Validation log

Per-corpus tables behind How we validate. Shallow clones, default branch, October 2026. "Unchanged corpora" notes stay here.

The Python/Django and Dart/Flutter plugins, Laravel broadcasting and test indexing, the Nuxt layout handling, the framework presets with their starter queries and route-guard classification, and generated-file detection were checked against shallow clones of well-known open-source projects (default branch, October 2026). Numbers are from python -m codegraph.cli index <repo> on a single 8-core Linux box; wall time includes the Dart extractor (facts cache cold) but not the one-off dart compile exe of the extractor.

"Spot check" means: 20 routes (or every route when there are fewer) sampled at random from the graph and compared by hand with the source line they cite: HTTP method, full path including every include()/add_router()/router prefix, path parameters, and the handler symbol.

Django / Python

The difference between files and parsed files is migrations (skipped by default; python_include_migrations turns them on) and files over the size cap. No file failed ast.parse.

Gaps seen:

• netbox: the API prefix comes from an f-string over settings.BASE_PATH, rendered as {?}; views registered through register_model_view() / get_model_urls() are partly unresolved.
• wagtail: page_viewset_registry / hook-generated URL lists resolve paths but not always the handler.
• saleor: one GraphQL endpoint; resolvers/mutations are not routes.

Python source-root detection (src/ and lib/ layouts, monorepos, namespace packages) is validated on fastapi/full-stack-fastapi-template, opentelemetry-python, ansible, flask, pytest and netbox: see validation. Test indexing (pytest, unittest, fixtures, Django / DRF test clients) is validated on the same projects: see pytest and unittest.

tests.py modules and collection chains, checked on django (211 tests.py files), netbox, saleor, ansible, opentelemetry-python, mkdocs, flake8, httpie, beets, sphinx and pylint: every graph is identical before and after (same nodes, edges and attributes; index time within noise, for example django 50.5 s -> 52.2 s, saleor 62.8 s -> 62.7 s). The Django tests.py files hold test cases and stay test code, and no collection call gained or lost an edge. On cg's own source, the two plugin modules named tests.py that application code imports became application code (136 nodes, 148 test edges back to calls), and index_project gained the 9 calls through its framework and language plugin lists (every framework plugin's contribute, the SCIP indexer plugins' index), all correct.

Flutter / Dart

Spot checks:

• flutter/samples: 12 sampled HTTP calls all correct (method, host, path, {id} params); 2 calls whose whole URL is a runtime value are labelled dynamic. All 13 go_router routes of navigation_and_routing (nested paths joined to their parent, :id → {id}) and their screens are correct.
• lichess: 18/20 HTTP calls correct; the two imprecise ones are an env-hosted CDN URL rendered with a leading / and a HEAD whose URI comes from a list. 105 call sites keep an unknown origin because the host is added in the client's send() override. Pages come from the project's buildScreenRoute(screen: X()) helper (89 call sites in the source).
• mova and flutter_clean_arch: every HTTP call correct, including the Dio baseUrl path prefix (/auth/login).

Gaps seen:

• localsend talks to peers through a Rust bridge and an enum whose constructor builds the paths; neither is modelled.
• auto_route v4 annotation configs (@MaterialAutoRouter(routes: [...])) are not read; v6 @RoutePage classes are pages without a path.
• Data-driven route lists (demos.map((d) => GoRoute(path: d.route, ...))) leave navigation targets unresolved.

Before the analyzer 10 upgrade, 499 lichess files failed to parse (Dart 3.13 primary constructors); they now parse with the primary-constructors experiment fallback.

Laravel broadcasting and tests

Shallow clones of Laravel apps that use Broadcast::channel (default branch, October 2026). "Channels" lists the declared and undeclared channels found; publishers were compared by hand with every ShouldBroadcast event's broadcastOn(), subscriptions and listened events with every Echo / pusher call in the repo's own JS.

Tests: TEST_HTTP edges, 10 sampled at random per project and checked against the cited source line (verb, path or route name, target route): 40 / 40 correct.

Nuxt layouts and clean checkouts

Shallow clones indexed without npm install and without .nuxt (the clean-checkout path):

Presets, starter queries and route guards

cg index <repo> with no flags and no .cg.yaml, then cg starters and cg routes --unguarded. Monorepos are indexed per app (immich/server, cal.com/apps/web, ...). "Starters" counts the starter queries that resolve to existing nodes out of those generated; "auth by" counts auth guards by the rule that recognised them (preset X: the framework preset lists the guard by its own name; name pattern: the shared auth token pattern; framework: the plugin knows the check, e.g. Laravel broadcast channel callbacks). Index time includes the starters (last column).

