding call through their `@declaration.function` capture. The widened `buildGraphTargetIndex` gate gives the same call a SECOND possible route, so each must still produce exactly one edge. `tryEmitEdge` dedups by key, but a collapsed key and a site-anchored key are DIFFERENT keys — a real double-emit would show up as two ids for one call site, not be silently collapsed. Asserting on edge ids rather than target ids is what makes that visible. * fix(scope-resolution): join value bindings to their callable node by POSITION (#2693) Review found the first cut of this series minted FALSE CALLS edges. Admitting a value binding whose *resolved* graph node is callable let `resolveDefGraphId` fall through to its label-agnostic, first-write-wins `simpleKey(filePath, simpleName)` and bind the name to ANY same-named callable in the file. The safety argument in the previous commit — "a genuine constant keeps its own Const/Property node, so the qualified key hits first" — silently assumed `def.type === node.label`. It does not hold: - TypeScript declares `const` as `Variable` but emits a `Const` NODE, so the qualified key misses even though the value node exists; - Rust `let` bindings get no graph node at all, so the fallback is the only route. Reproduced, all previously emitting a fabricated caller: const save = (x: number) => x * 2; // next to an unrelated Svc.save -> Method:svc.ts:Svc.save#1 // Svc never instantiated const handler = other; // shadowing a top-level handler -> Function:app.ts:handler // unreachable from here let handler = cb; // Rust -> Function:main.rs:handler Worse in Dart, where the same collision INVERTED the feature: the only edge went to the class method and the closure's own node got none. The result was also declaration-order dependent — two files differing only in declaration order got different CALLS sets — and it propagated through argument-to-formal binding into functions whose source never mentions the name. A closure binding IS its callable node: same file, same line, same name. An aliasing local is not. So the join is positional now — a file/line/name index built in the graph walk `byAnchor` already performs — and value bindings never run the key chain at all. That is both correct and cheaper: large_ms 4.90-5.02 -> 4.37-4.63 widening_overhead 1.45-1.50 -> 1.43-1.58 (name-match design: 2.50-2.82) with a byte-identical target-set fingerprint on the bench corpus. Also from review: - `Static` dropped from VALUE_BINDING_DEF_TYPES: `normalizeNodeLabel` has no `static` case, so no def can carry that type — it was an entry no fixture could ever exercise. The remaining set now documents why it deliberately does NOT reuse `isOwnableValueLabel`, which is contracted to a different consumer. - Dart `final`/`const` top-level closures (static_final_declaration_list) and every declarator after the first in a multi-name local now resolve; both parse into shapes the earlier rules never reached. - The bench source carried a literal NUL byte, so git recorded it as BINARY and the only artifact pinning the target set was unreviewable in the PR diff. It is written as an escape now. Its corpus also modelled `startLine` as 1-based where graph nodes are 0-based, which would have stopped it exercising the value-binding path at all. - `call-summary-schema-version.test.ts` asserted `passesReuseGate(15)` is true; the 15 to 16 bump made that false and the test RED. It now pins 16 as current and 15 as rejected, matching the pattern every prior bump followed. - The v23 parse-cache comment is at the top of the list, not mid-list. Tests: the five collision cases above are new regression tests, each confirmed failing against the previous commit. Also added Kotlin class-body closures (the only case exercising the Method arm), Dart top-level `final`, Dart multi-name locals, and a warm-parse-cache replay for Kotlin and Dart — the #2693 captures are replayed verbatim, so a serialization change would surface only on a SECOND analyze and every other test here runs cold. The previous negative tests were vacuous: they paired names that did not collide (`maxSize` vs `size`), so the pre-filter rejected them before the guard they were named after could run. * docs(storage): fix the schema-version changelog blocks (#2693) Two problems, one mine and one not. MINE: the `INCREMENTAL_SCHEMA_VERSION` block is ASCENDING (v2 … v15), and I inserted v16 above v15 rather than at the end — I had just moved the parse-cache entry to the top of ITS block, which is descending, and applied the same habit to a list ordered the other way. Moved to the end; both blocks are now internally consistent. NOT MINE: the parse-cache block carries TWO v21 entries, with v20 wedged between them. Tracing it: #2632 (Spring DI facts) bumped 20 -> 21 and merged first; #2653 (Java JLS local-class identities) had branched at 20, also bumped to 21, and merged second — so it shipped with NO invalidation of its own. An index already stamped 21 by the first change was treated as current by the second and kept serving stale local-class identities from the warm cache. Numbers left alone: both genuinely shipped as 21, and renumbering them now would misstate what users' indexes actually contain. Instead the entry says so explicitly, and points at the process fix — re-check the constant against origin/main immediately before merging, not just when the branch is cut. The identical collision hit INCREMENTAL_SCHEMA_VERSION in #2653/#2654, so this is a recurring failure mode of concurrent PRs, not a one-off typo. Comment-only; no constant changes value. * feat(scope-resolution): resolve closure bindings in Ruby, Java, C#, PHP and JS/TS var (#2693) Ruby, Java, C# and PHP already emitted correct callable-flow seeds and invokes. What they lacked was the #2687 piece — a CALLABLE graph node at the binding, which is what buildGraphTargetIndex joins to by position. PHP additionally had no scope declaration for the bound name, so the flow pass had nothing to attach its seed to. ruby handler = ->(x) { x } handler.call(1) -> Function:a.rb:handler java Function<..> handler = x->x handler.apply(1) -> Function:A.java:A.handler csharp Func<int,int> handler = ... handler(1) -> Function:A.cs:A.handler php $handler = fn($x) => $x $handler(1) -> Function:a.php:handler Ruby and Java invoke through the callable-object protocol; C# and PHP call the binding directly. Locals work in all four, and a binding whose name collides with a same-named method resolves to the CLOSURE, not the method. Two things the sweep caught: JAVA TWIN. Anchoring the rule on the inner variable_declarator produced BOTH a Function and a Property node — the exact double-indexing #2687 removed. The parse-worker dedup keys on (definition node, name), and Java's value rule anchors on field_declaration, so the keys never matched. Re-anchored on field_declaration / local_variable_declaration. JS/TS `var`. `var f = (x) => x` kept a Variable label while const/let got Function, because `var` is a different grammar node (variable_declaration vs lexical_declaration) that no closure rule covered. A call through the binding still resolved via the declaration route, so the CALLS edge pointed at a NON-callable node. Now consistent across const/let/var. That last one flipped an existing assertion in const-function-twin.test.ts, which expected `Variable` for a var-bound function-expression. Its comment explained why — "var has no matching @definition.function pattern, so nothing claims the name" — i.e. it documented the gap rather than defending it. The property it was really protecting (an UNCLAIMED value node survives) now has its own case with a non-function initializer, and the var-closure case asserts the collapse to one node, which is also the twin guard for the new rule. Known limits, both pre-existing and both failing safe: - A PHP local closure whose name collides with a top-level function gets no edge: both want id Function:<file>:<name>, so the closure never gets its own node. This is the file-scoped node-identity convention — TypeScript, Python and Dart collapse identically at base. - TS/JS class-field arrows stay Property (Kotlin's equivalent emits Method). They already resolve; changing the label risks the HAS_PROPERTY ownership regression #2687 hit once. The invalidation constants already bumped in this PR (INCREMENTAL_SCHEMA_VERSION 16, SCHEMA_BUMP 23) cover these additional languages; their notes now say so. Tests: one case per newly-resolving language plus the PHP anonymous-function form and the JS var form, in closure-binding-labels.test.ts. The file now spins a worker pool per test across a dozen languages, so its timeout is raised file-wide — a case that takes ~7s alone was exceeding the 30s default under that contention. * fix(ingestion): class-field closures are callable members in TS/JS (#2693) A CALLS edge must target a callable node. `class A { handler = (x) => x }` emitted a Property, so calling it produced `CALLS -> Property:A.ts:A.handler` — an edge pointing at something the graph says is not callable. Same defect class as the JS/TS `var` binding fixed in the previous commit, and the last place a closure binding still carried a value label. Kotlin already models its class-body closure as Method + HAS_METHOD; TS/JS now match, so all three agree: class-field closure -> Method + HAS_METHOD (CALLS target is callable) plain class field -> Property + HAS_PROPERTY (unchanged, no CALLS) Anchored on public_field_definition / field_definition — the same nodes the property rules use — so the parse-worker dedup collapses the pair rather than leaving a Method/Property twin, the failure the Java rule hit in the previous commit. ON MATCHING THE COMPILERS. This deliberately diverges from tsc and SCIP. The TypeScript compiler classes `handler = () => {}` as a PropertyDeclaration ("a property declaration independently from what it's assigned to"), and SCIP gives it a `.` term descriptor, the same suffix as any field — both call it a property, and Kotlin's compiler likewise treats `val f = { }` as a property with a function type. The divergence is intentional: GitNexus's Function/Method label does not mean "tsc SymbolFlags", it means "this node can be the target of a CALLS edge", which is the convention #2687 set for closure bindings in every language. Modelling it the compiler's way would mean either dropping call resolution for these members or emitting a separate node for the lambda and flowing the property to it — the two-node shape #2687 removed. Recorded here so the next reader does not "fix" it back. Tests: TS and JS class-field arrows resolve to their Method node, plus a guard that a NON-closure class field stays a Property — the closure rule must key on the initializer, not on the field syntax. * fix(php): keep the $ sigil on closure-binding nodes so locals stop colliding (#2693) A PHP local closure whose name matched a file-level function got NO edge at all: function save($x) { return $x; } function run() { $save = fn($x) => $x * 2; return $save(1); // no CALLS edge } Both minted the id Function:<file>:save, so the closure's node was swallowed by the function's and the positional join found nothing at the binding's line. The fix is PHP's own semantics rather than a change to node identity across the graph. PHP holds variables and functions in SEPARATE namespaces — $save and save() cannot collide in the language — and the sigil is what separates them. Dropping it was the bug. The node rule now captures the whole variable_name, so the closure is Function:<file>:$save and the function stays Function:<file>:save. languages/php/query.ts already keeps the sigil on property declarations for the same reason, so this makes the two consistent. The positional join normalises a leading $/@ on both sides, matching what the scope layer and the callable-flow synthesizer already do, so the binding still matches its own declaration while its NODE stays distinct. local closure + same-named function -> Function:c.php:$save (the closure) calling the real function -> Function:f.php:save (unchanged) plain $max = 10 -> no node, no edge (unchanged) WHAT THIS DOES NOT FIX. The general problem is wider than PHP: GitNexus node ids are file-scoped, so a function-local symbol and a file-level one with the same name collapse in TypeScript, Python and Dart too, and Java/C# only escape by qualifying on the enclosing CLASS (so two same-named locals in different methods still collide). SCIP solves it with a separate `local <id>` keyspace that is document-scoped and never globally addressable. That is issue #2699 — it changes persisted ids for every function-local symbol and needs its own invalidation, so it is not bundled here. PHP is fixed on its own merits: the sigil belongs in the identity regardless of how locals are eventually scoped. * test(scope-resolution): pin the closure-binding caller-attribution limit (#2693) Review of this PR found the new callable nodes are call TARGETS but never call SOURCES: a call made INSIDE a closure binding is attributed to the enclosing scope, so `impact(handler, direction:"downstream")` reports nothing even though the closure calls out. Consistent across Kotlin, Dart, Ruby and PHP; TS/JS free bindings are the exception because their arrow carries a @scope.function whose range matches. Not fixed here — pinned, so the boundary is visible instead of surprising, and so a change in EITHER direction fails a test. The cause is precise: `pickCallerCallableDef` (graph-bridge/ids.ts) finds the caller by walking CHILD scopes whose range contains the call site, gated on `child.kind === 'Function'`. A closure literal is a BLOCK scope in these languages (Kotlin deliberately, #1757 smart casts), AND the binding's def is owned by the enclosing scope rather than by the closure's scope — so neither half of the link exists. Fixing it needs "callable boundary" decoupled from scope `kind` plus an association between the closure scope and its binding. That is a change to the caller anchor used by every call in the repo, which is not something to land at the tail of this PR. Also adds a unit suite for `buildGraphTargetIndex` itself, covering what the integration tier cannot isolate: a binding is admitted only on POSITIONAL evidence, a name-only match is rejected, a non-callable node at that position is rejected, an ambiguous position claimed by two callables is rejected, and the PHP dollar sigil normalises across the join while still not matching a same-named function on another line. That last one closes the review's LOW — the node/declaration name asymmetry now has an executable contract rather than resting on a comment. * docs(test): correct the per-language cause of the attribution limit (#2693) The comment on the pinned attribution tests claimed "a closure literal is a BLOCK scope in these languages". That is true for Kotlin (lambda_literal @scope.block, #1757) and Ruby (do_block/block @scope.block) and FALSE for PHP: anonymous_function and arrow_function are already @scope.function (php/query.ts:61-62). Dart is a third case again — it has no scope over a closure literal at all. So the four languages fail at three different points, not one: Kotlin, Ruby fail the `child.kind === 'Function'` gate PHP passes that gate; its closure scope owns no callable def, because the binding's def belongs to the enclosing scope Dart has no child scope for the walk to consider Worth correcting carefully rather than tidying: a follow-up plan re-stated this comment instead of re-deriving it, and inherited the misdiagnosis — it proposed "relax the kind gate" as required for all four, which is a no-op for PHP and unreachable for Dart. A review caught it. The comment now states each language's actual blocker and says why the distinction matters. Comment-only; the three pinned tests are unchanged and still pass. * fix(scope-resolution): an ordinary JS/TS `function` binds its own `this` (#2701) `this.m()` inside a nested `function` resolved to the lexically enclosing class, so it emitted a CALLS edge that does not exist at runtime — including the exact `forEach(function () { this.m(); })` shape arrow functions were introduced to avoid: class D { m() {} build() { const h = function () { this.m(); }; return h; } } // CALLS: Function:D.ts:D.h -> Method:D.ts:D.m#0 FALSE ECMA-262 gives an arrow `[[ThisMode]] = lexical`: it has no `this` binding in its environment record, so the lookup passes through to the enclosing environment. Every other function form binds `this` at call time. `tsc` draws the same line by resolving `this` through `getThisContainer` with `includeArrowFunctions = false`. That one rule is the whole fix. Languages declare it; shared code never learns a language. The query files — the one place that already names grammar nodes — tag every non-arrow function form with `@receiver-owner.this`, which becomes `Scope.ownsReceivers`. A receiver walk that reaches such a scope without finding the name stops there instead of borrowing an enclosing scope's binding. Every other language leaves the field unset and is bit-for-bit unchanged; a Kotlin lambda, which DOES capture the enclosing `this`, still resolves (pinned as a test). THREE GATES, ALL LOAD-BEARING. The false edge survived each one alone, which is why the tests assert on the emitted edge rather than any single walk: 1. `Scope.ownsReceivers` stops BOTH receiver-type walks — `findReceiver TypeBinding` here and its twin `lookupReceiverType` in gitnexus-shared's `lookup-core`, which was resolving the receiver independently. 2. `LanguageTypeConfig.thisBoundaryNodeTypes` stops the type-env AST walk that infers a receiver's type during capture. 3. `isReceiverOwnedButUnbound` makes `receiver-bound-calls` SUPPRESS the site. Without it the member still resolved by NAME through `lookupCore`'s lexical chain — the class-body scope binds `m` two scopes up — merely at lower confidence. An owned-but-unbound receiver is a definitive negative, not a miss, so it must not reach a receiver-blind fallback. Also fixed: `function*(){}` as an expression was not a `@scope.function` at all, so `this` inside one read as the enclosing method's. WHAT THIS GIVES UP. The fix REMOVES edges, and some were correct: `.bind(this)`, `.call(this)` and `forEach(fn, thisArg)` do make `this` the instance at runtime. Their correctness is fixed at the CALL SITE, which no scope-level rule can see, so the choice is between losing them and keeping every detached-callback false positive. All three are pinned as tests asserting the empty result, so changing the trade later is deliberate. `this` in a static method also stops resolving to the INSTANCE member — that edge was wrong in the other direction. INVALIDATION. Both constants move, and the parse-cache one is not optional: `ownsReceivers` lives on the cached `Scope`, and a warm cache replays scopes without it — verified by probe that `--force` alone does NOT re-derive it, so the fix silently did nothing until SCHEMA_BUMP moved. INCREMENTAL_SCHEMA_ VERSION 16 -> 17 (the incremental write set covers only changed files, so unchanged TS/JS files would keep their fabricated `this` edges); SCHEMA_BUMP 23 -> 24. Verified against a built index, not by reading: all three false edges from the issue gone, every correct edge kept, same result in JavaScript through its separate grammar. 64 tests green across the new suite plus the closure-binding and schema-version suites. The full suite's 36 failures are pre-existing load-flakes — confirmed by A/B: `skip-git-cli` fails FOUR tests on a clean HEAD versus three with this change, and `pipeline-pdg-streaming` passes in isolation either way. Refs #2701 * fix(ingestion): give function-local callables their own identity (#2699) Graph node ids were file-scoped, so a local callable and a same-named file-level one collapsed onto ONE node. That is a wrong answer, not a missing one — the local call was attributed to the file-level symbol: export function save(x) { return x; } export function run() { const save = x => x * 2; return save(1); } export function other() { const save = x => x * 3; return save(2); } // ONE node Function:a.ts:save, and BOTH run and other pointed at it, so // `impact` on the top-level save reported two callers that never call it. A local's identity is now its enclosing-callable chain plus its own position — `run.save@2:2`. The chain is for humans reading `impact`; the position is what makes it correct. Names alone cannot express what ECMAScript actually specifies, and the gap is the language's, not the grammar's: an environment record is created per function AND per block, so an anonymous function has no name to contribute and sibling blocks hold distinct bindings under the same name. One positional rule settles both, with no conditionals and no "disambiguate only when it looks ambiguous" heuristic — the ambiguity-flag class of bug that bit #2514. SCIP reaches the same place with its document-scoped `local <id>` keyspace. Top-level functions and class methods are NOT locals and keep their ids byte-for-byte. That is the bound on the churn: this touches only symbols that are unreachable from outside their own document anyway. RESOLUTION JOINS BY POSITION, NOT BY NAME. `resolveDefGraphId` matches a def to its node on (file, label, line, simple name). A def and its node are the same construct, so this needs no scope chain at all — which is the point: re-deriving the chain in the resolver would be a second implementation that could silently disagree with the first. A genuine tie (two callables on one line) stores an AMBIGUOUS_POSITION tombstone and falls through to the existing name keys rather than picking by source order. Without this the node ids were already correct and calls STILL resolved to the file-level symbol — the fix is only half a fix without it. JS/TS GAIN BLOCK SCOPES. They emitted no `@scope.block` at all, so the resolver could not tell two `const pick` in sibling branches apart. Giving them distinct ids made that visible as DUPLICATE edges — each call resolving to BOTH — which is worse than the collapse it replaced. `(statement_block) @scope.block` supplies the missing environment record. The other half of the ECMAScript rule was already implemented and waiting: `tsBindingScopeFor` hoists `var` past blocks to the enclosing Function/Module while `let`/`const` bind innermost, and its docblock already claimed "the innermost default covers these" for block scopes that did not exist. All 82 scope-resolution test files pass with blocks on. Verified by probe, per case: two locals in different functions, a local inside an ANONYMOUS function (`outer.fn@1:9.save@2:4`), sibling blocks resolving to their own binding, `var` still hoisting out of its block, a nested named `function` vs a file-level one, PHP composing with the `$` sigil from #2693, and Python. Top-level/method ids unchanged, asserted directly. Every assertion is on the EDGE, not on node existence. Ids are built twice and independently — definition phase and caller attribution — and a one-character disagreement makes the caller attach to a node that does not exist and the edge vanish, with nothing thrown and no test failing. An edge assertion can only pass if both phases agree. INVALIDATION. INCREMENTAL_SCHEMA_VERSION 17 -> 18 and SCHEMA_BUMP 24 -> 25: persisted node ids change for every function-local callable, and the cached scope tree lacks block scopes. A top-up would leave unchanged files on the old ids while changed files emit the new ones, splitting each symbol in two. Bench fingerprint unchanged and both timing budgets pass. The one full-suite failure (incremental-orchestration) passes in isolation — its log shows stale init locks and WAL reclaim, i.e. LadybugDB contention under the parallel run. Refs #2699 * perf(ingestion): emit block scopes only where they bind something (#2699) Block scopes make `let`/`const` in sibling blocks distinct bindings, which is what stopped a call in one branch resolving to both. Emitted naively — one scope per `statement_block` — they also cost ~10% of analyze wall time, because every scope-chain walk in every function then steps through levels that bind nothing. Two emit-side filters keep the semantics and drop the waste: 1. A block that IS a function body duplicates the enclosing Function scope. Nothing can be declared between a function and its own body, so a binding in either resolves identically — the inner scope is pure depth. 2. A block that declares no `let`/`const`/`class`/`function` binds nothing, so it is transparent: a lookup finds nothing in it and walks to the parent. `var` is deliberately excluded from that list — it hoists past the block to the function, so a block containing only `var` still binds nothing. MEASURED, on a 762-file / 228k-line TypeScript corpus (gitnexus/src), min of 6 warmed reps with the cold first rep discarded: block scopes emitted 19,389 -> 5,331 (-72%) total scopes 35,942 -> 21,884 (-39%) analyze wall time +9.8% -> +1.6-2.5% vs pre-#2699 peak RSS (whole tree) 2398MB -> 2434MB (+1.5%, inside run-to-run noise) The filters themselves are free: scope emission over the same corpus measured 12.6s naive vs 12.5s filtered. Wall-clock on a shared runner has a ±10% spread run to run, which is wider than the effect being optimised, so the durable gate added here counts scopes instead. `bench/scope-emission/measure.mjs --check` asserts an EXACT scope set over a synthetic corpus that mixes the shapes the filters discriminate between — function/method/arrow bodies, non-declaring if/else/for/while/try, blocks that declare `const`, and a `var`-only block. Baseline is 2 block scopes per module: only the two `if`/`else` branches that declare `const chosen`. If the filters regress that number jumps immediately, in a way wall-clock CI could never resolve from noise. Wired into the existing benchmarks job. Behaviour is unchanged: 86 scope-resolution and identity test files, 1371 tests, all green — including the sibling-block case this could plausibly have broken — and the callable-value-flow fingerprint is untouched. Refs #2699 * test(bench): re-baseline the TS/JS scope-capture fingerprints for #2701 `bench/scope-capture` fingerprints the full capture set per language, and #2701 added a `@receiver-owner.this` marker to every non-arrow function form so a scope that BINDS its own `this` can terminate the receiver walk. That is a capture-set change, so the TypeScript and JavaScript fingerprints moved and the benchmarks job has been failing since that commit — I pushed it without checking CI. A fingerprint is a correctness gate, so this does not simply adopt the new value. Verified first by diffing the capture-name HISTOGRAM over the same fixture corpus against 1d308817 (the commit before #2701), which says what a fingerprint cannot: WHICH names moved. typescript @receiver-owner.this 0 -> 143 javascript @receiver-owner.this 0 -> 32 Nothing else. Every other capture count is byte-identical, so no existing capture shifted and the drift is entirely the intended marker. Both languages' scaling ratios stay well inside their 1.5 budgets (0.976 / 1.025). Note `@scope.block` does not appear in the delta: the #2699 filters suppress a block that is a function body or that declares no binding, and no fixture in this corpus has a block that binds. Block-scope emission is guarded separately by `bench/scope-emission`, whose synthetic corpus exercises exactly those shapes. Refs #2701 * fix(ingestion): stop the callable-prefix walk at class bodies, not only declarations (#2699) An anonymous class owns its members, but `CLASS_CONTAINER_TYPES` lists only class DECLARATION nodes — and a Java anonymous class has none. It is object_creation_expression > class_body > method_declaration so `enclosingCallablePrefix` sailed straight through the anonymous body, reached the enclosing method, and re-keyed the member as a function-local of that method: Method:src/Worker.java:Worker$1.run#0 -> Method:src/Worker.java:Worker.makeHandler.run@7:12#0 That destroys the javac-compatible JLS identity #2550/#2555/#2562 exist to provide, and broke four existing Java tests that this PR never touched — anonymous-class instance identity, local-type identity, and enum-constant-body chaining. The design was right; the boundary was blind. `CALLABLE_PREFIX_BOUNDARY_TYPES` adds the body and anonymous-construction forms (`class_body`, `interface_body`, `annotation_type_body`, `enum_body`, `enum_body_declarations`, `enum_constant`, `object_creation_expression`, `object_literal`, `anonymous_object_creation_expression`). Over-inclusion is the SAFE direction here: an extra boundary only suppresses the nesting prefix, falling back to the pre-#2699 class qualification. This also falsifies the claim in the #2699 commit that "top-level functions and class methods keep their ids byte-for-byte" — an anonymous-class method IS a class method, and its id did change. The claim was true only for the shapes that were tested. Also removes the dead `NO_QUALIFIED_NAME` constant, which contained a literal NUL byte. That byte made `file(1)` report the source as `data` and made plain `grep` return zero matches for ANY pattern in the whole 2,928-line file — which is why several greps during development came back mysteriously empty. Two other files carry NULs; they are pre-existing and out of scope here. INVALIDATION. INCREMENTAL_SCHEMA_VERSION 18 -> 19 and SCHEMA_BUMP 25 -> 26. This is not defensive: an index stamped v18 holds the WRONG Java ids, and without the bump it passes the `=== INCREMENTAL_SCHEMA_VERSION` reuse gate and keeps them on every unchanged file. Found by the PR #2695 tri-review (review 4782134453) — independently by a Claude adversarial AST probe, by Codex's swarm, and by CI (`tests / ubuntu / coverage 2/3`). Verified: `resolvers/java.test.ts` 247/247 (was 243/247), plus this-boundary, function-local-identity and the schema-version suites. Refs #2699 * fix(scope-resolution): fail closed when a function-local shadows a same-named callable (#2699) The #2699 positional join failed OPEN. On a position miss `resolveDefGraphId` fell through to the label-agnostic, first-write-wins `simpleKey(filePath, simpleName)`, which aliases a def onto whichever same-named callable was registered first — the exact fabricated-caller mechanism this PR's own #2693 work already shipped once as a P0. It misses because the two id phases anchor on different nodes BY DESIGN: `tree-sitter-queries.ts` anchors the graph node on the outer `lexical_declaration`, while `languages/typescript/query.ts` anchors the scope def on the inner `arrow_function` so `anchor.range` lines up with `@scope.function` for auto-hoist. Split the declaration across lines and those land on different LINES: export function run() { const pick = (x) => x * 2; return pick(1); } export function other() { const pick = (x) => x * 3; return pick(2); } before: run -> run.pick@1:2 correct other -> other.pick@6:2 correct other -> run.pick@1:2 FABRICATED — other() never calls run's pick Every fixture in function-local-identity.test.ts kept the declaration and its initializer on ONE line, where the anchors coincide. That is why the suite stayed green while the bug shipped, and the new test deliberately splits them. WHY NOT A BLANKET FAIL-CLOSED. A position miss is not always a collision: it also happens where the anchors legitimately differ, e.g. a Vue SFC, whose graph nodes carry `+ lineOffset` while scope extraction does not. Failing closed on every miss would delete correct edges there. So the guard is keyed on evidence that the collision is REAL — `localNameKey` records that a function-local of this simple name exists in the file (local-identity nodes are recognisable by the `@<row>:<col>` on their last name segment). Only then is a miss treated as ambiguity. Files with no such local keep their previous fallback behaviour byte-for-byte. A missing edge is the correct failure direction here: `impact` can recover from an absent caller, but a fabricated one silently corrupts the answer. WHY NOT UNIFY THE ANCHORS. Considered and rejected: the split is deliberate and load-bearing for auto-hoist across every language (the `rangesEqual(anchor.range, innermost.range)` rule), so unifying it would fight that discipline far outside this fix. The regression test was verified to DISCRIMINATE: with the guard disabled it fails on exactly the fabricated edge (`+ "Function:m.ts:other -> Function:m.ts:run.pick@1:2"`). impact(resolveDefGraphId, upstream) is CRITICAL — 62 impacted, 23 direct, 6 flows — which is precisely why the guard is gated rather than broad. detect_changes: HIGH, 8 affected processes, all in EmitReceiverBoundCalls / EmitRubyMixinEdges. Verified: 85 test files / 1364 tests green, including every scope-resolution unit. Found by the PR #2695 tri-review (review 4782134453): raised by Codex's adversarial leg, mechanism source-confirmed during synthesis, then reproduced end-to-end. Refs #2699 * fix(typescript): stop the enclosing-type walk at nodes that rebind `this` (#2701) `findEnclosingType` walked `node.parent` to the top of the file with no boundary, so it happily synthesized a `this` binding from a type that does not own the member: class A { outer() { const o = { inner() { return this.x; } }; return o; } } `this` inside `o.inner` is `o`, never `A` — but the walk reached `A` and bound to it, so every `this.