Dev build from commit 6221df16ede3aceae71506b93f9b936ab4610dd1 on main.

Dev build from commit d8556f39d38038116dab303bf95aa63a25079c3c on main.

Dev build from commit c8846e6fcd6ed7395ac4781506914bbc312a23a9 on main.

Dev build from commit 4cbc5c51a874f56a7986d528cf6eea10de628af4 on main.

Dev build from commit 47bb53f450bd7bf3d8d90e654090f83f557e167a on main.

A wide correctness sweep across virtual-dispatch resolution, Dart support, and incremental builds. CHA/virtual-dispatch resolution gets over a dozen fixes closing collision and missed-edge cases around super(), receiver-typed dispatch, and cross-file same-named classes/functions; codegraph info now nudges you toward --no-incremental when an interface gains its first instantiated implementor after an incremental build. Dart gains full dataflow tracking (local variables, arrow-body implicit returns, grouped parameters) alongside extraction fixes for bare calls and bodyless members. Complexity/Halstead metrics now cover Julia, Solidity, R, Groovy, Zig, Objective-C, and CUDA, closing out the per-language rollout started in 3.16.0. Incremental/watch-mode builds gain several correctness fixes (barrel renames, tsconfig/jsconfig aliases, points-to confidence, return-type and invoked-property evidence) that previously required a full rebuild to pick up, and the roles/exports classifiers get sharper about Python entrypoints, declarative-only languages, and top-level-call consumers. Also included: .codegraphrc.json/--db config resolution no longer gets pinned to the invoking directory across a long tail of remaining call sites, several transitive dependency vulnerabilities are patched, and a batch of hooks/CI/skills reliability fixes for the project's own Claude Code tooling.

Bug Fixes

• cha: stop CHA/virtual-dispatch resolution from matching a coincidentally same-named local function or an unrelated same-named class across super() calls, scope the implementor map per file while walking ancestors for inherited methods, exclude super-dispatch edges from sibling expansion, include the receiver's own instantiated type and RTA evidence from new expressions, make native typed-receiver dispatch additive instead of a last-resort fallback, revisit sibling-implementor callers during the incremental CHA post-pass, seed object-rest-param type annotations for dispatch, scope same-named locals/params by their enclosing function so dispatch collisions can't cross function boundaries, tag super-dispatch edges distinctly in the WASM/JS inline path, and confirm concrete-receiver bare-name matches via type-aware dispatch; codegraph info nudges codegraph build --no-incremental when an interface gains its first instantiated implementor since the last full build (#2404, #2403, #2400, #2399, #2494, #2493, #2349, #2314, #2317, #2398, #2208, #2236, #2227, #2473)
• resolver: seed the typeMap from as-casts and a missing factory-method heuristic, resolve JSX elements and call-argument identifiers as references, stop .bind()/.call()/.apply() on an inline function from embedding its source as the receiver, remap .mjs/.cjs specifiers to .mts/.cts sources, resolve workspace exports-field targets without bypassing a node_modules symlink, give computed dispatch-table access and this-bound EventEmitter callback registrations real invocation evidence, resolve logical-or/ternary function fallbacks to a real calls edge, resolve Python module imports to files and aliased module calls, prevent resolveThisDispatch from matching an unrelated same-named class in another file, respect this-binding scope boundaries and distinguish static from instance accessors in same-file call attribution, and qualify object literals returned from factory functions (#2534, #2533, #2529, #2479, #2465, #2457, #2445, #2444, #2432, #2410, #2291, #2323, #2322, #2263)
• native/rust: port package.json exports-field resolution to the native engine, resolve crate::/self::/super:: module paths (including via a Cargo.toml target-path override), resolve if-let-bound method calls to cross-file Option/Result return types, remove a dead same-file suffix-scan fallback from resolveByGlobal, stop dropping dotfile-named source files and fix an undercounted build summary, and propagate a file_hashes read failure instead of silently reporting no prior state (#2289, #2215, #2376, #2371, #2209, #2532, #2541)
• extractors: recognize array-pattern CJS require() destructures and extract their rest bindings on the WASM/TS engine, extract rest/default bindings from destructured const declarations, mark destructured const export bindings as exported, preserve the barrel-renamed declared name for CJS require() imports, strip quotes from plain quoted method/property keys, match the export line to the declaration instead of the export keyword, recognize cross-file ES6 getter/setter accessor reads, resolve a same-line decorator upgrade gap in call dedup, and fix var-shadowing at a function boundary so loop heads no longer kill the fallback value (#2268, #2269, #2277, #2294, #2296, #2183, #2460, #2252, #2248, #2440)
• dart: port Dart's dataflow rules to the native Rust engine, track local variable declarations and calls, record an implicit return for arrow-body functions, give every name in a grouped-parameter wrapper the same paramIndex, populate the typeMap for field/parameter types, extract bare calls, fix endLine truncation and bodyless-member handling, and keep function scope active through Dart's sibling body (#2503, #2499, #2498, #2502, #2477, #2320, #2360)
• complexity: add cognitive/cyclomatic/Halstead rules for Julia, Solidity, R, Groovy, Zig, Objective-C, and CUDA; correct switch/case complexity shadowing and comment-prefix undercounting, skip complexity/CFG for bodyless WASM functions and bodyless Rust trait methods, track complexity for anonymous Lua function-expression assignments, and show max cyclomatic complexity in the text summary (#2472, #2313, #2281, #2233, #2202, #2286, #2284, #2282, #2264, #2523)
• ast-analysis: stop misattributing complexity/CFG across same-line anonymous functions, track block-comment state in LOC comment detection, and stop requiring a multi-line span for hasFuncBody (#2446, #2456, #2452)
• roles: recognize pyproject.toml console-script and Python __main__ entrypoints, persist Python entrypoint evidence so attribution survives rebuilds, stop emitting dead-* verdicts for declarative-only languages, apply the reachability downgrade to increm...

