Merge branch 'main' into fix/static-receiver-confidence-1398

Author: carlos-alm

src/extractors/javascript.ts

@@ -2905,6 +2905,11 @@ function firstArgIsStringLiteral(argsNode: TreeSitterNode): boolean {
  * member-expr args are only emitted when the first argument is a string
  * literal route path — matching Express/router shape and skipping
  * `cache.get(user.id)`-style calls.
+ *
+ * `.call()` / `.apply()` / `.bind()` — the first arg is the `this` context (not a callback of
+ * the enclosing function) and subsequent args flow into the delegated function's parameters.
+ * Emitting them here would produce false-positive edges from the *calling* function.
+ * This-rebinding (fn::this → ctx) is handled separately by extractThisCallBindingsWalk.
  */
 function extractCallbackReferenceCalls(callNode: TreeSitterNode): Call[] {
   const args = callNode.childForFieldName('arguments') || findChild(callNode, 'arguments');
@@ -2916,6 +2921,7 @@ function extractCallbackReferenceCalls(callNode: TreeSitterNode): Call[] {
   // Emitting them here would produce false-positive edges from the *calling* function.
   // This-rebinding (fn::this → ctx) is handled separately by extractThisCallBindingsWalk.
   if (calleeName === 'call' || calleeName === 'apply' || calleeName === 'bind') return [];
+
   let memberExprArgsAllowed = calleeName !== null && CALLBACK_ACCEPTING_CALLEES.has(calleeName);
   if (memberExprArgsAllowed && calleeName !== null && HTTP_VERB_CALLEES.has(calleeName)) {
     // HTTP verbs require a string-literal route path to be treated as a

tests/benchmarks/resolution/resolution-benchmark.test.ts

@@ -129,7 +129,7 @@ const THRESHOLDS: Record<string, { precision: number; recall: number }> = {
   //   total expected now 35. multi-class.js adds 4 class-scoped typeMap edges (#1382) → 39.
   //   call/apply this-rebinding adds 2 edges (runCallThis→invoker, invoker→handler) and removes
   //   the false-positive from handler being extracted as a callback arg of .call() (#1405) → 41.
-  //   #1407 adds class-scope.js (bare-call guard), +1 → total 42.
+  //   #1422 adds class-scope.js (bare-call guard), +1 → total 42.
   javascript: { precision: 1.0, recall: 0.9 },
   // pts-javascript: hand-authored points-to JS fixture (for-of, Set, Array.from, spread) — patterns
   //   too broad for the main JS fixture. Patterns split per file to prevent intra-fixture FPs.

tests/parsers/javascript.test.ts

@@ -850,6 +850,32 @@ describe('JavaScript parser', () => {
       expect(def.line).toBe(2);
       expect(def.endLine).toBe(4);
     });
+
+    // .call/.apply/.bind narrowing (#1406)
+    // All args flow into the delegated function, not as callbacks for the current scope.
+    // This-rebinding (fn::this → ctx) is handled by extractThisCallBindingsWalk instead.
+    it('emits nothing for .call() — args flow into the delegated function, not the current scope', () => {
+      const symbols = parseJS(`Array.prototype.forEach.call(collection, handler);`);
+      expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'handler' }));
+      expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'collection' }));
+    });
+
+    it('emits nothing for .apply() — second arg is an arguments array, not a callback', () => {
+      const symbols = parseJS(`fn.apply(ctx, handler);`);
+      expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'handler' }));
+      expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'ctx' }));
+    });
+
+    it('emits nothing for .call() with only the this-context arg', () => {
+      const symbols = parseJS(`fn.call(ctx);`);
+      expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'ctx' }));
+    });
+
+    it('emits nothing for .bind() — all args are absorbed into the partial application', () => {
+      const symbols = parseJS(`Promise.resolve.bind(null, transform);`);
+      expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'transform' }));
+      expect(symbols.calls).not.toContainEqual(expect.objectContaining({ name: 'null' }));
+    });
   });
 
   describe('Phase 8.3f: object-destructuring rest parameter binding extraction', () => {

tests/unit/call-resolver.test.ts

@@ -10,7 +10,7 @@
  * method fallback must apply computeConfidence >= 0.5 to avoid false edges from
  * distant files in a polyglot project.
  *
- * Also covers the bare-call JS/TS module-scope guard (#1407): bare `foo()` calls
+ * Also covers the bare-call JS/TS module-scope guard (#1422/#1424): bare `foo()` calls
  * (no receiver) inside a JS/TS class method must NOT fall through to the same-class
  * lookup, because bare calls in those languages are module-scoped, not class-scoped.
  */