…` in such a method resolved against the wrong type. Only the module-level object literal escaped, because there was no enclosing class to reach. Applies to JavaScript too: `languages/javascript/captures.ts` calls the same function. Boundary set: object literals and the function forms that rebind `this` at call time. Arrows are deliberately absent — they inherit `this` lexically, which is what makes a class-field arrow `m = () => this.x` resolve. WHY THE MARKER WAS NOT ALSO REMOVED FROM METHOD FORMS. The review argued `@receiver-owner.this` over-suppresses: `synthesizeTsReceiverBinding` returns null for static members, object-literal methods and anonymous class expressions, so those scopes are "owned but unbound" and get suppressed, losing edges the base resolved. Removing the marker from the method forms was tried and MEASURED, and the result does not support shipping it: marker removed, probe of all five shapes: static -> static RESTORED (true) object literal (module) RESTORED (true) anonymous class expression RESTORED (true) static -> INSTANCE FALSE EDGE returned object literal in a class FALSE EDGE (Nested.outer.inner -> Nested.x) The last one is the point: this fix stops the false *synthesis*, but removing the marker re-enables receiver-blind *name* resolution in `lookupCore`'s lexical chain, which recreates the same wrong edge by another route. The restored edges and the false ones come from the SAME mechanism — a name walk — so they cannot be separated by toggling the marker. The real trade is 2 genuinely-new true edges for 2 false ones, not the 3-for-1 the plan assumed. Corpus evidence (762 real TypeScript files, edge SETS not counts, cold cache both arms): baseline vs marker-removed: net 0, REMOVED 0, ADDED 0 Neither the gains nor the losses occur in production code. Given a 1:1 true/false ratio on synthetic shapes and zero effect on real ones, the marker stays: for a graph feeding `impact`, a fabricated caller is worse than an absent one — the same principle applied in the fail-closed positional join. The three shapes remain UNRESOLVED rather than wrongly resolved; resolving them properly needs a typed binding for object literals, anonymous classes and static contexts, which is a feature, not this fix. Measured with an edge-SET diff harness, after both ce-doc-review passes established that an edge COUNT cannot decide this (it conflates edges gained with edges lost, so a near-zero net reads as "no regression"). The harness also had to wipe the index each arm — a warm parse cache initially reported an unchanged edge set across a real behavioural change, the same trap documented in the v24 SCHEMA_BUMP note. detect_changes: low risk, 3 symbols, no affected processes. 85 files / 1365 tests green. Refs #2701 * docs(test): correct the false "three load-bearing gates" claim (#2701) The header of `this-boundary.test.ts` asserted that all three gates were independently load-bearing because "the false edge survived removing any one of them alone". That was true DURING development, measured incrementally, and was carried into the shipped comment without being re-tested against the finished code. It is false: gate 3 (`isReceiverOwnedButUnbound` in `receiver-bound-calls`) runs FIRST and marks the site in `handledSites`, which `emitReferencesViaLookup` then skips — so for an explicit `this` receiver it subsumes gate 1. Removing gate 1's `ownsReceivers` check in `gitnexus-shared/.../lookup-core.ts` leaves all 10 tests in the file passing; verified by experiment. The gate is RETAINED, and the review's recommendation to delete it as "dead" is rejected on evidence. `receiver-bound-calls` only suppresses EXPLICIT receivers (`if (site.explicitReceiver === undefined) continue;`), whereas `lookup-core`'s gate is also reached for IMPLICIT ones through `IMPLICIT_RECEIVERS` in `resolveReceiverOwner` — a bare `m()` inside a nested `function` inside a method goes down that path. The experiment shows the gate is UNTESTED, not unreachable; those are different claims and only the first is supported. Deleting it on the strength of a green test run would have removed live code, which is the same reasoning error the corrected comment is about. This is a documentation-only change: no behaviour, no test expectations. The correction is recorded in place rather than silently rewritten, because the way the claim came to be wrong — measured on an intermediate tree, then asserted about the final one — is the reusable lesson. Refs #2701 * test(scope-resolution): pin the block-scope ACCESSES delta as false-edge removal (#2699) The tri-review flagged that enabling `(statement_block) @scope.block` for JS/TS drops 114 `ACCESSES -> Const` edges corpus-wide with `added: 0`, undocumented and untested. That was recorded as a suspected regression. It is not one. All 274 emitting reference sites behind those 114 edges were classified by re-reading the source at the site: 269 are member reads, the 5 others are classifier artifacts (the name recurs earlier on the line, as in `a.b.declLine` for `b`) and are member reads too. No edge was bare-identifier-only. Every dropped edge was a property read (`options.baseUrl`) mis-resolving to an unrelated function-local `const` of the same name in the same file. The cause is not block-specific: `lookupCore` Step 1 walks the lexical chain for every lookup, including explicit-receiver property reads. Block scopes do not fix that, they narrow it, by moving the local off the chain of any reference outside its block. A local declared directly in the function body still hijacks the read; that is pre-existing and left alone here. Two tests. The first discriminates: it fails with the block capture removed (the false edge reappears) and passes with it. The second is a companion invariant, identical in both arms, so that "the edge went away" cannot be satisfied by a change that dropped Block-kind bindings outright. Fixture notes, both of which defeated earlier attempts at this edge class: `pruneLocalSymbols` deletes ~94% of function-local value symbols, so the `const` under test must be kept via `keepLocalValueSymbols`; and the member read must sit outside the block, since inside it the block is on the reference's own chain and the false edge appears in both arms. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * docs(ingestion): correct the SCIP citation on the function-local id (#2699) The comment justified the positional, name-bearing local id (`fn@12:9`) as "same reasoning as SCIP's document-scoped `local <id>` keyspace". SCIP is the wrong citation for this key shape: its `local <id>` is a per-document counter, and the spec states that locals do not encode the name. SCIP remains prior art for the document-scoped keyspace itself, which is the part the argument actually leans on, so the reference is corrected rather than dropped. clang's USR for a function-local (`name@offset`) and Kythe's C++ indexer are the accurate citations for a positional, name-bearing key. Comment only, no behavior change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(typescript,javascript): sync the function node-type lists, and test it (#2701) Four hand-maintained lists answer "which node types are function-like": 1. `query.ts` — the `@scope.function` / `@receiver-owner.this` patterns 2. `captures.ts` — `FUNCTION_NODE_TYPES` (callable-flow synthesis + the body-block filter) 3. `receiver-binding.ts` — `THIS_REBINDING_BOUNDARY_TYPES` 4. `type-extractors/typescript.ts` — `THIS_BOUNDARY_NODE_TYPES`, whose docstring already claimed it was "kept in sync with `@receiver-owner.this`" with nothing enforcing it `generator_function` (the EXPRESSION form, `const g = function* () {}`) was added to both queries for #2701 and is present in lists 3 and 4, but was missing from both `FUNCTION_NODE_TYPES`. Added. That gap changes no graph output today, and the commit does not claim otherwise. Measured on `const g = function* (x) { yield x; }; g(1)`: node and edge sets are byte-identical with and without the entry. The `this` boundary was already correct via the query marker — `this-boundary.test.ts` has a passing generator case. A generator-expression binding still emits a `Const` node rather than a `Function` one, so its call resolves to nothing either way; that label comes from the definition rules, and closing it is a separate change NOT made here. So the entry is list consistency and the test is the real deliverable. It asserts lists 1 and 2 EQUAL, and lists 3 and 4 as subsets of the query markers with an explicit allowlist — the method forms bind their own `this` but the class is their `this`-owner, so neither walk may stop there. Verified discriminating: removing the `generator_function` entry fails both equality assertions. The lists are exported for the test; no other production surface changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * test(bench): gate scope emission per language, not TypeScript-only (#2699) The scope-emission gate ran the TypeScript emitter only, so a JavaScript-only regression shipped green. The two filters it guards are implemented twice — `FUNCTION_BODY_OWNER_TYPES` in `typescript/captures.ts` and `JS_FUNCTION_BODY_OWNER_TYPES` in `javascript/captures.ts`, each with its own `blockDeclaresBinding` and `BLOCK_BINDING_CHILD_TYPES` — so covering one said nothing about the other. Adds a structurally parallel JavaScript corpus (the same shapes with the TS-only syntax removed) and splits `baselines.json` per language. `--check` now also fails when a baselined language is not measured, which is how a gate goes quietly green. Verified the new arm bites: disabling the JS body-block filter alone takes JavaScript from 400 to 600 block scopes and fails `--check`, while TypeScript stays green — the exact regression the old gate would have passed. The two languages happen to agree exactly on this corpus (2 blocks per module, 2200 scopes). That is recorded as a measured result, not an invariant: each language is still gated against its own baseline. TypeScript's numbers are unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR --------- Co-authored-by: Gergo Magyar <abhigyan1.patwari@gmail.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 07:52:18 +01:00
Copilot	d3d4fa31bb	fix(scope-resolution): gate C#/Kotlin free calls by instance ownership (#2563) (#2654) ... * Initial plan * fix(scope-resolution): gate C# and Kotlin free calls * fix(scope-resolution): keep Kotlin ownership gate safe * Apply remaining changes * perf(scope-resolution): benchmark and cache ownership gates * test(scope-resolution): simplify benchmark scaling loop * refactor(scope-resolution): encapsulate ownership cache * test(scope-resolution): enforce subquadratic ownership scaling * fix(scope-resolution): address ownership review findings * test(csharp): regenerate capture golden for #2563 fixtures The committed expected-captures.json was missing the new NamespaceOwnerCollision.cs entry and carried a stale SameFileCases.cs digest/count (56 → 67), so csharp-captures-golden.test.ts was the sole red check on the PR. Regenerate with UPDATE_GOLDEN=1 to match the fixtures the bench fingerprint already reflects. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-24 13:31:56 +01:00
MyShining	4af6fe8587	feat(spring): resolve constructor and standard injection (#2632)	2026-07-24 08:25:38 +01:00
Gergő Magyar	1abcac9c16	fix(scope-resolution): stop platform builtins resolving to unrelated same-file symbols (#2549) ... * fix(scope-resolution): stop platform builtins resolving to unrelated same-file symbols (#2545) An unqualified call to a platform/language builtin (e.g. TypeScript's global fetch()) could resolve to an unrelated same-file declaration sharing that name, most visibly a Cloudflare Worker's `export default { async fetch(req) {...} }` handler. Two contributing gaps, both fixed: - Object literals had no scope boundary in the TS/JS grammar queries, so a method's/property-arrow's name auto-hoisted past the literal into whatever lexically enclosed it (scope-extractor.ts's auto-hoist logic had nowhere to stop). Give object literals a Block scope, like 6 other languages already do for lexical blocks. - Independently, finalize's per-file bindings bucket (materializeBindings in gitnexus-shared) flattens every local declaration in a file onto its module scope for cross-file import resolution, regardless of true nesting -- so free-call-fallback's scope-chain walk could still hit the leaked binding at module scope. Guard free-call resolution: when a match for a known builtin name (LanguageProvider.isBuiltInName, already populated for TS/JS but never consulted by this pass) has no binding reachable via the true lexical scope chain, leave the call unresolved instead of emitting a false CALLS edge. Verified against the full TS/JS resolver suites plus every other language populating builtInNames (Python, Go, C/C++, C#, Dart, Kotlin, PHP, Ruby, Rust, Swift, Vue) -- 2333 tests, no regressions. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(scope-resolution): extend the #2545 scope-leak fix to Kotlin and Java Anonymous object-expressions (Kotlin `object { ... }`) and anonymous class bodies (Java `new Runnable() { ... }`) have the same missing scope-boundary gap that caused #2545 in TypeScript/JavaScript: a method declared inside has no scope of its own to stop the auto-hoist at, so its name leaks past the container into the enclosing scope. - Kotlin: `(object_literal) @scope.class` (distinct from the already- scoped named `object_declaration`/`companion_object`). Kotlin already populates `builtInNames`, so free-call-fallback's isBuiltInName guard (added for #2545) fully closes the equivalent leak here too -- verified with a `println`-shadowing regression test. - Java: `(object_creation_expression (class_body) @scope.class)`, matching PHP's existing `anonymous_class` handling. Java has no `builtInNames` list, so the isBuiltInName guard doesn't engage -- the scope-tree fix is still correct and necessary (the anonymous class's own methods are now owned by the right scope), but an unqualified call to an unrelated same-file method sharing the anonymous class's method name can still resolve via finalize's per-file module-scope bucket (materializeBindings, shared/ language-agnostic, intentionally not touched by this PR). Documented in the test as a known residual gap, same as TS/JS/Kotlin's own non-builtin-name collisions. Audited every other language for the same shape (a value/container node with no @scope.* capture hosting a would-be-auto-hoisted named declaration): PHP and Vue already handle it correctly (PHP scopes anonymous_class; Vue's <script> delegates to the now-fixed TS/JS query). Ruby, Python, Dart, C#, Swift, Go, Rust, and C/C++ have no query pattern that treats a literal/container value position as a named declaration in the first place, so the bug shape can't occur there. Verified: full Kotlin + Java resolver suites, 468 tests, no regressions. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(scope-resolution): dedicated Object scope kind for object literals (#2545, #2551) Review of the #2545 fix surfaced two defects, both fixed here: 1. The isBuiltInName guard suppressed genuine cross-file imports whose name matches a builtin (`import { fetch } from './fetch-polyfill'` silently stopped resolving -- verified regression vs. main). The leak the guard targets is inherently same-file (finalize's flat bucket is per-file), so the guard now also requires `fnDef.filePath === parsed.filePath`. New regression test covers the polyfill-import shape. 2. The sibling-property case of the reported bug was still broken and masked by a tautological assertion (`c.reason` -- a property that doesn't exist; the real path is `c.rel.reason` -- so the test passed regardless of behavior). In `export default { fetch() {...}, handler: () => fetch(...) }`, `handler`'s bare `fetch()` still resolved to its sibling. Reusing the `Block` scope kind was the root cause: correct for a real lexical block (a nested closure legitimately sees a sibling `let`/`const` from an enclosing `if`/`for`), wrong for object literals, whose members are reachable only via property access -- never as bare identifiers, not even by sibling property bodies. Fix: a dedicated `Object` ScopeKind (gitnexus-shared) -- a hoist boundary whose own bindings scope-chain walkers never consult while still traversing past it to the parent. TS/JS object literals now emit `@scope.object`; the four chain walkers in scope-resolution/scope/walkers.ts (walkScopeChain, findAllCallableBindingsInScope, findCallableBindingsAndAdlBlocker, findExportedDefByName) and free-call-fallback's hasGenuineLexicalBinding skip Object scopes' bindings. Kotlin's anonymous `object {}` keeps `@scope.class` -- unlike JS object literals it has real implicit-this sibling dispatch. Verified with the full resolver matrix run sequentially (TS 254, JS/ Kotlin/Java/Python/Go + TS variants 960, C/C++/C#/Dart/PHP/Ruby 1049, Rust/Swift/Vue/Cobol + route/flow/unit suites 828, scope-extractor/ scope-tree units 51). Worker-pool crashes under parallel suite load reproduced on unrelated files and pass in isolation (known flake, not caused by this change). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * feat(java): model anonymous class bodies as first-class Class nodes (#2550, step 1) `new Runnable() { public void run() {} }` now emits a synthesized javac-style `Class` node (`Worker$1`, `$N` = source order within the top-level class) and owns its methods: the enclosing-owner walk attributes `run` to `Worker$1` (re-keyed `Method:...:Worker$1.run#0`, HAS_METHOD from the anonymous class) instead of the lexically enclosing named class. - `synthesizeJavaAnonymousClassName` (ast-helpers): single naming authority for every layer that keys the anonymous class; returns undefined for `object_creation_expression` without a `class_body` child, which also keeps it a no-op for C#'s same-named node type. - `findEnclosingClassInfo`: anonymous-body branch before the generic container walk. - JAVA_QUERIES: `(object_creation_expression (class_body)) @definition.class` (no @name); `getLabelFromCaptures` now lets a nameless `definition.class` through — the parse-worker's existing `!nameNode && !extractedClassSymbol` gate still drops any nameless class the extractor cannot name, so other languages are unaffected. - `javaClassConfig.extractName` synthesizes the name on the extractor path (worker node emission). - Node identities move on unchanged files: INCREMENTAL_SCHEMA_VERSION 7→8 and parse-cache SCHEMA_BUMP 17→18 (the v5 Route-identity precedent) force full re-analyze / cache invalidation. Verified: new #2550 identity tests + resolve-enclosing-owner and has-method suites (53 tests) green. Prep for step 2/3 (scope-side ownership + receiver typeBinding) and the free-call instance-ownership gate per docs/plans/2026-07-18-gitnexus-plan-java-instance-scoped-freecalls.md (plan file is local — docs/ is gitignored by repo policy). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(java): instance-scoped free-call resolution for anonymous-class methods (#2550, steps 2-4) Completes the #2550 instance model on top of the Worker$N identity commit: - Scope-side ownership (java/captures.ts): synthesize `@declaration.class` + `@declaration.name` (`Worker$N`) anchored on the anonymous `class_body` — same range as its `@scope.class`, so the def lands in that Class scope's ownedDefs, `populateClassOwnedMembers` stamps `ownerId` on the anonymous class's methods, and the name auto-hoists exactly like a named class declaration. - Receiver typeBinding (java/captures.ts + type-extractors/jvm.ts): `Runnable handler = new Runnable() { ... }` binds `handler` to the ANONYMOUS class (`Worker$1`), not the declared JDK interface — in both the scope-side TypeRef channel (receiver-bound Case 4) and the worker typeEnv. `handler.run()` now resolves through the receiver path (reason 'global', target `Worker$1.run#0`) instead of depending on the free-call finalize-bucket leak — which is why the prior gate attempt broke it (the #2550 landmine, now explained and structurally removed). - Instance-ownership gate (free-call-fallback.ts + contract + run.ts + java opt-in): with `ScopeResolver.freeCallsRequireInstanceOwnership`, a free call may resolve to a `Method` only when the caller's enclosing class chain (self + MRO via `scopes.methodDispatch.mroFor`) contains the method's owner. Same-file matches only — the `materializeBindings` leak is per-file; cross-file Method matches come through genuine import channels (suppressing them broke the arity-narrowing parity suite, verified). Suppressions recorded as `'free-call-instance-ownership'` outcomes. Java opts in; every other language is byte-identical (flag off). Result on the #2545 fixture: `process()`'s bare `run()` emits NO edge to the unrelated anonymous method (the #2550 bug, closed), while `handler.run()`, same-class implicit-this dispatch, and bare inherited calls (MRO arm) all keep resolving. Verified: full java.test.ts 223/223 twice sequentially (landmine gate); cross-language matrix (TS/JS/Kotlin/Python/Go/C/C++/C#/Dart/PHP/Ruby/ Rust/Swift/Vue/Cobol + callable-value-flow + java-class-impact + core units) — zero assertion failures; worker-crash flakes re-verified green in single-file isolation. Known deferral (documented): EXTENDS/IMPLEMENTS edges from the anonymous class to its constructed type are not yet emitted, so a same-file inherited-but-not-overridden member called ON the anonymous instance does not resolve through the anon MRO; tracked as the follow-up in #2550. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(java): anonymous-class inheritance, host coverage, and phantom-node guard (#2550 review) Self-review of the instance model (gitnexus-review with empirical lens probes) surfaced three defects, all fixed: 1. HIGH — the ownership gate suppressed TRUE bare calls to inherited methods inside an anonymous body extending a same-file class (`new Base() { void extra() { work(); } }` lost `extra -> work`): the anon class had no inheritance edge, so `mroFor(Worker$N)` was empty and the MRO arm could never pass. The synthesis now emits an `@reference.inherits` for the constructed type, anchored on the `class_body` so the reference's enclosing class resolves to the SYNTHESIZED def (anchoring on the type node would sit outside the anonymous scope and attribute the edge to the wrong class). Anon classes now get real EXTENDS/IMPLEMENTS edges and inherited bare calls pass the gate. 2. MEDIUM — hostless anonymous bodies materialized a phantom Class node named after the CONSTRUCTED type (`Class:...:Runnable`) via extract()'s extractTypeNameFromNode fallback. New `shouldSkipClassCapture` in javaClassConfig drops the capture when no name can be synthesized. 3. MEDIUM — enum/interface/record-hosted anonymous bodies silently fell back to the pre-#2550 model (mis-attribution + open leak). The topmost-host walk now accepts all four host type declarations (JAVA_ANON_HOST_TYPES), so `EnumHost$1` etc. are modeled; the phantom-node shape disappears for those hosts as a side effect. Also: per-parse-tree WeakMap memo for the `$N` numbering — the helper is called from four independent layers per anonymous body and each call re-scanned the host subtree (`descendantsOfType`), quadratic on anon-heavy files (old-style listener-per-widget Java); and the scope-capture bench fingerprints rebaselined for java/typescript/ javascript/kotlin (`measure.mjs --check` now passes all 14 languages — it failed for every scope query this PR touched; drift notes added per the file's convention). Verified: full java.test.ts 225/225; all 11 #2550 tests including the new anon-extends-base and enum-host scenarios; bench --check PASS. Known remaining (documented, unchanged-old behavior): enum CONSTANT bodies (`A { ... }`) stay unmodeled; nested-host naming is top-level- anchored (`EnumWrap$1`, not javac's `EnumWrap$Mode$1`). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * test(storage): update the INCREMENTAL_SCHEMA_VERSION pin to v8 (#2550) The U-C5 reuse-gate test deliberately pins the exact schema version so a bump cannot land without consciously extending the gate expectations. Extend for v8 (Java anonymous-class node identities, #2550): a v7 stamp now fails the strict-equality reuse gate — a pre-v8 index would strand old `Worker.run`-keyed Method nodes alongside the re-keyed `Worker$N.run` ones on unchanged files — and v8 passes. Caught by CI (tests/ubuntu coverage shard 2/3 on PR #2549); the local matrix had not included this unit file. All 7 schema-referencing unit suites verified green (109 tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-18 14:30:37 +01:00
