Sixteen community pull requests: cross-repo member-call resolution
(Go/PHP/TS/Kotlin/ObjC), generic/template type-param cleanup
(Kotlin/Scala/C++/Swift), an Objective-C enum extractor, interface
dispatch fan-out, a native Pi guard extension, and resolution/ingest
fixes. The AST cache schema is bumped (now 13), so the first build
after upgrading re-extracts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
`_resolve_objc_member_calls` types a receiver from `self`/`super`, an explicit
class name, the file's local table or the class's @property/ivar table, then
requires exactly one declaration of that type. Zero declarations and more than
one shared a single bail, so a call into a class another repository declares was
dropped with the receiver type already in hand — the case #3152 parks for the
merge in Java, C++, C# and Swift.
Split the three type-known bails: zero declarations parks `{callee,
receiver_type, lang: "objc", line}` on the caller, more than one stays dropped as
before (a local ambiguity that merging only widens). A builtin receiver type is
filtered out at the parking sites, matching what the Swift and C++ resolvers
already skip before resolving.
On the merge side an ObjC method label keeps its `+`/`-` sigil where every other
extractor writes `.name()`, and a parked selector does not say which was meant,
so both spellings are tried and a class declaring both counts as ambiguous. The
sigil is what keeps ObjC and C++ members disjoint inside a shared `.h`, which is
in both languages' suffix sets.
Depends on the `_callable` / `_callable_class` markers (#3228) that
`_index_declarations` indexes declarations by; the commit before this one carries
them.
(cherry picked from commit 487fd5490d)
Every other extractor stamps its definitions through the generic engine:
`_callable` for "a real callable, not a same-named data symbol" (#2438),
narrowed to `_callable_class` for a type, which is callable only through a
constructor (#2137). The ObjC extractor builds its nodes by hand and set
neither, so an ObjC class was invisible to every pass that indexes
declarations by those markers — the `same_type_as` pass from #3007, the
qualified-name indexes, and anything new that needs to tell a declaration
from a reference — and an ObjC method could not be told apart from a data
symbol of the same name.
`@interface`, `@implementation` and `@protocol` nodes now carry both
markers (a protocol is a type declaration, the same way the engine marks a
Java or C# interface), and method nodes carry `_callable`. The file node
and the stubs minted for dangling references stay unmarked: a stub has no
declaration behind it.
(cherry picked from commit 9a64af9be1)
The cross-file `_resolve_kotlin_member_calls` landed for #1698 binds
`Receiver.method()` only when the object/class the receiver names is declared
in the same build. When that declaration lives in another repository the pass
had the receiver name in hand and dropped the call anyway, so nothing about it
reached graph.json — the one artifact merge-graphs and global add read — and no
merge-time pass could recover what was never written down.
Park the call by name at that bail-out, the same mechanism Java/C++/C#/Swift
already use: only when the object is declared nowhere here (an ambiguous 2+ match
still fabricates nothing) and never for a builtin receiver. cross_repo_calls then
finishes the edge once the declaring repo joins the graph, gated on .kt/.kts so a
same-named declaration in another language cannot answer a Kotlin call.
Co-Authored-By: Claude Code <noreply@anthropic.com>
(cherry picked from commit fa193c96c2)
A corpus-wide type index let a same-named class in another language stand in for
the receiver's type, which hid from the parking branch that nothing in the JS/TS
family declares it. SFC script blocks are in the family, so a class exported from
a .vue file still answers — here and at merge time.
(cherry picked from commit 078c106e62)
`_resolve_typescript_member_calls` binds `this.repo.save()` only when the
receiver's type is declared in the same build. With the type in another
repository the resolver held the receiver type and dropped the call, so
`graph.json` — the only artifact `merge-graphs` and `global add` read — recorded
nothing and no merge-time pass could recover it.
Those calls are now parked on the caller as `metadata.unresolved_calls`, and
`link_cross_repo_member_calls` finishes them after the merge. One
`_LANG_SUFFIXES` key covers all eight TS/JS suffixes: a TS class legitimately
answers a JS call site, and two keys would drop every TS<->JS cross-repo call.
Only a table-typed receiver parks. The uppercase-spelling arm also matches
namespace aliases and default imports (`React.createElement()`), and
`node_modules` is never scanned, so parking those would send npm names to the
merge to be matched by bare name. The park sits strictly upstream of the #2553
origin gate, which only ever vets a name that did match locally.
