@tekyzinc/gsd-t 5.16.12 → 5.17.11

package/CHANGELOG.md

@@ -2,6 +2,88 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.17.11] - 2026-09-01
+
+### Fixed — every arrow-function export was invisible to the code graph
+
+`who-calls logAudit` answered "no callers" for a function called throughout a
+server, while `verifyToken` — three lines away in the same directory — resolved
+fine. The difference was how they were declared:
+
+- `export function verifyToken()` → SCIP emits a METHOD descriptor, `verifyToken().`
+- `export const logAudit = async () => {}` → SCIP emits a TERM descriptor, `logAudit.`
+
+TypeScript treats an arrow function assigned to a const as a variable, so it gets
+a term. `funcNameFromSymbol` required the `().` shape and discarded everything
+else — on a real server that meant **3,584 term symbols dropped against 1,624
+kept**, more than twice as much data thrown away as used.
+
+The references were in the SCIP index the whole time; GSD-T was deleting them on
+read. This was diagnosed in the field as a "scip-typescript coverage limitation" —
+it was not, it was ours.
+
+Non-callable terms (`Array.`, imported types) are now admitted and cost nothing:
+a name only resolves when a call site is looking for that exact name, so a type
+reference never matches one. Parameters (`name().(p)`) stay excluded — they end
+in `)`, not `.`.
+
+Measured on the same repo, on top of 5.17.10: `server/src/index.ts` went from 30
+to **116** unique resolved symbols, compiler-accurate files 38 → **130**, call
+edges into `server/` 173 → **591**. `logAudit`, `withTransaction` and
+`getAuditContext` all return correct callers, verified against the source.
+
+- `bin/gsd-t-scip-reader.cjs`: accept term descriptors alongside method ones
+- `test/m114-nested-tsconfig-graph.test.js`: 4 more tests, mutation-tested
+
+**Re-index to pick this up**: `gsd-t graph index`.
+
+## [5.17.10] - 2026-09-01
+
+### Fixed — the code graph indexed one TypeScript project and called it the whole repo
+
+Found in a live TimeTracking session: 8 of 245 files indexed, 96 of 50,283 call
+edges resolved (0.2%, all same-file), and not one backend call among them. The
+root `tsconfig.json`'s `include` listed frontend paths only, so `server/src/`
+was never compiled and every backend `who-calls` returned empty.
+
+**Three defects, and fixing any one alone changes nothing.**
+
+1. **One indexer run at the repo root.** `--infer-tsconfig` does not cover this —
+   it finds *a* tsconfig when the root has none, but still emits one index from
+   one root. Now: one run per tsconfig project, merged.
+
+2. **Paths keyed to where the indexer ran.** Indexing `server/` emits
+   `src/index.ts` while the graph stores `server/src/index.ts`, so a second run
+   *without* re-prefixing resolves nothing while looking like a fix. The prefix
+   has to apply to the funcId values too (`relPath#name`), not just the map keys.
+
+3. **`who-calls` claimed `coverage.complete: true` while returning zero.**
+   Coverage counted parse failures only; a file that parsed but was never
+   compiler-resolved is equally invisible to a call query and never lands in
+   `skippedFiles`. "Nothing calls this" is what gets read right before a rename
+   or a delete — and it was firing on auth middleware.
+
+Why (3) hid so long: the per-file record handed to the query layer was
+`{file, entities, edges}` with no tier field, so the query layer structurally
+could not tell a resolved file from an unresolved one.
+
+Import queries deliberately still report complete at floor tier — import edges
+come from the parse, so `who-imports` and `blast-radius` are genuinely complete
+there, and flagging them would train you to ignore the field.
+
+Measured on TimeTracking: 8 → 40 indexed files, 0 → 173 resolved call edges into
+`server/`, 96 → 390 overall, `server/` 0 → 13 of 19 files compiler-accurate.
+Affects 13 registered projects with nested tsconfigs (binvoice 1→5 projects,
+newman 1→7, Tekyz-CRM 1→2).
+
+- `bin/gsd-t-graph-scip-upgrade.cjs`: `findTsProjectDirs()` + one indexer run per project
+- `bin/gsd-t-scip-reader.cjs`: `pathPrefix` re-roots fileRefs keys AND funcIds
+- `bin/gsd-t-graph-query-cli.cjs`: per-file tier carried onto records + tier-aware coverage
+- `test/m114-nested-tsconfig-graph.test.js`: 12 tests, each mutation-tested
+
+**Re-index to pick this up**: `gsd-t graph index` in any project with a nested
+tsconfig. A graph built before this version under-reports call edges.
+
 ## [5.16.12] - 2026-08-29
 
