Merge remote-tracking branch 'origin/main' into fix/resolver-static-confidence-1398-2

Author: carlos-alm

.github/workflows/claude.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Run Automated AI Review
         id: automated-review
-        uses: anthropics/claude-code-action@64de744025ca9e24df2b88204b4f1e968f39f009
+        uses: anthropics/claude-code-action@28f83620103c48a57093dcc2837eec89e036bb9f
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           model: claude-sonnet-4-6
@@ -208,7 +208,7 @@ jobs:
 
       - name: Run Interactive AI Assistant
         id: interactive-claude
-        uses: anthropics/claude-code-action@64de744025ca9e24df2b88204b4f1e968f39f009
+        uses: anthropics/claude-code-action@28f83620103c48a57093dcc2837eec89e036bb9f
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           model: claude-sonnet-4-6

package-lock.json

@@ -202,7 +202,11 @@ export function resolveByMethodOrGlobal(
     if (call.receiver && callerName) {
       const dotIdx = callerName.lastIndexOf('.');
       if (dotIdx > -1) {
-        const callerClass = callerName.slice(0, dotIdx);
+        // Extract only the segment immediately before the method name so that
+        // 'Namespace.ClassName.method' yields 'ClassName', not 'Namespace.ClassName'.
+        // Symbols are stored under their bare class name, not their qualified path.
+        const prevDot = callerName.lastIndexOf('.', dotIdx - 1);
+        const callerClass = callerName.slice(prevDot + 1, dotIdx);
         const qualifiedName = `${callerClass}.${call.name}`;
         const sameClass = lookup
           .byName(qualifiedName)

src/domain/graph/builder/call-resolver.ts

@@ -502,6 +502,34 @@ function buildCallEdges(
             ]),
           )
         : new Map();
+
+  // Phase 8.3f: seed typeMap[callee::restName] = { type: argName } from
+  // objectRestParamBindings × paramBindings, mirroring buildObjectRestParamPostPass.
+  // Scoped keys prevent same-name rest-param collisions when two functions in
+  // the same file both use `...rest` (#1358). The unscoped key is also seeded
+  // when only one callee uses a given rest name, preserving resolution when
+  // callerName is null (findCaller couldn't identify the enclosing function).
+  if (symbols.objectRestParamBindings?.length && symbols.paramBindings?.length) {
+    const restNameCallees = new Map<string, Set<string>>();
+    for (const orpb of symbols.objectRestParamBindings) {
+      if (!restNameCallees.has(orpb.restName)) restNameCallees.set(orpb.restName, new Set());
+      restNameCallees.get(orpb.restName)!.add(orpb.callee);
+    }
+    for (const orpb of symbols.objectRestParamBindings) {
+      for (const pb of symbols.paramBindings) {
+        if (pb.callee === orpb.callee && pb.argIndex === orpb.argIndex) {
+          const scopedKey = `${orpb.callee}::${orpb.restName}`;
+          if (!typeMap.has(scopedKey)) {
+            typeMap.set(scopedKey, { type: pb.argName, confidence: 0.65 });
+            if (restNameCallees.get(orpb.restName)!.size === 1 && !typeMap.has(orpb.restName)) {
+              typeMap.set(orpb.restName, { type: pb.argName, confidence: 0.65 });
+            }
+          }
+        }
+      }
+    }
+  }
+
   const seenCallEdges = new Set<string>();
   const lookup = makeIncrementalLookup(db, stmts);
   let edgesAdded = 0;
@@ -510,13 +538,59 @@ function buildCallEdges(
     if (call.receiver && BUILTIN_RECEIVERS.has(call.receiver)) continue;
 
     const caller = findCaller(lookup, call, symbols.definitions, relPath, fileNodeRow);
-    const { targets, importedFrom } = resolveCallTargets(
+    const { targets: initialTargets, importedFrom } = resolveCallTargets(
       lookup,
       call,
       relPath,
       importedNames,
       typeMap,
+      caller.callerName,
     );
+    let targets = initialTargets;
+
+    if (targets.length === 0 && call.receiver === 'this' && caller.callerName != null) {
+      const dotIdx = caller.callerName.indexOf('.');
+      if (dotIdx > 0) {
+        const className = caller.callerName.slice(0, dotIdx);
+        const qualifiedName = `${className}.${call.name}`;
+        const qualified = lookup
+          .byNameAndFile(qualifiedName, relPath)
+          .filter((n) => n.kind === 'method');
+        if (qualified.length > 0) {
+          targets = qualified;
+        }
+      }
+    }
+
+    if (
+      targets.length === 0 &&
+      call.receiver === 'this' &&
+      caller.callerName != null &&
+      symbols.definePropertyReceivers
+    ) {
+      const receiverVarName = symbols.definePropertyReceivers.get(caller.callerName);
+      if (receiverVarName) {
+        const typeEntry = typeMap.get(receiverVarName);
+        const typeName = typeEntry
+          ? typeof typeEntry === 'string'
+            ? typeEntry
+            : (typeEntry as { type?: string }).type
+          : null;
+        if (typeName) {
+          const qualifiedName = `${typeName}.${call.name}`;
+          const qualified = lookup.byNameAndFile(qualifiedName, relPath);
+          if (qualified.length > 0) {
+            targets = [...qualified];
+          }
+        }
+        if (targets.length === 0) {
+          const sameFile = lookup.byNameAndFile(call.name, relPath);
+          if (sameFile.length > 0) {
+            targets = [...sameFile];
+          }
+        }
+      }
+    }
 
