@optave/codegraph 3.0.1 → 3.0.3

package/README.md

@@ -195,6 +195,7 @@ Full agent setup: [AI Agent Guide](docs/guides/ai-agent-guide.md) · [CLAU
 | 👀 | **Watch mode** | Incrementally update the graph as files change |
 | 🤖 | **MCP server** | 30-tool MCP server for AI assistants; single-repo by default, opt-in multi-repo |
 | ⚡ | **Always fresh** | Three-tier incremental detection — sub-second rebuilds even on large codebases |
+| 🔬 | **Data flow analysis** | Intraprocedural parameter tracking, return consumers, argument flows, and mutation detection — all 11 languages |
 | 🧮 | **Complexity metrics** | Cognitive, cyclomatic, nesting depth, Halstead, and Maintainability Index per function |
 | 🏘️ | **Community detection** | Louvain clustering to discover natural module boundaries and architectural drift |
 | 📜 | **Manifesto rule engine** | Configurable pass/fail rules with warn/fail thresholds for CI gates via `check` (exit code 1 on fail) |
@@ -208,7 +209,7 @@ Full agent setup: [AI Agent Guide](docs/guides/ai-agent-guide.md) · [CLAU
 | 📋 | **Composite audit** | Single `audit` command combining explain + impact + health metrics per function — one call instead of 3-4 |
 | 🚦 | **Triage queue** | `triage` merges connectivity, hotspots, roles, and complexity into a ranked audit priority queue |
 | 📦 | **Batch querying** | Accept a list of targets and return all results in one JSON payload — enables multi-agent parallel dispatch |
-| 🔬 | **Dataflow analysis** | Track how data moves through functions with `flows_to`, `returns`, and `mutates` edges — included by default (JS/TS), skip with `--no-dataflow` |
+| 🔬 | **Dataflow analysis** | Track how data moves through functions with `flows_to`, `returns`, and `mutates` edges — all 11 languages, included by default, skip with `--no-dataflow` |
 | 🧩 | **Control flow graph** | Intraprocedural CFG construction for all 11 languages — `cfg` command with text/DOT/Mermaid output, included by default, skip with `--no-cfg` |
 | 🔎 | **AST node querying** | Stored queryable AST nodes (calls, `new`, string, regex, throw, await) — `ast` command with SQL GLOB pattern matching |
 | 🧬 | **Expanded node/edge types** | `parameter`, `property`, `constant` node kinds with `parent_id` for sub-declaration queries; `contains`, `parameter_of`, `receiver` edge kinds |
@@ -225,6 +226,7 @@ See [docs/examples](docs/examples) for real-world CLI and MCP usage examples.
 ```bash
 codegraph build [dir]          # Parse and build the dependency graph
 codegraph build --no-incremental  # Force full rebuild
+codegraph build --dataflow     # Extract data flow edges (flows_to, returns, mutates)
 codegraph build --engine wasm  # Force WASM engine (skip native)
 codegraph watch [dir]          # Watch for changes, update graph incrementally
 ```
@@ -327,7 +329,8 @@ codegraph ast -k call                 # Filter by kind: call, new, string, regex
 codegraph ast -k throw --file src/    # Combine kind and file filters
 ```
 
-> **Note:** Dataflow (JS/TS only) and CFG are included by default. Use `--no-dataflow` / `--no-cfg` for faster builds.
+> **Note:** Dataflow and CFG are included by default for all 11 languages. Use `--no-dataflow` / `--no-cfg` for faster builds.