Laravel resource routes follow ResourceRegistrar (#118). On koel the six nested registrations (albums.songs, artists.albums, artists.songs, playlist-folders.playlists, playlists.songs, podcasts.episodes) expand to the registrar's URLs with singular parameters (playlist-folders → {playlist_folder}), and no resource route is left with a dotted path segment (only GET /manifest.json and GET /manifest-remote.json keep a dot, as registered). The route count is unchanged. | immich-app/immich server/ | c5e06dc | nest, express | typescript, nest, express | 4 / 4 | 295 / 295 / 0 | name pattern 295, preset nest 295 | 12.3 s | 0.28 s | | immich-app/immich mobile/ | c5e06dc | flutter | python, dart | 3 / 3 | – | – | 3.79 s | 0.07 s | | calcom/cal.com apps/api/v2 | 54343aa | nest | typescript, nest | 3 / 3 | 162 / 140 / 22 | name pattern 217 | 7.76 s | 0.01 s | | calcom/cal.com apps/web | 54343aa | nextjs | typescript, nextjs | 4 / 4 | 99 / 0 / 99 | – | 11.28 s | 0.06 s | | brocoders/nestjs-boilerplate | 9620f15 | nest | typescript, nest | 6 / 6 | 22 / 11 / 11 | preset nest 16 | 2.6 s | 0.01 s | | hagopj13/node-express-boilerplate | 179ae84 | express | typescript, express | 2 / 2 | 14 / 6 / 8 | name pattern 6 | 2.18 s | 0.0 s | | elk-zone/elk | 8a90074 | nuxt | typescript, nuxt | 3 / 3 | – | – | 4.29 s | 0.01 s | | BurntSushi/ripgrep | 3fce3b5 | – | rust | 3 / 3 | – | – | 27.59 s | 0.05 s | | redis/redis | b540ca4 | – | python, c_cpp | 3 / 3 | – | – | 5.53 s | 0.09 s | | pallets/flask | d73fa1c | – | python | 3 / 3 | – | – | 0.74 s | 0.01 s |

saleor sets testpaths = ["saleor"], its application package. Since #18 only the files pytest collects there (plus conftest.py and tests/ directories) are test code: test modules 2,866 -> 1,718, CALLS edges 0 -> 11,848 (TEST_CALLS 58,676 -> 42,370), the same 12,866 test cases, and 6 starters instead of 1. impact saleor.order.utils.invalidate_order_prices now lists 1,152 application callers (before: none, only tests). On the now connected call graph the starters took 63 s at first, almost all of it in the unguarded-write-routes report (one reverse closure per written table, 95 tables). Since #25 the route report walks the graph once for all write targets, limited to what the routes reach, with the same output (cg routes --writes --unguarded and the 6 starters are identical), and the starters keep to a 20 s budget (starters_skipped names any left out). Index time, best of three on the same box:

Every starter resolved on every project. Index time on netbox, best of three on the same box: 34.1 s before (v0.4.0) and 33.5 s after, with 1.1 s of that spent on the starters; the shared skip lists and presets add no measurable cost.

Hand-checked routes --unguarded samples. For each framework, the first unguarded routes and a sample of the guarded ones were compared with the source:

A .cg.yaml for the two project patterns above:

auth:
  extra_patterns: ["IsAuthenticatedOrLoginNotRequired"]   # netbox
secret:
  extra_patterns: ["WebhookGuard$"]                        # cal.com apps/api/v2

Monorepo apps

One cg index <root> with .cg.yaml apps (the file was written for the run and removed afterwards), compared with indexing each app and linking each pair one by one: every per-app and per-pair graph has the same nodes and edges.

Taking the extractor skip lists from the presets changed no graph: immich server / web / mobile, cal.com apps/web, elk, social-app and nestjs-boilerplate index to the same nodes and edges as before.

Generated and copied files

cg index <repo> with no flags and no .cg.yaml (default: generated, copied and vendored files excluded), then again with --include-generated; "before" is v0.4.0 plus the presets change. The Nuxt row is the nuxt/starter template (v4 branch) after npm install and nuxi prepare, so .nuxt/ exists as in a developer checkout; the Ionic/Capacitor row is a public Angular + Capacitor app with its android/ project and www/ build committed.

In every default index no node comes from a classified file, and cg coverage lists each one by reason. In every --include-generated index, every node from a classified file carries attrs.generated (0 unlabelled): 210 on grpc, 2737 on jellyfin, 232 on openfga, 1478 on flutter/samples. flutter/samples grows past "before" with the flag, because *.freezed.dart output, which the Dart plugin always skipped, is indexed too. On the Ionic app and on capacitor-plugins the node count does not move: the TS plugin only reads src/, so the 211 copies were never parsed, but they were counted as unindexed TypeScript and inflated the coverage gap. Linking the JS side of a Capacitor plugin to its Android/iOS implementation needs the Kotlin/Java and Swift plugins (see Generated files).

Bundled examples are unchanged except bookstore-flutter (90 / 171 → 87 / 164: the book.g.dart json_serializable output is no longer a node; PARSES_JSON is unchanged, because the file is still read for the exact JSON keys). The classification scan takes 0.00–0.08 s on these projects; index time on netbox (no generated files), median of five alternating runs on a shared box: 35.6 s before and 36.0 s after (run-to-run spread 33–37 s), with the scan itself at 0.07 s.

Platform-specific code

cg index <repo> with no flags and no .cg.yaml, then cg platforms divergence. "Before" is the index without platform tags; node counts are identical before and after on every project, and the added edges are the platform_variant_of copies that give each sibling variant the callers of the one the resolver picked (plus Rust cfg-inactive references, which carry the condition instead of being dropped). Targets come from the project itself: Flutter folders, React Native and its react-native-web dependency, or the desktop default for native code, plus every OS a condition names.