 ### Fixed — a retired hook fired on every tool call, on every machine, since M61

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.16.12** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.17.11** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t-graph-query-cli.cjs

@@ -295,16 +295,51 @@ function loadSkippedFiles(storePath) {
  * @param {Set<string>} skippedFiles  — files that failed to parse (D3-T6)
  * @returns {{ complete: boolean, unparsedContributors?: number, note?: string }}
  */
-function computeCoverage(skippedFiles) {
-  if (!skippedFiles || skippedFiles.size === 0) {
-    return { complete: true };
+function computeCoverage(skippedFiles, opts = {}) {
+  const n = (skippedFiles && skippedFiles.size) || 0;
+
+  // M114 — an UNRESOLVED file is as invisible to who-calls as an unparsed one.
+  // Parsing a file yields its call SITES; only compiler-accurate resolution says
+  // WHICH function each site targets. A floor-tier file parses fine, contributes
+  // zero resolved call edges, and never lands in skippedFiles — so coverage used
+  // to report complete:true while who-calls returned empty for an entire backend.
+  // "Nothing calls this" is what gets read right before a rename or a delete, so
+  // a false all-clear here is worse than no answer.
+  // Applies to CALL-edge queries only: IMPORT edges come from the parse, so
+  // who-imports and blast-radius are genuinely complete at floor tier.
+  const unresolved = opts.callEdgesUnresolved ? (opts.unresolvedFiles || 0) : 0;
+
+  if (n === 0 && !unresolved) return { complete: true };
+
+  const notes = [];
+  if (n) notes.push(`${n} file(s) unparsed`);
+  if (unresolved) {
+    notes.push(`${unresolved} file(s) parsed but not compiler-resolved — ` +
+      `call edges there are unknown, not absent`);
   }
-  const n = skippedFiles.size;
-  return {
+  const coverage = {
     complete: false,
-    unparsedContributors: n,
-    note: `result may be incomplete — ${n} file(s) unparsed`,
+    note: `result may be incomplete — ${notes.join('; ')}`,
   };
+  if (n) coverage.unparsedContributors = n;
+  if (unresolved) coverage.unresolvedContributors = unresolved;
+  return coverage;
+}
+
+/**
+ * Count files whose tier is NOT compiler-accurate — i.e. files that parsed but
+ * whose call targets were never resolved. These are invisible to who-calls.
+ *
+ * @param {{fileTier?: Map<string,string>}} index
+ * @returns {number}
+ */
+function countUnresolvedFiles(index) {
+  if (!index || !index.fileTier) return 0;
+  let n = 0;
+  for (const tier of index.fileTier.values()) {
+    if (tier && tier !== 'compiler-accurate') n++;
+  }
+  return n;
 }
 
 /**
@@ -332,6 +367,9 @@ function buildIndex(records, skippedFiles) {
   const funcEntities = new Map();
   /** @type {Set<string>} */
   const allFiles = new Set();
+  /** @type {Map<string,string>} file → tier (M114: who-calls needs the TARGET
+   * file's tier, not just the repo-wide dominant one). */
+  const fileTier = new Map();
 
   let dominantTier = "compiler-accurate";
   let hasFloor = false;
@@ -339,6 +377,7 @@ function buildIndex(records, skippedFiles) {
 
   for (const rec of records) {
     allFiles.add(rec.file);
+    if (rec.tier) fileTier.set(rec.file, rec.tier);
 