Remote embedding providers, complexity metrics for six more languages, and a broad resolver/extractor accuracy sweep across both engines. codegraph embed and codegraph search can now call a self-hosted or third-party OpenAI-compatible /embeddings endpoint instead of only the bundled local model, configured via a new embeddings.provider setting. codegraph complexity gains cognitive/cyclomatic/Halstead metrics for C, C++, Kotlin, Swift, Scala, and Bash on the WASM engine, which previously returned nothing for these languages. The Leiden community-detection algorithm is now ported to native Rust, closing a long-standing engine-parity gap where native ran classic Louvain while WASM ran Leiden. codegraph watch's incremental rebuild path gains CHA/RTA virtual-dispatch, points-to fallback, and dynamic-sink edge emission that only full builds previously produced, and reverse-dependency edge reconnection is fixed for a compound sibling-count-and-line-shift edge case. Deleted-file export tracking is now durable across purge ordering, so codegraph check's signature-change gate can no longer be bypassed by rebuild timing. Beyond these headline items, over a hundred targeted fixes improve call-edge resolution, symbol extraction, and native/WASM parity across nearly every supported language.

Features

• search: configurable remote embedding provider — set embeddings.provider: "openai" and llm.baseUrl in .codegraphrc.json to route codegraph embed through any OpenAI-compatible /embeddings endpoint (self-hosted text-embeddings-inference, Ollama, LM Studio, vLLM, or OpenAI itself); codegraph search and the semantic_search MCP tool embed queries through the same remote provider; new CODEGRAPH_LLM_BASE_URL env override; reuses the existing llm.apiKey/apiKeyCommand secret resolution (#1716)

