@optave/codegraph 3.13.0 → 3.15.0

package/src/db/migrations.ts

@@ -263,6 +263,74 @@ export const MIGRATIONS: Migration[] = [
       CREATE INDEX IF NOT EXISTS idx_edges_technique ON edges(technique);
     `,
   },
+  {
+    version: 18,
+    up: `
+      CREATE TABLE IF NOT EXISTS dataflow_vertices (
+        id          INTEGER PRIMARY KEY AUTOINCREMENT,
+        func_id     INTEGER NOT NULL REFERENCES nodes(id),
+        kind        TEXT NOT NULL,
+        name        TEXT,
+        param_index INTEGER,
+        line        INTEGER,
+        node_id     INTEGER REFERENCES nodes(id)
+      );
+      CREATE INDEX IF NOT EXISTS idx_dfv_func ON dataflow_vertices(func_id);
+      CREATE INDEX IF NOT EXISTS idx_dfv_func_kind ON dataflow_vertices(func_id, kind);
+      CREATE INDEX IF NOT EXISTS idx_dfv_node ON dataflow_vertices(node_id);
+
+      ALTER TABLE dataflow ADD COLUMN source_vertex INTEGER REFERENCES dataflow_vertices(id);
+      ALTER TABLE dataflow ADD COLUMN target_vertex INTEGER REFERENCES dataflow_vertices(id);
+      ALTER TABLE dataflow ADD COLUMN scope TEXT;
+      ALTER TABLE dataflow ADD COLUMN call_edge_id INTEGER REFERENCES edges(id);
+
+      CREATE INDEX IF NOT EXISTS idx_dataflow_sv ON dataflow(source_vertex);
+      CREATE INDEX IF NOT EXISTS idx_dataflow_tv ON dataflow(target_vertex);
+      CREATE INDEX IF NOT EXISTS idx_dataflow_scope ON dataflow(scope);
+
+      CREATE TABLE IF NOT EXISTS dataflow_summary (
+        func_id     INTEGER NOT NULL REFERENCES nodes(id),
+        param_index INTEGER NOT NULL,
+        flows_to_return INTEGER NOT NULL DEFAULT 0,
+        is_mutated  INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY(func_id, param_index)
+      );
+      CREATE INDEX IF NOT EXISTS idx_dfs_func ON dataflow_summary(func_id);
+
+      -- dataflow_fn exposes only vertex-linked (v18+) interprocedural flows.
+      -- The INNER JOINs intentionally exclude pre-v18 rows where source_vertex
+      -- and target_vertex are NULL — this is NOT a backward-compat replacement
+      -- for querying the dataflow table directly; legacy consumers must continue
+      -- to query dataflow directly to avoid silently dropping historical rows.
+      CREATE VIEW IF NOT EXISTS dataflow_fn AS
+        SELECT
+          sv.func_id AS source_id,
+          tv.func_id AS target_id,
+          d.kind,
+          d.param_index,
+          d.expression,
+          d.line,
+          d.confidence
+        FROM dataflow d
+        JOIN dataflow_vertices sv ON d.source_vertex = sv.id
+        JOIN dataflow_vertices tv ON d.target_vertex = tv.id
+        WHERE sv.func_id != tv.func_id;
+    `,
+  },
+  {
+    version: 19,
+    // P6 sentinel: forces a full rebuild so that databases built with the native
+    // fast path (which skipped vertex extraction before P6) backfill
+    // dataflow_vertices and dataflow_summary on the next `codegraph build`.
+    up: `SELECT 1`,
+  },
+  {
+    version: 20,
+    up: `
+      ALTER TABLE edges ADD COLUMN dynamic_kind TEXT;
+      CREATE INDEX IF NOT EXISTS idx_edges_dynamic_kind ON edges(dynamic_kind) WHERE dynamic_kind IS NOT NULL;
+    `,
+  },
 ];
 
