@optave/codegraph 3.13.0 → 3.15.0

package/src/domain/queries.ts

@@ -39,7 +39,7 @@ export {
   moduleMapData,
   statsData,
 } from './analysis/module-map.js';
-export { rolesData } from './analysis/roles.js';
+export { dynamicCallsData, rolesData } from './analysis/roles.js';
 // ── Analysis modules ─────────────────────────────────────────────────────
 export {
   childrenData,

package/src/domain/wasm-worker-entry.ts

@@ -834,6 +834,9 @@ function serializeExtractorOutput(
       ? { returnTypeMap: Array.from(symbols.returnTypeMap.entries()) }
       : {}),
     ...(symbols.callAssignments?.length ? { callAssignments: symbols.callAssignments } : {}),
+    ...(symbols.cjsRequireBindings?.length
+      ? { cjsRequireBindings: symbols.cjsRequireBindings }
+      : {}),
   };
 }
 

package/src/domain/wasm-worker-pool.ts

@@ -86,11 +86,14 @@ interface PendingJob {
  */
 const WORKER_PARSE_TIMEOUT_MS = 60_000;
 
-function deserializeResult(ser: SerializedExtractorOutput | null): ExtractorOutput | null {
-  if (!ser) return null;
+/** Deserialize the core fields and metadata scalars from a serialized result. */
+function deserializeCoreFields(
+  ser: SerializedExtractorOutput,
+): Pick<ExtractorOutput, 'definitions' | 'calls' | 'imports' | 'classes' | 'exports' | 'typeMap'> &
+  Partial<Pick<ExtractorOutput, '_langId' | '_lineCount' | 'dataflow' | 'astNodes'>> {
   const typeMap = new Map<string, TypeMapEntry>();
   for (const [k, v] of ser.typeMap) typeMap.set(k, v);
-  const out: ExtractorOutput = {
+  const out: ReturnType<typeof deserializeCoreFields> = {
     definitions: ser.definitions,
     calls: ser.calls,
     imports: ser.imports,
@@ -106,6 +109,11 @@ function deserializeResult(ser: SerializedExtractorOutput | null): ExtractorOutp
   // {line, kind, name, text?, receiver?} shape — see engine.ts:822 where the
   // visitor output is cast the same way.
   if (ser.astNodes !== undefined) out.astNodes = ser.astNodes as unknown as ASTNodeRow[];
+  return out;
+}
+
+/** Deserialize the simple array binding fields (present when non-empty). */
+function deserializeBindingFields(ser: SerializedExtractorOutput, out: ExtractorOutput): void {
   if (ser.fnRefBindings?.length) out.fnRefBindings = ser.fnRefBindings;
   if (ser.paramBindings?.length) out.paramBindings = ser.paramBindings;
   if (ser.arrayElemBindings?.length) out.arrayElemBindings = ser.arrayElemBindings;
@@ -117,6 +125,12 @@ function deserializeResult(ser: SerializedExtractorOutput | null): ExtractorOutp
   if (ser.objectPropBindings?.length) out.objectPropBindings = ser.objectPropBindings;
   if (ser.thisCallBindings?.length) out.thisCallBindings = ser.thisCallBindings;
   if (ser.newExpressions?.length) out.newExpressions = ser.newExpressions;
+  if (ser.callAssignments?.length) out.callAssignments = ser.callAssignments;
+  if (ser.cjsRequireBindings?.length) out.cjsRequireBindings = ser.cjsRequireBindings;
+}
+
+/** Deserialize the Map-typed fields that require entry-by-entry reconstruction. */
+function deserializeMapFields(ser: SerializedExtractorOutput, out: ExtractorOutput): void {
   if (ser.definePropertyReceivers?.length) {
     const m = new Map<string, string>();
     for (const [k, v] of ser.definePropertyReceivers) m.set(k, v);
@@ -127,7 +141,17 @@ function deserializeResult(ser: SerializedExtractorOutput | null): ExtractorOutp
     for (const [k, v] of ser.returnTypeMap) returnTypeMap.set(k, v);
     out.returnTypeMap = returnTypeMap;
   }
-  if (ser.callAssignments?.length) out.callAssignments = ser.callAssignments;
+}
+
+function deserializeResult(ser: SerializedExtractorOutput | null): ExtractorOutput | null {
+  if (!ser) return null;
+  // deserializeCoreFields supplies all required ExtractorOutput fields (definitions,
+  // calls, imports, classes, exports, typeMap). The cast is safe: every required field
+  // is present in the returned Pick. If a new required field is added to ExtractorOutput,
+  // add it to deserializeCoreFields' return Pick and body to keep the cast honest.
+  const out = { ...deserializeCoreFields(ser) } as ExtractorOutput;
+  deserializeBindingFields(ser, out);
+  deserializeMapFields(ser, out);
   return out;
 }
 