Bug Fixes

• check: persist a durable snapshot of each deleted file's exported symbols and external consumers (new deleted_export_advisories table, mirrored in the native orchestrator) so the no-signature-change gate can't be bypassed depending on whether check runs before or after a rebuild has already purged the deleted file's rows (#1939, #2103)
• incremental: port CHA/RTA virtual-dispatch, points-to/alias fallback, and dynamic-sink edge emission into codegraph watch's single-file rebuild path — these three edge categories were silently absent whenever a file was rebuilt via watch mode instead of a full build (#1997)
• native: port the Leiden algorithm to Rust so both engines run the identical community-detection implementation, closing a documented "intentional" engine mismatch where native ran classic Louvain and WASM ran Leiden (#1937)
• incremental: fix reverse-dependency edge reconnection when a same-named sibling group's size changes in the same edit as a line shift — replaces the ordinal/nearest-line heuristic with alignment by the dominant shift that best explains surviving siblings (#2014)
• complexity: add cognitive/cyclomatic/Halstead rule support for C, C++, Kotlin, Swift, Scala, and Bash to the WASM engine, which previously had no rules at all for these languages; also fixes three native-only rule bugs surfaced during the port (C/C++ else-clause detection, Bash trailing-else scoring, Swift logical-operator node types) and a WASM-only double-counting bug for node types shared between branch and case sets (#2059)
• complexity: stop using dotted names as a proxy for signature-only stubs; scope summary stats to file/target/kind filters; recognize Lua function nodes in complexity computation (#2056, #1953, #1924)
• resolver: attribute new ClassName() calls to the constructor method, kind-filter same-file bare-name lookup for receiver-bearing calls, recognize identifier arguments passed to user-defined higher-order functions via parameter type, require invocation evidence for object-literal value-ref liveness, pick the single best match in resolveByGlobal instead of every candidate, and scope extends/implements edges to same-file/import/language candidates (#2028, #2026, #1989, #2034, #2000, #1957)
• extractors: extract bare super(...) constructor calls as call edges, extract rest/default bindings from dynamic import() destructures, emit per-element definitions for array-pattern destructuring, resolve inline object-literal dispatch tables on WASM, attribute same-file ES6 getter/setter property reads as call edges, capture top-level const definitions regardless of initializer shape, align native/WASM definition order for object-literal methods, and label property_signature interface/type members with kind property (#2102, #2052, #2038, #2035, #2031, #1964, #1963, #1955)
• native: resolve monorepo workspace package imports, add an Object.defineProperty accessor dispatch post-pass to the native orchestrator, scope barrel-only import skipping to transient barrel re-parses, propagate edge/node write failures out of run_pipeline instead of swallowing them, write dynamic_kind for sink edges, recover renamed import names in the FFI hybrid import-edge path, and resolve self.field/unit-struct/constructor-typed locals (#2061, #2024, #1991, #1972, #1698)
• dynamic-calls: port Lua eval/computed-key dynamic-call detection to the WASM extractor; restore reflection dynamicKind for .call/.apply/.bind; gate identifier-argument dynamic call edges on callback-accepting callees; apply the plain-identifier guard to the query path for .call/.apply/.bind (#2043, #1917, #1846, #1697)
• roles: exclude genuine class/struct properties from dead-role classification; restrict entry-role classification to function/method-kind symbols; attribute liveness to Lua functions assigned to global/builtin identifiers (#1956, #1919, #1912)
• exports: credit plain imports of TypeScript interfaces/type aliases, discriminate file-level from symbol-level consumer entries, credit instanceof ClassName checks, and credit destructured dynamic import() bindings as consumers (#1978, #1974, #1930, #1921)
• cycles: classify cycles whose only closing edges are speculative (#1988)
• incremental: correct blast-radius/fn-impact computation for line-shifted declarations, add a same-class bare-call fallback, recompute directory structure metrics for affected directories, couple file_hashes updates with edge regeneration, scope neighbor expansion to the changed file, and eliminate non-deterministic ordering in community detection (#1916, #1886, #1840, #1828, #1950, #1835)
• db: derive loadConfig() rootDir from the --db path in read-only query functions, thread configured busyTimeoutMs into NativeDatabase open factories and remaining read-only query call sites, resolve directory paths in findDbPath to .codegraph/graph.db, resolve codegraph embed's default DB path from the positional dir instead of cwd, and log (instead of silently swallowing) statSync failures in findDbPath (#2018, #2021, #1943, [#1706](https://github.com/optave/ops-codegrap...

Dynamic call detection ships across all 34 languages, plus richer codegraph stats output and a new ignoreAdditionalDirs config option. Seven phases of dynamic dispatch detection land in a single release: Reflect/decorator patterns in JS/TS, JVM dynamic dispatch with Kotlin callable-reference resolution, Python getattr/eval/functools.partial, Ruby send/public_send and PHP call_user_func, Go MethodByName and C/C++ dlsym/function-pointer detection, and C#/Swift/Elixir/Lua long-tail patterns. Every pattern is classified with a DynamicKind taxonomy (computed-literal, computed-key, reflection, eval, unresolved-dynamic) and visible via a new codegraph roles --dynamic flag; resolved calls remain in the normal call graph while unresolvable patterns emit zero-confidence sink edges that never pollute regular queries. A closed dispatch-table resolver (RES-2) handles ({a:fnA,b:fnB})[key]() via the existing PTS wildcard solver. codegraph stats now breaks down dead symbols by actionable sub-role (dead-leaf, dead-unresolved, dead-ffi, dead-entry, dead-callable), fixing a pre-existing double-counting bug in the dead total. A new ignoreAdditionalDirs config field lets projects append additional directories to the built-in IGNORE_DIRS without patching codegraph source.