Gergő Magyar	ed8ab1c246	fix(scope-resolution): resolve callable reference flows (#2437) (#2522) ... * docs(plans): add provider-hook value-refs plan (#2437) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(plans): deepen #2437 plan to USES + property-dispatch design Design revised after prior-art research (Kythe ref vs ref/call, Joern METHOD_REF, Feldthaus field-based call graphs, CodeQL impliedReceiverStep): registration sites emit reference-class USES, invocation is recovered by a field-based property-dispatch pass synthesizing CALLS at member-call sites. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(scope-resolution): model provider-hook value references (#2437) Functions referenced as object-literal property values (provider hooks like emitScopeCaptures: emitCppScopeCaptures) previously produced no edge at all, so impact/context reported a false-safe 0 upstream dependents. Two coordinated halves, per prior art (Kythe ref vs ref/call, Joern METHOD_REF, Feldthaus ICSE'13 field-based call graphs, CodeQL impliedReceiverStep): - Registration -> USES: new ReferenceKind 'value-ref'; TS/JS queries capture pair values and shorthand properties (with @reference.property-key); emitted as a reference-class USES edge, reason 'scope-resolution: value-ref'. Resolution is callable-gated so plain values emit nothing. - Dispatch -> CALLS: new shared pass emitPropertyDispatchCalls synthesizes CALLS (reason 'property-dispatch', confidence 0.7, per-key fan-out cap 32 calibrated on this repo's 16-provider hook tables) from member-call sites to every function registered under the same property key. Deviation from plan: the pass owns value-ref resolution entirely via the post-finalize findCallableBindingInScope walker — the shared registries only see pre-finalize local bindings, so imported hooks (the c-cpp.ts case) were unresolvable through lookupForSite; Reference.propertyKey passthrough dropped as unnecessary. SCHEMA_BUMP 13 -> 14: ParsedFile gains value-ref sites + propertyKey. Verified end-to-end: impact(emitCppScopeCaptures, upstream) now reports 8 impacted / HIGH with extractParsedFile (true dispatch caller) at d=1 via property-dispatch and the c-cpp.ts registration via USES. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(scope-resolution): cover value-ref registration and property dispatch (#2437) Integration: same-file/cross-file/aliased/shorthand registrations emit USES; non-callable and destructuring values emit nothing; dispatch sites gain property-dispatch CALLS (incl. JS twins and per-language partitioning); fan-out-capped keys are dropped entirely; factory-call values unchanged. Unit: capture-shape pins for @reference.value-ref + @reference.property-key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): surface dropped property-dispatch keys in stats (#2437) Review finding: skippedKeys was returned but discarded — a hook table larger than the fan-out cap silently reopened the #2437 gap for those keys. Log dropped keys and fold value-ref USES + dispatch CALLS into referenceEdgesEmitted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(plans): add callable reference-flow implementation plan * fix(scope-resolution): close property-dispatch review gaps * feat(scope-resolution): add callable flow facts * feat(scope-resolution): resolve callable value flow * feat(scope-resolution): resolve callable references across providers * fix: harden callable reference flow resolution * fix(scope-resolution): preserve callable binding semantics * docs(plans): add pr-2522-review-fixes plan Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(storage): bump INCREMENTAL_SCHEMA_VERSION for callable-value-flow edges Callable-value-flow CALLS/USES edges (#2437) can connect two files whose content did not change, but the incremental write set only covers changed files — a top-up against a pre-v7 index would silently omit the new edges for every unchanged file pair, indefinitely. Force the one-time full re-analyze (review finding 1, #2522). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(storage): sanitize callable-flow sites per-site at load, log drops The load-time validator rejected the WHOLE ParsedFile when one site was malformed or over-bound, with no logging — and C++ legitimately emits empty-string parameterTypes entries ('' = unknown, the ReferenceSite.argumentTypes convention) for cv-only/ERROR-recovered types, so real repos fell into a permanent, silent warm-cache-miss reparse loop through the #1983-sensitive main-thread path (review finding 7, #2522). Now: '' entries are valid in type arrays; a malformed/over-bound site drops only itself (counted, warned once per load); only non-array garbage — evidence the serialization itself is untrustworthy — rejects the file. Deviation from plan §6 wording: validator-side tolerance replaces emit-side clamps — smaller diff, same asymmetry closed at the single chokepoint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): keep declarations in the union for reassigned callable cells The binding-lookup suppression for fact-constrained cells was wholesale: reassigning a declared function through its own name (greet = other; greet()) deferred the call to the solver, which then refused the lexical lookup that resolves the declaration — an unresolvable RHS yielded zero CALLS for a call that resolved pre-flow (review finding 8, #2522). Suppression now applies only to cells bound by FORMAL facts — its actual purpose (a parameter whose grammar emits no declaration binding must not adopt a same-named outer function). Copy/alias/store/load destinations keep their declaration as an inclusion seed (Andersen-style union). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): count forfeited deferred sites in the budget-bailout warning On work-budget exhaustion the deferred invoke sites end the run with zero CALLS — free-call fallback and reference emission already skipped them — but the warning said 'ordinary graph emission remains untouched', which is false for exactly those sites. The warning context now carries the unresolved deferred-site count and the comment states the real cost (review finding: budget-bailout honesty, #2522). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(scope-resolution): surface dropped property-dispatch keys in stats and warn payload The over-cap warning carried only a count; the dropped key NAMES were discarded and RunScopeResolutionStats had no field, so the PR-body claim 'includes them in resolver statistics' was unimplemented (review finding, #2522; reviewer ask on the fan-out cap). The warn payload now names up to 20 dropped keys and the stats carry propertyDispatchSkippedKeys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(scope-resolution): drop producer-less ownerQualifiedName from formal sites No capture emitter anywhere produces @callable-flow.owner-qualified-name — the solver branch consuming it was unreachable in production, yet the field was typed, parsed, validated, and unit-tested with hand-built input (review finding 16, #2522; YAGNI). Re-add with a real producer if C++ qualified member declarators ever need it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(scope-resolution): drop dead callable-flow knobs CallableFlowPassingMode 'callable-object' had no producer and no consumer distinguishing it, and CallableFlowCaptureOptions.extractCallArguments had no language providing it (unlike its live sibling extractCallCallee) — review finding 17, #2522 (YAGNI). The invocation-kind 'callable-object' is a different, live concept and stays. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): bind subscripted callable cells to the container, not the index terminalIdentifier iterates children in reverse, so tbl[i] = handler seeded the INDEX variable's cell (polluting a same-named formal) and tbl[i](7) looked up the callee under i in a different scope — no join, no CALLS edge for the classic function-pointer-array dispatch (review finding 12, #2522). Subscript nodes now recurse into their container field only, in both bindingIdentifier and terminalIdentifier, across the fielded grammars (C/C++/JS/TS/Python/Go/Java). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): make cross-function file-scope callable bindings resolvable Two stacked gaps killed the canonical C callback-registration pattern (fp assigned in init(), called in run()) — the exact #2437 false-safe this PR exists to fix (review finding H1, #2522): 1. isVisibleValueBinding only consulted assignment regions and formals, so a call in a function OTHER than the assigning one emitted no invoke fact. A declared callable-typed binding is now a value binding wherever its declaration is visible (visibleCallableSignature). 2. The C scope query had no @declaration.variable pattern for function- pointer declarators — void (*fp)(int); created no scope-tree binding, so the seed (init) and invoke (run) cells canonicalized to different keys and never joined. Both bare and initialized forms now bind. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(c): detect variadic parameters via the named variadic_parameter node tree-sitter-c materializes '...' as a named variadic_parameter node; the anonymous-token checks never matched, so variadic function-pointer signatures were emitted with a wrong fixed arity and no '...' sentinel (review finding, #2522). C++ is unaffected ('...' stays an anonymous token there); the token checks remain for such grammars. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): emit invoke facts for field-stored callable member calls The C ops-vtable pattern (o->run = handler; o->run(1)) captured the store but never the call — the member path in emitCallFacts bailed for languages without protocol methods, and the value-binding index recorded the member store under the OBJECT's name ('o'), not the member's ('run') (review finding 11/M3, #2522). Member destinations now also record their terminal member name, and a member call whose name-cell has a visible store emits an indirect invoke — gated on the store so plain accessor calls (map.get) stay inert. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cpp): disambiguate (obj->*ptr)() ERROR recovery by token order tree-sitter-cpp groups the recovered '->*' two ways depending on error-recovery cost (identifier lengths): [identifier, ERROR '->*m'] or [ERROR 'obj->*', identifier]. The recovery assumed the first shape, so the second silently swapped receiver/member and dropped the call site — the committed test passed only by name luck (review finding H2, #2522). The identifier's position relative to '->*' inside the ERROR now decides roles. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cpp): class members are never file-local in hasFileLocalCallableLinkage The name-keyed file-local set is populated from every static declaration, so an in-class 'static void make();' (external linkage — in-class static means no-instance) and any member sharing a name with a static free function were over-marked, refusing legitimate cross-file declaration/definition joins (review finding 13/M2, #2522). Method and Constructor defs now bypass the name-set, per the hook's own linkage-only contract. Deviation from plan step 13: the regression is a unit-level contract pin rather than an end-to-end join test — C++ merges out-of-line member definitions onto the member node by qualified identity, so the graph shape cannot discriminate the join refusal for members. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cpp): classify parameter passing mode from the declarator chain only A whole-subtree scan for reference_declarator inverted copy vs alias: void reg(void (*cb)(int& out)) marked the by-value pointer cb as 'reference' because of the NESTED parameter's int&, making the solver back-propagate formal targets into every caller's argument cell — alias semantics for a copy (review finding 14/M5, #2522). The chain walk never descends into nested parameter lists; a reference anywhere ON the chain (int& x, void (*&cb)(int)) still aliases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ruby): bare identifiers are calls, not callable references Ruby parses a receiver-less zero-arg method call identically to a variable read, so 'action = process' — which CALLS process and stores its return — seeded action with the callable and minted a wrong CALLS edge from any dispatch through it, confirmed end-to-end (review finding 15/HIGH, #2522). New provider knob bareNamesAreCalls: a bare name that is not a provably local value binding and not an explicit reference form (method(:x), lambda/proc) emits no flow fact, on both the assignment and argument paths. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(go): pair multi-value := positionally instead of cross-wiring The shared field fallback took the FIRST LHS identifier and the LAST RHS identifier of Go's expression_list pair, cross-wiring 'a, b := f, g' and synthesizing a garbage comma-joined qualified name — the real relationships were silently dropped (review finding 16, #2522). extractAssignment may now return multiple pairs; Go pairs list entries positionally and emits nothing for a length mismatch (multi-return call RHS). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(java): drop get/test from callableProtocolMethods 'get' and 'test' collide with ubiquitous non-functional-interface APIs (Map/List/Optional/Future.get), so every ordinary container access emitted a spurious callable-object invoke fact — high-volume misleading graph facts with a cross-wiring risk on receiver-name reuse (review finding 17, #2522). Supplier.get/Predicate.test dispatch is deliberately traded away until the check can gate on the receiver's declared type. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(rust): pin the qualified-name no-degrade guard as a hard invariant Rust's scoped_identifier callable-reference capture over-includes unit enum variants and associated constants (Shape::Square seeds as if callable); they stay edge-free only because resolveSeedCandidates refuses to degrade an unresolved qualified name to a simple-name lookup (review finding 18, #2522). Capture-side type filtering would false-negative on tuple-variant constructors, so the guard IS the contract: documented as a hard invariant (Go's mis-shaped multi-value forms also rely on it) and pinned end-to-end. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(php): remove nonexistent optional_parameter node type tree-sitter-php has no 'optional_parameter' — defaults ride on simple_parameter — so the entry was dead weight the #1920 literal gate does not cover for capture-option Sets (review finding 19, #2522). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cobol): detect procedure pointers on fixed-format sources Two stacked defects made the feature a no-op on classic sequence-numbered fixed format (review finding 20/H3, #2522): 1. parseDataItemClauses' USAGE alternation knew POINTER but not PROCEDURE-POINTER/FUNCTION-POINTER, so the dataItems filter was dead. 2. The raw-line fallback scanned UNCLEANED text, where the sequence number satisfied the leading digits and the LEVEL NUMBER got captured as the pointer name. It now scans preprocessed lines and requires a letter- initial name (COBOL data names must contain a letter). 161 COBOL preprocessor/copy-expander tests stay green; free-format matrix case unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cobol): skip comment lines in SET seed/copy scans A commented-out SET (indicator-column '*'/'/' or free-format '*>') produced a live seed and a false CALLS edge from dead code (review finding 21/M1, #2522). The scan now skips indicator-column comment lines and strips inline '*>' tails before matching. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(architecture): document callable-flow-only mode and skipped-key reporting The Callable-value flow section omitted scopeResolutionEdgeMode: 'callable-flow-only' — a real emit-pipeline branch that suppresses all ordinary emission for standalone providers (review finding 22, #2522) — and predated the skipped-key names/stats surfacing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(scope-resolution): correct value-ref resolution attribution and stale pdg-gating comments The value-ref contract comment claimed MethodRegistry resolution — the mechanism is the post-finalize findCallableBindingInScope walker owned by emitPropertyDispatchCalls (resolveReferenceSites skips these sites). Three 'only under --pdg' calleeIdSink comments were falsified by the #2437 gating change (callee-id-sink.ts's header was updated; these copies were missed). Review finding 23, #2522. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(ingestion): direct unit coverage for synthesizeCallableFlowCaptures The 1,100-line shared synthesizer had no test naming it — only downstream consumers were covered (review finding 24, #2522). Pins seed/invoke/ formal/argument emission, subscript container binding, store-gated member invokes, produced-value guards, and the bareNamesAreCalls knob over a minimal options object so assertions target the synthesizer's own semantics. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(resolvers): deepen shallow-language coverage; fix Kotlin/Swift reassignment gaps it exposed Adds the COBOL SET x TO y copy-branch scenario and conditional-assignment scenarios for Kotlin, C#, Swift, and Dart (10 languages previously had one generic case each — review finding 25, #2522). The new scenarios exposed two real capture gaps, fixed here: - tree-sitter-kotlin's 'assignment' node is fieldless, so nested reassignments (chosen = ::target inside a block) produced no flow facts; Kotlin's extractAssignment now decomposes it positionally. - tree-sitter-swift fields its assignment as target:/result:, neither in the shared fallback's field lists; both added. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(infra): literal-validation gate for callable-capture option Sets The #1920 gate validates query literals and exported configs but not the module-private *_CALLABLE_CAPTURE_OPTIONS Sets consumed by the shared synthesizer — a typo'd node type silently captures nothing (PHP shipped a dead 'optional_parameter'; review finding 26, #2522). Every <key>NodeTypes Set literal is now validated against its language's grammar; name-carrying sets (callableProtocolMethods, memberPointerOperators) are deliberately outside the contract. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(storage): centralize corrupt-fixture casts into makeStoreEntry The callable-flow store tests scattered 'as unknown as' double-casts per fixture (review finding 27, #2522; standing no-as-any rule). One typed helper now owns the single controlled escape hatch for building malformed serialization-boundary payloads. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(bench): refresh capture fingerprints after review fixes python-scope: the committed baseline (8d5c3699) never matched this branch's code — CI's benchmarks arm was red on the PR head (review finding 2/HIGH, #2522); regenerated (a99e69ab), scaling 1.04 in budget. scope-capture: ruby/cpp/swift/java/kotlin drifted from the review-fix commits (bare-name suppression, passing modes + ->* recovery, assignment fields, protocol narrowing, positional assignment); all 14 languages re-verified PASS with ratios <= 1.18 against the 1.5 budget. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(docs): untrack docs/plans working documents docs/ is gitignored (local working docs); the plan files were force-added past the ignore. Untracked from the index only — they stay on disk. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(golden): regenerate captures goldens after callable-flow review fixes The per-language digest guards (csharp/go/php/python/ruby/rust/swift) locked the pre-fix capture output; the review-fix series intentionally changed it — store-gated member invokes, subscript container binding, Ruby bare-name suppression, Swift assignment fields, positional pairing. Regenerated with UPDATE_GOLDEN=1; clean verification run 59/59; all other parity/golden guards (pipeline-graph, spring-route, python parity) pass untouched at 33/33. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): prototypes are callees, not callable value cells The cross-function visibility fix indexed EVERY signature-bearing declaration as a value binding — including plain function/method prototypes (void f(int);). Every call to a declared function then became an indirect invoke, and with emitCanonicalInvokeReference (C/C++) minted a free-call reference that resolved through the registry, bypassing the precise passes' two-phase/ambiguity/subobject suppression — eight phantom CALLS edges in the cpp resolver suite on CI. Only declarations whose binding identifier sits under a pointer/ parenthesized declarator (callable-typed variables like void (*fp)(int);) create value cells now. cpp resolver suite 331/331; callable-value-flow + C/C++ suites 181/181 (the cross-function fp regression still passes); cpp fingerprint rebaselined, both bench gates PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:20:02 +01:00
Gergo Magyar	5869dde31d	fix(embeddings): make HTTP generation resumable (#2468)	2026-07-16 10:00:50 +00:00
Eva	5407747c67	fix(php): resolve function imports by declaring file	2026-07-14 12:46:59 +07:00
Eva	711ff8721d	fix(embeddings): make HTTP generation resumable	2026-07-14 02:15:57 +07:00
ChunxueLi	1029a8ddd7	feat: add Spring DI resolver for @Autowired List<T> injection (#2200) ... * feat: add Spring DI resolver for @Autowired List<T> injection Addresses all P0/P1 findings from tri-review (#2200): - P0: Register INJECTS in RelationshipType union (compiles) - P0: Rewrite execute() to emit consumer→implementation edges from graph data only - P1: Register in VALID_RELATION_TYPES, single-pass O(N) indexes - P1: Java-only gate with early exit on non-Java repos - P1: Update FULL_ORDER golden test - 8 unit tests covering all edge cases * test: make VALID_RELATION_TYPES size assertion array-driven (no hardcoded count) The security test hardcoded toBe(16) for the relation type count, but PR #2200 added INJECTS, bumping it to 17. Replace the magic number with an EXPECTED_RELATION_TYPES array whose .length drives the size assertion, so future additions only need to append to the list. Fixes CI failure on PR #2200. * fix(ingestion): thread raw generic field types onto Property nodes so Spring DI matching works (review 4616076037 P0) Production declaredType is generics-stripped by design (extractSimpleTypeName: List<Shape> -> "List"), so the spring-di phase's anchored regexes could never match real extraction output — the phase was a silent no-op on every real Java repository, while its unit tests passed against hand-built node shapes. Add FieldInfo.rawDeclaredType captured verbatim from the field's type node (.text, generics and qualifiers preserved — same precedent as the JVM method extractor), thread it through both parse-worker Property sites, add it to the shared NodeProperties contract, and match on rawDeclaredType ONLY (no declaredType fallback: it can never match real data and would mask future plumbing regressions as quiet no-ops). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): gate Spring DI on real injection annotations, honest edge reason (review 4616076037 P1) Extract Java field annotations (shared extractAnnotations helper, moved verbatim from the method extractor) onto Property nodes and require @Autowired or @Inject before a collection field becomes an INJECTS candidate. Previously every edge's reason string fabricated "@Autowired" without any annotation ever being checked, and any plain collection field would have fanned out false edges once matching worked. @Resource is deliberately excluded: JSR-250 resolves by bean name first (defaulting to the field name), injecting a single named collection bean — the opposite of the collect-all-implementers fan-out INJECTS models. Pinned by a test. An annotated candidate missing rawDeclaredType now logs an isDev warning (plumbing-contract breach signal) instead of vanishing silently. SCHEMA_BUMP 9 -> 10: Property nodes gained rawDeclaredType + annotations; warm parse caches must invalidate or the DI phase silently no-ops on replayed pre-upgrade nodes (the #2038 trap). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(ingestion): framework-neutral di phase + language-scoped Spring matcher registry (review 4616076037 P1) spring-di was the only pipeline phase naming a language in shared core/ingestion code (DoD.md language rule; the maintainer's direction is a generic DI solution). Split it: - di-extractors/spring.ts: the Spring matcher (annotation gate, collection type parse, @Resource exclusion rationale, framework-specific reason payload) — language-scoped home, mirroring route-extractors/. - di-extractors/index.ts: DI_MATCHERS, a single-valued ReadonlyMap<SupportedLanguages, DiFieldMatcher> mirroring the SCOPE_RESOLVERS registry shape sanctioned by AGENTS.md. Constructor injection deliberately out of scope; widen to arrays only when a second same-language framework lands. - pipeline-phases/di.ts (renamed from spring-di.ts): framework-neutral — routes Property nodes to registered matchers by node language via a typed guard, then runs the unchanged reverse-index fan-out. Zero language or framework names remain (grep-verified). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): language- and qualified-name-scoped interface resolution for DI fan-out (review 4616076037 P2) The interface index was built from ALL Interface nodes regardless of language, keyed by bare simple name with last-writer-wins overwrite — a polyglot repo with a TS and a Java 'Shape' could fan Java INJECTS edges into TypeScript classes, and two same-named Java interfaces in different packages silently collapsed to whichever parsed last (documented GitNexus bug class: #2054, PR #1956). Resolution is now per-language with qualifiedName as the primary key (Interface nodes already carry package-qualified qualifiedName); dotted element types resolve via qualifiedName, bare names via a per-language simple-name index that records ambiguity and fails CLOSED. Ambiguity skips are observable: DIOutput.ambiguousSkipped + an aggregated isDev debug log, so 'no DI fields' is distinguishable from 'all candidates ambiguous'. Same-package tiebreaking is a pinned, documented follow-up. Order-independence pinned by running collision tests in both insertion orders. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): depth-aware Spring collection-type parser for idiomatic generics (review 4616076037 P3) The two anchored regexes silently skipped idiomatic Spring shapes: Map<Pair<A,B>, IFoo> (nested-generic key broke the [^,]+ split), List<? extends IFoo> / List<? super IFoo> (bounded wildcards), java.util.List<IFoo> (qualified wrapper), and whitespace/multi-line declarations. Replace them with a small scanner: whitespace normalization, wrapper matched by last dotted segment, depth-aware top-level-comma split, wildcard bound stripping, and a final plain-dotted-type-name gate so anything else (nested-generic elements, arrays, unbounded wildcards, embedded comments, unbalanced brackets) fails closed. Every accept and reject is documented in the module docstring and pinned by 27 table-driven cases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(integration): prove Spring DI end-to-end through the real pipeline (review 4616076037 P1) Both no-op incarnations of this feature shipped with a green unit suite because every test hand-built the exact graph shape the phase expected — no test ever ran real Java source through the actual extraction pipeline. Add test/integration/spring-di-pipeline.test.ts: real .java fixtures via runPipelineFromRepo, pinning (a) the extraction contract on the annotated field's Property node (declaredType 'List', rawDeclaredType 'List<IFoo>', annotations ['@Autowired']), (b) set-equality on ALL INJECTS edges (exactly Consumer->FooA and Consumer->FooB; the non-annotated 'plain' field of the same type contributes nothing; no self-edges), and (c) a negative-control fixture with no injection annotations producing zero INJECTS edges. Either historical regression fails at least one of these. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(incremental): register INJECTS across product surfaces + delete-before-writeback (review 4616076037 P2) INJECTS was allowlisted in VALID_RELATION_TYPES but invisible or unhandled everywhere else. Register it deliberately: - REL_TYPES (gitnexus-shared schema-constants): web-side validRelType() otherwise silently rejects INJECTS filters (CLI/web single source of truth). - mcp/tools.ts cypher edge list (agent-facing schema discovery). - isGraphWideRelType: INJECTS validity is a whole-program property — a change to a THIRD file (the interface, or a new/removed implementer) creates/invalidates edges between two untouched files (the TAINT_PATH / #2084 M4 U6 class), so incremental extraction must always re-include the full fresh set. - deleteAllInjects (lbug-adapter): mirrors deleteAllInterprocTaintPaths — COUNT-then-DELETE under withConnLock, benign missing-table carve-out, re-throw otherwise (CodeRelation has no PK and there is no read-side dedup; a fail-soft delete + re-add would silently duplicate rows). - run-analyze.ts: the delete is UNCONDITIONAL, next to the Communities delete — deliberately NOT inside the options.pdg block: the di phase runs on every persisting analyze while the graph-wide re-include is unconditional, so a pdg-gated delete would append without deleting on every non-pdg incremental run (N runs = N copies). - local-backend.ts comment: opt-in traversal by design (not in default impact()/context() lists; no IMPACT_RELATION_CONFIDENCE entry per the WRAPS/FETCHES precedent — edges carry their own 0.8). - ARCHITECTURE.md: 14 -> 15 phases, DAG diagram, phase table, skip-list. Note: the tools.ts edge list also predates WRAPS/QUERIES/USES — that drift is pre-existing and left for a follow-up. Idempotency pinned end-to-end: two successive incremental runs (real runFullAnalysis + real LadybugDB, unrelated-file touches) leave the INJECTS row count stable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: describe INJECTS' actual precondition; drop stale fixed-at-16 comments (review 4616076037 P3) The shared-schema doc for INJECTS claimed an @Autowired precondition the code (pre-fix) never checked, and hardwired Spring semantics into what is now a framework-neutral edge type. Reword: precondition is an injection annotation recognized by a per-language matcher in di-extractors/; framework specifics live in the reason payload, not the type contract. security.test.ts comments still said the allow-list size 'stays fixed at 16' (it is 17 and the assertion derives from EXPECTED_RELATION_TYPES). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: simplify DI surfaces — narrow matcher contract, dedup delete-alls, derive tools edge list Post-implementation simplification pass (4 review angles): - DiFieldMatch/CandidateField carried collectionType + matchedAnnotation that no consumer read (the matcher bakes both into reason) — narrowed to {elementTypeName, reason}. - parseElementTypeName had two guard branches fully subsumed by the final plain-dotted-type-name gate — deleted, rationale folded into the regex comment. - The three byte-identical delete-all-by-rel-type functions in lbug-adapter (TAINT_PATH / CALL_SUMMARY / INJECTS) are now one parameterized helper + thin wrappers with identical names, signatures, and message text (character-diff verified) — the missing-table regex and abort policy now live in exactly one place. - The cypher tool's hand-maintained edge-type list (already missing WRAPS/QUERIES/USES) is now derived from the canonical REL_TYPES — the drift class is gone rather than patched. - di phase: interface indexes are built only for languages that actually have candidates; test builder gained a rawDeclaredType opt-out replacing a hand-rolled node. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: apply Tier-2 review findings — qualified-name fail-closed, honest cypher docs, pinned delete contract, hook isolation - byQualifiedName was last-writer-wins on duplicate qualified names (reproduced: order-dependent INJECTS edges with ambiguousSkipped 0 — same package+interface duplicated across monorepo modules/source roots; Java qualifiedName has no file-path component). Both indexes now share the AMBIGUOUS fail-closed sentinel; order-flip test added. - The REL_TYPES-derived cypher edge list advertised pdg-gated types with no caveat (LLM queries on them silently return zero rows on default indexes) — caveat appended, INJECTS example added, impact relationTypes description now names the DI fan-out opt-in. - The delete-all re-throw contract (only defense against duplicate CodeRelation rows) was untested — error classification extracted to a pure classifyDeleteAllError and pinned exhaustively. - extractRawType/extractAnnotations hooks lacked the per-hook try/catch the pipeline applies elsewhere (#2286 pattern): a throwing hook would silently drop every remaining file in the language group. Hardened, degradation tested. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 17:49:46 +01:00