What the findings are, from spot checks:

• ripgrep, alacritty, curl: every variant group is a real per-OS definition set (#[cfg(unix)] / #[cfg(windows)] pairs, #ifdef WIN32 / #else function and macro pairs), and no reference lacks a callee on any target.
• dart-lang/http: the conditional imports (client_stub.dart / io_client.dart / browser_client.dart, connect_stub.dart / …) form the variant groups, including imports whose default is an SDK library (dart:isolate). The one API difference and missing callee are connect in browser_web_socket.dart, a top-level const connect = BrowserWebSocket.connect tear-off the Dart extractor does not record as a symbol.
• social-app: the .ios / .android / .native / .web file groups. Sampled findings come from variant files that re-export the symbol (export {x}, export {a as b} from 'react-dom'), which the TS extractor does not record as a definition in that file, and from .web.ts files that tests call directly.
• libuv: the per-OS function sets of src/unix/* and src/win/*. Missing callees come from the C heuristic extractor: functions generated by macros (SOCKOPT_SETTER in src/win/udp.c), functions after a region tree-sitter cannot parse (src/win/tty.c), and one macro defined in two #if branches of one header.
• localsend: almost all platform logic is runtime Platform.isX / defaultTargetPlatform checks inside shared code; 64 of them use TargetPlatform values that do not exist on web, so the web count of unevaluated conditions is high and those branches stay in for web.

Index time on netbox (no platform-specific code), best of three alternating runs on a shared box: 43.2 s before and 42.7 s after (spread 42.7–45.4 s); nodes and edges are identical (38028 / 140181).

Divergence false positives removed in #63 (before → after on the same commits):

Kotlin

Heuristic mode (tree-sitter-kotlin 1.1.0), shallow clones, cg index on the default branch:

Unresolved calls are mostly library and standard-library calls (Compose, coroutines, collections), which have no node in the graph.

Framework facts added with exact mode (same corpora, before → after; every other node and edge unchanged apart from calls now owned by the new page / route-handler nodes): nowinandroid 2 → 7 pages (Navigation 3 entry<Key>), 0 → 3 NAVIGATES_TO; ktor-samples 77 → 90 routes (type-safe resources), 3 Exposed tables with 14 reads / writes, 8 → 11 Ktor client calls (builder blocks); spring-petclinic-kotlin 4 tables with 17 Spring Data reads / writes (plus 38 from tests). KaMPKit (URL built in a helper) and android/architecture-samples (routes from const val strings) are unchanged. No corpus has a SecurityFilterChain; the fixture covers it.

Kotlin exact mode (scip-java)

scip-java 0.12.3 standalone launcher, JDK 17, CODEGRAPH_KOTLIN_SCIP_FILE pointing at the index. scip-java's semanticdb-kotlinc plugin only loads into Kotlin ≤ 2.1, and these builds use Kotlin 2.4: each was indexed from a copy with the Kotlin Gradle plugin pinned to 2.1.20 (Ktor samples also with -Xskip-metadata-version-check, since Ktor 3.6 is compiled with Kotlin 2.3 metadata); the sources are unchanged. Precision: share of heuristic call edges (CALLS / INSTANTIATES, same source and target) that the index confirms; recall: share of compiler edges the heuristic layer found.

The heuristic layer's misses are mostly extension functions called on a library receiver (call.redirect(...)), overloads and lambda receivers (it.area()); its few disagreeing edges attribute a call to the file instead of the enclosing function, or pick a same-named function. Unmatched definitions (SCIP definitions with no syntax-layer declaration on that line) get no edges. Not run: chat, h2, opentelemetry (the build does not configure with the pinned plugin), httpbin (needs Kotlin 2.2 language features), and the Android projects (nowinandroid, KaMPKit, architecture-samples: no Android SDK on the validation machine). Without a JDK, or with the unpinned Kotlin 2.4 build, the index completes in heuristic mode and cg coverage names the reason (no JDK, or scip-java run failed (exit 1: ...)).

Kotlin 2.2 and mixed Kotlin / Java (scip-java 0.13.1 launcher next to 0.12.3, CODEGRAPH_KOTLIN_SCIP=1, build not edited): statsig-io/java-server-sdk 9edc7ca, Kotlin 2.2.10, Gradle 8.5 wrapper, 86 Kotlin + 12 Java (test) files. cg read Kotlin 2.2.10 from the build, ran 0.13.1 (93 s cold): 84 Kotlin files exact, 944 / 59 definitions matched / unmatched (compiler-generated members such as data class copy / componentN and anonymous objects not counted), 2,207 references resolved to project code; heuristic precision 0.91, recall 0.81 (1,434 of 1,573 heuristic edges confirmed, 1,779 exact). Java: 13 documents, 30 classes and 192 methods as java nodes, 358 exact Java -> Kotlin / Java edges; coverage kotlin 86 exact; java 12 scip (heuristic mode: java 12 unsupported). Graph 1,003 -> 1,097 nodes, 3,226 -> 3,852 edges. The same Gradle fixture on Kotlin 2.1.20 (0.12.3) and 2.2.10 (0.13.1) gives identical edges; on 2.2.21, 2.3.21 and 2.4.20 neither release loads (NoSuchMethodError / AnalyzerRegistrar is incompatible) and coverage names the version.

Android: android/architecture-samples ee66e15 (Kotlin 2.1.10, modules app, shared-test) with an Android SDK installed in the user's home (command-line tools + sdkmanager "platforms;android-35" "build-tools;35.0.0", no sudo). The default scip-java run fails on the settings' FAIL_ON_PROJECT_REPOS; cg reports that and names both Android modules. With an init script switching the mode to PREFER_SETTINGS and the variant tasks requested explicitly (:app:compileDebugKotlin), the build compiles (1 min 27 s) but scip-java 0.12.3's Gradle plugin attaches no compiler plugin to Android variant tasks: no SemanticDB output, so the index stays heuristic (61 Kotlin files).