Features

• dynamic-calls: detect and flag dynamic call sites in JS/TS — DynamicKind taxonomy classifies every dynamic call at extraction time; sink edges flagged as dynamic_kind in a new DB column (migration v20); new codegraph roles --dynamic flag surfaces them; Rust native extractor fully mirrored (#1629)
• dynamic-calls: Reflect.apply/construct/get and TypeScript @Foo decorator detection (Phase 1) — JS/TS-specific reflection idioms emit reflection-kind calls; both walk and query extractor paths updated; Rust mirrored (#1637)
• dynamic-calls: JVM dynamic dispatch — Java Method.invoke/Class.forName/getMethod, Kotlin callable references (::fn), Scala/Groovy invoke patterns; Kotlin ::fn refs resolve at 100% recall (Phase 2) (#1646)
• dynamic-calls: Python getattr/eval/exec/functools.partial detection; getattr(obj, 'method') resolves at 100% recall for top-level functions (Phase 3) (#1653)
• dynamic-calls: Ruby send/public_send and PHP call_user_func/$fn() detection; literal symbol calls resolve at 100% recall (Phase 4) (#1654)
• dynamic-calls: Go reflect.MethodByName and C/C++ function-pointer/dlsym detection; both resolve at 100% recall for literal names (Phase 5) (#1655)
• dynamic-calls: C# GetMethod/Invoke, Swift NSSelectorFromString/performSelector, Elixir apply, Lua load/loadstring/bracket-index calls, ObjC performSelector, Dart Function.apply; Swift resolves at 100% recall; Rust extractor mirrored for all four languages (Phase 6) (#1657, #1670)
• dynamic-calls: RES-2 — closed dispatch-table resolution — ({a:fnA,b:fnB})[key]() resolves to each table entry via the PTS wildcard solver; Rust native mirror included (#1677)
• stats: separate dead-code categories in codegraph stats — per-sub-role breakdown with actionability labels (dead-leaf, dead-unresolved, dead-ffi, dead-entry, dead-callable); fixes pre-existing double-counting bug where the synthetic dead aggregate was summed alongside individual sub-role counts (#1648)
• config: add ignoreAdditionalDirs to .codegraphrc.json — array of directory names merged with the built-in IGNORE_DIRS at file-collection time; included in BUILD_HASH_KEYS to trigger a full rebuild when changed; crates removed from the global IGNORE_DIRS default (add it to ignoreAdditionalDirs in your own .codegraphrc.json if needed) (#1666)

Bug Fixes

• dataflow: P4 incremental re-stitch + P6 vertex extraction on native engine path — vertex rows extracted during bulk-insert pass; re-stitch fires on callee-only changes without a full rebuild; P6 parity fix for incremental vs full-build paths (#1635)
• dataflow: make dataflow vertex write and inter-procedural stitch atomic — closes half-written state gap when the process is killed between vertex insert and stitch (#1658)
• dataflow: purge dataflow rows keyed by call_edge_id before edge deletion — prevents FK constraint failures during incremental file purge that left stale nodes after file deletion (#1662)
• dynamic-calls: RES-3 type-aware method name lookup for JVM getMethod patterns — Rust resolver now uses receiver type to construct qualified lookup for Groovy, Java, and Scala getMethod calls
• native: Kotlin callable-ref prefers class method over top-level function; suppress spurious invoke sink edge that diverged from WASM (#1686)
• native: CJS require bindings now produce receiver-edge parity with WASM — require()-destructured class types emit receiver call edges on the native path (#1671, #1678, #1679)
• native: always run JS role re-classification on full builds to fix hasActiveFileSiblings parity — incremental-only re-classification left stale role assignments on fresh builds
• wasm: preserve dyn=1 when deduplicating edges with same source/target/kind/confidence — bare @Log decorator was silently dropped when @Log() call-expression had already been processed first (#1688)
• native: dispatch-table PTS resolution in JS extractor — ({a:fnA,b:fnB})[key]() now resolves on the native path, matching WASM output (#1690)
• stats: exclude sink edges (dynamic call placeholders, confidence=0.0) from the call-confidence denominator; lift minimum confidence for resolved ts-native edges from 0.3 → 0.5 (#1641)
• stats: suppress false-positive high-fan-in warnings for Rust ::new() constructors (#1643)
• mcp: break 37-file circular dependency by extracting McpToolContext to mcp/types.ts — two consecutive architectural audits had flagged this cycle (#1638)
• config: ignoreAdditionalDirs and ignoreDirs now respected in watch mode (#1666)
• analysis: exclude gitignored NAPI-RS artifacts from native gap detection — prevents spurious WARN and unnecessary WASM backfill on every fresh --no-incremental build (#1647)
• analysis: exclude NAPI-RS generated index.js from WASM engine analysis — eliminates false 359 cognitive-complexity reading for requireNative in codegraph triage (#1636)
• types: use @types/better-sqlite3 types in getDatabase() and McpToolContext — removes last any usages in the DB layer (#1639)

