@tekyzinc/gsd-t 5.17.10 → 5.17.11

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.17.11] - 2026-09-01
+
+### Fixed — every arrow-function export was invisible to the code graph
+
+`who-calls logAudit` answered "no callers" for a function called throughout a
+server, while `verifyToken` — three lines away in the same directory — resolved
+fine. The difference was how they were declared:
+
+- `export function verifyToken()` → SCIP emits a METHOD descriptor, `verifyToken().`
+- `export const logAudit = async () => {}` → SCIP emits a TERM descriptor, `logAudit.`
+
+TypeScript treats an arrow function assigned to a const as a variable, so it gets
+a term. `funcNameFromSymbol` required the `().` shape and discarded everything
+else — on a real server that meant **3,584 term symbols dropped against 1,624
+kept**, more than twice as much data thrown away as used.
+
+The references were in the SCIP index the whole time; GSD-T was deleting them on
+read. This was diagnosed in the field as a "scip-typescript coverage limitation" —
+it was not, it was ours.
+
+Non-callable terms (`Array.`, imported types) are now admitted and cost nothing:
+a name only resolves when a call site is looking for that exact name, so a type
+reference never matches one. Parameters (`name().(p)`) stay excluded — they end
+in `)`, not `.`.
+
+Measured on the same repo, on top of 5.17.10: `server/src/index.ts` went from 30
+to **116** unique resolved symbols, compiler-accurate files 38 → **130**, call
+edges into `server/` 173 → **591**. `logAudit`, `withTransaction` and
+`getAuditContext` all return correct callers, verified against the source.
+
+- `bin/gsd-t-scip-reader.cjs`: accept term descriptors alongside method ones
+- `test/m114-nested-tsconfig-graph.test.js`: 4 more tests, mutation-tested
+
+**Re-index to pick this up**: `gsd-t graph index`.
+
 ## [5.17.10] - 2026-09-01
 
 ### Fixed — the code graph indexed one TypeScript project and called it the whole repo

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.17.10** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.17.11** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t-scip-reader.cjs

@@ -81,15 +81,33 @@ function loadScipProto() {
  */
 function funcNameFromSymbol(symbol) {
   if (!symbol || typeof symbol !== 'string') return null;
-  // Only function/method occurrences (end with "()."). Parameters are "name().(p)"
-  // — they don't end with "()." so they're excluded.
-  if (!/\(\)\.$/.test(symbol)) return null;
-  // The callable name is the last descriptor segment. Top-level functions are
+
+  // The name is the last descriptor segment. Top-level functions are
   // ".../`file.ts`/name()."; methods are ".../`file.ts`/Class#method()." — so the
   // name follows the LAST '/' OR '#', whichever is later (methods key on '#').
   const cut = Math.max(symbol.lastIndexOf('/'), symbol.lastIndexOf('#'));
   const descriptor = cut === -1 ? symbol : symbol.slice(cut + 1);
-  const m = descriptor.match(/^([A-Za-z_$][\w$]*)\(\)\.$/);
+
+  // TWO callable descriptor shapes, and missing the second one silently halved
+  // the graph. [RULE] scip-accepts-term-and-method-descriptors
+  //
+  //   `name().`  — a METHOD descriptor: `export function name() {}`
+  //   `name.`    — a TERM descriptor:   `export const name = async () => {}`
+  //
+  // TypeScript treats an arrow function assigned to a const as a VARIABLE, so
+  // SCIP emits a term. Requiring "()." therefore discarded every arrow-function
+  // export: on a real server that was 3,584 term symbols dropped against 1,624
+  // kept, so `who-calls logAudit` answered "no callers" for a function called
+  // throughout the codebase — while `verifyToken`, three lines away but written
+  // as `export function`, resolved fine.
+  //
+  // Non-callable terms (`Array.`, an imported type) are admitted here and cost
+  // nothing: a name only resolves when a CALL SITE is looking for that exact
+  // name, so a type reference never matches one.
+  //
+  // Parameters (`name().(p)`) stay excluded — they end in `)`, not `.`.
+  let m = descriptor.match(/^([A-Za-z_$][\w$]*)\(\)\.$/);   // function / method
+  if (!m) m = descriptor.match(/^([A-Za-z_$][\w$]*)\.$/);   // term (const arrow fn)
   return m ? m[1] : null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.17.10",
+  "version": "5.17.11",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",