     if (rec.tier === "tree-sitter-floor") hasFloor = true;
     if (rec.tier === "tree-sitter-floor-STALE-SCIP") hasStaleScip = true;
@@ -384,6 +423,7 @@ function buildIndex(records, skippedFiles) {
     forwardCallEdges,
     funcEntities,
     allFiles,
+    fileTier,
     tier: dominantTier,
     skippedFiles: skippedFiles instanceof Set ? skippedFiles : new Set(),
   };
@@ -516,6 +556,17 @@ function loadSqliteStore(dbPath) {
     for (const n of nodes) {
       if (n.func_id) rec(n.file).entities.push({ funcId: n.func_id, name: n.name, file: n.file, tier: n.tier, endLine: n.end_line });
     }
+    // M114 — carry each file's TIER onto its record. Without this the record is
+    // {file, entities, edges} with no tier, so the query layer cannot tell a
+    // compiler-resolved file from an unresolved one and coverage cannot report
+    // incompleteness. A file is only compiler-accurate if every entity is; a
+    // single floor entity means some call target in it is unknown.
+    for (const n of nodes) {
+      if (!n.file) continue;
+      const r = rec(n.file);
+      if (n.tier && n.tier !== 'compiler-accurate') r.tier = n.tier;
+      else if (!r.tier) r.tier = n.tier || 'compiler-accurate';
+    }
     for (const e of edges) {
       // src for an IMPORT edge is the source FILE; for a CALL edge it's a funcId
       // (file#fn@line). The owning file record is the src's file part.
@@ -676,7 +727,7 @@ function queryWhoImports(index, target) {
  */
 function queryWhoCalls(index, identity) {
   const isFuncId = identity.includes("#");
-  const coverage = computeCoverage(index.skippedFiles);
+  const coverage = computeCoverage(index.skippedFiles, { callEdgesUnresolved: true, unresolvedFiles: countUnresolvedFiles(index) });
 
   if (isFuncId) {
     // File-qualified identity — exact funcId lookup (tolerate @line suffix:
@@ -909,7 +960,7 @@ function queryBlastRadius(index, target) {
   }
 
   const results = Array.from(visited).sort();
-  const coverage = computeCoverage(index.skippedFiles);
+  const coverage = computeCoverage(index.skippedFiles, { callEdgesUnresolved: true, unresolvedFiles: countUnresolvedFiles(index) });
   return { results, tier: index.tier, coverage };
 }
 
@@ -1295,6 +1346,7 @@ module.exports = {
   queryDangling,
   queryTestImpl,
   computeCoverage,
+  countUnresolvedFiles,
   loadStore,
   runFreshnessCheck,
   resolveStorePath,

package/bin/gsd-t-graph-scip-upgrade.cjs

@@ -243,6 +243,59 @@ function isRustCrossCrateEdge(edge, relPath) {
   return false;
 }
 
+// ── TypeScript project discovery (M114) ──────────────────────────────────────
+
+/**
+ * Find every TypeScript project root in the repo — each directory holding a
+ * `tsconfig.json`.
+ *
+ * Why: scip-typescript indexes ONE tsconfig per run, and a tsconfig's `include`
+ * governs what it can see. A repo whose root tsconfig covers only the frontend
+ * indexes only the frontend; `server/src/` is never compiled, so not one backend
+ * call resolves and `who-calls` answers empty for the entire backend.
+ * `--infer-tsconfig` does NOT cover this — it finds *a* tsconfig when the root
+ * has none, but still produces a single index from a single root.
+ *
+ * Returns repo-relative dirs, root first (`''` for the repo root itself), so the
+ * root project's symbols win when two projects define the same name.
+ *
+ * A nested project inside another's `include` gets indexed twice; that is
+ * harmless — the second read overwrites identical keys with identical values.
+ *
+ * [RULE] scip-indexes-every-tsconfig-project
+ *
+ * @param {string} repoRoot
+ * @returns {string[]} repo-relative project dirs, e.g. ['', 'server']
+ */
+function findTsProjectDirs(repoRoot) {
+  const SKIP = new Set(['node_modules', '.git', 'dist', 'build', 'out', '.venv', 'venv',
+    'site-packages', '__pycache__', '.next', 'coverage', 'Pods', '.dart_tool', 'vendor']);
+  function isSkip(name) {
+    if (SKIP.has(name)) return true;
+    return ['dist', 'build', 'out'].some(p => name.length > p.length && name.startsWith(p) &&
+      (name[p.length] === '-' || name[p.length] === '.' || name[p.length] === '_'));
+  }
+  const found = [];
+  function walk(dir, depth) {
+    if (depth > 4) return;               // deep enough for monorepo packages/*/x
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (e.isFile() && e.name === 'tsconfig.json') {
+        const rel = path.relative(repoRoot, dir).split(path.sep).join('/');
+        found.push(rel);
+      }
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && !isSkip(e.name)) walk(path.join(dir, e.name), depth + 1);
+    }
+  }
+  walk(repoRoot, 0);
+  // Root ('') first so its symbols are read before nested ones.
+  found.sort((a, b) => (a === '' ? -1 : b === '' ? 1 : a.localeCompare(b)));
+  return found;
+}
+
 // ── Repo-level SCIP resolver (M95) ────────────────────────────────────────────
 