     for (const t of targets) {
       const edgeKey = `${caller.id}|${t.id}`;

src/domain/graph/builder/incremental.ts

@@ -669,6 +669,51 @@ async function runPostNativePrototypeMethods(
 
   db.transaction(() => batchInsertNodes(db, newNodeRows))();
 
+  // ── Caller-only second pass (#1371) ──────────────────────────────────────
+  // `wasmResults` only covers `protoFiles` (definition files). A file that
+  // only *calls* a newly-inserted method (e.g. `f.method()`) was excluded from
+  // the pre-filter, so its call edges to the new nodes are silently dropped.
+  // After node insertion we know the method name suffixes; text-search the
+  // remaining JS/TS files and WASM-parse any that contain a matching call.
+  const newMethodSuffixes = new Set(
+    newDefs.map((d) => {
+      const dotIdx = d.name.indexOf('.');
+      return dotIdx !== -1 ? d.name.slice(dotIdx + 1) : d.name;
+    }),
+  );
+
+  let mergedWasmResults = wasmResults;
+  if (newMethodSuffixes.size > 0) {
+    // Pre-compile patterns once — avoids re-compiling up to newMethodSuffixes.size
+    // regexes on every file in the scan loop.
+    const suffixPatterns = [...newMethodSuffixes].map((m) => {
+      const escaped = m.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      return new RegExp(`\\.${escaped}\\s*\\(`);
+    });
+    const protoFileSet = new Set(protoFiles);
+    const callerCandidateAbs: string[] = [];
+    for (const relPath of jsFiles) {
+      if (protoFileSet.has(relPath)) continue; // already parsed in first pass
+      try {
+        const content = readFileSafe(path.join(rootDir, relPath));
+        const matchesAny = suffixPatterns.some((re) => re.test(content));
+        if (matchesAny) callerCandidateAbs.push(path.join(rootDir, relPath));
+      } catch {
+        /* skip unreadable files */
+      }
+    }
+    if (callerCandidateAbs.length > 0) {
+      try {
+        const callerWasmResults = await parseFilesWasmForBackfill(callerCandidateAbs, rootDir);
+        if (callerWasmResults.size > 0) {
+          mergedWasmResults = new Map([...wasmResults, ...callerWasmResults]);
+        }
+      } catch (e) {
+        debug(`runPostNativePrototypeMethods: caller-only WASM parse failed: ${toErrorMessage(e)}`);
+      }
+    }
+  }
+
   // Build a name → node lookup from all DB nodes (including newly inserted ones).
   type NodeEntry = { id: number; file: string; kind: string };
   const byNameMap = new Map<string, NodeEntry[]>();
@@ -716,14 +761,13 @@ async function runPostNativePrototypeMethods(
   // zero benefit and could OOM on large repositories.
   const seenByPair = new Set<string>();
 
-  // Resolve call edges in every file — not just those that define new func-prop
-  // methods. A caller in app.js calling a method defined in lib.js
-  // would be silently missed if we only scanned definition files.
-  // The newNodeIds guard inside the loop already prevents duplicate edges.
+  // Resolve call edges across all parsed files (definition files + caller-only
+  // files discovered in the second WASM pass above). The newNodeIds guard inside
+  // the loop prevents emitting duplicate edges for nodes the Rust engine already built.
   const newEdgeRows: unknown[][] = [];
   const fileNodeStmt = db.prepare(`SELECT id FROM nodes WHERE kind = 'file' AND file = ?`);
 
-  for (const [relPath, symbols] of wasmResults) {
+  for (const [relPath, symbols] of mergedWasmResults) {
     const fileNodeRow = fileNodeStmt.get(relPath) as { id: number } | undefined;
     if (!fileNodeRow) continue;
 