Chores

• docs: add ADRs for dynamic call resolution and interprocedural dataflow (#1675)
• deps: bump better-sqlite3 from 12.10.0 to 12.11.1 (#1634)
• deps: bump vitest from 4.1.8 to 4.1.9 (#1633)
• deps: bump actions/checkout from 6 to 7 (#1630)

Interprocedural dataflow analysis ships in full, plus a sweep of role-classifier accuracy fixes. The headline feature is a complete variable-level dataflow model: dataflow_vertices tracks param, return, and local variable locations per function; def_use edges connect definitions to uses within a function; arg_in and return_out edges stitch caller and callee dataflow across call boundaries. All 34 supported languages have dataflow rules. Incremental re-stitch (P4) fires on both the WASM/JS and native engine paths so arg_in edges are rebuilt when only a callee file changes, without a full rebuild. codegraph fn-impact --json gains direct and transitive shorthand fields alongside the existing levels breakdown. The role classifier received five accuracy fixes that eliminate a family of false-positive dead-symbol reports on real TypeScript and Rust codebases: exported interfaces with no cross-file call edges, type-def kinds in files with active callables, Commander.js dispatch methods, methods with active file siblings, and self-sibling sole-callable false-negatives. Erlang WASM parity is restored after the malicious package removal in v3.13.0.

Features

• dataflow: interprocedural variable-level model across all 34 languages — new def_use (intra-function define-use), arg_in (caller arg → callee param), and return_out (callee return → caller capture) edge kinds; dataflow_vertices table tracks param/return/local locations; dataflow_summary table stores per-param transfer functions (flows_to_return, is_mutated); DB migrations v18 + v19; P4 incremental re-stitch runs on both JS and native engine paths so arg_in edges are rebuilt on callee-only changes without a full rebuild; parity-compare.mjs --dataflow flag for vertex multiset comparison (#1608, #1612, #1615)

Bug Fixes

• fn-impact: add direct and transitive shorthand counts to JSON output — direct is the level-1 caller count, transitive is all callers at depth 2+; computed from the existing BFS levels data with no extra DB queries; fully backward-compatible (#1603)
• roles: honour exported=1 flag for interfaces and type aliases with no cross-file edges — exported symbols used only as same-file type annotations now classify as entry rather than dead-unresolved (#1599)
• roles: classify type-def kinds as leaf when the file has active callables — type, interface, struct, enum, and trait definitions in files with at least one callable (fan-in or fan-out > 0) no longer produce dead-ffi or dead-unresolved false positives (#1600)
• roles: classify Commander.js execute/validate methods in framework dispatch directories as entry — eliminates ~12,000 false positives in codegraph roles --role dead output on Commander.js-based CLIs (#1601)
• roles: classify methods and functions with active file siblings as leaf — interface-dispatch callbacks (visitor pattern), logical-or function defaults, and handler-table property callbacks no longer report as dead-unresolved; fanOut > 0 guard prevents over-promotion of trivial helpers; mirrored in Rust native classifier (#1602)
• roles: prevent sole-callable self-sibling false-negative — a function whose only active file sibling is itself no longer satisfies the hasActiveFileSiblings heuristic; applied symmetrically in TypeScript and Rust classifiers (#1603)
• db: derive rootDir from customDbPath when a custom --db path is set — openRepo/openReadonlyWithNative no longer always default to process.cwd() when a custom DB path is provided (#1606)
• config: wire config.build.engine from .codegraphrc.json into pipeline and DB connection — openRepo/openReadonlyWithNative now read the file-level engine config; CLI --engine flag still takes priority (#1604)
• dataflow: guard C/C++ function name and parameter extraction against unnamed declarators (#1608)
• dataflow: guard exitFunction scope-stack pop against early-return from enterFunctionScope (#1612)
• parity: restore Erlang WASM grammar — the grammar was lost when the malicious tree-sitter-erlang npm package was removed in v3.13.0; the validated WASM is now committed directly via a .gitignore negation rule so the WASM engine has Erlang support without reinstating the removed devDependency (#1598)
• ci: fix Windows SSH git dependency resolution — add --add flag to the second git config insteadOf call to prevent silent overwrite on Windows runners (#1597)