azizur100389	1c8ad84796	feat(taint): add conservative Java source/sink model (#2267) ... * feat(taint): add conservative Java source model * fix(taint): preserve Java import provenance * chore: retry CI after network timeout --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-06-23 06:59:46 +01:00
Gergő Magyar	78b4077d8a	feat(impact): opt-in PDG-backed impact mode - statement + inter-procedural slicing, resolved-callee-id soundness, mutation-oracle validated (#2227)	2026-06-20 12:04:32 +01:00
azizur100389	72876ab69a	fix(cpp): rank homogeneous braced-init overloads (#2214)	2026-06-16 18:29:28 +01:00
azizur100389	ff0124e067	feat(cpp): parse CUDA source extensions (#2213) ... * feat(cpp): parse CUDA source extensions * test(cpp): characterize CUDA parser limitations --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-06-16 07:32:53 +01:00
Gergő Magyar	7c3d4e6862	feat(pdg): control dependence — post-dominators + CDG (Ferrante) [M5 #2085] (#2188) ... * feat(pdg): add CDG + POST_DOMINATE edge types (M5 #2085) * feat(pdg): post-dominator tree on reverse CFG (M5 #2085) * feat(pdg): Ferrante control-dependence over the post-dom tree (M5 #2085) * feat(pdg): emitFileCdg + optional POST_DOMINATE debug edges (M5 #2085) * feat(pdg): wire CDG emission in-phase + pdgModeMismatch CDG-cap stamp (M5 #2085) * test(pdg): CDG snapshot + end-to-end pipeline answerability (M5 #2085) * fix(review): apply autofix feedback (M5 #2085) * fix(pdg): label CDG edges by controller arm sense, not edge kind (#2188 F1/F2/F4) Tri-review (with Codex as the independent engine) found the CDG 'T'/'F' label was wrong for the commonest control flow: the M1 TS visitor wires a condition's fall-through FALSE arm as `seq`/`loop-back`, but `branchSense` mapped both to 'T', so guard clauses, if-no-else, and loop `break` got 'T' instead of 'F' (F1, P1). The structural CDG edges were correct; only the label — the AC3 "under what condition does X run?" answer — was wrong. - F1: replace edge-kind `branchSense` with controller-arm-sense `labelFor`. An ambiguous fall-through edge (seq/loop-back) takes the COMPLEMENT of its source block's explicit cond-true/cond-false sibling arm. This correctly handles do/while (loop-back = TRUE arm) and inner-if-in-loop (loop-back = FALSE arm) — the ambiguity a kind→label table cannot resolve. Adds real-parser regression tests (the hand-built tests used a fictional cond-false edge and missed it). - F2: correct the false "sound over-approximation that never drops a real dependence" claim in post-dominators.ts — exit-unreachable regions both drop and invent control dependences (latent for the current TS visitor, which keeps EXIT reverse-reachable). Reframe the exit-less-loop test to characterize, not bless, the degenerate behavior. - F4: make the AC2 property-test reference compute post-dominance INDEPENDENTLY (node-removal reachability, no shared code with post-dominators.ts), so a post-dom direction bug can no longer pass both the impl and the reference. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ci): root-prettier format + run-analyze pdg stamp gains maxCdgEdgesPerFunction (#2085) Two deterministic CI failures from the M5 CDG work: - quality/format: basicblock-roundtrip.test.ts failed CI's root `prettier --check .` (the pre-commit hook uses the gitnexus-local prettier config, which differs); reformatted with the root config. - tests/ubuntu/coverage: run-analyze.test.ts pinned the resolved RepoMeta.pdg shape (DEFAULTS) and the all-zero cap override without the new maxCdgEdgesPerFunction key (default 5000); added it so resolvePdgConfig toEqual and pdgModeMismatch(DEFAULTS) pass. (The stale-test sweep missed this file in PR #2188 — same trap M2 hit.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(mcp): add pdg_query tool definition (controls/flows modes) [M6 #2086] * feat(mcp): pdg_query backend — controls (CDG) + flows (REACHING_DEF) + e2e test [M6 #2086] * feat(mcp): document PDG edges + pdg_query (schema, cypher, skill, --pdg-gated ai-context) [M6 #2086] * fix(mcp): correct pdg_query symbol-anchor lower bound + harden inputs [PR #2188 review] Tri-review (Codex + adversarial + correctness lanes) of the M6 pdg_query surface found the symbol-anchor window over-includes a neighbor function's block. The upper bound was widened to the 1-based BasicBlock basis (symEnd+1) but the lower bound was left 0-based, so a block on the line directly above the target function leaked into the result. Shift both bounds +1 ([symStart+1, symEnd+1]) so the window is the function's true block span. Also from the same review: - pdg_query no longer throws on a no-arguments MCP call: the dispatch passes raw `params`, so default it to {} → a clean mode-validation error instead of a TypeError. (`explain` shares this latent pattern — pre-existing follow-up.) - tools.ts: the controls-mode description no longer hard-codes the 'F' branch sense for guards — `if (!ok) return;` rides the predicate's 'T' arm; the guard:true flag is label-agnostic (regex on the dependent block text). Tests: a hand-seeded adjacency regression (verified failing without the lower-bound +1) + a no-arguments validation test. Skill doc updated to document the two-sided [symStart+1, symEnd+1] window. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(mcp): drop always-true anchor conditional in pdg_query [CodeQL #2188] CodeQL alert 756 flagged `...(anchor ? { anchor } : {})` in _pdgQueryImpl as a useless conditional: `anchor` is unconditionally assigned in both the file-path and symbol branches before the return (the not-found/ambiguous/no-layer paths return earlier), so it is always truthy. Drop `| undefined` from the declaration (TypeScript definite-assignment holds across both branches) and emit `anchor` directly. No runtime change — the `anchor` field was already present on every result. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cli): add hasPdg to the noStats bridge expectation [#2188] The M6 work threaded `hasPdg: options.pdg === true` into the AIContextOptions passed to generateAIContextFiles on the --skills regeneration path, but this test's strict .toEqual expectation predated it (4 keys vs 3 → CI failure). Add `hasPdg: false` (the value on this non---pdg path). The assertion stays strict; the #1477 noStats bridging it guards is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cli): collapse generateGitNexusContent params to an options bag [#2188] The function had grown to 9 positional params; reaching `hasPdg` meant passing six `undefined`s (the M6 review's maintainability flag). Collapse params 3-9 (generatedSkills, groupNames, noStats, skipSkills, runnerPath, defaultBranch, hasPdg) into a `GitNexusContentOptions` object with the defaults moved to destructuring. The body is unchanged (same local names); the single production caller and the test calls become self-documenting named fields. Pure refactor — generated AGENTS.md/CLAUDE.md content is byte-identical. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): skip CDG for exit-unreachable CFGs (unsound post-dominance) [#2188] M5 review P2: computePostDominators roots only at cfg.exitIndex and nothing enforced that EXIT is reachable from every block. For an entry-reachable region that cannot reach EXIT (a non-terminating loop, or a multi-terminal CFG a future visitor might emit) the EXIT-rooted reverse walk degenerates — it both drops real control dependences and invents spurious ones. Add a pure precondition predicate `isExitReachableFromAllBlocks` (co-located with the algorithm it guards) and gate it in emitFileCdg: a CFG that violates it is skipped for CDG (counted as skippedUnsoundFunctions + one onWarn), while its CFG and REACHING_DEF projections — which do not depend on post-dominance — are kept. A CDG-specific gate, not a widening of isEmitSafeCfg, so the blast radius is exactly the unsound CDG. The current TS visitor always satisfies the precondition (every loop gets a structural header→loopExit edge), so CDG output for real fixtures is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): bound computeControlDependence materialization (heap parity) [#2188] M5 review P2: unlike computeReachingDefs (maxFacts) and the emit-side edge cap, computeControlDependence materialized the full deduped seen/out before emitFileCdg's per-function cap could trim it — O(edges × post-dom depth) heap for a deeply nested function. Add a `maxEdges` ceiling (default 0 = unbounded) returning {edges, truncated}, mirroring computeReachingDefs's {facts, truncated}. The ceiling is checked before pushing a new unique edge, so `truncated` means a genuine overflow (not merely "reached cap"). emitFileCdg passes a FIXED materialization ceiling (8× the default edge cap) — deliberately NOT derived from the runtime edge cap, because CDG's materialization IS the deduped-edge quantity the cap reports on (deriving it would pre-truncate that set and lose the exact dropped count). A ceiling hit is surfaced via onWarn + the truncated flag — never silent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(mcp): share resolveBlockAnchor; fix explain's anchor off-by-one [#2188] M6 review P2 (duplication) + the flagged pre-existing _explainImpl correctness follow-up. _pdgQueryImpl and _explainImpl each carried a near-identical symbol↔block anchor resolver that had DRIFTED: pdg_query used the corrected [symStart+1, symEnd+1] window (BasicBlock startLine is 1-based, the symbol span 0-based) while _explainImpl still used [symStart, symEnd] — dropping a taint source on the function's final line AND leaking a neighbor's block on the line directly above. Extract one `resolveBlockAnchor` helper, used by both, that applies the correct window and a single (bare) clause convention (callers compose their own WHERE). This removes ~50 duplicated lines and fixes explain's anchor in one place. A hand-seeded characterization test (taint-explain Block 4) pins both bounds — verified to FAIL on the pre-fix window (it returned the line-10 neighbor instead of the line-15 final-line source). Existing taint-explain + pdg-query suites are unchanged (their fixtures have interior sources/sinks). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(mcp): pdg_query reports "status unknown" when the layer can't be confirmed [#2188] M6 review P3 (Codex): when meta is UNREADABLE and the bounded global existence probe returns zero rows of the edge type, _pdgQueryImpl asserted "no PDG layer" — but a genuinely edge-free layer (all-linear functions) is indistinguishable from a missing one via that probe. Soften only that fallback path to an inconclusive "PDG layer status unknown — was this repo indexed with --pdg?" note. The meta-stamped path (stamp present, cap absent ⇒ layer truly missing) keeps the definitive "no PDG layer" wording. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(mcp): cover pdg_query ambiguous / pagination / Windows-path gaps [#2188] M6 review test-gap follow-ups, all hand-seeded with controlled data: - ambiguous symbol name → status:'ambiguous' + ranked candidates shape (uid/name/filePath/score), never a silent guess; - total/truncated page boundary in both directions (limit below the match count sets truncated with the full total; limit above it omits truncated); - a Windows-style filePath containing ':' resolves and fnLineOf decodes the function-line segment correctly (split-from-right past the drive letter). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(skills): ship gitnexus-pdg-query skill mirrors + add pdg_query to the guide [#2086] M6 bundled pdg_query into this PR, but the skill shipped only in the canonical gitnexus/skills/ root. Mirror it (byte-identical) to the two hand-maintained roots the sibling taint skill uses — .claude/skills/gitnexus/ and the plugin — so Claude Code + plugin users get it too. Also extend the gitnexus-guide tool reference (all 3 copies, now byte-identical): add a `pdg_query` row + a "Control & data dependence" section mirroring the taint/`explain` section, and reconcile the pre-existing drift where only the .claude copy carried the `check` tool row (a real registered tool) — all three now list it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(architecture): refresh CFG/PDG section for the full M1–M6 stack [#2086] The PR body had deferred the "ARCHITECTURE docs refresh" to #2086; now that M6 ships here, do it: - MCP tools table gains `explain` and `pdg_query` (were absent). - "Optional CFG/PDG emission" was M1-only; rewrite to cover the whole opt-in stack — M1 CFG, M2 REACHING_DEF, M3/M4 taint, M5 CDG (Ferrante over CHK post-dominators, with the exit-unreachable skip), M6 read surface (pdg_query + explain, anchored + LIMIT-bounded, shared resolveBlockAnchor) — and note the no-Function→BasicBlock-edge join. - LadybugDB schema notes the `--pdg` additions: the `BasicBlock` node table and the CFG/REACHING_DEF/CDG/TAINTED/SANITIZES/TAINT_PATH relation types, kept out of the default VALID_RELATION_TYPES / web schema. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 18:49:03 +01:00
Gergő Magyar	5bf8a17cd5	feat(ingestion): add control-flow-graph layer for TS/JS (#2081) (#2099) ... * feat(cfg): language-agnostic CFG construction core (#2081) U1 of M1 (CFG layer). Plain JSON-serializable CFG data model (BasicBlockData/ CfgEdgeData/FunctionCfg — must survive the worker→main boundary + ParsedFile store), a CfgBuilder accumulator (leaders→blocks→edges, synthetic ENTRY/EXIT, idempotent edges), a ControlFlowContext (break/continue/switch + labeled-jump target stacks), and a TraversalResult ({entry, dangling exits}). AST-agnostic and unit-tested on the classic control-flow topologies (if/else, while back-edge, mid-block return, labeled break/continue) the S2 spike validated; reachability helper backs the R9 property test. * feat(ingestion): U2 — TS/JS CFG visitor over tree-sitter AST (#2081) Add the TS/JS CfgVisitor that walks a function's tree-sitter AST and drives the U1 CfgBuilder to produce a serializable FunctionCfg. One visitor covers both languages (shared grammar family). Handles the classic CFG hazards explicitly (R2, R10): - loops allocate a dedicated loop-exit block so `break` has a concrete target before the loop's successor is known; `continue`/back-edge close the loop (while, do-while, C-for with init-once + increment-as-continue-target, for-in, for-of) - switch fallthrough falls out naturally: a non-breaking case yields exits we wire to the next case as `fallthrough`; a breaking case wires to the switch exit via ControlFlowContext - try/catch/finally: normal completion AND exceptional flow both route through finally (post-domination); a conservative exceptional edge models that the protected region may raise to its handler (not just explicit `throw`) - labeled break/continue resolve against the labeled loop's frame - early return/throw wire to EXIT/handler and terminate their block 19 hazard tests (one per construct) + AC1 10-function fixture; all green. No change to the committed U1 core or ControlFlowContext. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(ingestion): U3 — worker CFG build + cfgSideChannel + cache coherence (#2081) Run the CFG visitor in the parse worker (where the AST lives), serialize the per-function CFG onto a new ParsedFile.cfgSideChannel, and keep it coherent across the disk-backed store and the warm/durable parse cache (R3, R4). - gitnexus-shared parsed-file.ts: add `cfgSideChannel?: unknown` as a DISTINCT field from captureSideChannel (different producer/consumer/lifecycle; plain JSON data — blocks/edges deliberately lack the `nodeId` the store's interning reviver keys on, so no mis-interning). - cfg/types.ts + visitors/typescript.ts: add CfgVisitor.isFunction so the worker enumerates functions (and applies the line budget) by a cheap node-type test. - cfg/collect.ts (new): collectFunctionCfgs walks the tree, builds one CFG per function (nested included), applies maxFunctionLines (over-cap = skipped). - language-provider.ts: add `cfgVisitor?: CfgVisitor<SyntaxNode>` hook; typescript.ts attaches it to both the TS and JS providers (shared grammar). - parse-worker.ts: read pdg + pdgMaxFunctionLines from workerData (read once at init — the worker never sees PipelineOptions), gate the build, attach cfgSideChannel alongside captureSideChannel. - parse-cache.ts: bump SCHEMA_BUMP 4→5 (ParsedFile shape changed) and fold the pdg flag into computeChunkHash so a pdg-off cached chunk is NOT reused on a --pdg run (the #2038-class warm-cache trap). Default path keeps its keys. - worker-pool.ts + parse-impl.ts + pipeline.ts: thread pdg/pdgMaxFunctionLines PipelineOptions → WorkerPoolOptions → workerData, and into the chunk-hash key. 9 boundary tests: collect contract, JSON round-trip identity (no AST leakage), the pdg cache-key guard, the line-cap skip, and the no-visitor gate. Full CFG suite (U1+U2+U3) green; build clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(ingestion): U4 — emit BasicBlock + CFG within scope-resolution (#2081) Emit persisted BasicBlock nodes + CFG edges from each ParsedFile's worker-built cfgSideChannel, INSIDE scope-resolution's Phase-4 graph emission — the last point where the worker-built CFGs are loaded (emitParsedFiles carries the channel; the disk store is cleared right after the orchestrator returns). This is the architecture the doc-review corrected to: a standalone post-`mro` phase (the issue's literal subtask) provably reads empty data (KTD1). - cfg/emit.ts (new): pure emitFileCfgs(graph, cfgs, maxEdgesPerFunction, onWarn). BasicBlock id = `BasicBlock:<filePath>:<functionStartLine>:<blockIndex>` (KTD3 — funcStart disambiguates blocks across functions in one file; no `name` column). CFG edge = CodeRelation type 'CFG' with the edge KIND (seq/cond-true/…) in `reason` (kinds can't be their own edge type). Per- function edge cap stops at the cap and warns with the dropped count — no silent truncation (R6/KTD6). - run.ts: pdg-gated emit pass over emitParsedFiles after emitPostResolutionEdges (store still live); RunScopeResolutionInput gains pdg + pdgMaxEdgesPerFunction. - phase.ts: thread ctx.options.pdg / pdgMaxEdgesPerFunction into the call. - pipeline.ts: PipelineOptions.pdgMaxEdgesPerFunction. 6 tests: node/edge shape (KTD3 id, no name, type='CFG', kind in reason), cross-function id uniqueness, AC2 reachability-from-ENTRY property, the edge cap's no-silent-truncation contract, and empty-input no-op. Flag-off byte-identity + full runPipelineFromRepo round-trip land in U7. Build clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cli): U5 — `--pdg` opt-in plumbing (CLI + .gitnexusrc → both sinks) (#2081) Expose the CFG/PDG substrate as an opt-in and thread it from CLI/.gitnexusrc to the single source of truth (PipelineOptions.pdg), which fans out to BOTH sinks already wired in U3/U4: the worker build gate (workerData.pdg) and the scope-resolution emit gate. Off by default (R7). - cli/index.ts: `--pdg` commander flag. - cli/analyze.ts: AnalyzeOptions.pdg + pass `pdg` into runFullAnalysis options. - cli/analyze-config.ts: KEY_SPECS `pdg` (boolean) so `.gitnexusrc { "pdg": true }` normalizes and a non-boolean value fails closed with GitNexusRcError. - core/run-analyze.ts: AnalyzeOptions.pdg → runPipelineFromRepo({ pdg }). (The internal PipelineOptions/WorkerPoolOptions/workerData fields + the parse-cache key fold landed in U3/U4; this unit adds the user-facing surface. The budget knobs stay at internal defaults for M1.) Tests: analyze-config pdg normalization + non-boolean rejection; opt-in.test.ts covers the CLI/file merge precedence and that pdg perturbs the chunk-dispatch key. The full worker-build + main-emit round-trip is the U7 integration test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ingestion): U7 — CFG acceptance fixtures, parity, end-to-end + docs (#2081) Acceptance criteria for the M1 CFG layer: - AC1: a 10-function TS fixture's CFG node/edge set matches a committed snapshot (cfg-snapshot.test.ts). - AC2: every BasicBlock is reachable from its function ENTRY (property test over the emitted graph; the fixture has no dead code). - AC3: hazard fixtures lock the classic-bug coverage — try/throw/finally post-domination + labeled break/continue resolution. - AC4: the existing pipeline-graph-golden test stays byte-identical with --pdg off (verified; no UPDATE_GOLDEN), proving the opt-in adds zero default-run drift. - End-to-end (pipeline-pdg.test.ts): runPipelineFromRepo({ pdg: true }) on a tiny repo emits BasicBlock nodes + CFG edges with both endpoints present — the true both-sinks proof (worker builds → store → scope-resolution emits); the default run emits zero. Docs: CHANGELOG M1 entry, ARCHITECTURE "Optional CFG/PDG emission" subsection (why emit is in-phase, not post-mro), README CFG language-support note. Full CFG suite (U1–U7): 56 tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ingestion): drop unused helper in cfg-snapshot test (#2081) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(review): apply ce-code-review autofix feedback (#2081) Review (10 reviewers) confirmed OFF-path byte-identity (adversarial + golden) and found defects all within the --pdg path. Fixes: - P1 same-line BasicBlock id collision: add a start-column disambiguator to FunctionCfg + the id (`BasicBlock:<file>:<line>:<col>:<idx>`) so two functions sharing a start line no longer collide under first-writer-wins addNode. - P1 worker crash-cascade: per-file try/catch around collectFunctionCfgs so a CFG-build throw cannot escape to the language-group catch and silently drop every remaining file in the group. - P2 edge-cap drop now logs unconditionally (input.onWarn is validator-gated/ silent in prod) — upholds the no-silent-truncation guarantee. - P2 Array.isArray guard before the cfgSideChannel cast in run.ts. - P2 maxFunctionLines default: worker applies DEFAULT_PDG_MAX_FUNCTION_LINES=2000 when unset; caps forwarded through run-analyze AnalyzeOptions (closes the server-path drop). - P3 README duplicate paragraph removed; `0`-vs-default docstrings corrected; CLI --pdg flag made language-neutral; reachableBlocks JSDoc corrected. - Documented the break-through-finally + stacked-label CFG limitations. - Tests: same-line id-collision regression, standalone throw→EXIT, dead-code- after-return, async/generator/method coverage, strengthened labeled-continue. Refuted: the HTTP-500 getNodeQuery finding — M0 already shipped the BasicBlock branch + name-floor (R12/web-safety handled). CFG + analyze-config suites: 95 tests green; golden parity (AC4) byte-identical. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(ingestion): benchmark CFG construction + O(n) block-text accumulation (#2081) Closes the M1 review's requires_verification perf gap ("no benchmark for collectFunctionCfgs; a wall-time + cfgSideChannel byte-size regression gate would catch the extendBlock concatenation before kernel scale"). - bench/cfg/measure.mjs (new): build-free tsx harness timing collectFunctionCfgs (parse once, reuse the tree) across three scaling scenarios — straight-line (extendBlock path), many-functions (collect walk), branchy (block/edge growth) — at 500→2000. Reports a wall-time scaling ratio AND a cfgSideChannel byte-size ratio, plus an order-independent sha256 over the emitted blocks/edges as the behavior gate. `--check` compares both ratios + the fingerprint against bench/cfg/baselines.json; mirrors the scope-capture / python-scope harnesses. - .github/workflows/ci-tests.yml: run the gate on every test job (build-free, alongside the existing scope-capture guards) so an O(n^2) re-regression fails CI. - cfg-builder.ts: structural fix for the one real hotspot the bench surfaced — accumulate basic-block text as fragments joined once in finish(), instead of concatenating onto a growing string per coalesced statement (O(n^2) → O(n)). Behavior-identical (the CFG fingerprint + the AC1 snapshot are unchanged). Measured (post-fix): time ratios straight-line ~1.3, many-functions ~1.0, branchy ~1.1 (all sub-quadratic; a true O(n^2) would be ~4.0). cfgSideChannel bytes scale linearly (~1.0-1.04). 60 CFG tests green; build clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(ingestion): add memory + disk growth gates to the CFG benchmark (#2081) Extend bench/cfg/measure.mjs beyond wall-time to the two other scalability dimensions that matter at kernel scale: - DISK growth: utf8 byte size of the serialized cfgSideChannel — exactly what a --pdg run writes onto every ParsedFile shard (durable store + parse cache). - MEMORY growth: retained JS heap of the cfgSideChannel payload, measured by the release-delta method (heap held minus heap after dropping it) — robust to pre-existing garbage and dead-stable run-to-run. Needs `node --expose-gc`; without it the heap metric is null and its gate is skipped (local runs still work). ci-tests.yml now passes --expose-gc so the heap gate runs in CI. Both gated on linear scaling in baselines.json (disk_bytes_budget / heap_budget 1.2-1.3). Measured: disk ~1.0-1.04, retained heap ~0.87-1.0 — both linear (~1KB/function each; ~2MB heap / 1.6MB disk at 2000 functions, --pdg only). Bumped REPS 7->15 to stabilize the noisier time signal and widened the coarse time tripwire budgets (the disk/heap gates carry the tight regression detection). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): address tri-review + CFG-expert findings (#2081) Corroborated findings from the tri-review (Codex + CE personas + GitNexus swarm + a CFG/program-analysis domain-expert lane). The OFF-path stays byte-identical; all fixes are within the --pdg path or the benchmark. - [Codex+CFG-expert] Exceptional `throw` edges now wire EVERY block in a try's protected region to the handler, not just the body ENTRY. A branched try body (`try { if (x) { use(t); } } catch`) previously left interior blocks with no path to `catch` — a taint false-negative into the handler for the M2 PDG pass. - [Codex+CFG-expert] An unresolved labeled jump (a stacked outer label or a labeled non-loop block) now routes to the function EXIT instead of leaving a dangling sink — restores the single-exit invariant post-dominator/PDG computation needs. - [Codex] computeChunkHash now folds pdgMaxFunctionLines/pdgMaxEdgesPerFunction into the chunk key (not just the pdg boolean), so a warm cache built under one cap is never served to a run with a different cap (#2038 class, extended to the budgets). Adds PdgCacheKey; boolean form kept for back-compat. - [perf] visitTry resolves catch/finally in a single namedChild pass (the double `namedChildren.find` allocated two throwaway arrays). - [adversarial] The bench `straight-line` scenario now runs at 2000->8000: output is a constant 4 blocks so disk/heap can't see the concat path, and at the old N a genuine O(n²) was masked by V8 cons-strings. Verified at the new N: the array-join impl ~1.0, a rope-optimized `+=` ~1.0 (correctly not flagged), a real O(n²) (re-join-every-append) ~3.8 — budget tightened 2.0->1.5. - [adversarial+Codex] The bench `--check` now FAILS LOUDLY when run without `--expose-gc` instead of silently skipping the retained-heap gate. - Doc: re-labeled the finally-bypass as a SOUNDNESS (false-negative) limitation tracked for M2, not mere "precision." 3 new regression tests (branched-try interior→handler, stacked-label→EXIT, cap-fold key). 