+
 
 ### Audit, Triage & Batch
 
@@ -477,15 +480,15 @@ codegraph registry remove <name>  # Unregister
 
 | Language | Extensions | Coverage |
 |---|---|---|
-| ![JavaScript](https://img.shields.io/badge/-JavaScript-F7DF1E?style=flat-square&logo=javascript&logoColor=black) | `.js`, `.jsx`, `.mjs`, `.cjs` | Full — functions, classes, imports, call sites |
-| ![TypeScript](https://img.shields.io/badge/-TypeScript-3178C6?style=flat-square&logo=typescript&logoColor=white) | `.ts`, `.tsx` | Full — interfaces, type aliases, `.d.ts` |
-| ![Python](https://img.shields.io/badge/-Python-3776AB?style=flat-square&logo=python&logoColor=white) | `.py` | Functions, classes, methods, imports, decorators |
-| ![Go](https://img.shields.io/badge/-Go-00ADD8?style=flat-square&logo=go&logoColor=white) | `.go` | Functions, methods, structs, interfaces, imports, call sites |
-| ![Rust](https://img.shields.io/badge/-Rust-000000?style=flat-square&logo=rust&logoColor=white) | `.rs` | Functions, methods, structs, traits, `use` imports, call sites |
-| ![Java](https://img.shields.io/badge/-Java-ED8B00?style=flat-square&logo=openjdk&logoColor=white) | `.java` | Classes, methods, constructors, interfaces, imports, call sites |
-| ![C#](https://img.shields.io/badge/-C%23-512BD4?style=flat-square&logo=dotnet&logoColor=white) | `.cs` | Classes, structs, records, interfaces, enums, methods, constructors, using directives, invocations |
-| ![PHP](https://img.shields.io/badge/-PHP-777BB4?style=flat-square&logo=php&logoColor=white) | `.php` | Functions, classes, interfaces, traits, enums, methods, namespace use, calls |
-| ![Ruby](https://img.shields.io/badge/-Ruby-CC342D?style=flat-square&logo=ruby&logoColor=white) | `.rb` | Classes, modules, methods, singleton methods, require/require_relative, include/extend |
+| ![JavaScript](https://img.shields.io/badge/-JavaScript-F7DF1E?style=flat-square&logo=javascript&logoColor=black) | `.js`, `.jsx`, `.mjs`, `.cjs` | Full — functions, classes, imports, call sites, dataflow |
+| ![TypeScript](https://img.shields.io/badge/-TypeScript-3178C6?style=flat-square&logo=typescript&logoColor=white) | `.ts`, `.tsx` | Full — interfaces, type aliases, `.d.ts`, dataflow |
+| ![Python](https://img.shields.io/badge/-Python-3776AB?style=flat-square&logo=python&logoColor=white) | `.py` | Functions, classes, methods, imports, decorators, dataflow |
+| ![Go](https://img.shields.io/badge/-Go-00ADD8?style=flat-square&logo=go&logoColor=white) | `.go` | Functions, methods, structs, interfaces, imports, call sites, dataflow |
+| ![Rust](https://img.shields.io/badge/-Rust-000000?style=flat-square&logo=rust&logoColor=white) | `.rs` | Functions, methods, structs, traits, `use` imports, call sites, dataflow |
+| ![Java](https://img.shields.io/badge/-Java-ED8B00?style=flat-square&logo=openjdk&logoColor=white) | `.java` | Classes, methods, constructors, interfaces, imports, call sites, dataflow |
+| ![C#](https://img.shields.io/badge/-C%23-512BD4?style=flat-square&logo=dotnet&logoColor=white) | `.cs` | Classes, structs, records, interfaces, enums, methods, constructors, using directives, invocations, dataflow |
+| ![PHP](https://img.shields.io/badge/-PHP-777BB4?style=flat-square&logo=php&logoColor=white) | `.php` | Functions, classes, interfaces, traits, enums, methods, namespace use, calls, dataflow |
+| ![Ruby](https://img.shields.io/badge/-Ruby-CC342D?style=flat-square&logo=ruby&logoColor=white) | `.rb` | Classes, modules, methods, singleton methods, require/require_relative, include/extend, dataflow |
 | ![Terraform](https://img.shields.io/badge/-Terraform-844FBA?style=flat-square&logo=terraform&logoColor=white) | `.tf`, `.hcl` | Resource, data, variable, module, output blocks |
 
 ## ⚙️ How It Works
@@ -552,14 +555,14 @@ Self-measured on every release via CI ([build benchmarks](generated/benchmarks/B
 
 | Metric | Latest |
 |---|---|
-| Build speed (native) | **4.4 ms/file** |
-| Build speed (WASM) | **13.7 ms/file** |
+| Build speed (native) | **11.5 ms/file** |
+| Build speed (WASM) | **17.8 ms/file** |
 | Query time | **3ms** |
-| No-op rebuild (native) | **4ms** |
-| 1-file rebuild (native) | **325ms** |
+| No-op rebuild (native) | **5ms** |
+| 1-file rebuild (native) | **384ms** |
 | Query: fn-deps | **0.8ms** |
 | Query: path | **0.8ms** |
-| ~50,000 files (est.) | **~220.0s build** |
+| ~50,000 files (est.) | **~575.0s build** |
 
 Metrics are normalized per file for cross-version comparability. Times above are for a full initial build — incremental rebuilds only re-parse changed files.