Refactors

• native-orchestrator: decompose into focused helper functions; extract call-resolution strategy dispatch to resolver/strategy.ts (#1591, #1592)
• cfg: replace TS and Rust processStatement switch with handler-table dispatch — O(1) single-type handler lookup (#1590)
• types: consolidate shared interfaces and extract DRY abstractions (#1588)
• config: split config command subcommands; move JS type-resolution confidence threshold and engine env vars to DEFAULTS (#1589)
• complexity: address warn-level complexity in ast-analysis visitors, features domain, and infrastructure (#1593)
• roles: extract ANNOTATION_ONLY_KINDS constant in Rust classifier for parity with TS (#1602)

Chores

• bench: update resolution benchmarks and embedding benchmarks for v3.13.0 (#1580, #1581)
• bench: prune stale 3.11.x KNOWN_REGRESSIONS entries (#1580)

User-level global config, codegraph config scaffolding, and an explain alias land. The headline feature is a new user-level configuration layer (~/.config/codegraph/config.json via XDG, or ~/.codegraph/config.json fallback) with an interactive per-repo consent model — DEFAULTS → global (if consented) → project → env → secrets. codegraph config now shows a human-friendly key/value/source table by default (pass --json for machine output), and gains --init (scaffold a .codegraphrc.json with all sections pre-populated), --edit (open in $EDITOR), --enable-global, --disable-global, and --list-global flags. Global --user-config [path] and --no-user-config CLI flags are also new. The explain command lands as a discoverable alias for audit. TypeScript compiler-based type resolution now auto-enables for TS projects that have a tsconfig.json. A supply-chain incident is resolved — a malicious tree-sitter-erlang npm package is replaced with a clean source build. On engine accuracy, super-dispatch cross-file false edges are eliminated, CHA confidence is aligned between WASM and native, and a sweep of parity fixes improves call-graph correctness for Go, Python, C++, CUDA, Haskell, and Zig.

Features

• cli: add explain as alias for audit — codegraph explain <target> is equivalent to codegraph audit <target>; makes the audit command easier to discover
• config: codegraph config now shows a key/value/source table when --json is not passed — each key displays its current value and which layer it came from (default, user, project, env)
• config: add --init and --edit scaffolding helpers — codegraph config --init scaffolds a .codegraphrc.json with all sections pre-populated; codegraph config --edit opens the project config file in $EDITOR
• config: user-level (global) config with per-repo consent — new ~/.config/codegraph/config.json (XDG) or ~/.codegraph/config.json fallback; interactive per-repo consent model; codegraph config --enable-global, --disable-global, --list-global flags; global --user-config [path] and --no-user-config CLI flags; layered merge order: DEFAULTS → global (if consented) → project → env; config_hash invalidation triggers a full rebuild when build-relevant config changes; loadConfigWithProvenance returns per-key source map (#1559)