99 CFG tests pass; build clean; bench gate green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(parse-cache): clarify that SCHEMA_BUMP still invalidates caches once (#2099 F6) The computeChunkHash comment claimed pdg-off warm caches "survive this change untouched" — true for the key FORMAT, but misleading as an upgrade-behavior promise: SCHEMA_BUMP 4→5 changes PARSE_CACHE_VERSION and both stores hard-invalidate on it. Separate the two facts so the next cache change isn't reasoned about from a false premise. Review finding F6 (P3) of PR #2099 tri-review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): correct for-loop back-edge kinds when no increment clause (#2099 F5) A for with a body but no increment emitted an unconditional header→header 'loop-back' self-edge (a path that never executes the body) while the real back-edge body→header was labeled 'seq'. Any consumer identifying loops via reason='loop-back' picked the phantom edge and excluded the body from the natural loop. Gate the self-edge on the body being absent (the one case where the header genuinely re-tests itself) and carry 'loop-back' on the body's exits when they ARE the back-edge, matching visitWhile/visitForIn. Review finding F5 (P3) of PR #2099 tri-review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): treat an empty catch clause as a real handler (#2099 F2) visitTry keyed handler semantics off the traversal result — null for an empty body, since visitSeq([]) returns null — instead of the syntactic clause. An empty `catch {}` was therefore treated as NO catch: the swallowed exception escaped to the outer handler/EXIT, the no-catch re-propagation misfired past finally, and code after a try whose body always throws became unreachable from ENTRY — a hard false-negative source for the M2 taint pass, on an extremely common pattern. Synthesize one empty block spanning the clause (entry == sole exit) when the catch body traverses to null, before the protected region is walked. Exception flow lands in it and rejoins the normal continuation; all downstream wiring (handler selection, finally routing, the !catchRes re-propagation gate) operates on the syntactically-correct shape. Review finding F2 (P2, reproduced) of PR #2099 tri-review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): guard CFG emission per element, not just per outer array (#2099 F4) The cfgSideChannel guard checked only Array.isArray before casting to FunctionCfg[] — its own comment promised a wrong-shape value would 'skip emission, not throw a TypeError mid-graph-build', but a malformed ELEMENT sailed through. Worse, the obvious-looking failure shape never throws at all: emitFileCfgs string-templates any edge endpoint into the BasicBlock id and graph inserts are no-throw, so a non-integer endpoint silently became a dangling 'BasicBlock:…:undefined' edge that degrades the DB rel-pair COPY to row-by-row fallback inserts much later. Layered fix matching house precedents (parsedfile-store reviver, worker-side per-file catch): a per-element shape+content predicate (arrays + integer edge endpoints) that warns and skips malformed elements while valid siblings still emit, plus a per-file try/catch backstop for shapes that genuinely throw (e.g. a null inside blocks). Review finding F4 (P3) of PR #2099 tri-review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(parse-cache): drop emit-time edge cap from the pdg chunk key (#2099 F3) pdgMaxEdgesPerFunction is applied exclusively in emitFileCfgs during scope-resolution on the main thread — the worker never receives it (workerData carries only pdg + pdgMaxFunctionLines), so the cached worker output is byte-identical across cap values. Folding it into the chunk key (added by a prior review round) only converted a free knob into a repo-sized cost: every cap change forced a full re-parse and a durable-store rewrite of unchanged data. Keep pdg + maxFunctionLines (genuinely worker-visible, shape the cached cfgSideChannel) and document the classification test in the PdgCacheKey doc comment so the next option gets sorted deliberately: worker-shard inputs go in this key; persisted-graph-only inputs belong in the RepoMeta pdg stamp (F1). Chunks written under the old ns string miss once and prune — no migration needed. Review finding F3 (P2) of PR #2099 tri-review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(analyze): record pdg config in RepoMeta; force full writeback on mode flip (#2099 F1) Running --pdg against an already-indexed repo silently persisted ~zero CFG: incremental eligibility had no pdg term, RepoMeta recorded no mode, and extractChangedSubgraph keeps only changed-file nodes — on a no-change --pdg re-run every freshly built BasicBlock was dropped from the written subgraph ('Incremental: changed=0', run succeeds, zero rows). The converse flip left zombie mixed-coverage blocks only --force could clean. Worse, a clean-tree flip hit the alreadyUpToDate fast path and never ran the pipeline at all. - RepoMeta gains an additive-optional pdg stamp ({maxFunctionLines, maxEdgesPerFunction}, resolved values; absent ≡ pdg-off, which covers every legacy meta). No INCREMENTAL_SCHEMA_VERSION bump — that would force a one-time full rebuild for everyone. The end-of-run meta is a fresh literal, so omitting the field on a pdg-off run is what clears the stamp after an on→off flip. - pdgModeMismatch (pure, exported) compares the resolved triple; the flip check sits before the fast path and always logs its notice (not gated on options.force — --skills implies force with no message of its own), naming the .gitnexusrc pdg key that pins the mode. - The full-rebuild branch now writes the incrementalInProgress dirty flag (toWriteCount: 0 sentinel) before the wipe whenever a prior meta exists, mirroring the incremental branch. This closes the crash window where a rebuild dying between the bulk load and saveMeta left meta/DB inconsistent and the fast path certified zombie (or missing) CFG rows indefinitely — and incidentally closes the same pre-existing hole for user --force runs. Recovery log reworded accordingly. Tests: pdg-mode-flip.test.ts (real git + LadybugDB; primary assertion is a direct BasicBlock table count — meta.stats aggregates nondeterministic Community/Process rows) covering off→on, steady-state fast path, on→off zombie cleanup, cap-change rebuild, and dirty-flag + flip composition; pure-helper tests for default resolution and the 0=unlimited carve-out. Review finding F1 (P1) of PR #2099 tri-review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-10 19:26:45 +01:00
azizur100389	e26002c37a	fix(cpp): suppress deleted overload winners (#2094) ... * fix(cpp): suppress deleted overload winners * test(cpp): update scope capture fingerprint --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-06-10 18:41:30 +01:00
Gergő Magyar	f2c9e69792	feat(ingestion): M0 — taint/PDG substrate (schema + seams + spikes) (#2080) (#2092)	2026-06-08 18:56:10 +01:00
Gergő Magyar	4fc2ffa5d0	refactor(ingestion): delete shadow-mode parity harness (RING4-3, #944) (#2071) ... Ring 4 retires the legacy call-resolution DAG. With the legacy resolver gone (RING4-1 #942, RING4-2 #943), shadow mode has nothing to dual-run against, so the remaining shadow-mode artifacts are dead code. - Delete gitnexus-shared/src/scope-resolution/shadow/{diff,aggregate}.ts (pure parity comparison logic) and its gitnexus-shared barrel exports. - Delete the static parity dashboard (gitnexus/shadow-parity-dashboard/), which also removes the last GITNEXUS_SHADOW_MODE reference in the repo. - Delete the shadow-mode unit tests (gitnexus/test/unit/shadow/). - Scrub stale doc comments referencing the shadow harness / parity dashboard / removed legacy run (csharp/php/python/typescript index.ts, evidence.ts, module-scope-index.ts). Already removed by RING4-1/-2 (verified): the shadow harness source and GITNEXUS_SHADOW_MODE env handling; no CI job published dashboard artifacts. Historical parity records preserved per acceptance: the CHANGELOG entry (#918, #923, #951, #972) and the ci.yml RING4-1 note remain. Last documented parity state is that historical coverage — no live .gitnexus/shadow-parity/ run data exists in-tree (runtime output only). Closes #944. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-07 20:06:42 +01:00
Gergő Magyar	95f87fc12a	perf(ingestion): Linux-kernel-scale analysis — worker-pool parse + finalize O(n²) + scope-resolution memory wall (#1983) (#2038) ... * fix(ingestion): reduce parse-phase memory for huge repos (#1983) Stop retaining full parse-cache chunks in RAM alongside the merged graph, slim on-disk shards, defer worker ParsedFile emission for scope-resolver languages, and add GITNEXUS_DEBUG_HEAP probes for OOM diagnosis. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ingestion): address #2038 tri-review findings (parse-phase memory) Resolves the confirmed review findings on PR #2038: - P1: thread exportedTypeMap through the sequential parse path (processParsingSequential) so a no-worker run over a partially-warm cache no longer silently drops the sequential-miss files' exported types. Cache hits made exportedTypeMap.size > 0, suppressing the end-of-loop buildExportedTypeMapFromGraph rebuild, but the sequential path never populated the map. Regression test added (fails on the pre-fix tree, passes after) plus a fully-sequential differential oracle. - P2: saveParseCache builds its on-disk index from hashes actually written/copied (writtenKeys), never a usedKeys hash whose shard write or copy was skipped — no more phantom index entries. - P2: add a unit test asserting SCOPE_RESOLUTION_LANGUAGES stays in sync with SCOPE_RESOLVERS (asymmetric drift would lose a language's ParsedFile). - Backfill cache coverage: loadParseCacheChunk missing/corrupt -> undefined, pruneCache onDiskKeys branch, slim preserves nodes, saveParseCache copy-evicted-shard round-trip. - Cleanups: single-source heap-probe gating via isDebugHeapEnabled(); hoist the per-chunk mkdir in persistParseCacheChunk behind a process-scoped Set; gate COBOL's unused worker-side ParsedFile extraction (graph nodes still come from cobolPhase) while keeping fileCount/progress unconditional. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(ingestion): remove dead worker-side ParsedFile extraction After #2038 gated worker `ParsedFile` emission behind `!isScopeResolutionLanguage(language)`, and with all 16 SupportedLanguages registered in SCOPE_RESOLVERS, that gate was structurally always true — the worker already produced no ParsedFiles and scope-resolution re-extracts each file from source on the main thread (run.ts). Remove the now-dead machinery: - Drop both worker `extractParsedFile` call-sites (tree-sitter processFileGroup + the standalone-provider branch) and the `result.parsedFiles.push`. The standalone branch keeps fileCount/onFileProcessed per file. `result.parsedFiles` stays declared but empty (field removal deferred). - Remove the now-orphaned `scopeSourceKind` var + `ScopeCaptureSourceKind`/`extractParsedFile`/`isScopeResolutionLanguage` imports. - Delete the consumerless `migrated-languages.ts` (isScopeResolutionLanguage + SCOPE_RESOLUTION_LANGUAGES) and its drift-guard test — parse-worker was their only importer. Also improves AGENTS.md "shared ingestion code must not name languages" compliance. `extractParsedFile` and the scope-extractor-bridge stay (scope-resolution/run.ts + Vue resolver use them). Behavior-preserving: worker-sequential-parity passes before and after; tsc/eslint clean; no baseline/golden drift. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(ingestion): worker-pool-only parsing; remove sequential parser (#1983) Completes the #1983 huge-repo parse-OOM effort by making the worker pool GitNexus's sole parse path. Parallel serialization (the perf core): workers serialize their ParsedFiles to a disk store in parallel and stream them back to scope-resolution, so the main thread no longer re-parses every file (the tree-sitter native-memory leak that caused the OOM). Adds chunk merge-pipelining + work-proportional chunk sizing so the pool stays saturated. Remove the sequential parser: `--workers 0`, `GITNEXUS_WORKER_POOL_SIZE=0`, and `skipWorkers` now hard-error (no silent degrade — #1741); the small-repo threshold no longer selects an in-process path; pool creation stays lazy / cache-miss-gated so warm all-hit runs never spawn workers. Worker-path parity fixes — removing sequential surfaced two pre-existing gaps that tiny-fixture tests had masked by running below the worker threshold, both fixed by carrying per-file metadata as DATA across the worker boundary (never re-parsing on the main thread, preserving the OOM fix): - C++: templateConstraints wired into worker node identity (SFINAE overload disambiguation) + ADL / inline-namespace capture side-channel serialized onto the ParsedFile. - Kotlin: companion-scope side-channel serialized the same way (companion / static dispatch). Validation: tsc + build clean; full suite green (10,190 pass — the only deterministic failures were the now-fixed C++/Kotlin worker-path gaps; the 2 remaining full-run failures are pre-existing load flakiness, green in isolation); cpp-pipeline benchmark stays linear on a 1-worker pool. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): wire C static-linkage side-channel + ADL O(1) collect + tri-review cleanups (#1983) Follow-up to the worker-pool-only refactor, from a tri-review of the parse path. - C static-linkage side-channel (P1): cProvider had no collect/applyCaptureSideChannel, so on the now-sole worker path C `static` file-local marks were lost across the worker boundary -> false cross-file CALLS edges + over-broad #include wildcard visibility on every C analysis (the Linux kernel is C). Mirror the C++/Kotlin wiring: serialize `staticNames` per file onto ParsedFile.captureSideChannel and restore it on the main thread (no re-parse). + a worker-path regression test (the existing c-static-isolation fixture passed vacuously — its collision resolves via #include before the global free-call fallback ever consults static-linkage). - captureSideChannel `kind` discriminant: add `kind:'cpp'`/`kind:'c'` tags + guards (Kotlin already had one) now that C/C++/Kotlin share the single generic field. - Perf: collectCppAdlSideChannel scanned the whole argInfoBySite/noAdlSites maps per file (O(F^2) per sub-batch, ~100M parseSiteKey calls at kernel scale). Add per-filePath lockstep indexes -> O(1) collect; serialized snapshot byte-identical. - Cleanups: inline the one-line processParsingWithWorkers wrapper into processParsing; drop the always-empty WorkerExtractedData.calls/assignments/constructorBindings fields; remove the voided astCache param from processParsing; refresh stale "sequential fallback" JSDoc. Validation: tsc + build clean; cpp 297/297, c 8/8 (incl. the new worker-path static-linkage guard), typescript + parsedfile-store green; cpp ADL benchmark stays linear. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(scope-resolution): index C/C++ #include resolution in finalize (O(n²)→O(n)) Kernel-scale C/C++ analysis ground in finalizeScopeModel because three per-#include operations each did a full O(F) scan with no index — the finalize O(n²) that surfaced once the #1983 parse-phase OOM was fixed: - expand{C,Cpp}WildcardNames: parsedFiles.find() per wildcard edge → O(R·F) - resolveImportTarget: new Set(allFilePaths) rebuilt per #include - resolveCImportTarget: suffix-match scanned all workspace paths Each is replaced with a WeakMap-per-pass index keyed on the stable parsedFiles/allFilePaths references that scope-resolution run.ts passes once per pass: - Map<ScopeId,ParsedFile> for wildcard expansion (c/static-linkage.ts + cpp/file-local-linkage.ts) - memoized augmented header set (c/scope-resolver.ts + cpp/scope-resolver.ts) - basename-bucketed suffix index in resolveCImportTarget (c/import-target.ts), shared by C and C++ since resolveCppImportTarget delegates to it Collapses the C/C++ finalize from O(R·F) to O(R+F). Pure-perf, byte-identical edge output: 962 targeted tests green (490 C + 472 C/C++ scope-resolution); the basename index preserves the exact endsWith('/'+target) match and the fewest-path-components-then-lexicographic tie-break. The kernel's ~25-30k .h headers are classified C++, so both providers must be fixed. Proven on the Linux kernel: the C finalize completed (sr-post-finalize lang=c → sr-end lang=c), which the pre-fix run never reached in 16+ min of grinding. Build-independent follow-ups (separate from this finalize fix), documented for later: emitFreeCallFallback same-name buckets (emit phase), buildGraphNodeLookup + precount global setup, the ParsedFile store-load, the dart/go/ruby expand-wildcards .find siblings, and the ~26GB scope-resolution memory floor (full kernel completion needs >~40GB RAM). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(bench): regenerate C scope-capture baseline for the #1983 c-static-linkage-worker fixture bench/scope-capture/measure.mjs fingerprints emitCScopeCaptures over the lang-resolution/c-* fixture corpus. The #1983 PR added the c-static-linkage-worker fixture (caller.c/lib.c/lib.h/local.c — the worker-path static-linkage side-channel test) but did not regenerate the C baseline, so `--check` has been red on this branch (main, lacking the fixture, still matches 0de009b). Pure fixture-corpus drift — no c/captures.ts or query change branch-vs-main, existing fixtures' captures byte-identical (c-captures.test.ts 45/45), scaling stays linear (~0.97). Regenerated: 0de009b -> 39f3a83. Bench now PASS (14 languages). Unrelated to the finalize O(n²) fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(scope-resolution): lower kernel-scale resident memory floor + setup cost Reduce the scope-resolution resident-memory floor and setup throughput on huge repos (Linux kernel), the wall that remains after #1983 (parse OOM) and the finalize O(n^2) fix (b71c77b8). Five units; all preserve byte-identical edge output (C fixture 177n/255e + c/cpp/cross-file/php/static-linkage suites green, 619 tests). U1 (src/cli/analyze.ts): RAM-aware auto heap-cap. Replace the hardcoded 16384MB cap with computeHeapCapMb = max(16384, floor(0.75*effectiveRAM)), where effectiveRAM = min(os.totalmem(), process.constrainedMemory()) with the unconstrained-sentinel guard. Add --max-semi-space-size=128 on the respawn. A user-supplied NODE_OPTIONS heap still wins (no re-exec). Verified: 23973MB on a 31964MB box, 16384 floor on small machines, cgroup-aware, sentinel safe. U2 (src/storage/parsedfile-store.ts, .../pipeline/phase.ts): export forceGc() and call it at the per-language eviction boundary, so a finished language's ParsedFiles are reclaimed before the next language's store-load instead of collected lazily under the next pass's allocation pressure (which at cap>=RAM degrades into swap-thrash). Measured on a real drivers/net/ethernet run: C 2113->894MB and C++ 1754->1057MB reclaimed at the boundary (no fragmentation defeat). Answers the plan's Open Question 1. U3 (src/storage/parsedfile-store.ts): intern def objects by nodeId in the load reviver so a SymbolDefinition's three serialized copies (localDefs / scope.ownedDefs / scope.bindings[].def) collapse to one shared object on load. Per-shard def pool (a def's copies are shard-local). Measured ~42% off the def-object retained heap (3->1; 1.8M->600k distinct objects on 600k defs). U4 (.../passes/free-call-fallback.ts): memoize pickUniqueGlobalCallable's post-filter candidate list per (name, callerFilePath), only when no per-caller visibility filter applies (the list is then a pure function of name+file), so repeated free calls of one name from a file reuse the same-name-bucket scan instead of re-walking a potentially huge bucket per site. The cached array is read-only-consumed by the .filter()-based arity/overload narrowers. Exported pickUniqueGlobalCallable + buildGlobalCallableIndex and added an equivalence test (memoized == un-memoized reference for every (name, file, arity), including warm-cache repeats and cross-file file-local exclusion). U5 (.../pipeline/phase.ts): replace the O(L*F) per-language precount + repeated scannedFiles.filter() with a single O(F) partition-by-language pass; bracket buildGraphNodeLookup with scope-setup-nodeLookup heap probes so the long setup is no longer silent. Plan: docs/plans/2026-06-06-001-perf-kernel-scope-resolution-memory-plan.md (U6 out-of-core global index deferred). Note: the kernel's full C++ pass floor (~20k headers + the 8.8GB graph) likely still exceeds 24GB by itself, which is why U6 remains the only unit that clears the wall. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(test): match OOM-guidance e2e assertions to the U1 reworded hint The analyze-heap-oom-e2e real-child-OOM test still asserted the pre-U1 wording ('...out of memory.' + a hardcoded 24576 cap). U1 reworded the hint to mention the auto heap-cap and use a <MB> placeholder, so the three toContain substrings no longer matched (the assertion at line 62 failed on all platforms). Update them to the current message. The unit twin (analyze-heap-respawn) was already updated in 85bfc216; this integration test was missed by the targeted local run. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(lbug): U6a — deterministic id-sorted graph output behind GITNEXUS_SORT_GRAPH_OUTPUT First increment of U6 (out-of-core scope-resolution). Adds an optional deterministic ordering of node + relationship CSV rows by their unique graph id, behind GITNEXUS_SORT_GRAPH_OUTPUT (default OFF = today's graph-insertion order, byte-identical — the iterator is returned untouched). With the flag ON the CSV becomes a pure function of the node/edge SET rather than of emit order. This is the structural enabler for the windowed/out-of-core resolve (U6b-U6d): csv-generator.ts:518 currently iterates graph.iterRelationships() in insertion order with NO terminal sort, so any deviation from parsedFiles-order emit would change bytes. With U6a on, a windowed emit need only reproduce the same edge SET, not the global insertion order — removing the single largest byte-identical hazard from every later windowing step. Verified: default off keeps the existing csv-pipeline suite byte-identical; on, node rows are id-sorted and output is independent of graph insertion order (set-build) with the same node/edge set. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(storage): U6d foundation — disk-backed scope store + lazy ScopeTree Adds scope-index-store.ts: persistScopeShards (per-file scope shards via the proven mapReplacer + def-interning reviver) + DiskBackedScopeTree, a lazy ScopeTree that serves getScope from a bounded LRU of decoded shards plus a small resident skeleton (scopeId -> {shard, childIds, parent}). Exports makeInterningReviver from parsedfile-store for reuse. This is the contained, highest-risk mechanism of U6d (out-of-core scope resolution): the emit passes reach the heavy per-Scope binding payload (~17-20GB on the kernel) ONLY through scopeTree.getScope (a point lookup) and getChildren — they never read parsed.scopes directly — so moving that payload to disk behind getScope is transparent. Every consumer reads a Scope BY VALUE, so a value-faithful disk round-trip is byte-identical to resolution. Proven in isolation: DiskBackedScopeTree is value-identical to buildScopeTree for getScope/getChildren/getParent/getAncestors/has/size across multiple files and after LRU eviction, and preserves the def-identity collapse (ownedDefs[i] === binding.def). Nothing wires it yet (the resolution-pipeline integration is the next increment) — zero production impact; default off. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(scope-resolution): U6d integration — seal scopeTree to disk before emit (GITNEXUS_DISK_SCOPE_INDEX) Wires the U6d out-of-core scope index into the live pipeline behind GITNEXUS_DISK_SCOPE_INDEX (default OFF = byte-identical). When on: - finalize-orchestrator builds a TransitionalScopeTree (validated, fully resident) instead of buildScopeTree, so finalize/propagate/resolve are unchanged. - After resolve, before emit, run.ts seals it: persists the scopes to a file-sharded scope-index-store, swaps the model's scopeTree to disk-backed serving from the inside (the frozen bundle can't be reassigned, but the wrapper nulls its own resident backing), and drops the heavy Scope.bindings payload from all THREE holders — the model's tree (seal), the caller's preExtractedParsedFiles, and run.ts's own parsedFiles (scope-stripped copies for emit). Emit reads scopes only via scopeTree.getScope (a point lookup, now disk-backed + LRU) — verified it never reads parsed.scopes. Purpose: lower the per-language resident PEAK (kernel C pass ~20→~12 GB by moving the ~8-9 GB scope payload to disk) so the analysis fits on smaller-RAM machines. At >=24 GB the full kernel already fits with U1-U5 (U2's 8.7 GB inter-language forceGc reclaim keeps each pass under cap) — empirically confirmed — so this is the sub-24 GB lever, not needed at 24 GB. Byte-identical evidence: DiskBackedScopeTree/TransitionalScopeTree return value-identical scopes vs buildScopeTree (getScope/getChildren/getParent/ getAncestors, across files + after LRU eviction + post-seal); emit reads only getScope + referenceSites; flag-off (394 tests) and flag-on-resident (91 tests) resolver suites stay green; an end-to-end A/B on a 212-file C+cpp+rust subset produced identical 17,444 nodes / 31,343 edges with the seal firing per language (c: 410→141 MB reclaimed). Kernel-scale peak-drop measurement pending the in-flight verdict run freeing memory. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(scope-resolution): U6d — id-back workspaceIndex so the disk seal can reclaim scopes The kernel run revealed the contained scopeTree seal didn't lower the heap: WorkspaceResolutionIndex held Scope OBJECTS (classScopeByDefId / moduleScopeByFile), built from every ParsedFile and live through emit, so the ~28k module + class scopes stayed pinned past the seal (sr-seal-pre 17,583 -> sr-seal-post 17,771 MB, no drop). It was the sole residual Scope-object holder (SemanticModel holds none). Fix: classScopeByDefId / moduleScopeByFile become id-backed ScopeByKeyView instances — a ReadonlyMap<K, Scope> facade over a K->ScopeId map + the scopeTree, whose .get fetches via scopeTree.getScope(id). The index now pins only ids, so once the tree seals to disk the scopes become collectible. Byte-identical: the view returns the same Scope the resident tree holds (or a value-identical revived one in disk mode), and iteration keeps the old insertion order. buildWorkspace ResolutionIndex takes an optional scopeTree (live pipeline passes it); without it (unit tests) the legacy direct Scope-object maps are returned unchanged. Verified byte-identical: 733 tests across workspace-index / imported-return-types / c / cpp / cross-file / go / java. Kernel peak-drop re-measurement to follow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(scope-resolution): U6d — precompute exportedCallableByName (fix disk-getScope thrash) The workspaceIndex id-backing freed the kernel scopes but exposed a throughput collapse: findExportedDefByName's workspace fallback (walkers.ts:1019) scanned EVERY module scope's bindings per unresolved free call, and under the U6d disk-backed scopeTree each module-scope access faulted a shard in from disk — lib ON went ~1min -> ~7.5min. Fix: precompute the fallback result once into WorkspaceResolutionIndex.exportedCallableByName (simpleName -> first module-local callable def, first-file-wins — the exact semantics the scan returned), built from the resident module-scope bindings at index-build time. findExportedDefByName now does an O(1) lookup with zero disk reads. Result: lib ON ~7.5min -> 21s (cache-warm), byte-identical 17,444/31,343; 758 tests green across workspace-index + c/cpp/cross-file/go/python. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: rename cryptic U-unit codes to descriptive names in comments The plan-unit shorthand (U3/U4/U6a/U6d/...) was meaningless in the code. Renamed in comments + test descriptions (no behavior change, byte-identical): out-of-core scope index (was U6) deterministic output (was U6a) disk-backed scope seal (was U6d) def-object interning (was U3) free-call candidate cache (was U4) Also renamed throughout the PR title/summary. Pushed commit messages keep their original U-codes as historical record. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): durable ParsedFile shards for warm-cache coverage (#2038) On a warm re-analyze where every chunk is a parse-cache HIT, no parse worker runs, the run-scoped ParsedFile store is cleared at parse start, and the cached ParseWorkerResult carries no ParsedFiles (the worker writes them to the store and empties them from the message). Scope-resolution then found an empty store and fell back to main-thread extractParsedFile — re-opening the #1983 tree-sitter native-leak OOM the disk store closes (abhigyanpatwari review on parse-cache.ts). Fix: workers ALSO write their ParsedFiles to a durable, content-addressed store (parsedfile-cache/) keyed by chunk hash, mirroring the parse cache's lifecycle (version-gated by PARSE_CACHE_VERSION, pruned in lockstep to the surviving keys). On a warm hit the chunk's durable shards are byte-COPIED into the run-scoped store (no re-parse, no re-serialize -> byte-identical), so scope-resolution streams them exactly as on a cold run. A coherence gate re-dispatches the worker whenever a cached chunk's durable shards are missing (migration / pruned / version-stale) -- never the main-thread extract. - worker-pool/parse-worker: thread chunkHash through dispatch->job->flush (incl. split/requeue) so the worker tags its durable shard by content - parsedfile-store: durable persist / restore / index / prune API (sibling dir, never cleared per run); content-addressing makes stale reuse impossible - parse-impl: load durable index, gate the cache hit on durable coverage, restore on hit, dispatch chunkHash on miss - run-analyze: prune+save the durable store to the parse cache's surviving keys - saveParseCache returns its written keys (the durable keepKeys) Verified on linux/lib: warm preExtractedHits = full coverage (520/207/1, zero main-thread re-parse), byte-identical cold==warm (17,456n/31,353e), warm 8.5x faster. New two-run + mixed-mode + coherence-gate regression test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): clear stale scope-index-store shards on each seal (#2038) The disk-backed scope index writes sequential s<n>.json shards into a shared <storagePath>/scope-index-store/ dir, with the index resetting per persistScopeShards call. A seal that writes fewer shards than a previous one (a later language with fewer files, or a re-run of a shrunken repo) left stale tail shards on disk indefinitely -- never read by the disk-backed tree, but multi-GB on kernel-scale repos. Add clearScopeIndexStore() and clear at the start of persistScopeShards: the previously sealed language has finished emit and been released before the next seal runs, so its DiskBackedScopeTree never reads those shards again. Unit tests: a stale prior-run shard is removed, a fewer-files re-seal leaves no tail shards, and the helper is idempotent. Addresses abhigyanpatwari review on run.ts (disk hygiene for the GITNEXUS_DISK_SCOPE_INDEX path). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-06 22:46:34 +01:00