(cherry picked from commit 5b593c6d00)
`_DISPATCH` routes `.mjs`/`.cjs` to `extract_js` and the cross-file call gate
already lists them, but `typescript_member_calls` claimed only six suffixes, so a
repo written entirely in `.mjs` was the one shape where the resolver never ran and
`const s = new Svc(); s.doThing()` produced no edge.
Both the suffix set and the resolver now read one `_JS_TS_SUFFIXES` constant.
(cherry picked from commit 84fce94ce8)
A receiver typed to a class this build declares nowhere is parked on the
caller (#3152); the merge then binds it to the one declaration in another
repo. PHP was absent from `_LANG_SUFFIXES`, so parked PHP entries were never
language-checked and the edge was dropped. Adding PHP's suffixes lets the
merge finish the call, gated to PHP declarations like every other tier.
Co-Authored-By: Claude Code <noreply@anthropic.com>
(cherry picked from commit e7fee26542)
v8's `_resolve_php_member_calls` (#3872) binds scoped `Class::method()` calls
but leaves instance `$g->method()` calls unresolved. This adds the instance
tier beside it: a per-file receiver type table (`_php_receiver_type_table`
over typed properties, promoted constructor params, typed params and `new`
bindings) names the receiver's class, and the shared resolver takes the single
PHP declaration of that class and emits the `calls` edge, INFERRED.
The declaration index is gated to the PHP interop family: the index is
corpus-wide, so a same-named class in another language would both answer the
receiver and hide that no PHP file declares it. A receiver the table cannot
type to one class — untyped, union, longer chain — stays unresolved.
Co-Authored-By: Claude Code <noreply@anthropic.com>
(cherry picked from commit 199ba1af0d)
test_the_first_binding_of_a_name_wins asserted the flat table's cross-function
shadowing as intended behaviour, which the scoping fix removed; its fixture now
pins that each function's parameter answers only its own calls.
(cherry picked from commit 8a4bfef899)
Parameter names repeat across a Go file, so the file-flat table answered one
function's receiver with a sibling function's parameter type: `Second(g *Shouter)`
calling `g.Greet()` bound to Greeter.Greet. Each function body now carries its own
parameter/local table, consulted before the flat one, which keeps serving fields.
(cherry picked from commit b74abf098a)
A corpus-wide `_callable_class` lookup let a same-named class in another language
answer a Go receiver, and it hid from the parking branch that no Go file declares
the type. The flat per-file table also mistyped a method's own receiver when an
earlier binding of the same name won, so `s.Save()` inside a `Store` method could
reach `Server.Save`.
(cherry picked from commit 86792724ff)
The Go resolver had the receiver's type in hand and dropped the call when nothing
in the corpus declared it, so `graph.json` — the only artifact `merge-graphs` and
`global add` read — recorded nothing and no merge-time pass could recover it. A
merged graph of a Go service and a Go library was missing exactly the edges that
make it a call graph.
Parks the pair on the caller node like the Java/C++/C#/Swift resolvers already do,
and adds `"go": {".go"}` to the merge pass's language guard. `.go` alone: Go and
Java both turn up in one backend merge, and a shared type name across them is a
coincidence, not a namespace.
The `_key` case preservation the merge pass already documents is what makes this
correct for Go — `greet` is a different method from `Greet` and is not reachable
from another package at all.
(cherry picked from commit f7d2a50603)
`g.Greet()` where `Greeter` is declared in another file produced no edge. The
shared cross-file pass skips member calls, and the Go extractor read the
receiver's identifier only to discard it for anything that was not an imported
package — so the one shape Go dependency injection actually takes (a struct
field used from a method) contributed nothing to the call graph.
`extract_go` now exports a per-file `go_type_table` built from the four places a
Go receiver's type is written down: a struct field, a parameter (which covers the
method receiver `func (s *Server)`), `var x T`, and `x := T{}` / `x := &T{}`.
`_resolve_go_member_calls` looks the receiver up there, takes the single
declaration of that type and emits the `calls` edge to its method.
Also stamps `_callable` / `_callable_class` on Go declarations (#2438). Go is the
one extractor outside the tree-sitter engine, so its nodes carried neither, which
left them invisible to every consumer that reads the markers off the node.