 interface PragmaColumnInfo {

package/src/db/repository/build-stmts.ts

@@ -5,6 +5,10 @@ interface PurgeStmts {
   cfgEdges: SqliteStatement | null;
   cfgBlocks: SqliteStatement | null;
   dataflow: SqliteStatement | null;
+  dataflowByVertex: SqliteStatement | null;
+  dataflowByCallEdge: SqliteStatement | null;
+  dataflowSummary: SqliteStatement | null;
+  dataflowVertices: SqliteStatement | null;
   complexity: SqliteStatement | null;
   nodeMetrics: SqliteStatement | null;
   astNodes: SqliteStatement | null;
@@ -44,6 +48,26 @@ function preparePurgeStmts(db: BetterSqlite3Database): PurgeStmts {
     dataflow: tryPrepare(
       'DELETE FROM dataflow WHERE source_id IN (SELECT id FROM nodes WHERE file = ?) OR target_id IN (SELECT id FROM nodes WHERE file = ?)',
     ),
+    dataflowByVertex: tryPrepare(
+      `DELETE FROM dataflow WHERE source_vertex IN (SELECT id FROM dataflow_vertices WHERE func_id IN (SELECT id FROM nodes WHERE file = ?))
+         OR target_vertex IN (SELECT id FROM dataflow_vertices WHERE func_id IN (SELECT id FROM nodes WHERE file = ?))`,
+    ),
+    // Delete dataflow rows whose call_edge_id references a calls edge that
+    // touches the deleted file (source or target). These rows are not caught by
+    // the source_id/target_id or vertex-based deletions above when the dataflow
+    // row's own nodes live in other files. Must run before the edges delete to
+    // avoid SQLITE_CONSTRAINT_FOREIGNKEY: dataflow.call_edge_id REFERENCES edges(id).
+    dataflowByCallEdge: tryPrepare(
+      `DELETE FROM dataflow WHERE call_edge_id IN
+         (SELECT id FROM edges WHERE source_id IN (SELECT id FROM nodes WHERE file = @f)
+          OR target_id IN (SELECT id FROM nodes WHERE file = @f))`,
+    ),
+    dataflowSummary: tryPrepare(
+      'DELETE FROM dataflow_summary WHERE func_id IN (SELECT id FROM nodes WHERE file = ?)',
+    ),
+    dataflowVertices: tryPrepare(
+      'DELETE FROM dataflow_vertices WHERE func_id IN (SELECT id FROM nodes WHERE file = ?)',
+    ),
     complexity: tryPrepare(
       'DELETE FROM function_complexity WHERE node_id IN (SELECT id FROM nodes WHERE file = ?)',
     ),
@@ -80,6 +104,12 @@ function runPurge(stmts: PurgeStmts, file: string, opts: PurgeOpts = {}): void {
   stmts.cfgEdges?.run(file);
   stmts.cfgBlocks?.run(file);
   stmts.dataflow?.run(file, file);
+  stmts.dataflowByVertex?.run(file, file);
+  // Clear dataflow rows keyed by call_edge_id before deleting edges so the FK
+  // (dataflow.call_edge_id REFERENCES edges(id)) does not block the edge purge.
+  stmts.dataflowByCallEdge?.run({ f: file });
+  stmts.dataflowSummary?.run(file);
+  stmts.dataflowVertices?.run(file);
   stmts.complexity?.run(file);
   stmts.nodeMetrics?.run(file);
   stmts.astNodes?.run(file);

package/src/db/repository/dataflow.ts

@@ -3,6 +3,7 @@ import { cachedStmt } from './cached-stmt.js';
 
 // ─── Statement caches (one prepared statement per db instance) ────────────
 const _hasDataflowTableStmt: StmtCache<{ c: number }> = new WeakMap();
+const _hasDataflowVerticesStmt: StmtCache<{ c: number }> = new WeakMap();
 
 /**
  * Check whether the dataflow table exists and has data.
@@ -17,3 +18,18 @@ export function hasDataflowTable(db: BetterSqlite3Database): boolean {
     return false;
   }
 }
+
+/**
+ * Check whether the dataflow_vertices table exists and has data.
+ * Returns false on DBs built before migration v18.
+ */
+export function hasDataflowVertices(db: BetterSqlite3Database): boolean {
+  try {
+    return (
+      (cachedStmt(_hasDataflowVerticesStmt, db, 'SELECT COUNT(*) AS c FROM dataflow_vertices').get()
+        ?.c ?? 0) > 0
+    );
+  } catch {
+    return false;
+  }
+}

package/src/db/repository/index.ts

@@ -7,7 +7,7 @@ export { cachedStmt } from './cached-stmt.js';
 export { deleteCfgForNode, getCfgBlocks, getCfgEdges, hasCfgTables } from './cfg.js';
 export { getCoChangeMeta, hasCoChanges, upsertCoChangeMeta } from './cochange.js';
 export { getComplexityForNode } from './complexity.js';
-export { hasDataflowTable } from './dataflow.js';
+export { hasDataflowTable, hasDataflowVertices } from './dataflow.js';
 export {
   countCrossFileCallers,
   findAllIncomingEdges,

package/src/db/repository/native-repository.ts

@@ -163,6 +163,61 @@ function toComplexityMetrics(r: NativeComplexityMetrics): ComplexityMetrics {
   };
 }
 