 /**
@@ -282,11 +335,32 @@ function buildScipResolver(repoRoot, opts = {}) {
     }
   }
 
+  // TypeScript: one indexer run PER tsconfig project, each re-prefixed back to
+  // repo-root-relative paths before merging. A single root run misses every
+  // nested project (see findTsProjectDirs), and a second run without the prefix
+  // resolves nothing — both halves are required for either to work.
+  const tsProjects = [];
   if (avail.typescript && langs.typescript) {
-    try {
-      const run = runScipTypescript(repoRoot, resolveScipPath('index.scip', repoRoot));
-      if (run && run.ok) { mergeRead(readScipIndex(run.scipPath)); ranIndexers.push('typescript'); }
-    } catch { /* degrade to floor for TS */ }
+    const dirs = findTsProjectDirs(repoRoot);
+    // No tsconfig anywhere → one root run with --infer-tsconfig (prior behavior).
+    const targets = dirs.length ? dirs : [''];
+    for (const rel of targets) {
+      const absRoot = rel ? path.join(repoRoot, rel) : repoRoot;
+      // One .scip per project — a shared filename would have each run clobber
+      // the last, leaving only the final project's symbols.
+      const outName = rel ? `index-ts-${rel.replace(/[^A-Za-z0-9_-]/g, '-')}.scip` : 'index.scip';
+      try {
+        const run = runScipTypescript(absRoot, resolveScipPath(outName, repoRoot));
+        if (run && run.ok) {
+          const read = readScipIndex(run.scipPath, rel);
+          if (read && read.ok) {
+            mergeRead(read);
+            tsProjects.push({ dir: rel || '.', files: read.fileRefs.size });
+          }
+        }
+      } catch { /* this project degrades to floor; others still contribute */ }
+    }
+    if (tsProjects.length) ranIndexers.push('typescript');
   }
   if (avail.python && langs.python) {
     try {
@@ -335,7 +409,17 @@ function buildScipResolver(repoRoot, opts = {}) {
     return { edges: out, resolved };
   }
 
-  return { ok: true, indexers: ranIndexers, scipPath: resolveScipPath('index.scip', repoRoot), resolveFileEdges };
+  // tsProjects reports which tsconfig projects actually contributed refs. A
+  // project that ran but yielded 0 files is the signature of this bug class —
+  // surfaced rather than swallowed, so a re-index can be inspected.
+  return {
+    ok: true,
+    indexers: ranIndexers,
+    tsProjects,
+    indexedFiles: fileRefs.size,
+    scipPath: resolveScipPath('index.scip', repoRoot),
+    resolveFileEdges,
+  };
 }
 
 /** No-op resolver used when SCIP is unavailable (floor mode). */
@@ -495,6 +579,7 @@ if (require.main === module) {
 module.exports = {
   tryScipUpgrade,
   buildScipResolver,
+  findTsProjectDirs,
   detectScip,
   _resetScipCache,
   isRustCrossCrateEdge,

package/bin/gsd-t-scip-reader.cjs

@@ -81,15 +81,33 @@ function loadScipProto() {
  */
 function funcNameFromSymbol(symbol) {
   if (!symbol || typeof symbol !== 'string') return null;
-  // Only function/method occurrences (end with "()."). Parameters are "name().(p)"
-  // — they don't end with "()." so they're excluded.
-  if (!/\(\)\.$/.test(symbol)) return null;
-  // The callable name is the last descriptor segment. Top-level functions are
+
+  // The name is the last descriptor segment. Top-level functions are
   // ".../`file.ts`/name()."; methods are ".../`file.ts`/Class#method()." — so the
   // name follows the LAST '/' OR '#', whichever is later (methods key on '#').
   const cut = Math.max(symbol.lastIndexOf('/'), symbol.lastIndexOf('#'));
   const descriptor = cut === -1 ? symbol : symbol.slice(cut + 1);
-  const m = descriptor.match(/^([A-Za-z_$][\w$]*)\(\)\.$/);
+
+  // TWO callable descriptor shapes, and missing the second one silently halved
+  // the graph. [RULE] scip-accepts-term-and-method-descriptors
+  //
+  //   `name().`  — a METHOD descriptor: `export function name() {}`
+  //   `name.`    — a TERM descriptor:   `export const name = async () => {}`
+  //
+  // TypeScript treats an arrow function assigned to a const as a VARIABLE, so
+  // SCIP emits a term. Requiring "()." therefore discarded every arrow-function
+  // export: on a real server that was 3,584 term symbols dropped against 1,624
+  // kept, so `who-calls logAudit` answered "no callers" for a function called
+  // throughout the codebase — while `verifyToken`, three lines away but written
+  // as `export function`, resolved fine.
+  //
+  // Non-callable terms (`Array.`, an imported type) are admitted here and cost
+  // nothing: a name only resolves when a CALL SITE is looking for that exact
+  // name, so a type reference never matches one.
+  //
+  // Parameters (`name().(p)`) stay excluded — they end in `)`, not `.`.
+  let m = descriptor.match(/^([A-Za-z_$][\w$]*)\(\)\.$/);   // function / method
+  if (!m) m = descriptor.match(/^([A-Za-z_$][\w$]*)\.$/);   // term (const arrow fn)
   return m ? m[1] : null;
 }
 