Swift

Heuristic mode (tree-sitter-swift 0.7.3) on Linux without Xcode, shallow clones, cg index on the default branch:

Unresolved calls are mostly SDK calls (SwiftUI modifiers, Foundation, Combine), which have no node in the graph. IceCubesApp and isowords call their APIs through typed endpoint enums and a swift-parsing router, which are not HTTP client forms the plugin reads yet. The Vapor template's routes.swift contains Mustache markup, so its two closure routes do not parse. Since exact mode, the body of an overloaded method is owned by its (merged) method node rather than the enclosing type: Alamofire 3,825 → 3,817 resolved calls (overloads calling each other became self calls), isowords gained one URLSession endpoint (built inside an overloaded request).

Moya and Fluent: none of the four corpora uses Moya (the fixture tests/swift_facts_fixture covers it, including a TargetType with a relative base linked to Vapor routes). The Vapor template rendered with Fluent (fluent: true, SQLite, no Leaf) gives table:todos (MAPS_TO_TABLE from Todo), 2 migration writes, 2 reads (Todo.query, Todo.find) and 1 write (todo.delete(on:)) from TodoController, and 2 test uses; the unrendered template gives the same. create saves the model returned by TodoDTO.toModel(), whose type is not inferred. No corpus has @available(iOS / macOS, unavailable) or a call to a function defined per #if os(...) branch (the fixture covers both). Apart from these and the overload change above, the four corpora index as before.

Swift exact mode (index store)

Swift 6.3.2 for Linux (Debian 12 build), libIndexStore.so from the same toolchain, swift build --enable-index-store (debug). Precision: share of heuristic call edges (CALLS / INSTANTIATES, same source and target) in the files the store covers that the index confirms; recall: share of compiler edges the heuristic layer found.

After the heuristic precision fixes of #58 (same stores, same sources; SDK initializers of extended types, initializer argument labels, standard-library collection methods, and the exact layer's initializers declared in extensions of SDK types):

The exact edges grew by the initializers projects declare in extensions of SDK types (extension Data { init(hex:) }), which the layer used to drop; recall moves by that denominator, not by lost heuristic edges. The whole graph also loses the SDK-initializer edges in files without a store (all edges: Alamofire 7,321 → 6,756, isowords 4,973 → 4,295, mostly Result, Data, URL, URLRequest and UUID constructions in tests).

What a Linux build covers: Alamofire's Source/ (tests and example apps need Apple frameworks); isowords' server modules (the full swift build stops at SwiftUI; the server product needs libsqlite3-dev), the rest of its 384 files keep heuristic edges and cg coverage counts them; the Vapor app's App target (its test target was not built). Not run: Dimillian/IceCubesApp (iOS-only SwiftUI app, no Linux build; heuristic, with the reason in cg coverage).

Where they disagreed before #58: the heuristic layer linked initializers of SDK types the project extends (URL(...), Date(...), UUID(...) → the extension's class node, while the compiler resolves them to Foundation) and picked same-named methods (xs.first(where:) → a project first; now fixed; a Fluent migration's .create() still matches TodoController.create); it misses initializer calls through Self(...) / .init(...) / nested types, calls to explicit init declarations (the index adds a CALLS to T.init next to INSTANTIATES), and members reached through inferred types (.live, closure parameters). In Alamofire, 247 heuristic edges sit in inactive #if branches (Apple-only code); they are kept with via: "not-compiled". Without the opt-in or a toolchain the index completes in heuristic mode and cg coverage names the reason (Swift toolchain found but the package was not built ..., no Package.swift ..., swift build failed (exit 1: ...)).

Web / native bridges

cg index <repo> with no flags and no .cg.yaml, then cg bridges (Web / native bridges). The two Capacitor repositories are monorepos without a root tsconfig.json; the TypeScript plugin indexes their per-package tsconfigs as one program (capacitor: 794 / 1664 → 1633 / 4521 nodes / edges, before that the plugin did not run; capacitor-plugins: 589 / 640 → 959 / 1367, 20 package tsconfigs instead of 3–4 files picked up by the fallback). Index time is one run each on a shared box (the spread between repeated runs of the same build was 2–4 s); the bridge pass itself takes the time shown.

What the findings are, from spot checks:

• capacitor: the framework's own core plugins (CapacitorHttp, CapacitorCookies, WebView, Console) are received on both platforms; CapacitorHttp#request is the one method the framework's own web code sends (through nativePromise), the others are the plugins' public API, called by apps. Console#log exists on iOS only (Android logs through the web view). The external endpoints are test literals and App#exitApp from the @capacitor/app package.
• capacitor-plugins: a library repository, so no senders. The two missing_on are real: TextZoom.get / set are Android methods (iOS has getPreferred only).
• immich mobile: 11 Pigeon APIs (10 @HostApi, 1 @FlutterApi) from mobile/pigeon/*.dart (the generated files are git-ignored): 50 Dart sends, 86 Kotlin / Swift receivers, 3 native sends to the Dart BackgroundWorkerBgService. Kotlin implementations inherit shared methods from NativeSyncApiImplBase (hashAssets is received there on Android and in NativeSyncApiImpl on iOS). The missing_on are real (BackgroundWorkerLockApi and ViewIntentHostApi are implemented on Android only), as are the two no_sender (NetworkApi#addCertificate, NativeSyncApi#clearSyncCheckpoint have no Dart caller).
• flutter/samples: every channel method is linked on both platforms. Native → Dart: reportCounter (add_to_app fullscreen, Kotlin and Swift), setCount (multiple_flutters) and setCellNumber (android_view list cells) are sent by invokeMethod and received by the Dart setMethodCallHandler; the books sample's Pigeon HostBookApi / FlutterBookApi link both ways. platform_view_swift is an iOS-only app (no android/ next to its pubspec.yaml), so its switchView is not reported missing on Android. The stubs are Swift methods the Swift plugin does not index (multi-line application(...) signatures, viewDidLoad overrides).
• mattermost-mobile: the app imports its modules from local file: packages (@mattermost/rnutils, @mattermost/calls-native, ...) without node_modules; they resolve to their source, through isTurboModuleEnabled ? require('./NativeX').default : NativeModules.X, X || new Proxy(...) and Object.assign(X, { onEvent }) (whose helpers are not endpoints). setNavigationBarColor is Android-only and its only call is under Platform.OS === 'android', so it is not missing on iOS. The 3 senderless MattermostShare methods are called from share_extension/, which the default source dirs do not index; the module is declared codegenConfig.platforms: ["android"].
• social-app: the Expo modules are called from wrapper functions inside modules/*/src, which is outside the default source dirs; with include: [modules] 21 methods link and no platform gap remains (ExpoBlueskyReferrer is called from an .android.ts file, setAudioActive after if (Platform.OS !== 'ios') return). The senderless methods are view-ref methods (GifView.playAsync) and notification-extension preferences.
• immich: the mobile app talks to native code through Pigeon-generated APIs only, which are not modelled yet.

Native events, Cordova and dynamic names (#61), before → after on the same commits:

• mattermost-mobile: DimensionsChanged links the Swift sendEvent(name:) to useWindowDimensions' NativeEventEmitter(RNUtils) listener (the Android side emits through an enum value, not followed). Three native events have "no JS listener found": their listeners sit in the local @mattermost/* packages and take the name from a constant object or a switch on the event. Three DeviceEventEmitter listeners belong to the app's JS event bus (emitted with names built elsewhere) and are not flagged. No existing endpoint or check changed.
• capacitor-plugins: a library, so the events have no JS listener; appRestoredResult, backButton and the local / push notification action events are emitted on Android only. The unresolved sends are notifyListeners calls with a variable name (Browser, StatusBar).
• Toast-PhoneGap-Plugin: show / hide from www/Toast.js link to the Java execute actions (compared with ACTION_SHOW_EVENT.equals(action) constants) and the Objective-C CDVPlugin methods on both platforms.
• social-app: no native events or Cordova calls; its addListener calls are navigation, Keyboard and a web-only EventEmitter, none of which became endpoints.

Desktop process boundaries (Electron, Tauri) and declared targets

cg index <repo> with no flags and no .cg.yaml, then cg bridges; Rust in heuristic mode (CODEGRAPH_RUST_SCIP=0). Index times are one run each on a shared box.

• fiddle: channels are IpcEvents enum members, registered through an ipcMainManager wrapper; main → renderer messages go to a preload addEventListener that maps event names to channels through a lookup table (a union-typed channel). Every channel is linked. The two no_sender members are real: getTemplateValues and removeAllListeners of the isolated run-button API are exposed but never called. impact on the main process's readThemeFile went from 5 callers (main only) to 18, through the preload script into the renderer components.
• clash-verge-rev: 90 #[tauri::command] functions, all registered in generate_handler!; 89 are invoked from the TypeScript services. perf_state (a command in a perf script crate) has no sender.
• Declared targets: swift-Alamofire windows, linux, macos, ios (desktop default) → windows, linux, macos, ios, android (Package.swift platforms, plus the targets its #if os(Linux) || os(Windows) || os(Android) names); canImport / targetEnvironment conditions take it from 33 to 103 platform conditions and from 26 to 370 tagged nodes. KaMPKit windows, linux, macos, ios, android → ios, android (the kotlin { } block of shared/build.gradle.kts); Kotlin/kotlinx-datetime (c73ca37) windows, linux, macos, web → windows, linux, macos, ios, android, web (mingwX64(), linuxX64(), macosArm64(), iosArm64(), androidNativeArm64(), js(); a plain jvm() is not a platform target). Graph edges are unchanged on all three.

Overrides in tests / reaches, inherited specs, TypeScript class hierarchy

cg index <repo> before and after (#53), no flags. TypeScript graphs gain only class hierarchy edges (no node and no other edge changes); Python graphs are identical (the change is in the queries).

Spot checks: every added edge was a real extends / implements / override. On social-app, impact MergeFeedSource_Following._getFeed had no callers and now lists MergeFeedSource._fetchNextInner (via the base _getFeed) up to fetchNext; on nestjs-boilerplate the repository implementations were already reached through Nest's BOUND_TO edges and now also state overrides: FileRepository.create. Calls on a TypeScript interface type (api.fetch() with api: FeedAPI) still had no target node then; #55 below adds interface members.

Receiver types on inherited calls in Kotlin, Swift, Dart and PHP (#62)

cg index before and after on the same commits: nodes and edges unchanged, calls into an inherited method now carry attrs.recv (the receiver's class), which impact / reaches / tests on Sub.method use to leave out calls on sibling subclasses.

Interface members, receiver-narrowed inherited specs, container bindings as dispatch (#55)

cg index <repo> before and after, no flags; queries with the old and the new code on the old and the new graph.