Gergő Magyar	9f3bcee7fc	fix(cpp): resolve cross-namespace same-tail inheritance bases bridge-held (#1993) (#2005) ... * fix(cpp): resolve cross-namespace same-tail inheritance bases bridge-held (#1993) PR #1981's bridge fixed within-namespace same-tail heritage (NS::A::Inner vs NS::B::Inner). The residual: a cross-namespace same-tail base (NS1::A::Inner vs NS2::A::Inner) both key the namespace-omitted `A.Inner` in the qualifiedNames index, so resolveQualifiedInheritanceBase couldn't pick a winner and the deriving classes cross-wired (DB's EXTENDS bound to NS1's A::Inner). Fixed bridge-held via the existing `namespacePrefix` sidecar — no qualifiedName invariant flip, no resolution-index re-keying: (1) tagNamespacePrefixes also tags defs declared directly in a namespace (the deriving NS1::DA), composed identically to the class-nested path; (2) resolveQualifiedInheritanceBase breaks a same-tail tie by preferring the candidate whose namespacePrefix matches the deriving class's. Two-phase lookup, UDC, brace-init, file-local linkage untouched (def.qualifiedName + index keys unchanged). New cpp-cross-namespace-same-tail fixture + registry-primary test (in the cpp parity expected-failures). Verified: cpp suite 287/287 primary, 209 + 78 skips legacy — no regression; tsc + prettier clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cpp): worker-path parity for #1993 cross-namespace tie-break + correct narrative Add the missing parse-worker.ts parity describe for the #1993 cross-namespace same-tail heritage tie-break, mirroring the #1982/#1995 worker siblings (workerThresholdsForTest minFiles:1/minBytes:1, workerPoolSize:2, usedWorkerPool guard, and the same NS1.DA→NS1.A.Inner / NS2.DB→NS2.A.Inner base assertions), and register both worker test names in LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES['cpp'] (registry-primary-only, like the sequential entry). Closes the DoD sequential≡worker gap flagged in the tri-review of PR #2005. Also correct the fixture/test narrative: the pre-fix failure is a CROSS-WIRE (DB's EXTENDS binds NS1::A::Inner via the refuse-on-tie scope-walk fallback), not a silent miss — the empirical pre-fix run shows the edge exists but points at the wrong target. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(scope-resolution): type the namespacePrefix sidecar; regen cpp bench baseline (#1993) F4 follow-up to #1993: declare `namespacePrefix?: string` on SymbolDefinition (gitnexus-shared) and drop the six `as { namespacePrefix?: string }` casts in walkers.ts / graph-bridge/ids.ts that #1993 introduced. Pure type-level — the `as` assertions erase at compile time, runtime is byte-identical, and the field stays a sidecar (no graph-node identity; the qualifiedName-keyed index is untouched). Also regenerate the cpp scope-capture bench baseline: rebased onto main (now carrying #1995's cpp fixtures), #1993 adds cpp-cross-namespace-same-tail, growing the cpp-* corpus 272->273 and drifting the fingerprint d63ded6->6d6207ae. Pure fixture-corpus drift — no scope-extractor change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-04 10:34:56 +01:00
DuduPhudu	c2b4ec6c31	feat(vue): migrate Vue SFC to scope-based resolution (RFC #909 Ring 3, closes #940) (#1950) ... * feat(vue): migrate Vue SFC to scope-based resolution (RFC #909 Ring 3, closes #940) Adds `vueScopeResolver` and wires Vue into the scope-resolution pipeline (`SCOPE_RESOLVERS`, `MIGRATED_LANGUAGES`). Vue's `<script>` / `<script setup>` blocks are TypeScript — `emitVueScopeCaptures` extracts the script block via the existing `extractVueScript` utility and delegates to `emitTsScopeCaptures`, keeping grammar identity consistent with the cached tree the parse-worker already builds. - `languages/vue/captures.ts` — `emitVueScopeCaptures` - `languages/vue/import-target.ts` — `makeVueResolveImportTarget` (TS resolver + tsconfig path-alias support; explicit `.vue` imports resolve via the exact-path branch) - `languages/vue/scope-resolver.ts` — `vueScopeResolver` - `languages/vue/index.ts` — barrel + known-limitations doc - `languages/vue.ts` — `emitScopeCaptures` hooked up - `scope-resolution/pipeline/registry.ts` — Vue entry added - `registry-primary-flag.ts` — `SupportedLanguages.Vue` added to `MIGRATED_LANGUAGES` (production default → registry-primary) - `vue-composition-api` — `<script setup lang="ts">`, defineProps / defineEmits macros, cross-file TS imports, computed refs - `vue-options-api` — `defineComponent({methods, computed, data})`, this-based method calls, imported utility calls - `vue-cross-file` — composable functions returning class instances, multi-level import chains, UserModel/PostModel method calls - `fieldFallbackOnMethodLookup: true` — Options API `this.X()` calls may not resolve through the type-binding layer (no formal class); fallback catches common patterns via declared field names. - `allowGlobalFreeCallFallback: false` — Vue uses explicit imports; workspace-wide unique-name fallback would produce spurious edges for built-ins (ref, reactive, defineProps, …). - Template expression calls intentionally out of scope: component- reference CALLS edges are already emitted by the legacy template extractor. Remaining template gaps tracked in #1647. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(vue): address P0/P1 review findings from #1950 ## P0 #1 — missing scope-resolution hooks in vueProvider `pass3CollectImports` early-returns when `interpretImport` is undefined, producing zero IMPORTS and zero cross-file CALLS edges. Add the four hooks to `vueProvider` in `vue.ts`: - `interpretImport: interpretTsImport` - `interpretTypeBinding: interpretTsTypeBinding` - `bindingScopeFor: tsBindingScopeFor` - `importOwningScope: tsImportOwningScope` Also add `receiverBinding`, `mergeBindings`, `arityCompatibility`, and `resolveImportTarget` to complete the scope-resolution contract. ## P0 #2 — template-component CALLS dropped when Vue is registry-primary `isRegistryPrimary(Vue) → true` makes the main call-processor loop skip Vue files entirely, silencing the inline `vue-template-component` CALLS emitter at ≈L1506. Add a dedicated post-loop pass in `call-processor.ts` that emits template-component CALLS for Vue files whenever Vue is registry-primary. Update the stale `vue/index.ts` limitation comment to reflect the new emit site. ## P1 #3 — worker-mode double-extraction → zero captures In worker mode (≥15 files) the parse worker pre-extracts the `<script>` block and passes `scriptContent` as `sourceText`. `emitVueScopeCaptures` was calling `extractVueScript` a second time, getting null, and returning `[]`. Fix: if extraction returns null and the content has no SFC block- level markers (`<template`, `<style`), treat it as already-extracted script text and delegate directly to `emitTsScopeCaptures`. ## Test assertion strictness Replace all `toBeGreaterThanOrEqual(1)` assertions with exact `toBe(N)` counts. IMPORTS counts reflect per-symbol scope-based edges (value imports only; `import type` is not emitted as an IMPORTS edge). CALLS counts are 1 per single-call-site. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(vue): template-derived edges + pipeline benchmark (#1950 review) Addresses the reviewer's request for template edge attribution and a performance benchmark. ## Template event-handler CALLS (`vue-template-callback`) Add `extractTemplateEventHandlers` to `vue-sfc-extractor.ts`. Extracts bare single-identifier handlers from `@event="methodName"` and `v-on:event="methodName"` attributes. Inline expressions with arguments or operators (`@click="toggle(item)"`) are intentionally excluded. Wire into the dedicated registry-primary Vue template pass in `call-processor.ts`. For each extracted handler name, `ctx.resolve` finds the in-file Function/Method node and emits a CALLS edge with `reason: 'vue-template-callback'`. ## Template attribute-binding ACCESSES (`vue-template-attribute`) Add `extractTemplateAttributeBindings` to `vue-sfc-extractor.ts`. Extracts bare single-identifier values from `:prop="varName"` and `v-bind:prop="varName"` bindings. Member-access (`:key="post.id"`) and literals are excluded by the identifier-boundary regex. Wire into the same template pass. For each extracted variable, `ctx.resolve` finds the in-file node and emits an ACCESSES edge with `reason: 'vue-template-attribute'`. ## `vue/index.ts` limitations comment Updated to accurately describe all three categories of template-derived edges and explicitly document the complex-expression exclusions. ## Tests Add 6 new assertions in `vue-scope.test.ts`: - `@click="handleSave"` → CALLS `handleSave` (UserProfile.vue) - `@select="onPostSelected"` → CALLS `onPostSelected` (App.vue composition) - `@keyup.enter="addTodo"` → CALLS `addTodo` (TodoList.vue) - `@loaded="onUserLoaded"` → CALLS `onUserLoaded` (App.vue cross-file) - `:userId="currentUserId"` → ACCESSES `currentUserId` (App.vue composition) - `:posts="allPosts"` → ACCESSES `allPosts` (App.vue composition) Add `vue` entry to `LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES` in `helpers.ts` documenting which assertions are registry-primary-only (IMPORTS cardinality, template-derived edges, `<script setup>` export). ## Benchmark Add `vue-pipeline-benchmark.test.ts` (gated by `GITNEXUS_BENCH=1`). Generates N-component synthetic repos (10 / 25 / 50 / 100) and asserts that wall-clock and node counts scale sub-quadratically with component count, guarding against O(n²) regressions in the template extraction or scope-resolution passes. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(vue): BINDS_EVENT_HANDLER/EMITS_EVENT edges via ScopeResolver hook Per maintainer feedback on PR #1950: - Do not edit call-processor.ts (will be removed when all languages migrate) - Model Vue component-event system with dedicated edge types to avoid CALLS noise in deep component hierarchies (per contributor discussion) Changes: - gitnexus-shared: add BINDS_EVENT_HANDLER and EMITS_EVENT to RelationshipType - vue-sfc-extractor: add extractComponentEventBindings, extractNativeElementEventHandlers, and extractScriptEmitCalls - ScopeResolver contract: add optional emitPostResolutionEdges hook - run.ts: wire emitPostResolutionEdges after emitImportEdges - vue/scope-resolver: implement emitPostResolutionEdges emitting: 1. CALLS (vue-template-component) — PascalCase component File refs 2. CALLS (vue-template-callback) — @event on native HTML elements 3. BINDS_EVENT_HANDLER (vue-event: @name) — @event on component elements; source = handler fn in parent, target = child component File (not CALLS) 4. EMITS_EVENT (vue-emit: name) — emit() calls; self-loop on component File, joinable with BINDS_EVENT_HANDLER via Cypher for impact tracing 5. ACCESSES (vue-template-attribute) — :prop="var" bindings - call-processor.ts: revert dedicated Vue post-loop pass; moved to scope resolver - Tests and parity expected-failures updated accordingly Co-authored-by: Cursor <cursoragent@cursor.com> * fix(vue): close review gaps in scope/parity extraction Resolve the new PR #1950 review findings by widening Vue scope context to include TS/JS import closures, fixing BINDS_EVENT_HANDLER endpoint assertions, hardening emit/event extraction to avoid comment/property false positives, supporting kebab-case component tags, and ensuring parity runs include vue-scope suites. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(vue): address second review round — regex safety, emit coverage, arch Closes items raised in the Jun 2 review comment on PR #1950. Correctness fixes: - ReDoS mitigation: bound attribute-capture spans to [^>]{0,512}? in all three template tag regexes to prevent pathological backtracking. - Kebab-case misclassified as native: added (?![A-Za-z0-9-]) negative lookahead to NATIVE_TAG_RE so <post-list> is no longer split as native tag `post` with attrs `-list ...`. - Hyphenated event names dropped: widened TAG_EVENT_RE from [\w:.]+ to [\w:.-]+ so @user-loaded and @update:model-value are captured. - this.$emit silently dropped: collectBareEmitEventNames now allows this.$emit(...) by looking back past the '.' to verify preceding token is exactly `this`; socket.emit etc. remain blocked. - Event names with colon rejected: extended validator to accept update:modelValue and update:model-value patterns. Architecture fix: - Moved collectVueScopeFilePaths out of shared phase.ts into a new collectScopeContextPaths optional hook on ScopeResolver, keeping shared pipeline code language-agnostic. vueScopeResolver implements the hook. - Fixed memory leak: preExtractedByPath cleanup now iterates filePaths (all context files) not just primaryFilePaths (only .vue files). Cleanup: - Removed unused extractTemplateEventHandlers and duplicate EVENT_HANDLER_RE. - Fixed skipped comment numbers in emitPostResolutionEdges (1,2,4,5,6 -> 1-6). - Updated vue/index.ts: four categories -> five (added EMITS_EVENT). - Fixed gitnexus-shared EMITS_EVENT JSDoc to reflect File->File reality. Tests: 7 new unit tests covering hyphenated events, this.$emit, kebab-case native-tag exclusion, and update:modelValue event name validation. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(vue): eliminate double file-read and per-file template re-scans Two performance fixes from the self-review pass: 1. **No more double read of .vue files in phase.ts**: primary files were previously read once for `collectScopeContextPaths` (via `entryFileContents`) and again in the blanket `readFileContents(filePaths)` call. Now the primary-file map is passed directly and only the extra context files (TS/JS import closure) require a second I/O round-trip. 2. **Single template parse per .vue file in emitPostResolutionEdges**: previously each of the five extractor functions (components, native handlers, component event bindings, emit calls, attribute bindings) ran `TEMPLATE_RE.exec(content)` independently — five full-file scans per `.vue` file. Replaced with a new `extractVueTemplateEdgeData` batching helper that parses the template and script blocks once and feeds all five extractors from the pre-extracted content. emitPostResolutionEdges now calls a single function and destructures the results. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(parity): exclude TypeScript HOC/HOF/JSX scope-resolver tests from legacy DAG parity gate Three test files introduced in prior PRs exercise scope-resolver-only correctness wins: HOC-wrapped const declarations, HOF-callback caller attribution, and JSX-as-call CALLS edges. The parity runner's ${slug}-*.test.ts glob now picks them up, causing typescript [legacy] failures in CI. Fix: convert each file to use createResolverParityIt('typescript') and register all 26 legacy-failing test names in LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES.typescript with explanatory comments. Legacy mode: 11+11+4 tests skipped, zero failures. Registry-primary mode: all 37 tests pass as before. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(test): remove registry-primary-flag unit tests after migration complete All languages are now in MIGRATED_LANGUAGES; the per-language flip tests are no longer needed. Addresses PR #1950 review feedback. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-06-03 21:48:38 +01:00
Gergő Magyar	c60ad9f7ab	fix(ingestion): fully-qualified nested-type identity for C++/Ruby — structure (#1978) + resolution (#1982) (#1981) ... * fix(ingestion): qualify nested-type node identity for C++/Ruby (#1978) Nested types sharing a tail name in one file — C++ `Outer::Inner` vs `Other::Inner`, Ruby `Outer::Inner` vs `Other::Inner` modules — silently merged into a single graph node keyed by the simple tail (`Struct:file:Inner`), cross-wiring their methods/properties onto one owner. Key class-like type nodes (Class/Struct/Interface/Enum/Record) by their normalized fully-qualified path (`Struct:file:Outer.Inner`) instead of the simple name. Gated per-language by a new `qualifiedNodeId` config flag (default false → byte-identical for every other language); enabled here for C++ and Ruby. - class-types.ts / generic.ts: `qualifiedNodeId` flag on ClassExtractor + config - ast-helpers.ts: findEnclosingClassInfo gains an optional getQualifiedOwnerName hook + EnclosingClassInfo.qualifiedClassId, so member-owner edges resolve to the qualified class node id (owner id == node id by construction) - parsing-processor.ts + parse-worker.ts: flag-gated qualified node-id + owner edges on both the sequential and worker parse paths (incl. routed properties) - call-processor.ts: same qualifier in the routed-property pre-pass (lockstep with the worker `kind === 'properties'` block) - configs/c-cpp.ts, configs/ruby.ts: qualifiedNodeId: true Method/Property node ids stay simple-qualified; only type nodes get the qualified id. Deferred to a resolution-side follow-up: Ruby SAME-TAIL routed-property/mixin owner identity under registry-primary (`emitRubyMixinEdges` keys owners by the simple tail name, last-wins); and Rust inherent-impl methods (impl_item is not a typeDeclaration — its #1978 test is describe.skip). Tests: same-tail collision fixtures + #1978 resolver tests for C++/Ruby (positive owner identity, R7), a worker-path parity block, and an unambiguous nested attr_accessor case; the C++ #1975 out-of-line test updated to assert qualified-id distinctness (forward-decl + out-of-line now unify). Verified green on both parity legs, the worker path, and tsc. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ingestion): scope #1978 resolver tests to registry-primary leg; fix lint - helpers.ts: exclude the new #1978 C++/Ruby resolver tests from the legacy parity leg (LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES). They PASS on legacy too — the fix lives in the SHARED structure phase, not the legacy resolution path — so this is a deliberate registry-primary-only scoping (not a legacy gap), keeping the legacy path untouched and uncoupled from the new node-identity behavior. - rust.test.ts: drop the `eslint-disable vitest/no-disabled-tests` directive. That rule isn't configured in this repo, so eslint errored "Definition for rule 'vitest/no-disabled-tests' was not found" and failed `quality / lint`. The describe.skip needs no disable directive. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(test): satisfy CI for the new #1978 fixtures (format + golden + fingerprint) Adding the {cpp,ruby,rust}-nested-tail-collision fixtures changed the lang-resolution corpus, which the scope-capture golden snapshots and the fingerprint baselines gate on. These are pure fixture-corpus additions — #1978 does not touch the scope-capture phase (captures.ts / emit*ScopeCaptures are unchanged). Verified: the regenerated ruby/rust golden diffs are additive-only (no existing fixture's capture digest changed), so the cpp/ruby/ rust fingerprint drift is solely the new fixtures. - prettier --write test/integration/resolvers/{ruby,rust}.test.ts - regenerate ruby/rust captures-golden snapshots (UPDATE_GOLDEN=1; +1 fixture each) - rebaseline cpp/ruby/rust scope-capture fingerprints (bench/scope-capture/baselines.json) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(ingestion): extract shared qualified-name normalizer (#1982) Move normalizeQualifiedName/splitQualifiedName out of class-extractors/ generic.ts into utils/qualified-name.ts so the structure-phase buildQualifiedName, the scope-resolution inheritance resolver, and the per-language capture emitters can all key against ONE normalizer. A raw '::' qualifier must normalize to the exact '.'-joined key the QualifiedNameIndex already holds, or the qualified lookup silently misses (the #1982 resolution-side foundation). Pure relocation — byte-identical function bodies; tsc clean; existing C++ nested-collision tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): resolve same-tail C++ nested-type heritage to the correct qualified node (#1982) Registry-primary C++ inheritance (preEmitInheritanceEdges -> resolveInheritanceBaseInScope) resolved a same-tail nested base by its SIMPLE TAIL with first-wins, so `struct DerivedB : Other::Inner` mis-resolved EXTENDS to Outer.Inner (the wrong sibling; 0 dangling, so undetected). The namespace qualifier was discarded at the C++ inheritance capture. Fix (additive, qualified-first): - ReferenceSite gains an optional `rawQualifiedName`; the C++ inheritance capture emits `@reference.qualified-name` (qualifier-preserving, template-stripped: Other::Inner, ns::Base<T> -> ns::Base) only when the base is qualified, registered as a sub-tag so it can't shadow the `@reference.inherits` anchor. - resolveInheritanceBaseInScope resolves the qualifier against the full-path QualifiedNameIndex FIRST (which already carries Outer.Inner / Other.Inner keys from the structure phase), with progressive-prefix lookup for relative bases and refuse-on-tie, falling through to the existing simple-tail walk on miss — so unqualified bases and the single-candidate cross-file case are unchanged. Registry-primary cpp.test.ts 278/278 (incl. worker-path: rawQualifiedName survives worker serialization). Legacy leg unaffected (207 pass / 71 skip) — the new resolution-side assertions are registry-primary-only via helpers.ts. tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): resolve same-tail Ruby mixin/attr_accessor owners to the correct qualified node (#1982) emitRubyMixinEdges keyed its owner map by the SIMPLE tail (def.qualifiedName split-popped) with last-wins, and the __heritage__/__property__ markers carried only the immediate owner name — so `module Outer; class Inner` and `module Other; class Inner` collapsed onto one `Inner` key and cross-wired their include/attr_accessor edges onto whichever Inner was processed last. Fix (lockstep, full-qualified): - ruby/captures.ts: build the marker owner from the FULL enclosing class/module chain (buildEnclosingQualifiedName walks all ancestors, normalizing the compact `class Outer::Inner` scope_resolution form via the shared splitQualifiedName) so the marker owner byte-matches the resolution def's qualifiedName. - ruby/scope-resolver.ts: key graphIdByName by the full def.qualifiedName instead of the simple tail. Top-level owners/mixins are unchanged (full == simple). Registry-primary ruby.test.ts 142/142 incl. a new worker-path block (the deferred note's duplicate-edge concern: markers survive worker serialization, exactly one HAS_PROPERTY per attr). Legacy leg unaffected (136 pass / 6 skip) — new assertions registry-primary-only via helpers.ts. tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ingestion): rebaseline #1982 golden/fingerprint + lint/format sweep Cross-cutting verification artifacts for the #1982 same-tail resolution fix: - ruby capture golden regenerated: ONLY the ruby-nested-tail-collision fixture drifts (+10 capture groups from its new include/attr_accessor + the now full-qualified __heritage__/__property__ marker owner). All other ruby fixtures byte-identical (proves the owner-qualification is localized to nested owners). - bench/scope-capture/baselines.json: rebaseline cpp + ruby fingerprints (the only two that drift; 12 other languages byte-identical). cpp = additive @reference.qualified-name capture; ruby = the localized owner change. Provenance notes record both. scaling linear (~1.0), 14/14 PASS. - generic.ts: drop the now-unused normalizeQualifiedName import (lint error). - walkers.ts / ruby.test.ts: prettier formatting. Verified: cpp 278/278 + ruby 142/142 (registry-primary), both legacy legs clean (skips registry-primary-only assertions), go/java/csharp 542 (cross-language regression — the qualified-first branch is gated on rawQualifiedName, set only by C++, so non-C++ inheritance resolution is unchanged). tsc + eslint(0 errors) + prettier clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): resolve nested Ruby mixin included by short name (#1982) emitRubyMixinEdges keyed graphIdByName by the full def.qualifiedName on the owner side, but the __heritage__ marker carries the mixin target as the bare written name (arg.text). A nested mixin module included by its short name (include Loggable where it is App::Loggable) missed the full-qn map and its IMPLEMENTS edge was silently dropped (0 dangling, undetectable). The shipped same-tail fixture used only top-level mixin modules, so CI stayed green. Add a secondary simple-tail fallback map consulted only when the full-qn mixin lookup misses; owner lookups stay full-qn so same-tail owner disambiguation is preserved. Characterization test + fixture (registry-primary only); golden regenerated additively. Addresses PR #1981 review (4417182679) P1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): normalize qualified Ruby mixin arg in heritage marker (#1982) `include Outer::Mixin` embedded the raw `Outer::Mixin` into the ':'-delimited __heritage__ marker, so the `::` collided with the field separator and emitRubyMixinEdges mis-split it (className became empty), dropping the IMPLEMENTS edge. Normalize the mixin arg via splitQualifiedName(...).join('.') before emit so the marker carries the dotted form, which both parses correctly and matches the mixin def's qualifiedName. Simple names are unchanged (no golden drift). Addresses PR #1981 review (4417182679) secondary R2. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): resolve C++ same-tail nested heritage inside a namespace (#1982) A namespace-nested C++ type's scope-model qualifiedName carried its enclosing CLASS chain (A.Inner) but dropped the enclosing NAMESPACE, while the structure-phase graph node is keyed by the full path (NS.A.Inner). resolveDefGraphId's qualifiedKey therefore missed and fell back to simpleKey('Inner'), collapsing same-tail nested bases across sibling namespace members — DB : B::Inner pointed at NS.A.Inner. The shipped fixture was top-level only, so it could not catch this. Fix without disturbing the qualifiedName-keyed resolution index (an earlier attempt that rewrote qualifiedName regressed brace-init / UDC / two-phase namespace resolution): tagNamespacePrefixes records each namespace-nested def's enclosing-namespace prefix on a sidecar field, and resolveDefGraphId retries the node lookup with the namespace-prefixed key before the simpleKey fallback. The helper is language-agnostic (acts only on Namespace scopes) and opt-in — only the C++ provider calls it. Namespaced fixture + sequential & worker tests (registry-primary only). All 280 cpp resolver tests pass; tsc clean. Addresses PR #1981 review (4417182679) P2. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ingestion): worker-path parity for Ruby mixin IMPLEMENTS + C++ DerivedA (#1982) The Ruby worker-path parity block asserted only attr_accessor (HAS_PROPERTY); add an IMPLEMENTS assertion so a dropped/cross-wired mixin owner on the worker path is caught (the __heritage__ marker owner must survive serialization). The C++ worker heritage block asserted only DerivedB; add a DerivedA assertion with a toHaveLength(1) duplicate guard. Registry-primary only. Addresses PR #1981 review (4417182679) test-coverage gap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): distinct Rust same-tail nested-mod inherent-impl ownership (#1982) Rust methods live in `impl Inner` blocks, and findEnclosingClassInfo keyed the inherent-impl owner by the target's RAW tail (`Impl:lib.rs:Inner`), so two same-tail `impl Inner` blocks under different mods (mod outer / mod other) collapsed onto ONE Impl node and their methods cross-wired. The shipped fixture test for this was skipped/deferred. Qualify an UNSCOPED inherent-impl target by its enclosing `mod_item` scope (`outer.Inner`) in BOTH the owner walk (ast-helpers.qualifyRustImplTargetByModScope) and the Impl-node materialization (parsing-processor + parse-worker, lockstep) so the owner edge and node id agree byte-for-byte. Gated on the Impl label + impl_item + an unscoped type_identifier target — Rust-impl-exclusive, so C++/Ruby and the rust captures golden are untouched; a SCOPED `impl a::Inner` keeps its full raw text (#1975, unchanged). The previously-skipped distinct-ownership test is now active and passing; rust 170/170, cpp+ruby+golden 437/437, tsc clean. Done in-PR at maintainer request (was deferred as a follow-up). Addresses PR #1981 review (4417182679) test-coverage gap R7. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(ingestion): single qualified-name normalizer + module-scoped Ruby PROPERTY_PREFIX (#1982) Replace cpp/captures.ts's parallel normalizeCppNamespaceQName with the shared normalizeQualifiedName (behaviorally equivalent for C++ qualified-identifier inputs: '::'->'.' with leading/trailing-:: handling; no interior whitespace reaches it). Promote Ruby's PROPERTY_PREFIX to module scope alongside HERITAGE_PREFIX (was function-local — asymmetric with no behavioral effect). Maintainability only; cpp+ruby resolver suites 428/428, tsc clean. Addresses PR #1981 review (4417182679) maintainability item. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf+fix(ingestion): single enclosing-class walk + root-anchored base guard (#1982) U7 (perf): preEmitInheritanceEdges resolved the deriving class AND resolveQualifiedInheritanceBase re-walked findEnclosingClassDef for the same site. Resolve callerClass once and thread it into resolveInheritanceBaseInScope -> resolveQualifiedInheritanceBase -> enclosingScopeSegments, so the enclosing class is walked once per qualified site. Add a 'program' early-exit to buildEnclosingQualifiedName (ruby/captures.ts). Behavior-preserving. U8 (P3): a root-anchored C++ base ": ::A::Inner" names the GLOBAL type, but resolveQualifiedInheritanceBase prepended the deriving class's enclosing segments and could mis-bind to an enclosing-relative same-path type. Detect the leading "::" on the raw qualifier and try only the root-anchored key. Discriminating fixture + test (registry-primary only). cpp+ruby+rust resolver suites 599/599; tsc clean. Addresses PR #1981 review (4417182679) perf + P3 items. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ingestion): rebaseline ruby+cpp scope-capture fingerprints for new #1982 fixtures The four new fixtures (ruby-nested-mixin-shortname, ruby-qualified-mixin, cpp-namespaced-collision, cpp-global-base-anchor) grow the lang-resolution corpus, drifting the ruby and cpp order-independent capture fingerprints. Verified purely additive: the ruby captures golden shows only the two new fixtures added (existing byte-identical), and removing the two cpp fixtures reverts the cpp fingerprint to the prior baseline (so the U3/U6/U8 code changes are scope-resolution / behavior-preserving, not capture-emission). measure.mjs --check PASS (14 languages). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style(ingestion): prettier-wrap ruby resolver test call (#1982) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-03 16:23:17 +01:00