@@ -118,12 +136,29 @@ function isBuildOutputPath(relPath) {
 /**
  * Decode a `.scip` file and build resolution maps.
  *
+ * `pathPrefix` re-roots every path in the index to be repo-root-relative.
+ * An indexer reports paths relative to WHERE IT RAN: indexing `server/` emits
+ * `src/index.ts`, while the graph stores `server/src/index.ts`. Without the
+ * prefix, a nested project's refs key on paths the graph has never heard of and
+ * resolve nothing — a second indexer run would LOOK like a fix and change
+ * nothing. [RULE] scip-paths-reprefixed-to-repo-root
+ *
+ * The prefix must apply to BOTH the fileRefs keys AND the funcId values, since
+ * a funcId is `relPath#name` — prefixing only the keys leaves every funcId
+ * pointing at a path the graph does not have.
+ *
  * @param {string} scipPath  absolute path to an index.scip
+ * @param {string} [pathPrefix]  repo-relative dir the index was produced from
+ *                               (e.g. "server"); "" or "." for the repo root
  * @returns {{ ok: true, symbolToDef: Map<string,string>,
  *             fileRefs: Map<string, Array<{symbol:string, funcId:string, line:number}>> }
  *         | { ok: false, reason: string }}
  */
-function readScipIndex(scipPath) {
+function readScipIndex(scipPath, pathPrefix) {
+  // Normalize: "", ".", "./", "server/" and "server" all mean the same thing.
+  const rawPrefix = (pathPrefix || '').replace(/^\.\/+/, '').replace(/\/+$/, '');
+  const prefix = (rawPrefix === '' || rawPrefix === '.') ? '' : rawPrefix + '/';
+  const reroot = prefix ? (p) => prefix + p : (p) => p;
   const proto = loadScipProto();
   if (!proto) {
     return { ok: false, reason: 'scip-decoder-unavailable' };
@@ -147,22 +182,24 @@ function readScipIndex(scipPath) {
 
   // First pass: collect every DEFINITION occurrence → symbol → funcId.
   for (const doc of docs) {
-    const relPath = doc.relative_path;
-    if (!relPath || isBuildOutputPath(relPath)) continue;
+    const rawPath = doc.relative_path;
+    if (!rawPath || isBuildOutputPath(rawPath)) continue;
+    const relPath = reroot(rawPath);
     for (const occ of doc.occurrences || []) {
       const isDef = (occ.symbol_roles & SYMBOL_ROLE_DEFINITION) !== 0;
       if (!isDef) continue;
       const name = funcNameFromSymbol(occ.symbol);
       if (!name) continue;
-      // funcId = the graph's file#name key
+      // funcId = the graph's file#name key (repo-root-relative)
       symbolToDef.set(occ.symbol, `${relPath}#${name}`);
     }
   }
 
   // Second pass: collect every REFERENCE occurrence per file, resolved to the def.
   for (const doc of docs) {
-    const relPath = doc.relative_path;
-    if (!relPath || isBuildOutputPath(relPath)) continue;
+    const rawPath = doc.relative_path;
+    if (!rawPath || isBuildOutputPath(rawPath)) continue;
+    const relPath = reroot(rawPath);
     const refs = [];
     for (const occ of doc.occurrences || []) {
       const isDef = (occ.symbol_roles & SYMBOL_ROLE_DEFINITION) !== 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.16.12",
+  "version": "5.17.11",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",