package/src/domain/wasm-worker-protocol.ts

@@ -77,6 +77,10 @@ export interface SerializedExtractorOutput {
   definePropertyReceivers?: Array<[string, string]>;
   returnTypeMap?: Array<[string, TypeMapEntry]>;
   callAssignments?: CallAssignment[];
+  /** Variable-level dataflow vertices extracted during parsing (P1+). */
+  dataflowVertices?: import('../types.js').DataflowVertex[];
+  /** CJS require bindings — see ExtractorOutput.cjsRequireBindings (#1661). */
+  cjsRequireBindings?: Array<{ names: string[]; source: string }>;
 }
 
 export interface WorkerParseResponseOk {

package/src/extractors/dart.ts

@@ -255,14 +255,59 @@ function handleDartSelector(node: TreeSitterNode, ctx: ExtractorOutput): void {
   const argPart = findChild(node, 'argument_part');
   if (!argPart) return;
 
-  // Look for the identifier this selector belongs to
+  const line = node.startPosition.row + 1;
+
+  // Look for the identifier this selector belongs to.
+  // Two layouts are possible depending on grammar version:
+  //   A) selector has both unconditional_assignable_selector + argument_part (same node)
+  //   B) one selector node holds unconditional_assignable_selector (.method),
+  //      the next holds argument_part (the call args) — method name is in the previous sibling
   const unconditional = findChild(node, 'unconditional_assignable_selector');
+  let methodName: string | null = null;
+
   if (unconditional) {
     const id = findChild(unconditional, 'identifier');
-    if (id) {
-      ctx.calls.push({ name: id.text, line: node.startPosition.row + 1 });
+    if (id) methodName = id.text;
+  } else {
+    // Layout B: look at the previous sibling selector for the method name
+    const parent = node.parent;
+    if (parent) {
+      for (let i = 0; i < parent.childCount; i++) {
+        const sibling = parent.child(i);
+        if (sibling === node) break;
+        if (sibling?.type === 'selector') {
+          const unc2 = findChild(sibling, 'unconditional_assignable_selector');
+          if (unc2) {
+            const id2 = findChild(unc2, 'identifier');
+            if (id2) methodName = id2.text;
+          }
+        }
+      }
     }
   }
+
+  if (!methodName) return;
+
+  // Function.apply(fn, positionalArgs, namedArgs) — dynamic higher-order dispatch
+  if (methodName === 'apply') {
+    const parent = node.parent;
+    if (parent) {
+      for (let i = 0; i < parent.childCount; i++) {
+        const sibling = parent.child(i);
+        if (sibling && sibling !== node && sibling.text === 'Function') {
+          ctx.calls.push({
+            name: '<dynamic:unresolved>',
+            line,
+            dynamic: true,
+            dynamicKind: 'unresolved-dynamic',
+          });
+          return;
+        }
+      }
+    }
+  }
+
+  ctx.calls.push({ name: methodName, line });
 }
 
 function handleDartTypeAlias(node: TreeSitterNode, ctx: ExtractorOutput): void {

package/src/extractors/groovy.ts

@@ -292,8 +292,26 @@ function handleGroovyImport(node: TreeSitterNode, ctx: ExtractorOutput): void {
   }
 }
 