+// ── fnDeps conversion helpers ────────────────────────────────────────────
+
+/**
+ * Convert a native transitive-callers array (array of `{ depth, callers[] }`)
+ * into the JS `Record<number, FnDepsNode[]>` shape the Repository interface expects.
+ */
+function mapTransitiveCallers(groups: any[]): Record<number, FnDepsNode[]> {
+  const result: Record<number, FnDepsNode[]> = {};
+  for (const group of groups ?? []) {
+    result[group.depth] = (group.callers ?? []).map(
+      (c: any): FnDepsNode => ({
+        name: c.name,
+        kind: c.kind,
+        file: c.file,
+        line: c.line ?? null,
+      }),
+    );
+  }
+  return result;
+}
+
+/**
+ * Convert a single raw native fnDeps entry into the typed `FnDepsEntry` shape.
+ * Handles napi-rs camelCase → Repository snake_case field aliasing.
+ */
+function mapFnDepsEntry(entry: any): FnDepsEntry {
+  return {
+    name: entry.name,
+    kind: entry.kind,
+    file: entry.file,
+    line: entry.line ?? null,
+    endLine: entry.endLine ?? entry.end_line ?? null,
+    role: entry.role ?? null,
+    fileHash: entry.fileHash ?? entry.file_hash ?? null,
+    callees: (entry.callees ?? []).map(
+      (c: any): FnDepsNode => ({
+        name: c.name,
+        kind: c.kind,
+        file: c.file,
+        line: c.line ?? null,
+      }),
+    ),
+    callers: (entry.callers ?? []).map(
+      (c: any): FnDepsCallerNode => ({
+        name: c.name,
+        kind: c.kind,
+        file: c.file,
+        line: c.line ?? null,
+        viaHierarchy: c.viaHierarchy ?? c.via_hierarchy ?? undefined,
+      }),
+    ),
+    transitiveCallers: mapTransitiveCallers(entry.transitiveCallers),
+  };
+}
+
 // ── NativeRepository ────────────────────────────────────────────────────
 
 export class NativeRepository extends Repository {
@@ -485,46 +540,7 @@ export class NativeRepository extends Repository {
     // to JS format (transitiveCallers as Record<number, Array>)
     return {
       name: raw.name,
-      results: raw.results.map((entry: any): FnDepsEntry => {
-        const transitiveCallers: Record<number, FnDepsNode[]> = {};
-        for (const group of entry.transitiveCallers ?? []) {
-          transitiveCallers[group.depth] = (group.callers ?? []).map(
-            (c: any): FnDepsNode => ({
-              name: c.name,
-              kind: c.kind,
-              file: c.file,
-              line: c.line ?? null,
-            }),
-          );
-        }
-        return {
-          name: entry.name,
-          kind: entry.kind,
-          file: entry.file,
-          line: entry.line ?? null,
-          endLine: entry.endLine ?? entry.end_line ?? null,
-          role: entry.role ?? null,
-          fileHash: entry.fileHash ?? entry.file_hash ?? null,
-          callees: (entry.callees ?? []).map(
-            (c: any): FnDepsNode => ({
-              name: c.name,
-              kind: c.kind,
-              file: c.file,
-              line: c.line ?? null,
-            }),
-          ),
-          callers: (entry.callers ?? []).map(
-            (c: any): FnDepsCallerNode => ({
-              name: c.name,
-              kind: c.kind,
-              file: c.file,
-              line: c.line ?? null,
-              viaHierarchy: c.viaHierarchy ?? c.via_hierarchy ?? undefined,
-            }),
-          ),
-          transitiveCallers,
-        };
-      }),
+      results: raw.results.map(mapFnDepsEntry),
     };
   }
 }

package/src/domain/analysis/fn-impact.ts

@@ -294,10 +294,14 @@ export function fnImpactData(
         maxDepth,
         includeImplementors,
       });
+      const direct = levels[1]?.length ?? 0;
+      const transitive = totalDependents - direct;
       return {
         ...normalizeSymbol(node, repo, hc),
         levels,
         totalDependents,
+        direct,
+        transitive,
       };
     });
 

package/src/domain/analysis/module-map.ts

@@ -211,12 +211,20 @@ function computeQualityMetrics(
   const totalCallEdges = (
     db.prepare("SELECT COUNT(*) as c FROM edges WHERE kind = 'calls'").get() as { c: number }
   ).c;
+  // Exclude sink edges (confidence=0.0) from the confidence ratio: they flag
+  // unresolvable dynamic calls (eval/computed-key) and are not resolution
+  // attempts — including them in the denominator unfairly penalises the metric.
+  const resolvedCallEdges = (
+    db.prepare("SELECT COUNT(*) as c FROM edges WHERE kind = 'calls' AND confidence > 0").get() as {
+      c: number;
+    }
+  ).c;
   const highConfCallEdges = (
     db
       .prepare("SELECT COUNT(*) as c FROM edges WHERE kind = 'calls' AND confidence >= 0.7")
       .get() as { c: number }
   ).c;
-  const callConfidence = totalCallEdges > 0 ? highConfCallEdges / totalCallEdges : 0;
+  const callConfidence = resolvedCallEdges > 0 ? highConfCallEdges / resolvedCallEdges : 0;
 
   const falsePositiveWarnings = buildFalsePositiveWarnings(queryFalsePositiveRows(db, fpThreshold));
 