No edge was lost: the only edges that changed source are 22 REFERENCES_TYPE from an interface to the types its member signatures use, which now start at the member. Precision, from spot checks: all 50 added IMPLEMENTED_BY edges are real (implements declarations; the 8 structural ones are return new AuthorFeedAPI(...) etc. in a function returning the other FeedAPI interface of social-app's followingV2), and the 36 sampled calls into interface members are calls on values typed with that interface (api.peekLatest(), bulk.getAssetIds(...), Intl.formatMessage, mattermost's REST client mixins). impact AuthorFeedAPI.peekLatest (social-app) 0 → 48 callers via FeedAPI.peekLatest; impact MemoryRepository.getAssetIds (immich) 0 → 15 callers, 7 entry points via IBulkAsset.getAssetIds; impact BaseConfig.getCommand 0 → 3. mattermost's REST client implements its interfaces through mixin class expressions, so those members have callers but no IMPLEMENTED_BY yet.

Inherited specs: impact AppDataOperator.handleRecords (mattermost) leaves out 4 of 42 calls into BaseDataOperator.handleRecords, all this.handleRecords(...) in the sibling ServerDataOperatorBase (656 → 339 transitive callers); ExifTestContext.newUser (immich tests) 123 of 624 calls on LibraryTestContext / SyncTestContext; MergeFeedSource_Custom.take (social-app) the call on MergeFeedSource_Following. Calls on mattermost's ServerDataOperator (a class built with mix(ServerDataOperatorBase).with(...) merged with an interface) are kept, since the graph does not know that class's ancestry. Container bindings: on nestjs-boilerplate all 36 bound repository implementations listed the abstract method as a d=1 caller (284 callers in total); now 0, the abstract method is under overrides: (248 callers, exactly those 36 fewer).

Queries on sphinx (graph unchanged): reaches on ASTBaseBase._stringify (135 overrides) 26 → 31 dependents (5 via override), on Builder.write_doc 25 → 26; tests counts unchanged there, since sphinx's calls land on the base declarations. DirectoryHTMLBuilder.write_doc (inherited) answered "no method matches" and now resolves to StandaloneHTMLBuilder.write_doc (27 callers, 504 tests). On cg itself tests FrameworkPlugin.contribute goes from 0 to 226 tests (via the plugins' overrides) and impact FlaskPlugin.contribute resolves to the inherited _PyWebPlugin.contribute. Index times are unchanged within noise (social-app 18.4 → 16.8 s, mattermost 25.7 → 26.4 s, cal.com api v2 7.2 → 7.0 s, sphinx 7.9 → 7.8 s; single runs).

Exact index per target, Swift availability, re-exports in variant files, C macro gaps (#56)

cg index <repo> before and after, no flags (Rust in exact mode with rust-analyzer, CODEGRAPH_RUST_TARGETS default auto); cg platforms divergence counts are variants / API surface / missing callee. Index times are one run each on a shared box.

• Rust: every lost edge was a cfg-inactive name match the per-target index contradicts (ripgrep 6, alacritty 22, tauri 343: e.g. a call matched to another type's load / height), and owner attribution improved (tauri's Windows event loop new_any_thread now owns its Windows-only calls). The extra runs roughly double a cold Rust index; rust-analyzer's cache makes later runs cheaper. CODEGRAPH_RUST_TARGETS=0 turns them off.
• libuv: UV_LOOP_WATCHER_DEFINE / SOCKOPT_SETTER expansions are functions now; kqueue.c's uv__io_poll had swallowed 6 following definitions and win/tty.c 14. Calls to a function defined once in src/unix/ and once in src/win/ (uv_close, uv_tty_reset_mode, ...) had no edge at all, since the file-qualified keys of the two definitions were not seen as one symbol; they now reach both (+9,600 CALLS, mostly from tests and docs examples). 261 more per-platform definition groups (163 unix/win pairs; 2 are same-named functions of separate docs programs). 62 edges were lost: references inside a recovered definition that kept its head only, and calls the main parse had attributed to a swallowing function.
• Re-exports: the findings removed on social-app (4 API surface, 14 missing callee), dart-lang/http and expo (15 API surface, 7 missing callee) were re-exports (export {LockScroll} from 'react-remove-scroll', export { SymbolView } from './SymbolView.ios', const connect = IOWebSocketChannel.connect). Expo gains 4 API-surface findings, all web-only named exports the native variant does not have (AudioPlayerWeb re-exported by AudioModule.web.ts).
• Swift (expo): 194 declarations with @available versions (iOS 17: 53, iOS 18: 41, tvOS 17: 33, iOS 26: 30), 13 deprecated, 316 #available branches with 254 references in them, 1 declaration unavailable everywhere (BaseModule.init). Spot checks of 8 matched the source.
• Expo's targets come from apps/bare-expo/app.json (macos, ios, android, web).

Protocol links: shared endpoint model (#31)

cg index with no flags and no .cg.yaml, then cg link for the pairs and cg protocols (Protocol links). The existing links are read through adapters, so the graph and the outputs of cg link, cg channels and cg bridges were compared before and after on every project below: nodes, edges and all three outputs are identical. Index time is one run each on a shared box, within the run-to-run spread.