+/** Extract the first string literal argument from a Groovy call node. */
+function getFirstStringArgGroovy(node: TreeSitterNode): string | null {
+  const args = node.childForFieldName('arguments') || findChild(node, 'argument_list');
+  if (!args) return null;
+  for (let i = 0; i < args.childCount; i++) {
+    const child = args.child(i);
+    if (!child) continue;
+    const t = child.type;
+    if (t === '(' || t === ')' || t === ',') continue;
+    if (t === 'string' || t === 'string_literal' || t === 'string_fragment') {
+      return child.text.replace(/^["']|["']$/g, '');
+    }
+    break;
+  }
+  return null;
+}
+
 function handleGroovyCallExpr(node: TreeSitterNode, ctx: ExtractorOutput): void {
   const call: Call = { name: '', line: node.startPosition.row + 1 };
+  let fieldNode: TreeSitterNode | null = null;
 
   // Try standard call_expression pattern
   const funcNode = node.childForFieldName('function') || node.childForFieldName('method');
@@ -301,7 +319,10 @@ function handleGroovyCallExpr(node: TreeSitterNode, ctx: ExtractorOutput): void
     if (funcNode.type === 'field_expression' || funcNode.type === 'member_access') {
       const field = funcNode.childForFieldName('field') || funcNode.childForFieldName('property');
       const obj = funcNode.childForFieldName('argument') || funcNode.childForFieldName('object');
-      if (field) call.name = field.text;
+      if (field) {
+        fieldNode = field;
+        call.name = field.text;
+      }
       if (obj) call.receiver = obj.text;
     } else {
       call.name = funcNode.text;
@@ -311,12 +332,51 @@ function handleGroovyCallExpr(node: TreeSitterNode, ctx: ExtractorOutput): void
     const nameNode = node.childForFieldName('name');
     const obj = node.childForFieldName('object');
     if (nameNode) {
+      fieldNode = nameNode;
       call.name = nameNode.text;
       if (obj) call.receiver = obj.text;
     }
   }
 
-  if (call.name) ctx.calls.push(call);
+  if (!call.name) return;
+
+  // obj."$dyn"() or obj."${var}"() — GString method name; cannot resolve statically
+  if (fieldNode && (fieldNode.type === 'gstring' || fieldNode.type === 'template_string')) {
+    ctx.calls.push({
+      name: '<dynamic:unresolved>',
+      line: call.line,
+      dynamic: true,
+      dynamicKind: 'unresolved-dynamic',
+      receiver: call.receiver,
+    });
+    return;
+  }
+
+  // obj.invokeMethod("name", args) — Groovy's explicit dynamic dispatch
+  if (call.name === 'invokeMethod') {
+    const literal = getFirstStringArgGroovy(node);
+    if (literal) {
+      ctx.calls.push({
+        name: literal,
+        line: call.line,
+        dynamic: true,
+        dynamicKind: 'reflection',
+        keyExpr: literal,
+        receiver: call.receiver,
+      });
+    } else {
+      ctx.calls.push({
+        name: '<dynamic:computed-key>',
+        line: call.line,
+        dynamic: true,
+        dynamicKind: 'computed-key',
+        receiver: call.receiver,
+      });
+    }
+    return;
+  }
+
+  ctx.calls.push(call);
 }
 
 function handleGroovyObjectCreation(node: TreeSitterNode, ctx: ExtractorOutput): void {

package/src/extractors/helpers.ts

@@ -1,5 +1,6 @@
 import type {
   Call,
+  DynamicKind,
   ExtractorOutput,
   Import,
   SubDeclaration,
@@ -270,18 +271,20 @@ export function extractModifierVisibility(
 
 /**
  * Append a `Call` to the extractor output. `line` defaults to the start line of
- * `node`; pass `extra` for `receiver` / `dynamic` flags.
+ * `node`; pass `extra` for `receiver` / `dynamic` / `dynamicKind` / `keyExpr` fields.
  */
 export function pushCall(
   ctx: ExtractorOutput,
   node: TreeSitterNode,
   name: string,
-  extra: { receiver?: string; dynamic?: boolean } = {},
+  extra: { receiver?: string; dynamic?: boolean; dynamicKind?: DynamicKind; keyExpr?: string } = {},
 ): void {
   if (!name) return;
   const call: Call = { name, line: nodeStartLine(node) };
   if (extra.receiver !== undefined) call.receiver = extra.receiver;
   if (extra.dynamic !== undefined) call.dynamic = extra.dynamic;
+  if (extra.dynamicKind !== undefined) call.dynamicKind = extra.dynamicKind;
+  if (extra.keyExpr !== undefined) call.keyExpr = extra.keyExpr;
   ctx.calls.push(call);
 }
 

package/src/extractors/java.ts

@@ -258,11 +258,90 @@ function handleJavaImportDecl(node: TreeSitterNode, ctx: ExtractorOutput): void
   }
 }
 