Design notes:
- The receiver travels as `member_receiver`, not `receiver`: in this extractor
`receiver` means "imported package", and the Swift/Python/Ruby member-call
resolvers select on `is_member_call` plus `receiver` without checking the
language, so a Go name there binds to their types in a mixed corpus.
- `s.logger.Log()` is read as a call on the `logger` field only when `s` is the
enclosing method's own receiver. The table is flat and file-scoped, so any
other head could be a package or a variable whose type it cannot confirm.
- Names are matched case-sensitively, unlike the sibling resolvers. Go exports by
capitalisation, so `Run` and `run` on one type are two different methods.
- Go does not defer: a member call reaches `raw_calls` only once the bare callee
name misses in the caller's file, so in-file behaviour is byte-identical.
- Two packages declaring the same name stay two type nodes and the
single-definition guard bails — without import evidence neither is the answer.
(cherry picked from commit deca9fa366)
extract_go keys a type on its package directory, so every file declaring a
method on it mints the type again under the same id. Disambiguation then splits
those apart by path, and the type ends up fragmented into several partial nodes,
each owning some of its methods: the declaring file's node owns none of them,
and every single-definition guard downstream reads the set as an ambiguity.
Fold the id-collision before disambiguation, the same point and the same shape
as _merge_decl_def_classes for C/C++/ObjC. Guards: all members must be .go
files in one directory (the id folds in only the directory's name), and a
_test.go member stops the fold, since its package clause may be a separate
external test package. The declaring file wins; no edge re-pointing is needed
because the group already shares one id.
(cherry picked from commit 7f9439ddd5)
Validate both complete argument spans and reject unsupported body children instead of emitting partial enum graphs.
AI-Assistance: OpenAI Codex
(cherry picked from commit 7c09b4d360)
Extract NS_ENUM and NS_OPTIONS typedefs in Objective-C files using isolated enum body parsing and original member locations.
Fixes#4400
AI-Assistance: OpenAI Codex
(cherry picked from commit d6a74da475)
A `struct Stack<Element>` / `func map<R>(...)` binds `Element`/`R` as local
names, not corpus symbols, but `_swift_collect_type_refs` appended the bare
identifiers used in a signature or stored-property type as type references and
ran them through the sourceless-stub path. Every generic type/function in the
corpus then collapsed its `T` onto one bare `t` node — a god node that pollutes
god-node rankings, since single-letter type parameters are not in the
analyzer's builtin-noise filter. C#, Java, TypeScript, Kotlin, Scala, C++, and
Go already exclude theirs.
Mirrors that pattern (and complements the `Self` keyword fix already in this
collector): a new `_swift_type_parameters_in_scope` helper walks up to every
enclosing declaration's `type_parameters` list and takes each `type_parameter`'s
first `type_identifier` as the bound name (a constraint like `T: Equatable` is a
separate `user_type`, left to reference), and `_swift_collect_type_refs`
auto-computes and threads that skip set. Genuine user types and the `Int`/
`String` builtin hubs are unaffected.
(cherry picked from commit 2e8a5c0f97)
A `template<typename T>` binds `T` as a local name, not a corpus symbol, but
`_cpp_collect_type_refs` appended the bare identifiers used in a template
signature or member as type references and ran them through the sourceless-stub
path. Every template in the corpus then collapsed its `T` onto one bare `t`
node — a god node that pollutes god-node rankings, since single-letter type
parameters are not in the analyzer's builtin-noise filter. C#, Java,
TypeScript, Kotlin, Scala, and Go already exclude theirs.
Mirrors that pattern: a new `_cpp_type_parameters_in_scope` helper walks up to
every enclosing `template_declaration`'s `template_parameter_list` and collects
names from its `type_parameter_declaration`/`variadic_type_parameter_declaration`
children (a non-type `int N` parameter is a value and is left alone), and
`_cpp_collect_type_refs` auto-computes and threads that skip set. Genuine user
types and the generic container head still reference.
(cherry picked from commit e3bf52b318)
A `class Box[T]` / `def map[R](...)` binds `T`/`R` as local names, not
corpus symbols, but `_scala_collect_type_refs` appended the bare identifiers
used in a signature as type references and ran them through the sourceless-stub
path. Every generic class/method in the corpus then collapsed its `T` onto one
bare `t` node — a god node that pollutes god-node rankings, since single-letter
type parameters are not in the analyzer's builtin-noise filter. C#, Java,
TypeScript, Kotlin, and Go already exclude theirs.