@@ -239,7 +247,7 @@ function computeQualityMetrics(
     callConfidence: {
       ratio: callConfidence,
       highConf: highConfCallEdges,
-      total: totalCallEdges,
+      total: resolvedCallEdges,
     },
     falsePositiveWarnings,
   };
@@ -373,11 +381,29 @@ function queryFalsePositiveRows(
     .all(fpThreshold) as FalsePositiveRow[];
 }
 
+/**
+ * Returns true when a high-caller-count row is a known structural false positive
+ * that should be silently excluded from warnings.
+ *
+ * Rust `::new()` methods (kind = method, local name = "new", file ends in ".rs")
+ * are conventional constructors — their high call counts are expected and carry
+ * no architectural signal.  Any pattern-based exclusion should be added here
+ * rather than hardcoding specific symbol names.
+ */
+function isStructuralFalsePositive(r: FalsePositiveRow): boolean {
+  const localName = r.name.includes('.') ? r.name.split('.').pop()! : r.name;
+  // Rust ::new() constructors are always high-caller by design.
+  if (localName === 'new' && r.file.endsWith('.rs')) return true;
+  return false;
+}
+
 /** Filter false-positive rows by the configured name set and shape them for the report. */
 function buildFalsePositiveWarnings(rows: FalsePositiveRow[]) {
   return rows
-    .filter((r) =>
-      FALSE_POSITIVE_NAMES.has(r.name.includes('.') ? r.name.split('.').pop()! : r.name),
+    .filter(
+      (r) =>
+        !isStructuralFalsePositive(r) &&
+        FALSE_POSITIVE_NAMES.has(r.name.includes('.') ? r.name.split('.').pop()! : r.name),
     )
     .map((r) => ({ name: r.name, file: r.file, line: r.line, callerCount: r.caller_count }));
 }
@@ -427,15 +453,21 @@ function buildStatsFromNative(
 
   const callerCoverage =
     s.quality.callableTotal > 0 ? s.quality.callableWithCallers / s.quality.callableTotal : 0;
+  // s.quality.callEdges is now the resolved (confidence>0) edge count — sink
+  // edges (confidence=0.0) are excluded so they don't dilute the ratio.
   const callConfidence =
     s.quality.callEdges > 0 ? s.quality.highConfCallEdges / s.quality.callEdges : 0;
 
-  // False-positive analysis still uses JS (needs FALSE_POSITIVE_NAMES set)
+  // False-positive analysis still uses JS (needs FALSE_POSITIVE_NAMES set).
+  // FP ratio uses the total calls count as denominator. When edgesByKind['calls']
+  // is undefined there are no call edges at all, so fpEdgeCount is 0 and the
+  // > 0 guard below returns 0 regardless — use 0 as the safe fallback.
+  const totalCallEdgesForFp = edgesByKind.calls ?? 0;
   const fpThreshold = config.analysis?.falsePositiveCallers ?? FALSE_POSITIVE_CALLER_THRESHOLD;
   const falsePositiveWarnings = buildFalsePositiveWarnings(queryFalsePositiveRows(db, fpThreshold));
   let fpEdgeCount = 0;
   for (const fp of falsePositiveWarnings) fpEdgeCount += fp.callerCount;
-  const falsePositiveRatio = s.quality.callEdges > 0 ? fpEdgeCount / s.quality.callEdges : 0;
+  const falsePositiveRatio = totalCallEdgesForFp > 0 ? fpEdgeCount / totalCallEdgesForFp : 0;
   const score = computeQualityScore(callerCoverage, callConfidence, falsePositiveRatio);
   const testFilter = testFilterSQL('n.file', noTests);
   const byTechnique = countCallEdgesByTechnique(db, testFilter);

package/src/domain/analysis/roles.ts

@@ -6,6 +6,29 @@ import { normalizeSymbol } from '../../shared/normalize.js';
 import { paginateResult } from '../../shared/paginate.js';
 import type { NodeRow } from '../../types.js';
 
+export interface DynamicCallCount {
+  dynamic_kind: string;
+  count: number;
+}
+
+/** Return a count of flagged dynamic call sink edges, grouped by kind. */
+export function dynamicCallsData(customDbPath: string): DynamicCallCount[] {
+  const db = openReadonlyOrFail(customDbPath);
+  try {
+    return db
+      .prepare(
+        `SELECT dynamic_kind, COUNT(*) AS count
+         FROM edges
+         WHERE dynamic_kind IS NOT NULL
+         GROUP BY dynamic_kind
+         ORDER BY count DESC`,
+      )
+      .all() as DynamicCallCount[];
+  } finally {
+    db.close();
+  }
+}
+
 export function rolesData(
   customDbPath: string,
   opts: {