 
@@ -804,7 +807,7 @@ const { results: fused } = await multiSearchData(
 - **No full type inference** — parses `.d.ts` interfaces but doesn't use TypeScript's type checker for overload resolution
 - **Dynamic calls are best-effort** — complex computed property access and `eval` patterns are not resolved
 - **Python imports** — resolves relative imports but doesn't follow `sys.path` or virtual environment packages
-- **Dataflow analysis** — currently JS/TS only; intraprocedural (single-function scope), not interprocedural
+- **Dataflow analysis** — intraprocedural (single-function scope), not interprocedural
 
 ## 🗺️ Roadmap
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optave/codegraph",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "Local code graph CLI — parse codebases with tree-sitter, build dependency graphs, query them",
   "type": "module",
   "main": "src/index.js",
@@ -71,10 +71,10 @@
   },
   "optionalDependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@optave/codegraph-darwin-arm64": "3.0.1",
-    "@optave/codegraph-darwin-x64": "3.0.1",
-    "@optave/codegraph-linux-x64-gnu": "3.0.1",
-    "@optave/codegraph-win32-x64-msvc": "3.0.1"
+    "@optave/codegraph-darwin-arm64": "3.0.3",
+    "@optave/codegraph-darwin-x64": "3.0.3",
+    "@optave/codegraph-linux-x64-gnu": "3.0.3",
+    "@optave/codegraph-win32-x64-msvc": "3.0.3"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.4",

package/src/ast.js

@@ -165,13 +165,12 @@ export async function buildAstNodes(db, fileSymbols, _rootDir, _engineOpts) {
     }
   });
 
-  let totalInserted = 0;
+  const allRows = [];
 
   for (const [relPath, symbols] of fileSymbols) {
-    const rows = [];
     const defs = symbols.definitions || [];
 
-    // Pre-load all node IDs for this file into a map
+    // Pre-load all node IDs for this file into a map (read-only, fast)
     const nodeIdMap = new Map();
     for (const row of bulkGetNodeIds.all(relPath)) {
       nodeIdMap.set(`${row.name}|${row.kind}|${row.line}`, row.id);
@@ -186,7 +185,7 @@ export async function buildAstNodes(db, fileSymbols, _rootDir, _engineOpts) {
           parentNodeId =
             nodeIdMap.get(`${parentDef.name}|${parentDef.kind}|${parentDef.line}`) || null;
         }
-        rows.push({
+        allRows.push({
           file: relPath,
           line: call.line,
           kind: 'call',
@@ -205,7 +204,7 @@ export async function buildAstNodes(db, fileSymbols, _rootDir, _engineOpts) {
         // WASM path: walk the tree-sitter AST
         const astRows = [];
         walkAst(symbols._tree.rootNode, defs, relPath, astRows, nodeIdMap);
-        rows.push(...astRows);
+        allRows.push(...astRows);
       } else if (symbols.astNodes?.length) {
         // Native path: use pre-extracted AST nodes from Rust
         for (const n of symbols.astNodes) {
@@ -215,7 +214,7 @@ export async function buildAstNodes(db, fileSymbols, _rootDir, _engineOpts) {
             parentNodeId =
               nodeIdMap.get(`${parentDef.name}|${parentDef.kind}|${parentDef.line}`) || null;
           }
-          rows.push({
+          allRows.push({
             file: relPath,
             line: n.line,
             kind: n.kind,
@@ -227,14 +226,13 @@ export async function buildAstNodes(db, fileSymbols, _rootDir, _engineOpts) {
         }
       }
     }
+  }
 
-    if (rows.length > 0) {
-      tx(rows);
-      totalInserted += rows.length;
-    }
+  if (allRows.length > 0) {
+    tx(allRows);
   }
 
-  debug(`AST extraction: ${totalInserted} nodes stored`);
+  debug(`AST extraction: ${allRows.length} nodes stored`);
 }
 
 /**

package/src/builder.js

@@ -1272,7 +1272,7 @@ export async function buildGraph(rootDir, opts = {}) {
   }
   _t.rolesMs = performance.now() - _t.roles0;
 
-  // For incremental builds, filter out reverse-dep-only files from AST/complexity
+  // For incremental builds, filter out reverse-dep-only files from AST/complexity/CFG/dataflow
   // — their content didn't change, so existing ast_nodes/function_complexity rows are valid.