Bug Fixes

• config: auto-enable TypeScript compiler resolver for TS projects — typescriptResolver now defaults to true; silently skips when typescript is unavailable or no tsconfig.json is present, so JS-only projects and environments without TypeScript are unaffected (#1461)
• config: clarify consent prompt wording to reflect per-key inheritance semantics and improve question clarity
• cha: eliminate super-dispatch cross-file false edges — super.method() calls no longer resolve to methods outside the class hierarchy; the native engine expands super-dispatch into CHA sibling overrides (#1506, #1514, #1537, #1544)
• native: resolve this-dispatch in func-prop methods — fn.method = function(){ this.other() } now resolves other through the func-prop enclosing context (#1512)
• native: seed typeMap entries for let/var object-literal methods — object literal methods defined with let/var now register their receiver types for downstream resolution
• native: prefer bare name over qualified in span-tie caller attribution — when two candidates share the same span, the bare-name symbol wins to avoid false qualified-name attribution
• native: resolve Go factory and Python constructor receiver types — NewFoo() in Go and Foo() constructors in Python now seed the typeMap for downstream method-call resolution (#1498)
• native: align object-literal shorthand method node ordering with WASM — extraction order is now consistent between engines
• wasm: align TypeScript CHA dispatch confidence (0.6 → 0.8) — WASM now matches the native engine's confidence for CHA-resolved edges (#1505)
• wasm: port missing node extractions to JS extractor (jelly-micro #1471) — several edge-type gaps in the WASM engine aligned with the native engine (#1509)
• wasm: emit receiver edges for declaration-typed locals (C++, CUDA) — typed local declarations in C++ and CUDA now produce receiver call edges (#1497)
• parity: port the JS points-to solver to native — WASM and native now run identical resolution logic for JavaScript/TypeScript points-to bindings; the four JS pts post-passes on the hybrid path are removed, leaving a single source of truth (#1465)
• parity: align Java interface dispatch across WASM, native, and hybrid engines — all three engines now agree on interface method resolution confidence and edge set (#1503)
• parity: align enclosing-caller attribution for variable bindings (Haskell, Zig) — multi-binding let patterns now attribute calls to the correct enclosing caller (#1499)
• extractor: strip brackets from computed string-key method names — obj['method']() no longer emits ['method'] as the method name
• receiver: local function constructors block cross-file class receiver edges — prevents false cross-file receiver matches when a same-file function constructor is in scope
• resolver: class-scope field annotation typeMap keys prevent cross-class collision — private repo: Repository in two classes no longer shares a typeMap key (#1495)
• triage: normalize JSON output to use items key at all levels — all triage JSON responses now use a consistent items array structure
• cli: accept --json flag in batch command as no-op — batch command no longer errors when --json is passed (#1563)
• parser: downgrade WARN to debug for optional parsers with missing WASM grammar — language parse errors for optional grammars no longer pollute stderr with WARN messages
• native: don't warn when a natively-supported file produces 0 symbols via WASM — gitignored Rust addon artifacts no longer trigger false-positive extractor failure warnings
• deps: remove malicious tree-sitter-erlang, fix 3 moderate vulnerabilities — replaces the compromised npm package with a clean source build; also fixes 3 moderate-severity vulns (#1478)
• hooks: track Bash file modifications to prevent false-positive commit blocks (#1483)
• perf: scope runPostNativeCha to changed files on incremental builds — incremental rebuilds no longer run the full CHA post-pass on unchanged files (#1490)
• perf: pass symbolsOnly through parseFilesWasmInline — avoids unnecessary data extraction during symbol-only parse passes (#1489)
• bench: update Elixir, Julia, and Objective-C expected-edges to module-qualified names (#1496)
• ci: accept v-prefixed versions in publish workflow_dispatch input (#1443)

Performance

• native: replace O(n²) type-map dedup with O(n) write-then-dedup — large files with many type-map entries no longer degrade quadratically during the native post-pass

Refactors

• native: mirror Rust crate module layout to the TypeScript src/ tree — crates/codegraph-core/src/ modules now follow the snake_case equivalent of their TypeScript counterparts (#1463)
• extractors: deduplicate C-family primitive types into a shared constant

Chores

• ci: add per-PR perf canary for extractor/graph/native changes (#1488)
• ci: add dev-dependency audit step at critical severity (#1479)
• deps-dev: bump @biomejs/biome from 2.4.16 to 2.5.0 (#1523)
• deps-dev: bump tree-sitter-gleam (#1522)
• deps-dev: bump @vitest/coverage-v8 from 4.1.7 to 4.1.8 (#1521)
• deps: bump anthropics/claude-code-action from 0.0.63 to 1.0.148 (#1520)