Mirrors that pattern: a new `_scala_type_parameters_in_scope` helper walks up
to every enclosing declaration's `type_parameters` list (the use site is
`type_arguments`, a distinct node) and collects parameter names from direct
identifiers and variance-annotated params, skipping `context_bound`/
`upper_bound`/`lower_bound` nodes (those name real types). `_scala_collect_type_refs`
auto-computes and threads that skip set. Context bounds (#2046), genuine user
types, and the generic container head still reference.
(cherry picked from commit 585e909535)
A `class Box<T>` / `fun <R> map(...)` binds `T`/`R` as local names, not
corpus symbols, but `_kotlin_collect_type_refs` appended the bare identifiers
used in a signature or property type as type references and ran them through
the sourceless-stub path. Every generic class/function in the corpus then
collapsed its `T` onto one bare `t` node — a god node that pollutes god-node
rankings, since single-letter type parameters are not in the analyzer's
builtin-noise filter. C#, Java, TypeScript, and Go already exclude theirs.
Mirrors the C#/Java pattern: a new `_kotlin_type_parameters_in_scope` helper
walks up to every enclosing declaration's `type_parameters` list (the use site
is `type_arguments`, a distinct node, so an instantiation argument is never
collected), and `_kotlin_collect_type_refs` auto-computes and threads that skip
set. Genuine user types and the generic container head still reference.
(cherry picked from commit a9304a245c)
_dispatch_confidence was computed from the raw implementers set before
the per-implementer language gate ran, so a sourceless/external-reference
implementer, or a cross-language name collision, that never produces an
edge could still dilute the confidence score for the implementer(s) that
do. A single real implementer alongside one gate-failing entry scored
0.75 (the two-implementer tier) instead of 0.85.
Gate first, then count only the implementers that pass it, so the score
reflects how many implementers actually share the dispatch edge.
Addresses review feedback on PR #4396 (Graphify review bot, finding at
interface_dispatch.py:154).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
(cherry picked from commit b01a6fcf10)
resolve_interface_dispatch (shared by the C# and Swift gates) bailed out
entirely whenever an interface/protocol had more than one implementer,
on the reasoning that guessing which one a runtime call reaches would be
wrong. For a static structural graph the question isn't which one is
reached at runtime, it's which ones *can* be reached, and the answer with
N implementers is all N, not none -- so every chain through an injected
dependency with more than one implementation was left permanently cut at
the interface.
Each implementer is still subject to the existing single-owner guard
independently: an implementer that itself declares more than one method
of the same name is skipped on its own, without suppressing its siblings.
Confidence drops as the candidate set grows, using the extraction
rubric's own discrete INFERRED tiers (0.85 / 0.75 / 0.65 floor) instead of
inventing continuous precision.
Fixes#3800 for the dispatches_to half (interface->implementation calls).
The property-access half of that issue (a method edge for `c.Count`
through an interface-typed receiver) is a separate mechanism and is not
addressed here, to keep this PR to one concern.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
(cherry picked from commit f340494e07)
Pi has no PreToolUse hook, so the installed hook-guard policy never ran
there. graphify/pi/ ships a Pi package (Node built-ins only, no
node_modules) that runs `graphify hook-guard read|search` before Pi's
read, grep, find and search-style bash calls: strict-mode denials become
tool_call blocks, and guidance arrives as a graphify system reminder.
Only local targets inside the project are checked, the hook uses the first
`graphify` on PATH outside the project, and every call is bounded and
fails open.
`graphify pi guard install|uninstall` delegates registration to Pi's own
`pi install|remove <dir>`; `graphify pi guard path` prints the package
directory. Oh My Pi reads the same `pi` manifest key, so
`omp plugin install "$(graphify pi guard path)"` loads it there too,
where guidance uses OMP's passive tool-call context channel.
(cherry picked from commit a6281363bb)
A grep fed by a pipe filters that command's output, not the code, so its
pattern is not a graph lookup the agent skipped.
(cherry picked from commit f9f3c9ce3a)
The always-on blocks now tell the assistant to pass the rule to every
subagent that explores code (a fresh subagent may never see a nudge before
it starts reading) and to read raw files only for lines the graph or an
earlier read already located, matching the hook's narrowed wording.
