fix: add loadfile to Lua eval-detection guard in both engines (#2043)

Greptile flagged that loadfile is listed in LUA_BUILTIN_GLOBALS alongside
load/loadstring/dofile and performs the same dynamic-code-loading operation,
but was missing from the eval-detection guard in both the WASM extractor
(src/extractors/lua.ts) and the native Rust extractor
(crates/codegraph-core/src/extractors/lua.rs) — so loadfile("script.lua")()
was not flagged as a dynamic eval site on either engine.

Since this PR's purpose is eliminating WASM/native divergence for Lua
eval/computed-key detection, fixing loadfile on only one engine would
reintroduce exactly the kind of parity gap this PR exists to close. Adds
loadfile to the guard on both sides plus a unit test on each (mirroring the
existing load/loadstring/dofile coverage).

Impact: 1 functions changed, 2 affected

Author: carlos-alm

crates/codegraph-core/src/extractors/lua.rs

@@ -156,10 +156,11 @@ fn handle_lua_function_call(node: &Node, source: &[u8], symbols: &mut FileSymbol
         None => return,
     };
 
-    // load(chunk) / loadstring(chunk) / dofile — dynamic code execution; always undecidable
+    // load(chunk) / loadstring(chunk) / loadfile(...) / dofile — dynamic code
+    // execution; always undecidable
     if name_node.kind() == "identifier" {
         let ident = node_text(&name_node, source);
-        if matches!(ident, "load" | "loadstring" | "dofile") {
+        if matches!(ident, "load" | "loadstring" | "loadfile" | "dofile") {
             symbols.calls.push(Call {
                 name: "<dynamic:eval>".to_string(),
                 line: start_line(node),
@@ -386,6 +387,14 @@ mod tests {
             && c.dynamic_kind.as_deref() == Some("eval")));
     }
 
+    #[test]
+    fn classifies_loadfile_call_as_dynamic_eval() {
+        let s = parse_lua("loadfile(\"script.lua\")()");
+        assert!(s.calls.iter().any(|c| c.name == "<dynamic:eval>"
+            && c.dynamic == Some(true)
+            && c.dynamic_kind.as_deref() == Some("eval")));
+    }
+
     #[test]
     fn resolves_bracket_index_call_with_string_literal_key_directly() {
         let s = parse_lua("t[\"handler\"]()");

src/extractors/lua.ts

@@ -258,12 +258,12 @@ function handleLuaFunctionCall(node: TreeSitterNode, ctx: ExtractorOutput): void
   const nameNode = node.childForFieldName('name');
   if (!nameNode) return;
 
-  // load(chunk) / loadstring(chunk) / dofile(...) — dynamic code execution;
-  // undecidable statically. Mirrors handle_lua_function_call's `load` arm in
-  // crates/codegraph-core/src/extractors/lua.rs.
+  // load(chunk) / loadstring(chunk) / loadfile(...) / dofile(...) — dynamic
+  // code execution; undecidable statically. Mirrors handle_lua_function_call's
+  // `load` arm in crates/codegraph-core/src/extractors/lua.rs.
   if (nameNode.type === 'identifier') {
     const ident = nameNode.text;
-    if (ident === 'load' || ident === 'loadstring' || ident === 'dofile') {
+    if (ident === 'load' || ident === 'loadstring' || ident === 'loadfile' || ident === 'dofile') {
       ctx.calls.push({
         name: '<dynamic:eval>',
         line: node.startPosition.row + 1,

tests/parsers/lua.test.ts

@@ -164,6 +164,13 @@ string.format("%s", name)`);
       );
     });
 
+    it('classifies loadfile(...) as a dynamic eval call', () => {
+      const symbols = parseLua(`loadfile("script.lua")()`);
+      expect(symbols.calls).toContainEqual(
+        expect.objectContaining({ name: '<dynamic:eval>', dynamic: true, dynamicKind: 'eval' }),
+      );
+    });
+
     it('classifies dofile(...) as a dynamic eval call', () => {
       const symbols = parseLua(`dofile("script.lua")`);
       expect(symbols.calls).toContainEqual(