Sparsh	04ade15451	fix(rust): scope-resolution coverage gaps — F66,F68,F71,F72 (#1934) (#1974) ... * fix(rust): scope-resolution coverage gaps — F66,F68,F71,F72,F73 (#1934) * fix(rust): reviewer fixes — macro namespace, revert pattern:(_), drop variadic * fix(rust): wire macro resolution end-to-end + materialize unions (#1974 review) Addresses the outstanding #1974 review (second batch). Per maintainer decision, F72 is FULLY WIRED rather than documented capture-only. F72 macro — was a capture-only no-op (@reference.macro dropped downstream): - gitnexus-shared: add 'macro' ReferenceKind + Reference.kind; add MACRO_KINDS (['Macro']) and a MacroRegistry that resolves a macro invocation ONLY to a macro_rules! definition — never a same-named free function (the disjoint-namespace guarantee the review required). - scope-extractor: referenceKindFromAnchor @reference.macro -> 'macro'; normalizeNodeLabel 'macro' -> Macro. - resolve-references: route 'macro' sites through MacroRegistry. - emit-references / graph-bridge edges: 'macro' -> USES (kept out of the CALLS keyspace, which denotes function/method dispatch). - node-lookup isLinkableLabel: Macro is linkable, bridging the registry def to the legacy @definition.macro graph node. - rust query: capture macro_rules! as @declaration.macro; fix the scoped macro arm to capture the tail identifier, not the full path (P3). F71 union — the @declaration.struct scope capture had no graph node to resolve to (legacy RUST_QUERIES never captured union_item): - legacy query: capture union_item as @definition.struct so the union is materialized as a Struct node and is genuinely resolvable. - query.ts: document the deliberate union->Struct downgrade rationale. Tests: - rust.test.ts (parity-gated): pipeline-level union resolution + macro resolution (USES to the Macro, exactly one CALLS to fn, none to Macro). Macro resolution is registry-primary-only -> listed in LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES['rust']. - rust-coverage.test.ts: scoped-macro tail + macro-def capture assertions; reframed as capture-layer only, pointing at the pipeline tests. - new fixtures rust-macro, rust-union. F73: dropped from baselines.json _note (variadic was never implemented). Rebaselined the rust capture golden + scope-capture fingerprint (a5fdff2c..., scaling ~0.99, fixture_count 126). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style(rust): prettier-format the Reference.kind union (#1974) CI quality/format gate — collapse the multi-line 'macro' addition back to one line (fits the 100-col print width). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <abhigyan1.patwari@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-03 07:24:37 +01:00
azizur100389	b1445daf04	feat(cpp): rank user-defined conversions (#1829)	2026-05-27 06:36:23 +01:00
Gergő Magyar	5e8690f992	feat(progress): add per-language progress reporting to scope-resolution phase (#1813) ... * feat(progress): add per-language progress reporting to scope-resolution phase (#1741) The scope-resolution phase (which can run 74+ minutes on large Java/Kotlin repos) previously emitted zero progress updates, causing the CLI progress bar to freeze at ~49% with a stale "Parsing code" label — making users think the tool was stuck. - Add `scopeResolution` to PipelinePhase type and PHASE_LABELS - Add `onProgress` callback to `runScopeResolution` with per-file updates during the extract loop and sub-phase boundary markers (building scope model, resolving references, emitting edges) - Wire progress through `scopeResolutionPhase` with pre-counted file totals, per-language labels, and pipeline-wide percent mapping (90-95 internal) - Bump mro/communities/processes percent ranges to 95-100 to maintain monotonic progress after scope resolution - Add `scopeResolution` to mro's deps (latent ordering fix: mro reads EXTENDS edges that scope resolution writes via preEmitInheritanceEdges) * fix(progress): clamp overallRatio, fire final extract event, fix mro @deps JSDoc - Clamp overallRatio to [0,1] so percent never exceeds 95 when readFileContents drops files (langFileCount < totalScopeFiles) - Fire onProgress for the last file in the extract loop even when files.length is not divisible by progressInterval - Update mro @deps JSDoc to include scopeResolution * fix(progress): ensure bar redraws at every state transition - Fire initial 'extracting' event at file 0 so the sub-phase label appears immediately, not after progressInterval files - Emit a completion event at percent 95 when scope resolution finishes so the bar definitively reaches the phase ceiling before mro starts * feat(progress): improve UX with human-readable elapsed, language counter, cleaner labels - Format elapsed time as "5m 12s" / "1h 20m" instead of raw "(312s)" for all pipeline phases (CLI-wide improvement) - Add language counter "[1/3]" to scope-resolution detail so users know how many languages remain and which is active - Rename sub-phases for clarity: "building scope model" → "analyzing types", "emitting edges" → "linking symbols" - Remove nested parentheses from detail strings for cleaner display - Expand scope-resolution percent range from 5 to 8 points (90-98 internal → 54-59% display) for more visible bar motion - Re-allocate mro (98), communities (98-99), processes (99-100) * feat(progress): typed sub-phases, i18n locales, and test coverage - Extract ScopeResolutionSubPhase union type with exhaustive switch guard so adding a sub-phase without updating phase.ts is a compile error - Add scopeResolution key to en and zh-CN locale files so the web UI shows translated labels instead of raw message fallback - Extract formatElapsed to its own module with 7 boundary-value tests (0s, 59s, 60s, 3599s, 3600s, 3661s, 7323s) - Add runScopeResolution onProgress integration test proving sub-phase order (extracting → analyzing types → resolving references → linking symbols) and the 0-file early-return path --------- Co-authored-by: Test <test@example.com>	2026-05-25 11:53:54 +01:00
Sparsh	73a6a5376e	fix(cpp): thread call-site types into qualified member lookup (#1632) (#1810) ... * fix(cpp): thread call-site types into qualified member lookup (#1632) Widen Callsite (arity optional, add argumentTypes) and add optional callsite?: Callsite to ScopeResolver.resolveQualifiedReceiverMember. receiver-bound-calls.ts passes the ReferenceSite through structurally; resolveCppQualifiedNamespaceMember forwards it to narrowOverloadCandidates along with cppConversionRank, enabling exact-type and conversion-rank disambiguation across inline-namespace children. Behavior change: - outer::foo(42) where v1 declares foo(int) and v2 declares foo(double) now resolves to v1::foo (was: 0 edges, conservatively suppressed). - Same-name same-normalized-signature (e.g. foo(int) vs foo(long)) still suppresses at 0 edges via isOverloadAmbiguousAfterNormalization. - ADL using-import path (resolveAdlCandidates) unchanged — passes no callsite, narrowing degrades to existing pass-through behavior. Closes #1632. Part of #1564. * fix(cpp): update legacy parity expected-failure list for #1632 - Remove stale expected-failure entry for old diff-sigs test name (test now expects 1 edge; legacy DAG also emits 1 edge) - Add entry for normalized-signature ambiguity (int vs long) test - Rename describe block from 'conservative suppress' to 'distinct signatures resolved via call-site types' Verified both modes: REGISTRY_PRIMARY_CPP=1: 241/241 passed REGISTRY_PRIMARY_CPP=0: 194 passed, 47 skipped, 0 failed	2026-05-25 07:11:47 +01:00
Minidoracat	2b6e7ffbd9	fix(php): avoid Blade templates entering PHP analysis (#1790)	2026-05-23 23:37:40 +01:00
azizur100389	5f0c0eba0e	feat(cpp): Expand type_traits constraint registry (#1648)	2026-05-18 21:10:18 +01:00
Anton Fedotov	c30833fad3	perf(scope-resolution): use owner-keyed lookup for Step 2 member resolution (#1657) ... * perf(scope-resolution): use owner-keyed lookup for Step 2 member resolution (#1656) * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(scope-resolution): index Const/Static in FieldRegistry for Step 2 lookup Extend FieldRegistry to hold multiple defs per (owner, name), reconcile Const and Static into the owner-keyed index, and wire lookupAllByOwner through the production hook so Step 2 does not drop field kinds the registry never indexed. Pass explicitReceiver on read/write reference sites and document undefined-vs-empty hook semantics for defs fallback. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(scope-resolution): centralize O(1) owned-member hook and guard hot path Extract lookupOwnedMembersByOwner for the production Step 2 hook so merges stay O(1) per registry with no defs.byId scan. Add a perf-contract unit test that throws if byId.values runs when the hook is wired. Reuse a frozen empty sentinel on double miss to avoid per-probe allocations. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: drop unused buildFieldRegistry import * chore(scope-resolution): apply ce-code-review safe_auto fixes - Drop unreachable return + unused values() capture in perf-contract trap (Finding #7) - Type lookupOwnedMembersByOwner ownerDefId as DefId (Finding #9) - Add Static-kind Step 2 lookup test mirroring the Const case (Finding #11) * docs(field-registry): document lookupFieldByOwner first-wins semantics Audit of all 6 production callers (call-processor.ts:2279, walkers.ts:535, receiver-bound-calls.ts:380+730, type-env.ts:627+631) confirms none depends on last-wins precedence — all treat the return as a generic 'field with this name owned by this class'. Clarify the JSDoc to surface the semantic change introduced when FieldRegistry moved from last-wins to append-order storage (ce-code-review finding #2). * test(scope-resolution): extend Step 2 perf contract to implicit-self, MRO, field paths Adds three sibling tests under the Step 2 perf contract describe block, each asserting defs.byId.values() does NOT execute when ownedMembersByOwner is wired: - implicit-self receiver via typeBindings.self (no explicitReceiver branch) - 2-level MRO chain (Child extends Parent, save resolves on Parent at depth 1) - FieldRegistry read via Step 2 (property lookup, separate registry path) Pins the perf invariant on every distinct entry into walkReceiverTypeBinding so a regression bypassing the hook on any sub-path now fails CI immediately (ce-code-review finding #8). * test(resolve-references): cover arity-overload filtering via resolveReferenceSites Pins the orchestration-layer wiring of providers.arityCompatibility: hook returns [save(arity 1), save(arity 2)], referenceSite.arity = 1, arityCompatibility verdicts 'compatible'/'incompatible' by parameterCount, exactly one reference emitted with toDef = the arity-1 overload. registries.test.ts already covered arity at the buildMethodRegistry level; this adds the missing entry-point check that resolveReferenceSites threads providers correctly through to lookupCore.Step5 (ce-code-review finding #10). * test(resolve-references): add hook-on vs hook-off parity test Runs resolveReferenceSites twice on the same fixture (Parent.save method hit + Child.name field hit, Child extends Parent MRO chain) — once with ownedMembersByOwner wired to a synthetic registry, once with the hook absent so collectOwnedMembers takes the defs.byId fallback. Asserts: - stats are identical (sitesProcessed / referencesEmitted / unresolved) - referenceIndex.bySourceScope entries have equal length - toDef sets are equal - each per-site reference (including evidence and depth) is .toEqual Locks the semantic-parity claim in code while both paths still exist. Will be removed alongside the fallback in finding #1 (ce-code-review #3). * test(typescript): probe Step 2 MRO walk against ambient (declare class) base Adds typescript-ambient-base-class fixture with an export declare class AmbientBase + Derived extends AmbientBase and a call site d.ambientMethod(). Integration assertions: - Both classes are detected - EXTENDS edge Derived → AmbientBase emitted - CALLS edge to ambient.ts:ambientMethod resolved via MRO walk Probes the ce-code-review #6 concern that ambient-only owners (whose bodies are never parsed) might be silently skipped by Step 2 after the owner-keyed lookup change. Result: the call resolves correctly — the method signature inside the declare class body still flows through reconcileOwnership into model.methods, so the hook returns the right ancestor hits. Residual risk is empirically closed. * feat(scope-resolution): route nested types via owner-keyed TypeRegistry Closes the Step 2 contract footgun where 'hook returns [] = authoritative miss' silently dropped any owned def whose NodeLabel was outside the method/field if-chain in reconcileOwnership. - TypeRegistry: add nestedByOwner Map + lookupAllByOwner(owner, simple) + registerByOwner(owner, simple, def). Mirrors MethodRegistry/ FieldRegistry shape; cleared with the rest on cascade clear. - reconcileOwnership: route class-like NodeLabels (Class/Interface/Enum/ Struct/Union/Trait/TypeAlias/Typedef/Record/Delegate/Annotation/ Template/Namespace) via types.registerByOwner. New nestedTypesRegistered stat. Idempotent skip via nodeId match. - validateOwnershipParity: extend the I9 invariant check to nested types. - lookupOwnedMembersByOwner: merge methods + fields + nested-type hits; short-circuit when any one source contributes the full result. Unblocks future receiver-MRO registries that need to resolve 'Outer.Inner' through the receiver's type-binding chain (ce-code-review finding #5a). * refactor(scope-resolution): make ownedMembersByOwner required; delete byId fallback Per ce-code-review finding #1, the optional-hook design encoded a silent O(|defs|) perf cliff into the type system: any RegistryContext built without the hook regressed Step 2 to scanning every def per probe with no warning. Production wires the hook unconditionally; the fallback was exercised only by tests. - RegistryContext.ownedMembersByOwner: required, returns readonly SymbolDefinition[] (no | undefined). Implementations MUST return [] on authoritative miss. - collectOwnedMembers in lookup-core.ts collapses to a one-line forward to the hook; the defs.byId.values() scan and simpleNameOf helper are deleted (simpleNameOf had no other consumers). - ResolveReferencesInput.ownedMembersByOwner: required to match. - Tests: drop three fallback-path tests (registries Const fallback, resolveReferenceSites no-hook fallback, resolveReferenceSites Const- undefined fallback) and the hook-vs-fallback parity test added by finding #3. makeCtx in registries.test.ts now defaults to a real owner-keyed scan over the test fixture defs so tests that don't care about the hook keep working. * perf(free-call-fallback): cache global callables by simple name once per pass pickUniqueGlobalCallable scanned scopes.defs.byId.values() on every free-call fallback site. After PR #1656 fixed Step 2, this scan became the dominant remaining O(|defs|) hot path on large repos (ce-code-review finding #4). - buildGlobalCallableIndex builds a Map<simpleName, SymbolDefinition[]> over scopes.defs once at the top of emitFreeCallFallback. Same filter the per-site scan applied: Function / Method / Constructor, keyed by the last .-segment of qualifiedName. - pickUniqueGlobalCallable consumes the prebuilt index via O(1) Map.get instead of iterating every def. Per-site complexity drops from O(|defs|) to O(|defs with this simple name|). - Cost: O(|defs|) once per pass instead of O(|defs| * |free-call sites|). Subsequent narrowing (arity, conversion-rank) and the model-side fallback (model.symbols.lookupCallableByName + model.methods.lookupMethodByName) are unchanged. * chore(autofix): apply prettier + eslint fixes via /autofix command * ci: trigger build --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Gergo Magyar <abhigyan1.patwari@gmail.com>	2026-05-18 13:14:27 +01:00
azizur100389	2376912ca7	feat(ingestion): Add C++ parameter type class sidecar (#1642) ... Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-05-16 21:44:26 +01:00
Zander Raycraft	a4dfebd073	feat(cpp): sfinae filter (#1623) ... * feat(cpp): SFINAE-aware overload filter — drops candidates whose enable_if_t / requires constraints fail (#1579) * fix(cpp): SFINAE follow-ups for is_integral_v/is_arithmetic_v bool and char support, an unqualified F1 test fixture, and parameter-lookup gap documentation (#1579) -> claude feedback * revert: reverting all changes to .md files	2026-05-16 20:23:13 +01:00
Copilot	586dbf7aa1	feat(cpp): disambiguate template specializations in class graph IDs and receiver routing (#1587) ... * Initial plan * fix(cpp): disambiguate template specializations in class graph IDs Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/c929edb2-f2e9-41c6-a2e9-2092b967f603 * fix(cpp): guard template-specialization class lookup fallback Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/c929edb2-f2e9-41c6-a2e9-2092b967f603 * fix(cpp): address github-actions inline review findings Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/68d8fbac-4ff4-47f7-b732-eaf2c2f94043 * fix(cpp): cover template-type receiver binding for specialization routing Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/9505dfcd-3fb6-4bc2-a134-f60fe0dc8cd9 * chore(cpp): clarify specialization-binding fallback assumptions Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/9505dfcd-3fb6-4bc2-a134-f60fe0dc8cd9 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-05-14 15:00:29 +01:00
WENJIE HUANG	e01f0912bc	feat(cpp): migrate C++ to scope-based resolution model (#938) (#1520) ... * fix(cpp): complete scope-resolution parity * fix(ci): resolve formatting, lint errors for PR #1520 - prettier: format arity-metadata.ts, captures.ts, index.ts - eslint: rename unused HEADER_GLOB to _HEADER_GLOB - eslint: replace unsafe parser.parse() with parseSourceSafe() - eslint: suppress intentional console.warn/log in sync.ts - eslint: remove unused _it import alias in cpp.test.ts * fix(ci): complete formatting, lint, and typecheck fixes - prettier: format call-processor.ts, imported-return-types.ts, include-extractor.test.ts, cpp-captures.test.ts, cpp-imports.test.ts - eslint: suppress intentional console.warn in manifest-extractor.ts - typecheck: restore 'thrift' in ContractType union (was accidentally removed) and add thrift case to exhaustive switch in manifest-extractor * fix(ci): revert unintended group module changes that broke tests Restore types.ts, config-parser.ts, matching.ts, sync.ts, and manifest-extractor.ts to upstream/main versions. The original commit accidentally removed fields (thrift, workspace_deps, exclude_links_paths, exclude_links_param_only_paths) from DetectConfig/MatchingConfig/ContractType which are still referenced by matching.test.ts, config-parser.test.ts, sync.test.ts and other integration tests. This PR's scope is C++ scope-resolution parity only — group module type definitions and logic should remain unchanged. * fix(codeql): address security and quality alerts - arity-metadata.ts, interpret.ts: replace single-pass template strip regex (/<[^>]*>/g) with a while-loop to fully handle nested templates like Map<List<int>> — resolves 'Incomplete multi-character sanitization' - cpp.test.ts: remove unused vitest 'it' import since the file defines its own 'it' via createResolverParityIt — resolves 'Assignment to constant' - include-extractor.test.ts: use fs.mkdtempSync() instead of predictable os.tmpdir()+Date.now() paths — resolves 'Insecure temporary file' - interpret.ts: remove redundant 'name !== undefined' check (already guaranteed by early return) — resolves 'Comparison between inconvertible types' * review: address Claude review findings on PR #1520 - Findings 1-3 (BLOCKERS): restore include-extractor.ts and its test to the main baseline. Block-comment fallback regression, suffix-resolve false-positive suppression, and the four deleted regression tests (#3-#6) are now back. These changes were unrelated to C++ scope parity and should not have been in this PR. - Finding 4 (MAJOR, partial): revert COMPOUND_RECEIVER_MAX_DEPTH 6 to 4. No C++ test exercises depth > 4 (cpp-chain-call uses a 2-hop chain), so the bump risked silent regressions on other migrated languages without justification. The wildcard-origin propagation in imported-return-types.ts is retained — C++ #include and using namespace both emit wildcard-origin bindings (cpp/import-decomposer .ts:40,90), so wildcard propagation is causal to C++ parity. - Finding 6: tighten write-access dedup test with exact per-field counts (nameWrites = 2, addrWrites = 1) instead of total-count + sub string containment, so a regression in one of the two name writes can no longer be masked. - Finding 8: skipped. Box-drawing characters in cpp/query.ts comments match the established convention used in csharp/java/php query files. Finding 5 (int/long normalization tie-breaker) left as documented follow-up — proper fix requires resolver-level tie-breaker logic and risks regressing other arity-matching tests. * fix(cpp): stop #include from leaking class methods and namespace members (U1) The C++ registry-primary resolver was emitting impossible CALLS edges for ordinary headers: an including file's unqualified save() resolved to User::save and unqualified foo() resolved to ns::foo. Two leak paths converged on localDefs: 1. expandCppWildcardNames (file-local-linkage.ts) iterated the flattened localDefs and exported every simple tail, including class-owned methods and namespace-contained symbols. Replaced with a scope-aware filter: build nodeId -> owning Scope from Scope.ownedDefs and skip defs whose owning scope is Namespace or Class. 2. The shared global free-call fallback's pickUniqueGlobalCallable walks the workspace registry by simple name and would still hit class methods / namespace members even with wildcard expansion fixed. Plugged the gap via the existing isFileLocalDef hook — semantically 'logically invisible cross-file' — by tracking per- file non-globally-visible nodeIds (populateCppNonGloballyVisible, called from populateOwners) and adding an ownerId !== undefined fast-path for class-owned defs. Side fix in shared finalize-algorithm.ts: when wildcard expansion resolves to a real target but produces zero propagating names, the edge was dropped, taking the file-level IMPORTS edge with it. Preserve the original wildcard edge so #include dependencies survive even when the header exposes no unqualified bindings. Tests: cpp-include-no-class-leak, cpp-include-no-namespace-leak, and cpp-anon-ns-same-file-visible fixtures. Negative tests mode-gated to REGISTRY_PRIMARY_CPP=1 via the expected-failures registry — legacy DAG has no scope-aware filtering on the global fallback; backporting is out of scope. All 2104 resolver integration tests pass under registry-primary mode. * fix(cpp): suppress receiver-bound CALLS when integer-width overloads collide (U2) C++ arity-metadata normalizes int, long, short, unsigned, size_t to 'int' so single-candidate flows like 'process(42L)' match a 'long'- typed parameter via loose matching. But when both 'process(int)' and 'process(long)' coexist as method overloads, they both end up with parameterTypes=['int'] in the registry, and pickOverload's narrowing returns 2 candidates with no way to disambiguate. The previous code picked candidates[0] arbitrarily, emitting a CALLS edge to the wrong overload roughly half the time. Fix: - Add isOverloadAmbiguousAfterNormalization in overload-narrowing.ts that detects >1 candidate sharing identical parameterTypes sequences. - Have pickOverload return a new OVERLOAD_AMBIGUOUS sentinel when this fires. - In the receiver-bound-calls loop, when pickOverload signals ambiguity, suppress the edge AND add the site to handledSites so the late-stage emitReferencesViaLookup pass does not re-emit the pre-resolved reference. Without the handled-mark, the reference index still carries a toDef and emits the same wrong edge. Graph schema has no ambiguous-target edge model, so emitting two edges (one per candidate) would require a separate schema change. Zero-edge is the only safe outcome. Other languages: the ambiguity check is a precondition gate, not a behavior change for normal narrowing. Languages whose normalizers do not collapse distinct types into a single token (verified by grep over *-arity-metadata.ts) will never produce >1 candidate with identical parameterTypes from genuinely distinct declarations, so the branch is effectively C++-only in practice. Test: cpp-overload-int-long fixture asserts exactly .toBe(0) CALLS edges. Count=1 = arbitrary pick (the bug); count>1 = unsupported ambiguous-edge model. Mode-gated to REGISTRY_PRIMARY_CPP=1 — legacy DAG has no OVERLOAD_AMBIGUOUS wiring; backporting is out of scope. All 2105 resolver integration tests pass under registry-primary; all 139 cpp tests pass under both modes (3 negative tests skipped in legacy as documented). * test(cpp): add integration coverage for anonymous-namespace, using-namespace conflict, and std-shim leakage (U3+U4+U5) Three new end-to-end fixtures exercise the resolver pipeline against scenarios that previously had only unit-level coverage or no coverage at all (Claude review Finding 7): U3 — cpp-anon-ns-cross-file: helper.cpp declares 'namespace { void worker(); }' and calls it internally. caller.cpp declares a separate 'void worker()' and calls it. Asserts (a) the cross-file CALLS edge from caller's run() does not target helper.cpp's anonymous-namespace worker, and (b) the same-file edge from helper_entry() to its own worker still resolves (positive guard against a 'no edges at all' regression making the negative check vacuously pass). Includes a state-isolation guard that re-runs the same fixture and asserts identical results, proving clearFileLocalNames() is called by the pipeline entry. U4 — cpp-using-namespace-conflict: Two headers each declaring 'namespace a { foo() }' and 'namespace b { foo() }' respectively, plus a caller doing 'using namespace a; using namespace b; foo()'. Asserts exactly zero CALLS edges. One edge = arbitrary pick (the bug); two edges would require an ambiguous-target edge model GitNexus does not have. Depends on U1 — without scope-aware filtering, both foo()s would already be in the importer's wildcard binding set as simple 'foo', so the test would pass for the wrong reason. U5 — cpp-using-namespace-std-smoke: Fixture-local 'namespace std { void cout_write(); void println(); }' shim rather than real <iostream> — captures the wildcard-leak shape deterministically without depending on system-header modeling stability (out of scope per plan). Asserts (a) the project-local call resolves correctly, (b) no leak to shim STL symbols, and (c) no CALLS/ACCESSES edges from the caller into std-shim.h at all. Negative tests for U2/U4 mode-gated to REGISTRY_PRIMARY_CPP=1 via the expected-failures registry; legacy DAG lacks the OVERLOAD_AMBIGUOUS suppression and the namespace-aware filtering, so the leaks persist there. All 2112 resolver integration tests pass under registry-primary; all 146 cpp tests pass under both modes (4 negative tests skipped in legacy as documented). * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(cpp): scope-aware isSuperReceiver classification (U1) The C++ isSuperReceiver hook used a regex `/^[A-Z]\w*::/` that misclassified any uppercase-qualified call as a super-receiver call. Singleton::getInstance(), std::Foo::bar(), and PascalCase namespace calls all entered the super branch, where the absence of an enclosing class (or wrong MRO context) dropped the resolution entirely. Fix: - New optional ScopeResolver hook isSuperReceiverInContext(text, callerScope, scopes). Languages where super classification depends on caller context define it; receiver-bound-calls.ts prefers it when defined and falls back to the simple isSuperReceiver(text) otherwise. Other migrated languages (Python, Java, C#, PHP, Go, TypeScript) are unchanged. - C++ implementation: parse the LHS of '::' from the receiver text, resolve via findClassBindingInScope, and return true only when the LHS is a class-like def in the caller's enclosing class's MRO. Returns false for namespace LHS, unresolved LHS, self-class LHS (qualified self-calls aren't super), and any non-'::' form. - Extended the C++ tree-sitter query to capture the LHS of qualified_identifier as @reference.receiver so qualified static member calls (Singleton::getInstance()) reach the receiver-bound Case 2 (class-name receiver) path. Without the receiver capture, qualified calls had no explicit receiver and could not resolve through any receiver-bound branch. Test: cpp-namespace-qualified-not-super fixture. Singleton::getInstance() from a free function asserts exactly 1 CALLS edge through the qualified-call path. Passes under both REGISTRY_PRIMARY_CPP=1 and =0. All 2113 resolver integration tests pass; all 147 cpp tests pass under both modes. * fix(cpp): suppress receiver-bound CALLS when default-arg overloads collide (U4) ISO C++ rejects 's.f(1)' as ambiguous when both 'void f(int)' and 'void f(int, int = 0)' are declared on S. The previous resolver returned the first viable candidate via pickOverload's fallback. Extended isOverloadAmbiguousAfterNormalization