+/** Extract the first string literal argument from a method_invocation node. */
+function getFirstStringArgJava(node: TreeSitterNode): string | null {
+  const args = node.childForFieldName('arguments') || findChild(node, 'argument_list');
+  if (!args) return null;
+  for (let i = 0; i < args.childCount; i++) {
+    const child = args.child(i);
+    if (!child) continue;
+    const t = child.type;
+    if (t === '(' || t === ')' || t === ',') continue;
+    if (t === 'string_literal' || t === 'string_fragment') {
+      return child.text.replace(/^["']|["']$/g, '');
+    }
+    break; // First real argument is not a string — stop
+  }
+  return null;
+}
+
 function handleJavaMethodInvocation(node: TreeSitterNode, ctx: ExtractorOutput): void {
   const nameNode = node.childForFieldName('name');
   if (!nameNode) return;
   const obj = node.childForFieldName('object');
-  pushCall(ctx, node, nameNode.text, obj ? { receiver: obj.text } : {});
+  const methodName = nameNode.text;
+  const receiver = obj?.text;
+
+  // Method.invoke(target, args) — runtime reflection, target not statically knowable.
+  // Require a non-null receiver to avoid false positives on user-defined `invoke` methods
+  // (e.g. executor services, command/strategy objects, Kotlin lambdas). The Java Reflection
+  // API always calls this on a `java.lang.reflect.Method` object, never bare.
+  if (methodName === 'invoke' && receiver !== undefined) {
+    pushCall(ctx, node, '<dynamic:unresolved>', {
+      dynamic: true,
+      dynamicKind: 'unresolved-dynamic',
+      receiver,
+    });
+    return;
+  }
+
+  // clazz.getMethod("name") / getDeclaredMethod("name") — resolvable if literal arg.
+  // Require a non-null receiver to avoid false positives on gRPC ServiceDescriptor.getMethod(),
+  // Spring AnnotationUtils.getDeclaredMethod(), proto-generated descriptors, and any other API
+  // that exposes a method by this name unrelated to java.lang.Class reflection.
+  if (
+    (methodName === 'getMethod' || methodName === 'getDeclaredMethod') &&
+    receiver !== undefined
+  ) {
+    const literal = getFirstStringArgJava(node);
+    if (literal) {
+      pushCall(ctx, node, literal, {
+        dynamic: true,
+        dynamicKind: 'reflection',
+        keyExpr: literal,
+        receiver,
+      });
+    } else {
+      const args = node.childForFieldName('arguments') || findChild(node, 'argument_list');
+      const firstArg = args?.child(1); // skip '('
+      const keyExpr = firstArg?.text;
+      pushCall(ctx, node, '<dynamic:computed-key>', {
+        dynamic: true,
+        dynamicKind: 'computed-key',
+        keyExpr: keyExpr ?? undefined,
+        receiver,
+      });
+    }
+    return;
+  }
+
+  // Class.forName("pkg.ClassName") — dynamic class loading; flag as unresolved
+  // (loading a class is not the same as calling it — don't emit a call edge).
+  // Guard on receiver === 'Class' to avoid false positives from user-defined
+  // `forName()` factory methods (e.g. Currency.forName("USD"), Enum.forName(...)).
+  if (methodName === 'forName' && receiver === 'Class') {
+    const literal = getFirstStringArgJava(node);
+    pushCall(ctx, node, '<dynamic:unresolved>', {
+      dynamic: true,
+      dynamicKind: 'unresolved-dynamic',
+      keyExpr: literal ?? undefined,
+      receiver,
+    });
+    return;
+  }
+
+  // Normal method invocation
+  pushCall(ctx, node, methodName, receiver ? { receiver } : {});
 }
 
 function handleJavaLocalVarDecl(node: TreeSitterNode, ctx: ExtractorOutput): void {