@@ -734,14 +778,32 @@ async function runPostNativePrototypeMethods(
 
       const caller = findCaller(lookup, call, symbols.definitions ?? [], relPath, fileNodeRow);
 
-      const targets = resolveByMethodOrGlobal(
+      let targets = resolveByMethodOrGlobal(
         lookup,
         call,
         relPath,
         typeMap as Map<string, unknown>,
         caller.callerName,
       );
 
+      // Direct receiver.method fallback: caller-only files often lack typeMap entries
+      // for the receiver (e.g. `f.process()` where `f` isn't declared in the file).
+      // Try qualified-name lookup scoped to newly-inserted nodes to avoid false positives.
+      // Note: `call.receiver` is always truthy here — the `if (!call.receiver) continue`
+      // guard above ensures we never reach this point with a falsy receiver.
+      if (
+        targets.length === 0 &&
+        call.receiver !== 'this' &&
+        call.receiver !== 'super' &&
+        call.receiver !== 'self'
+      ) {
+        const qualifiedName = `${call.receiver}.${call.name}`;
+        const direct = lookup
+          .byName(qualifiedName)
+          .filter((n) => n.kind === 'method' && newNodeIds.has(n.id));
+        if (direct.length > 0) targets = direct;
+      }
+
       for (const t of targets) {
         // Only emit edges to newly-inserted func-prop nodes to avoid
         // duplicating edges the Rust engine already built.

src/domain/graph/builder/stages/native-orchestrator.ts

@@ -185,11 +185,29 @@ export function buildPointsToMap(
   // `function f({ ...rest }) {}` + `f(obj)` + `const obj = { prop: fn }` →
   // seed pts["rest.prop"] = {"fn"} so that `rest.prop()` resolves to `fn`.
   if (objectRestParamBindings && objectPropBindings && paramBindings) {
+    // Index paramBindings: "callee::argIndex" → argName[] (O(|paramBindings|) build,
+    // O(1) lookup — avoids scanning paramBindings for each rest binding).
+    const paramByCalleeIdx = new Map<string, string[]>();
+    for (const { callee, argIndex, argName } of paramBindings) {
+      const k = `${callee}::${argIndex}`;
+      const list = paramByCalleeIdx.get(k);
+      if (list) list.push(argName);
+      else paramByCalleeIdx.set(k, [argName]);
+    }
+
+    // Index objectPropBindings: objectName → {propName, valueName}[]
+    const propsByObject = new Map<string, Array<{ propName: string; valueName: string }>>();
+    for (const { objectName, propName, valueName } of objectPropBindings) {
+      const list = propsByObject.get(objectName);
+      if (list) list.push({ propName, valueName });
+      else propsByObject.set(objectName, [{ propName, valueName }]);
+    }
+
     for (const { callee, restName, argIndex } of objectRestParamBindings) {
-      for (const { callee: pbCallee, argIndex: pbArgIdx, argName } of paramBindings) {
-        if (pbCallee !== callee || pbArgIdx !== argIndex) continue;
-        for (const { objectName, propName, valueName } of objectPropBindings) {
-          if (objectName !== argName) continue;
+      const argNames = paramByCalleeIdx.get(`${callee}::${argIndex}`) ?? [];
+      for (const argName of argNames) {
+        const props = propsByObject.get(argName) ?? [];
+        for (const { propName, valueName } of props) {
           if (!definitionNames.has(valueName) && !importedNames.has(valueName)) continue;
           const key = `${restName}.${propName}`;
           if (!pts.has(key)) pts.set(key, new Set());

src/domain/graph/resolver/points-to.ts

@@ -168,14 +168,20 @@ const COMMON_QUERY_PATTERNS: string[] = [
   '(expression_statement (assignment_expression left: (member_expression) @assign_left right: (_) @assign_right)) @assign_node',
 ];
 
-// JS: class name is (identifier)
-const JS_CLASS_PATTERN: string = '(class_declaration name: (identifier) @cls_name) @cls_node';
+// JS: class name is (identifier) — declarations and expressions
+const JS_CLASS_PATTERNS: string[] = [
+  '(class_declaration name: (identifier) @cls_name) @cls_node',
+  // class expressions: `return class Foo extends Bar { ... }` or `const X = class Foo { ... }`
+  '(class name: (identifier) @cls_name) @cls_node',
+];
 