What the findings are, from spot checks:

• unguarded is the same classification as cg routes --unguarded (the private pair: 40 = 40; netbox: 857 of cg routes' 864, the rest are admin and unmounted routes, which cg link leaves out of its uncalled list too). A side is only judged when the graph holds the other side of that protocol, so a server indexed alone reports no no_sender for its HTTP routes.
• immich: the 35 events are emitted through immich's own EventRepository and received with its own @OnEvent({ name }) decorator (built on SetMetadata). Since #101 the object's name is read: 44 named events, all 35 emitted ones meet their 86 listeners (before: one event:? endpoint; 20 sampled listener links correct). Its WebSocket gateway only emits (the web client listens through socket.io-client) and its jobs use the same SetMetadata system, so there are no gateway messages or BullMQ jobs to show yet (#32).
• bookstore-nest: order.placed is emitted by ClientProxy.emit and the microservice handler listens to order.shipped; both ends are reported.
• Django signals: the first run reported netbox's post_save[Interface], user_logged_in, request_finished ... as no_sender (10) or test_sender_only (24): Django sends them itself, so a django.* signal nobody in the repo sends is external ("sent by the framework") now, as is saleor's post_migrate. The 10 linked netbox signals are its own (core.signals.job_start, ...) and model signals fired by a resolved model write.
• saleor: the 6 senderless Celery tasks are queued from data migrations (delete_files_from_storage_task, update_discounted_prices_task; migrations are not indexed), by the beat schedule in settings.py (observability_reporter_task) or through a .delay passed as a value (handle_transaction_request_task.delay).
• Socket.IO (first new protocol): tests/protocol_fixtures (a FastAPI service emitting through an AsyncClient, a Django worker with an AsyncServer) links order:created and the template order:{status}, reports the unreceived order:cancelled, the external audit:order and the unguarded ping, and cg path "route:POST /orders" table:orders crosses the two services through SENDS_TO / RECEIVED_BY.

AI harnesses: LLM tools, MCP servers and agents (#66)

cg index with no flags, then cg tools (AI tools). Graphs of projects without these SDKs are unchanged (bookstore-django 207 / 341, netbox 38,028 / 140,181, saleor 43,390 / 210,377 nodes / edges, identical before and after).

What the findings are, from spot checks:

• python-sdk: examples/snippets/clients/stdio_client.py call_tool("add") matches the add tool of three example servers (Demo, Calculator, audited): the client does not name its server, so every server tool of that name is a candidate. Most unmatched client calls went to servers built inside a factory function (examples/stories/*/server.py: def build(): mcp = MCPServer(...) with nested @mcp.tool() handlers) or inside tests. Since #76 these are endpoints received by the enclosing function: MCP endpoints 584 → 955, no_receiver tool calls 30 → 10.
• openai-agents-python: appointment_referral_status_lookup (examples/sandbox/healthcare_support) links the @function_tool handler to the module building the agent; ask_order_agent is offered in a realtime session config whose handler is agent.as_tool() (not modelled). The first run flagged 7 getattr(context, f.name)-style calls in the SDK itself as dynamic dispatch; only runtime tool names (name, tool_call.function.name, ...) count now.
• langchain-ai/langgraph (7dc9195) did not finish indexing within 400 s, before and after this change (deep type inference in the Python plugin); not measured.

External systems (#40)

cg index with no flags, then cg external (External systems). The only graph change is additive: external nodes and their CONNECTS_TO / CONFIGURED_BY / CREDENTIAL_FROM edges; projects without env reads, connections or settings dicts are unchanged.

Fixture (tests/external_fixture): a Laravel API, an Express worker and a Django project sharing db / redis services: after cg link the API's connection:pgsql and the worker's pool() use the same external:postgres:db:5432, and reaches lists OrderController::index and POST /sync. The fixture secrets appear nowhere in the database files.

Seen on the way: column nodes from Laravel migrations differ between two runs of the same commit (a few columns attributed to another table), with or without this change.

Swift: selectors, static vs instance, SDK receivers (#70)

Same stores and sources as for #58 (heuristic edges in the files the store covers, against the compiler's):

Recall goes up because labelled selectors on receivers cg cannot type (client.put(endpoint:), toastCenter.update(id:toast:)) are bound again when exactly one project method fits, also for short names. Precision on isowords moves by two edges: calls of Dictionary.transformKeys, which isowords declares twice (in two modules); cg merges both into one node and the compiler's target is the copy without a node, so these real calls count as disagreements. The Alamofire false positives left (about 50 in the heuristic-only graph, 55 before) are mostly owner differences (HTTPHeaders.init calling HTTPHeader.init) and Apple-only branches.

Dimillian/IceCubesApp (9efcb16, heuristic only, no Linux build), before → after:

• MediaUIAttachmentVideoViewModel.resume: 20 callers → 1 (viewModel.resume()); continuation.resume(returning:) inside withCheckedContinuation is no longer bound.
• MastodonClient.post: the 10 NotificationCenter.default.post(name:object:) calls are gone (64 → 54 edges, all client.post(endpoint:)).
• InAppSafariManager.open: 9 → 1 (safariManager.open(url)); cg platforms divergence missing-callee findings 12 → 4 (the 8 UIApplication.shared.open findings are gone, the 4 left are the project's own close defined per #if).
• Removed 46 call edges, all false (also data.write(to:) → DeepLUserAPIHandler.write, UserDefaults.standard.register(defaults:) → SoundEffectManager.register); added 122 (labelled selectors on untyped receivers, MediaContainer.pending(...) static factories, extension View modifiers on SDK view chains, members of nested types). calls_sdk_selector: 2,132 calls left unbound by the SDK-selector rule.
• cg starters still suggests MastodonClient.get / .post, now with real callers only (76 / 42 direct callers).