to take an optional argCount: when provided, the predicate compares only the first argCount slots of each candidate's parameterTypes. Candidates whose declared-prefix matches up to argCount are treated as ambiguous because default arguments make all of them equally viable for the call. Without argCount, behavior is unchanged (the original int/long normalization-collapse contract, full-length equality required). pickOverload now passes site.arity so default-arg ambiguity fires. Test: cpp-overload-default-arg-ambiguous fixture. s.f(1) where S has f(int) and f(int, int = 0) asserts exactly .toBe(0) CALLS edges. Passes under both REGISTRY_PRIMARY_CPP=1 and =0. All 2114 resolver integration tests pass; all 148 cpp tests pass under both modes. * fix(cpp): two-phase template lookup suppresses dependent-base members (U3) ISO C++ two-phase name lookup: inside a class template body, unqualified calls MUST NOT bind to members of a dependent base class. Only this->name or Base<T>::name forms make the lookup dependent. GCC and Clang both reject the unqualified form with 'declaration of f must be available'. Before this fix, GitNexus's global free-call fallback walked the workspace registry by simple name and bound unqualified calls inside template bodies to dependent-base members, producing CALLS edges the compiler would reject. Implementation: - New languages/cpp/two-phase-lookup.ts module: per-pipeline state recording (className, dependentBaseName) pairs at capture time and resolving them to nodeId sets during populateOwners. - captures.ts detectCppDependentBases walks the AST once finding every template_declaration containing a class/struct definition. For each, it collects template-parameter names (typename T, class T, non-type int N, template-template parameters) and walks each base in the base_class_clause checking whether any inner type_identifier matches a template parameter. Conservative bias: typename T::U, decltype, and template-template-parameter shapes also classified as dependent. - Extended scope-resolution contract's isCallableVisibleFromCaller hook with optional callerScope and scopes fields. C++ implements the hook to consult isCppDependentBaseMember: when the candidate is a member of a dependent base of the caller's enclosing class, the hook returns false and pickUniqueGlobalCallable skips the candidate. - clearFileLocalNames also clears the dependent-base state per pipeline run. Fixtures: - cpp-two-phase-dependent-base: Derived<T> deriving from Base<T>, unqualified f() and i inside Derived's body. Asserts zero CALLS edges and zero ACCESSES edges respectively. - cpp-two-phase-this-qualified, cpp-two-phase-non-dependent-base, cpp-two-phase-namespace-free-call-inside-template: positive fixtures left as documented gaps (this-> and qualified-name resolution inside template bodies are pre-existing resolver weaknesses independent of U3). Tracked separately. Negative test mode-gated to REGISTRY_PRIMARY_CPP=1 via the expected- failures registry; legacy DAG has no two-phase lookup. All 2116 resolver integration tests pass under registry-primary; all 150 cpp tests pass under both modes (5 negative tests skipped in legacy as documented). * fix(cpp): implement V1 ADL (Koenig lookup) for free-function calls (U2) Plan 2026-05-13-001 U2. Adds argument-dependent lookup as a new candidate-generating tier in `emitFreeCallFallback`: when ordinary unqualified lookup is empty, ADL surfaces candidates from each value-class-typed argument's enclosing namespace. V1 boundary (locked by cpp-adl-pointer-arg-boundary fixture): - only direct enclosing-namespace closure - only directly-named class-type values (pointer / reference / template- spec args excluded; closure rules deferred to V2) - ADL fires ONLY when ordinary lookup is empty (no union-and-resolve) Parenthesized name `(f)(s)` suppresses ADL per ISO C++ [basic.lookup.argdep]/3.1. Multi-candidate ambiguity (e.g. `process(int)` vs `process(long)` after C++ int-width normalization) returns the ADL_AMBIGUOUS sentinel — caller suppresses entirely, mirroring the OVERLOAD_AMBIGUOUS contract from plan 2026-05-12-002 U2. Implementation: - `cpp/adl.ts` — new module: per-pipeline argInfoBySite + noAdlSites Maps populated at capture time, classToNamespaceQualifiedName Map populated during populateOwners; `pickCppAdlCandidates` returns SymbolDefinition | ADL_AMBIGUOUS | undefined - `scope-resolution/contract/scope-resolver.ts` — adds optional `resolveAdlCandidates` hook - `scope-resolution/passes/free-call-fallback.ts` — invokes ADL hook between `findCallableBindingInScope` and `pickUniqueGlobalCallable`; marks site handled on `'ambiguous'` so emit-references doesn't retry - `cpp/captures.ts` — detects `parenthesized_expression` function wrap; per-arg classification (pointer/reference/value class) preserving the shape info the existing arity-narrowing normalizer strips - `cpp/scope-resolver.ts` — registers hook, populates associated namespaces, clears state in loadResolutionConfig Negative tests (parens, pointer-boundary, ambiguous) gated under LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES.cpp — legacy DAG has no V1/V2 ADL boundary or ADL_AMBIGUOUS suppression. 154/154 cpp integration tests pass under REGISTRY_PRIMARY_CPP=1; 147 pass + 7 skipped under =0 (legacy parity baseline). * fix(cpp): inline namespace transitive walking + qualified namespace resolution (U5) Plan 2026-05-13-001 U5. Two ISO C++ inline-namespace semantics: 1. Unqualified-lookup transitive visibility: inline-namespace members reach the enclosing namespace's scope as if declared there. The `populateCppNonGloballyVisible` exemption keeps them globally visible so cross-file unqualified lookup finds them. 2. Qualified-receiver transitive visibility: `outer::foo()` resolves to `outer::v1::foo()` when `v1` is inline (and through arbitrarily-deep nesting like `outer::v1::experimental::foo`, matching libc++ `__1` / libstdc++ `__cxx11`). The second behavior required a new resolver case in `receiver-bound-calls.ts` (Case 1.5: language-specific qualified-receiver member lookup) because C++ qualified-namespace member calls had no prior resolution path — receiver-bound Case 1 only handled `ParsedImport.kind === 'namespace'` (Python/JS-style) and Case 2 handles class receivers, neither of which fired for `outer::foo()`. The new hook `resolveQualifiedReceiverMember` is opt-in; languages without C++-style qualified-name semantics omit it. Implementation: - `cpp/inline-namespaces.ts` — new module: per-pipeline `inlineNamespaceRangesByFile` + `inlineNamespaceScopeIds` Sets; `markCppInlineNamespaceRange` at capture time; `populateCppInlineNamespaceScopes` resolves ranges → scope IDs; `resolveCppQualifiedNamespaceMember` walks namespace scopes by simple name and descends transitively through inline children only. - `scope-resolution/contract/scope-resolver.ts` — adds optional `resolveQualifiedReceiverMember` hook to the contract. - `scope-resolution/passes/receiver-bound-calls.ts` — Case 1.5 invokes the hook between Case 1 (namespace imports) and Case 2 (class-name receiver). Returns undefined for non-namespace receivers so Case 2 still resolves class-qualified calls. - `cpp/captures.ts` — detects `inline` keyword child on `namespace_definition`; records 1-based range to match Scope.range. - `cpp/file-local-linkage.ts` — `populateCppNonGloballyVisible` exempts inline-namespace scopes so cross-file unqualified lookup keeps their members visible. - `cpp/scope-resolver.ts` — wires `populateCppInlineNamespaceScopes` into populateOwners (BEFORE `populateCppNonGloballyVisible` so the exemption sees populated state); registers `resolveQualifiedReceiverMember` hook. 4 fixtures: `cpp-inline-namespace-unqualified`, `-versioned`, `-nested` (two transitive inline hops, STL `__1` shape), and `-adl-participation` (composes with U2 — ADL surfaces records declared inside inline child namespaces). All 4 assert exactly 1 CALLS edge with correct target file. Versioned fixture gated under LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES.cpp — legacy DAG can't disambiguate two same-name foos without inline awareness. Other 3 coincidentally resolve in legacy. 158/158 cpp integration tests pass under REGISTRY_PRIMARY_CPP=1; 150 pass + 8 skipped under =0 (legacy parity baseline). * test(cpp): Phase 5 cross-unit composition tests for U1/U2/U3/U5 Plan 2026-05-13-001 Phase 5. Locks in correct behavior at the intersections between the previously-shipped scope-resolver units. Enhancement to U1: `isSuperReceiverInContext` strips template-argument lists (`Base<T>` → `Base`) and namespace prefixes (`outer::v1::Base` → `Base`) before resolving the receiver in the caller's scope chain. This makes the super-receiver classification work for template-class heritage shapes like `Base<T>::method()` and `outer::v1::Base<T>::f()`. Three fixtures + four tests: - `cpp-phase5-u1-u3-qualified-base-call`: `template<class T> struct Derived : Base<T>` with `Base<T>::method()` inside a template body. Asserts NO mis-routing (count = 0) — documents the V1 gap that template-class inheritance isn't captured as EXTENDS by the legacy DAG, so MRO walks are empty and the super branch can't dispatch. The composition still works correctly: U1's template-arg-stripping classifies `Base<T>` as a super candidate, but the empty-MRO terminates without false edges. - `cpp-phase5-u2-u3-adl-from-derived`: `Derived : Base<T>` where `Base::record` shadows `audit::record`. Unqualified `record(e)` inside the template body should resolve via ADL to `audit::record` (because U3 + the `isFileLocalDef` class- owned filter suppress `Base::record`). Asserts 1 edge to audit.h and 0 edges to base.h. - `cpp-phase5-u3-u5-inline-base`: `template<class T> struct Derived : outer::v1::Base<T>` where `v1` is inline. Unqualified `f()` inside `Derived<T>::g()` should NOT bind to Base::f (dependent-base suppression even across inline namespace prefix). Asserts count = 0. Phase 5 tests asserting no-false-positives are gated under LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES.cpp — legacy DAG over- resolves without the template-arg-stripping qualified-receiver path and without two-phase dependent-base suppression. 162/162 cpp integration tests pass under REGISTRY_PRIMARY_CPP=1; 152 pass + 10 skipped under =0 (legacy parity baseline). --------- Co-authored-by: HuangWenjie <zhoudeng.hwj@alibaba-inc.com> Co-authored-by: Gergo Magyar <gergomagyar@icloud.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-05-14 09:30:52 +01:00
Gergő Magyar	8083c39f6d	feat(php): migrate PHP to scope-based resolution model (#938) [supersedes #1124] (#1497)	2026-05-12 16:56:31 +01:00
Gergő Magyar	152a0506c9	feat: shared resilient-fetch (retries + circuit breaker) (#1448) ... * feat: shared resilient-fetch (retries + circuit breaker) Add a small, runtime-agnostic resilience layer in gitnexus-shared and migrate every backend HTTP outbound call (CLI, MCP, wiki LLM, web → backend) through it. Helpers (gitnexus-shared/src/integrations/): - retry.ts — withRetry(fn, opts) with caller-supplied retryability classification and full-jitter exponential backoff. - circuit-breaker.ts — closed/open/half-open per-process breaker with injectable clock, plus a keyed registry so callers targeting the same endpoint share state. - resilient-fetch.ts — composed wrapper: retries 5xx + 429 + retryable network throws, treats AbortSignal.timeout() and 4xx (other than 429) as terminal, honors Retry-After (capped at 30s), throws CircuitOpenError when the breaker opens. Migrations (no behaviour regression — all existing tests pass): - gitnexus/src/core/embeddings/http-client.ts (covers analyze + MCP query path) — replaces inline linear-backoff retry. - gitnexus/src/core/wiki/llm-client.ts — preserves Azure content-filter branch; resilientFetch handles 5xx/429. - gitnexus-web/src/services/backend-client.ts (fetchWithTimeout helper) — small retry budget (2 attempts, 250–1500 ms) so a dead local backend still fails fast for the user. - gitnexus-web/src/core/llm/settings-service.ts (OpenRouter model list). Deliberately not migrated: - gitnexus-web/src/services/backend-client.ts streamJob() — Server-Sent Events stream; the existing reconnect-with-Last-Event-ID logic is not unary-fetch shaped. - gitnexus-web/src/components/SettingsPanel.tsx checkOllamaStatus() — one-shot health probe; retrying delays the "Ollama not running" error rather than improving UX. 41 new helper tests cover backoff math, breaker state transitions, Retry-After parsing (delta-seconds + HTTP-date), 401/422 terminal classification, and breaker fail-fast on three exhausted retry batches. * fix(review): apply autofix feedback Address Claude's two MEDIUM blocking findings on PR #1448 plus the CodeQL SSRF false-positive flag. - backend-client `fetchWithTimeout` now uses `AbortSignal.timeout()` merged with the caller's signal via `AbortSignal.any()`. Timer-fired aborts surface as `DOMException(name='TimeoutError')` so resilientFetch routes them through the terminal-network branch (no retry, no breaker hit), instead of incrementing the breaker for user-side network slowness. - Method-aware retry budget in `fetchWithTimeout`: idempotent verbs (GET/HEAD/OPTIONS) keep the 2-attempt budget; POST/PATCH/PUT/DELETE default to single-attempt so a 5xx on `startAnalyze` cannot start a duplicate job. New `forceRetry` parameter for callers that know-idempotent mutations (e.g. DELETE of a known-deleted resource). - `resilient-fetch.ts` carries a documented suppression for CodeQL js/server-side-request-forgery on the inner fetch call. Every concrete caller passes a hardcoded URL constant or a value from configuration (env vars, saved settings); user request input never flows into the URL parameter. - New test file `backend-client-retry.test.ts` covers all three paths: GET retries on 503, POST does not retry, timeout does not increment the breaker. * fix(resilient-fetch): address Codex adversarial findings Closes the three blocking issues from Codex's review on PR #1448. U1 — Add `recordNeutral()` to CircuitBreaker. Third outcome path that's an explicit no-op for state and the consecutive-failure counter. Distinct from `recordSuccess` (closes the breaker) and `recordFailure` (may open it). Used for outcomes that are neither evidence of backend health nor evidence of backend failure. U2 — Route terminal-client / terminal-network through `recordNeutral`. Previously a 401 or local timeout called `recordSuccess`, which reset `consecutiveFailures` to 0. A 5xx → 401 → 5xx → 401 → 5xx sequence would NEVER trip the breaker because each 4xx in between erased the running count. Also classify external `AbortError` as terminal-network (was retryable-network), so caller-driven cancellation no longer retries against an already-aborted signal or counts toward breaker failures on exhaustion. U3 — Per-origin breaker key in web `fetchWithTimeout`. Was hardcoded to `'web-backend'` even though `_backendUrl` is mutable via `setBackendUrl`. Switching backend URLs after a circuit tripped on host-A would strand the user during the full cooldown. Key is now `web-backend:<origin>`, so each backend URL gets its own breaker state. Tests: +5 recordNeutral, +4 resilient-fetch (interleaved 4xx/5xx, external AbortError, prior-state preservation), +1 web switch-backend regression. All 70 gitnexus integration tests + 15 web tests green. * fix(resilient-fetch): tolerate header-less fetch mocks on 429 `classifyOutcome` called `resp.headers.get('Retry-After')` directly, which crashed when a test stubs `fetch` with a plain object like `{ ok: false, status: 429 }` (no `headers` field). Real `Response` always has Headers, so this surfaces only in test setups, but the helper has no business assuming caller-side correctness on this — the defensive guard is cheap and a missing `Retry-After` falls through to exponential-backoff retry like any 429 without the header. Surfaced by `gitnexus/test/unit/http-embedder.test.ts > retries on rate limit`, which the embeddings migration exercises against a plain-object 429 stub. Locked in with a new `classifies 429 from a header-less fetch mock without throwing` case. * fix(review): apply autofix feedback Closes findings from the third multi-agent review pass on PR #1448. #1 (P1) callLLM had no per-attempt timeout Wiki LLM calls passed no `signal` to resilientFetch; each of three retry attempts could hang indefinitely on a frozen TCP connection. Add `signal: AbortSignal.timeout(60_000)` so the per-attempt budget matches what http-client.ts and backend-client.ts already provide. #2 (P2) drop dead `lastRetryableResp` post-loop fallback Variable was set in one switch arm but only read in unreachable code after the loop. The retry loop always returns/throws on every iteration. Keep only the defensive `throw` so TypeScript's control-flow analysis still sees `Promise<Response>` as the return. #5 (P2) gate test-only exports behind a subpath `__resetBreakerRegistry__` and `classifyOutcome` were reachable from the main `gitnexus-shared` barrel — production code calling `__resetBreakerRegistry__` from a tool implementation would silently nuke every circuit breaker process-wide. Move to a new `gitnexus-shared/test-helpers` subpath export. Production callers see the cleaner public API; tests import via the explicit `gitnexus-shared/test-helpers` path. #6 (P2) exhaustiveness guard on Outcome switch Add a `default: const _: never = outcome` arm so a future sixth `Outcome.kind` won't compile silently — it'll surface at the switch site rather than fall through to a retry/no-retry default. #9 (P3) document cumulative wall-clock budget Add a "Cumulative wall-clock budget" paragraph to resilientFetch's JSDoc explaining the worst-case total wait (`maxAttempts × (per-attempt timeout + capDelayMs)` ≈ 60s with defaults) and pointing callers at outer `AbortSignal.timeout()` when they want a tighter bound. Deferred to follow-up PRs (per review's Auto-resolve recommendation): - #3 idempotency knob to shared API (forceRetry into ResilientFetchOptions) - #4 publish.ts migration to resilientFetch - #7 parseRetryAfter past-HTTP-date / negative-seconds asymmetry - #8 recordNeutral counter time-decay (documented breaker semantic) * fix(circuit-breaker): gate half-open to a single in-flight probe Closes the Codex adversarial-review finding on PR #1448 that flagged a recovery-time thundering herd: when cooldown expired, every concurrent caller transitioned the breaker to half-open and probed the still- recovering dependency in lockstep, defeating the breaker's "fail fast" promise. U1 — probe-permit gate in CircuitBreaker.check() Added a `probeInFlight: boolean` field. After cooldown expires, the first `check()` admits the probe and consumes the permit; subsequent callers throw `CircuitOpenError` with a configurable `halfOpenRetryAfterMs` (default 1000ms) until the probe resolves. Critical design point: `recordNeutral` now RELEASES the permit but does NOT transition state. Without that split, a single `TimeoutError` from per-attempt `AbortSignal.timeout` (which routes through neutral classification) would permanently park the breaker in half-open. By separating permit-release from state-resolution, we keep the "neutral doesn't claim health" semantic without creating that wedge. Other changes: - `halfOpenRetryAfterMs` is now a constructor option for consumers with long-running protected ops (LLM streaming, large uploads). - `getState()` is documented as a pure read; the implicit Open -> Half-Open transition lives in `check()` only, so tests that inspect state never inadvertently consume a probe permit. - `isProbeInFlight()` test-only accessor for assertion clarity. - JSDoc on `check()` records the JS event-loop atomicity dependency and the load-bearing `try/finally` pairing invariant. U2 — End-to-end concurrency regression through resilientFetch Three new scenarios in resilient-fetch.test.ts (26 -> 29): - 3 concurrent calls + probe gets 200 -> 1 hits fetch, 2 throw CircuitOpenError, breaker closes. - 3 concurrent calls + probe gets 503 -> ResilientFetchExhaustedError on probe; concurrent callers see halfOpenRetryAfterMs (1000ms); fresh caller after probe resolves sees the FULL new cooldown (10000ms), not the probe-in-flight default. - Probe cancelled mid-flight via AbortError -> permit released, state stays half-open, next caller becomes the new probe and succeeds. Plus 9 new circuit-breaker unit tests (16 -> 25) covering the permit gate, recordNeutral-releases-permit semantic, fresh-cooldown distinction, default vs configurable halfOpenRetryAfterMs, getState() purity, and the three-probes-via-neutrals chain. Total integration test count: 70 -> 82. All 106 gitnexus + 15 web tests pass; both packages typecheck. Maintainer decisions (deferred per plan 003 Open Questions): - Plan 002's deferral judgement was reversed on Codex's argument without new measurement / incident data. The reversal is defensible on principle (Hystrix / Resilience4j alignment) but lacks workload- driven evidence. - Probe-blocked callers throw silently (no log / event hook). R4's "no new public API" prevents adding observability; loosen if a debug log on probe-blocked is wanted. * refactor(embeddings): replace bespoke HF breaker with shared CircuitBreaker Deleted the local `HfDownloadCircuitBreaker` class and the manual retry loop in `withHfDownloadRetry`. Both are now backed by the shared `gitnexus-shared` primitives: - `hfDownloadCircuit` is `new CircuitBreaker({ failureThreshold, cooldownMs, key: 'hf-download' })` — same state machine as before PLUS the single-permit half-open gate that prevents recovery-time stampedes when CLI + MCP embedders concurrently re-load the model. - `withHfDownloadRetry` delegates the loop to `withRetry` from the shared package. Per-attempt timeout (`withDownloadTimeout`), network-vs-non-network classification, circuit recording, and the `onRetry` callback wire through `withRetry`'s `isRetryable` callback. Behaviour preserved: - Pre-flight `CIRCUIT_OPEN_TAG` rejection when the breaker is open. - Mid-loop `CIRCUIT_OPEN_TAG` "opened after N consecutive failures" when a network error trips the threshold. - Non-network errors (e.g. CUDA unavailable) bypass retry and go through `recordNeutral` instead of resetting the breaker's failure-count progress. - `onRetry(attempt+1, max, err)` fires only when there's a next attempt, matching the prior semantic. Generic CircuitBreaker gained two inspection accessors: - `getOpenedAt(): number | null` - `getCooldownMs(): number` Used by `withHfDownloadRetry` to compute `secsUntilReset` without consuming a probe permit (which `check()` would do). Test consolidation: the 7 bespoke `HfDownloadCircuitBreaker` state-machine tests in hf-env.test.ts were 1:1 duplicates of existing tests in `circuit-breaker.test.ts` and were deleted. Remaining 42 hf-env tests all pass; full integration sweep (148 gitnexus + 15 web) green.	2026-05-09 15:18:09 +01:00
Alex Macdonald-Smith	d91428ad9d	feat(cli): add gitnexus publish for opt-in understand-quickly registry (#1425) ... * feat(cli): add `gitnexus publish` for opt-in understand-quickly registry Adds a small, opt-in command that fires a single `repository_dispatch` event at `looptech-ai/understand-quickly` to ask the registry for an instant resync of the current repo's entry. No graph file is uploaded; the registry pulls from raw.githubusercontent.com per the protocol at https://github.com/looptech-ai/understand-quickly/blob/main/docs/integrations/protocol.md. - Pure helpers (id parsing, payload construction, validation) live in `gitnexus-shared/src/integrations/understand-quickly.ts` so the package stays Node-free and the same logic is testable in isolation. - The CLI command lives in `gitnexus/src/cli/publish.ts`. Without `UNDERSTAND_QUICKLY_TOKEN` it is a no-op (exits 0 with one informational line); with the token it POSTs the dispatch and surfaces 204 / 401 / 404 / 5xx distinctly. - The id defaults to `<owner>/<repo>` parsed from the `origin` remote and can be overridden with `--id`. - Refuses to publish when no `.gitnexus/` index exists, with a `gitnexus analyze` hint. Tests: a new vitest unit covers the pure helpers (8 + 8 + 2 cases) and the no-token no-op path with a `fetch` spy that fails the test if the network is touched. README gets a one-paragraph "Publishing to understand-quickly" section near the existing CLI docs. * fix(uq-publish): address review blockers + high-severity items Addresses CodeQL polynomial-regex (HIGH), token-gate ordering, distinct 401/403/404/422 response branches, fetch timeout, expanded test coverage, tightened owner/repo validation, and non-GitHub remote rejection. See response thread on PR #1425 for the per-finding rationale. Signed-off-by: amacsmith <alex.mac@looptech.ai> * fix(publish): address Claude review on PR #1425 - AbortError → TimeoutError: AbortSignal.timeout() throws a DOMException with name 'TimeoutError', not Error{name:'AbortError'}. Match the pattern used in core/embeddings/http-client.ts so the user-facing "timed out after 15000ms" message actually fires. Update the regression test to throw a real DOMException — the previous fake was a false-green. - isValidOwnerRepo: forbid trailing hyphen in the owner segment. GitHub rejects this at account-creation time; allowing it here meant hand-typed --id values like 'my-org-/repo' would pass our regex and 422 from GitHub. - Add publish-command coverage to cli-index-help.test.ts (asserts on --id, --skip-git, the registry name, and the token env var) and cli-commands.test.ts (asserts publishCommand is exported as a function). Catches accidental command-registration deletion. --------- Signed-off-by: amacsmith <alex.mac@looptech.ai> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-05-09 09:52:26 +01:00
evolution	d14d6602d5	feat(go): implement scope resolution hooks for Go language support (#1302)	2026-05-04 07:29:11 +01:00
ReidenXerx	851d2ab749	fix(typescript): address review findings — formatting + tighter test assertions ... Addresses the automated review findings on PR #1175: - prettier --write the 3 files flagged by `quality / format` CI check (query.ts, typescript-hof-callbacks.test.ts, typescript-jsx-as-call.test.ts). - [medium] typescript-jsx-as-call.test.ts: tighten the combined HOF+JSX assertion from `toBeGreaterThan(0)` to `toHaveLength(1)`. A single `<Foo />` is one logical invocation; the bounds-only assertion would have masked a duplicate-CALLS-edge regression (e.g. if both `jsx_self_closing_element` and a generic call pattern matched the same site). - [medium] typescript-hof-callbacks.test.ts: replace the vacuously-true `for (c of calls) expect(...)` Zustand assertion with a structural one. Old form passed unconditionally when `calls` was empty (any change that silenced ALL CALLS edges from store.ts would have slipped through). New form asserts both: (a) at least one File-rooted edge exists (proving the `isCallerAnchorLabel` fallback fires), and (b) no edge sources from anything else (proving the fallback fires exclusively). - [low] finalize-algorithm.ts (`findExportByName`): rephrase the comment to make the language-agnostic nature of the tie-break rule explicit. The implementation was already correct for all migrated languages; only the comment overplayed the TypeScript specificity. - [low] captures.ts (arity synthesis): add a comment explaining why JSX call anchors (`jsx_self_closing_element` / `jsx_opening_element`) intentionally don't synthesize `@reference.arity`. Name-only resolution is correct for React (components aren't overloaded in the current graph model); a JSX-aware synthesizer counting jsx_attribute children would be needed if that ever changes. No production behavior change. All 8/8 HOF + 7/7 JSX + 236/236 typescript + 11/11 api-deep-flow integration tests still pass. gitnexus and gitnexus-shared typechecks clean. Made-with: Cursor	2026-04-29 15:51:01 +03:00
ReidenXerx	7be595d317	fix(typescript): capture missed CALLS edges from HOF callbacks and JSX ... Two distinct gaps in the TypeScript scope-resolution path were silently dropping call edges in real-world React + TanStack + Zustand codebases. On the bug reporter's repo (Sourcerer-fe, 1185 src/ functions), 504 missing Function->Function CALLS edges are now captured (+61.6%) and the no-outgoing-CALLS orphan rate drops from 73.2% to 60.3%. HOF / arrow-callback caller-attribution (3 cooperating fixes): - typescript/query.ts: @declaration.function anchor moved from the wrapping lexical_declaration to the inner arrow_function / function_expression, so anchor.range aligns with @scope.function and pass2AttachDeclarations lands the def on the arrow's own scope. - finalize-algorithm.ts: findExportByName prefers callable / class- like defs over Variable when localDefs contains both for the same name (TS emits two defs per `const fn = () => {}`). - graph-bridge/ids.ts: resolveCallerGraphId's walk-up class-fallback now uses isCallerAnchorLabel restricted to Function / Method / Constructor / Class / Interface / Struct / Enum, so module-level calls fall through to the File node instead of mis-attributing to sibling Variable defs (the Zustand `create()(devtools(...))` phantom-self-loop regression). JSX as a CALLS edge (2 cooperating fixes): - typescript/query.ts: new TSX_JSX_QUERY_SUFFIX (TSX-grammar only) captures jsx_self_closing_element / jsx_opening_element as @reference.call.free / @reference.call.member. PascalCase predicate filters native HTML elements (<div>, <span>) so they don't emit edges to nonexistent targets. - typescript/captures.ts: shouldEmitReadMember extended with jsx_self_closing_element / jsx_opening_element parent cases to suppress phantom ACCESSES edges on member-form JSX names. Tests: 8 HOF assertions + 7 JSX assertions across two new integration test files plus 13 minimal fixtures. typescript.test.ts (236), api-deep-flow.test.ts (11), and scope-resolution / scope-extractor unit tests (613) pass with no regressions. Made-with: Cursor	2026-04-28 20:52:07 +03:00