(cherry picked from commit 3127ccdcbd)
Sanitise graph text before it reaches the hint (one line, no control
characters or backticks, capped length), skip the graph parse when the call
has nothing to look up, isolate hint failures so they can never cost the
nudge or the strict deny, skip value-taking flags (rg -t/-g, -A/-B/-C...)
and file-name searches (find/fd), drop declaration keywords from terms,
match labels only (no source-path tier, short terms exact-only), resolve a
relative read target against the project root, and align the strict deny's
wording with the narrowed nudge.
(cherry picked from commit f8ba08fe93)
Agents treated the soft nudge as noise: it was the same placeholder text on
every call, and "or to modify/debug specific lines" excused nearly any
targeted read. A firing nudge (and the strict-mode deny) now carries:
- a command built from the call: `graphify explain "<symbol>"` when the
searched word is a node label, `graphify query "<terms>"` otherwise, or
`graphify explain "<file>"` for a read;
- up to five matching graph nodes with file and line, so the nudge shows
what the graph already knows instead of only asking for it.
The lookup scans graph.json labels and paths directly (0.1-0.5 s on 3k-15k
node graphs; the full query stack costs ~1.5 s per hook call), skips graphs
over 32 MiB, and falls back to the plain nudge on any failure or no match.
The escape clause now allows raw reads only once the exact file and lines
are known, and the always-on rule names the moment to query: before the
first grep, search or source-file read.
(cherry picked from commit b51314765c)
Twenty community pull requests: Java/C-C++/Python/Swift/Go/PowerShell/C#
/JS extraction and call-resolution fixes, EJS extractor, dedup and
shrink-guard hardening, and query/graph.html ergonomics. The AST cache
schema is bumped (now 12), so the first build after upgrading
re-extracts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Java inherited-supertype and chained/new/cast receiver typing (#4305,
#4307), C/C++ cross-directory quoted-include provenance (#4392), and
JS external imports anchored to the package rather than the path leaf
(#3092) all change AST extraction output, so warm caches must
re-extract.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add to_json() and watch._check_shrink() regression tests that build a real
graph where build_from_json folds a semantic ghost into its AST twin (#4389),
plus a negative control showing a genuine semantic loss is still refused.
Both positive tests fail on v8 and pass with this branch.
- Update _fold_node_aliases / _fold_edge_aliases docstrings and the build()
dedup comment to list the new file/filepath and relationship aliases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 946333b2ab)
The seeded path hands the resolved nodes to _subgraph_to_text as seeds (seeds=start_nodes, the BUG2 fix), so the
given seed is the first NODE line and still shows under a small token budget.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 67f65c44b0)
- graphify query --seed with no value (trailing --seed or --seed=) now exits with an error instead of running a
keyword query.
- An unresolved seed given twice is listed once.
- The query log records the seeds used.
- Tests: the callable form (name and name()), --seed with --context, both no-value forms, and the logged seeds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit c46b0e78d0)
An external ranker (embeddings, a hybrid or learned retriever, or an agent
that already knows the file) can choose where graphify query starts instead
of the question's keyword matches; the graph then does the expansion.
Each --seed value resolves exactly as affected resolves its seed
(affected.resolve_seed: node id, unique label, callable name, repo-relative
or absolute file path anchored to the graph's root), so there is one
interpretation of a node reference. Fail closed: a value that does not
resolve to exactly one node is reported and skipped; if none resolve, the
query says so and does not fall back to keyword seeds. Without --seed the
output is unchanged (rendering moved into _render_query as is).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit c8af4e1b93)
Follow-up to the review on #4291:
- Hovering anywhere on a legend row except its count (checkbox, dot,
gaps, padding) now shows the truncated name. The tooltip tracks the
area the pointer must leave (the whole row for a name, the count
itself for a count), so moving inside a row doesn't hide or restart it.
- hideSidebarTip() also clears textContent, so a hidden tooltip doesn't
keep the last name in the DOM.
- Tests: the mock elements now have offsetWidth/offsetHeight, so the
positioning math is checked (no more NaNpx). New tests cover the
cursor offset, clamping and flipping near the window edges, and
hovering every part of a legend row on a parent-linked mock DOM.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 1000de9b46)