 // TS/TSX: class name is (type_identifier), plus interface and type alias
 // abstract_class_declaration is a separate node type in tree-sitter-typescript
 const TS_EXTRA_PATTERNS: string[] = [
   '(class_declaration name: (type_identifier) @cls_name) @cls_node',
   '(abstract_class_declaration name: (type_identifier) @cls_name) @cls_node',
+  // class expressions: `return class Foo extends Bar { ... }`
+  '(class name: (type_identifier) @cls_name) @cls_node',
   '(interface_declaration name: (type_identifier) @iface_name) @iface_node',
   '(type_alias_declaration name: (type_identifier) @type_name) @type_node',
 ];
@@ -206,7 +212,7 @@ async function doLoadLanguage(entry: LanguageRegistryEntry): Promise<void> {
       const isTS = entry.id === 'typescript' || entry.id === 'tsx';
       const patterns = isTS
         ? [...COMMON_QUERY_PATTERNS, ...TS_EXTRA_PATTERNS]
-        : [...COMMON_QUERY_PATTERNS, JS_CLASS_PATTERN];
+        : [...COMMON_QUERY_PATTERNS, ...JS_CLASS_PATTERNS];
       _queryCache.set(entry.id, new Query(lang, patterns.join('\n')));
     }
   } catch (e: unknown) {

src/domain/parser.ts

@@ -734,6 +734,8 @@ function walkJavaScriptNode(node: TreeSitterNode, ctx: ExtractorOutput): void {
       break;
     case 'class_declaration':
     case 'abstract_class_declaration':
+    // class expressions: `return class Foo extends Bar { ... }` or `const X = class Foo { ... }`
+    case 'class':
       handleClassDecl(node, ctx);
       break;
     case 'method_definition':
@@ -874,7 +876,7 @@ function handleStaticBlock(node: TreeSitterNode, definitions: Definition[]): voi
   if (!className) return;
   definitions.push({
     name: `${className}.<static>`,
-    kind: 'function',
+    kind: 'method',
     line: nodeStartLine(node),
     endLine: nodeEndLine(node),
   });
@@ -2141,6 +2143,31 @@ function extractParamBindingsWalk(rootNode: TreeSitterNode, paramBindings: Param
           if (ct === ',' || ct === '(' || ct === ')') continue;
           if (ct === 'identifier' && !BUILTIN_GLOBALS.has(child.text)) {
             paramBindings.push({ callee: fn.text, argIndex: argIdx, argName: child.text });
+          } else if (ct === 'spread_element') {
+            // f(...[a, b]) — inline array literal: expand each element as a direct param binding.
+            const inner =
+              child.childForFieldName('argument') ?? (child.childCount > 1 ? child.child(1) : null);
+            if (inner?.type === 'array') {
+              let elemCount = 0;
+              for (let j = 0; j < inner.childCount; j++) {
+                const elem = inner.child(j);
+                if (!elem) continue;
+                if (elem.type === ',' || elem.type === '[' || elem.type === ']') continue;
+                if (elem.type === 'identifier' && !BUILTIN_GLOBALS.has(elem.text)) {
+                  paramBindings.push({
+                    callee: fn.text,
+                    argIndex: argIdx + elemCount,
+                    argName: elem.text,
+                  });
+                }
+                elemCount++;
+              }
+              // Advance by the exact number of slots this spread occupies and skip
+              // the unconditional argIdx++ below so that zero-element spreads (...[])
+              // do not shift subsequent argument indices.
+              argIdx += elemCount;
+              continue;
+            }
           }
           argIdx++;
         }
@@ -2257,6 +2284,29 @@ function extractSpreadForOfWalk(
         funcStack.push(nameNode.text);
         pushedFunc = true;
       }
+    } else if (node.type === 'assignment_expression') {
+      // `obj.method = function() { ... }` — func-prop assignment.
+      // Mirror handleFuncPropAssignment's logic so for-of loops inside the
+      // body get the correct enclosingFunc (e.g. 'obj.method') instead of
+      // '<module>' or the wrong outer function name.
+      const lhs = node.childForFieldName('left');
+      const rhs = node.childForFieldName('right');
+      if (
+        lhs?.type === 'member_expression' &&
+        (rhs?.type === 'function_expression' || rhs?.type === 'arrow_function')
+      ) {
+        const obj = lhs.childForFieldName('object');
+        const prop = lhs.childForFieldName('property');
+        if (
+          obj?.type === 'identifier' &&
+          (prop?.type === 'property_identifier' || prop?.type === 'identifier') &&
+          !BUILTIN_GLOBALS.has(obj.text) &&
+          prop.text !== 'prototype'
+        ) {
+          funcStack.push(`${obj.text}.${prop.text}`);
+          pushedFunc = true;
+        }
+      }
     }
 
     if (node.type === 'call_expression') {