   let astComplexitySymbols = allSymbols;
   if (!isFullBuild) {
@@ -1287,13 +1287,12 @@ export async function buildGraph(rootDir, opts = {}) {
         }
       }
       debug(
-        `AST/complexity: processing ${astComplexitySymbols.size} changed files (skipping ${reverseDepFiles.size} reverse-deps)`,
+        `AST/complexity/CFG/dataflow: processing ${astComplexitySymbols.size} changed files (skipping ${reverseDepFiles.size} reverse-deps)`,
       );
     }
   }
 
   // AST node extraction (calls, new, string, regex, throw, await)
-  // Must run before complexity which releases _tree references
   _t.ast0 = performance.now();
   if (opts.ast !== false) {
     try {
@@ -1317,12 +1316,25 @@ export async function buildGraph(rootDir, opts = {}) {
   }
   _t.complexityMs = performance.now() - _t.complexity0;
 
+  // Pre-parse files missing WASM trees (native builds) so CFG + dataflow
+  // share a single parse pass instead of each creating parsers independently
+  if (opts.cfg !== false || opts.dataflow !== false) {
+    _t.wasmPre0 = performance.now();
+    try {
+      const { ensureWasmTrees } = await import('./parser.js');
+      await ensureWasmTrees(astComplexitySymbols, rootDir);
+    } catch (err) {
+      debug(`WASM pre-parse failed: ${err.message}`);
+    }
+    _t.wasmPreMs = performance.now() - _t.wasmPre0;
+  }
+
   // CFG analysis (skip with --no-cfg)
   if (opts.cfg !== false) {
     _t.cfg0 = performance.now();
     try {
       const { buildCFGData } = await import('./cfg.js');
-      await buildCFGData(db, allSymbols, rootDir, engineOpts);
+      await buildCFGData(db, astComplexitySymbols, rootDir, engineOpts);
     } catch (err) {
       debug(`CFG analysis failed: ${err.message}`);
     }
@@ -1334,7 +1346,7 @@ export async function buildGraph(rootDir, opts = {}) {
     _t.dataflow0 = performance.now();
     try {
       const { buildDataflowEdges } = await import('./dataflow.js');
-      await buildDataflowEdges(db, allSymbols, rootDir, engineOpts);
+      await buildDataflowEdges(db, astComplexitySymbols, rootDir, engineOpts);
     } catch (err) {
       debug(`Dataflow analysis failed: ${err.message}`);
     }
@@ -1434,6 +1446,7 @@ export async function buildGraph(rootDir, opts = {}) {
       rolesMs: +_t.rolesMs.toFixed(1),
       astMs: +_t.astMs.toFixed(1),
       complexityMs: +_t.complexityMs.toFixed(1),
+      ...(_t.wasmPreMs != null && { wasmPreMs: +_t.wasmPreMs.toFixed(1) }),
       ...(_t.cfgMs != null && { cfgMs: +_t.cfgMs.toFixed(1) }),
       ...(_t.dataflowMs != null && { dataflowMs: +_t.dataflowMs.toFixed(1) }),
     },

package/src/complexity.js

@@ -1769,9 +1769,6 @@ export async function buildComplexityMetrics(db, fileSymbols, rootDir, _engineOp
         );
         analyzed++;
       }
-
-      // Release cached tree for GC
-      symbols._tree = null;
     }
   });