Swift Testing, XCTest and Kotlin test cases (#71)

Test cases in cg tests, before → after (before, Swift and Kotlin test functions were test entries but the header counted only test nodes, so every project read "of 0 test cases"; all graphs heuristic, sources at the commits named):

• Swift Testing cases are new (863 on swift-testing, 73 on Alamofire, 25 on IceCubesApp: every uncommented @Test in Alamofire and IceCubesApp). On swift-testing's own suite, 137 are parameterized, 143 types are @Suites and 29 nodes carry tags. Its raw-identifier suites (struct `ABI.EncodedEvent Tests`, @Test func `Decode issueRecorded`()) parse now: 2,831 → 2,953 nodes and 6,952 → 7,159 edges. 59 functions that a parse error had turned into free functions are methods of their suite again. The @Test lines still missing are an @Test inside #if in front of its function and a few declarations the grammar cannot read.
• XCTest: 3 test* methods are no longer test cases, all helpers with parameters (IssueTests.testThrowing(_:producesIssueMatching:), BuiltInConformances.test(_:) on swift-testing, TimelineFilterTests.testCodableOn(filter:) on IceCubesApp). No other test case was lost, on any project.
• Alamofire cg tests Instant: 0 direct, 7 transitive (of 0 test cases) → 3 direct (the three InstantTests cases), 8 transitive (a Swift Testing RequestInterceptorTests case joins the XCTest ones), of 834.
• Kotlin numbers are unchanged; they now have a framework from the file's imports. Kotlin @Test lines without a test case: benchmarks in src/main (nowinandroid, not test code by path), @Test inside lint-test source strings, and on ktor-samples 30 expression-bodied tests (fun anything() = testApplication { ... }) in three httpbin files where the Kotlin grammar drops the class body's functions.

Python inference on self-referencing attributes (#78)

langchain-ai/langgraph (7dc9195, 461 .py files) did not finish indexing in 400 s. PregelLoop re-assigns self.checkpoint_pending_writes from list comprehensions over itself, several per method with one shared loop name w; inferring the attribute re-entered it once per binding of w at every level, with a fresh per-function guard each time, until the depth limit of 40, so the work grew exponentially. Attribute types (self.x assignments and class attributes) are now memoised per class and attribute, an attribute already being inferred further up the stack is unknown, and one top-level inference stops after 5,000 steps. A result computed while a cycle was cut is not memoised, so a partial answer is not reused elsewhere. The plugin stats report the cuts as inference_limits (attr_cycles, budget_exhausted).

• langgraph: indexes in 14 s, 9,774 nodes / 38,141 edges, 34 cycle cuts, budget never reached.
• The same graphs before and after (every node and every edge with kind and confidence identical), and times within noise or faster, on django (259 cuts), flask, saleor, netbox (186; 39 → 29 s), pytest (372), sphinx (20), ansible (9; 21 → 16 s), beets, flake8, httpie, microblog, mkdocs, pylint (17), opentelemetry-python (1,075) and full-stack-fastapi-template. The work budget was not reached on any of them.
• tests/test_python_infer_cycles.py has the langgraph shape in a dozen lines: it indexed for more than 60 s before (stopped by the test's alarm) and takes 0.2 s now.

Laravel graphs independent of the hash seed (#79)

A property read on a receiver that can be several Eloquent models, in a ?? fallback chain, took the table of the first model a set iteration produced, so two indexes of one commit could differ (in the issue's repro, seed 3 picked incomes where seeds 1, 2, 4, 5, 6 picked expenses). Each such step now has one FALLS_BACK_TO edge per candidate model's column, all with the step's order, ambiguous: true and candidates; the candidates are those whose migrations declare the column, else those whose table the migrations create. A single-model read is unchanged.

Every graph below indexed under PYTHONHASHSEED 1 and 2 is identical (nodes, edges, attributes), and against the previous version only the multi-model steps changed:

tests/test_laravel_determinism.py indexes the issue's fixture under two seeds that differed before and compares the whole graph.

Raw TCP / UDP sockets and UDP application protocols (#39)

Socket and UDP-application edges on the corpora that use them (indexed at the commits shown):

tauri gains one edge, the CLI's built-in dev server listening on its default port 1430 (port.unwrap_or(1430)). No edge changed on redis, httpie, flask, opentelemetry-python, the MCP python-sdk and servers, electron-fiddle, alacritty, ktor-samples, django, netbox, immich, outline, saleor, element-x-ios, eslint and ansible (whose SSH_AUTH_SOCK Unix-socket paths are not TCP ports). A random 20 of the new edges were checked by hand against the source: 20 correct (an earlier sample of 20 found a wrong / path for a concatenated CoAP URI, fixed before this one). tests/test_sockets.py covers each language on tests/sockets_fixture and the BSD / libuv C calls on tests/sockets_c_fixture.

gRPC services from .proto contracts (#33)

gRPC edges on the example trees of the gRPC implementations and on the OpenTelemetry demo (indexed at the commits shown; "paired" endpoints have both a server and a client in the graph):

No edge or node changed on the 20 corpora checked for #39 (electron-fiddle, immich, saleor, django, flask, httpie, outline, eslint, mcp-servers, netbox, opentelemetry-python, python-sdk, python-zeroconf, tauri, alacritty, redis, aiocoap, ansible, ktor-samples, element-x-ios). A random 20 of the gRPC edges above were checked by hand against the source: 20 correct. tests/test_rpc.py covers Python, Node / TypeScript, Connect, tonic and Kotlin on tests/rpc_fixture (including two packages with a RouteGuide service each) and grpc++ on tests/rpc_cpp_fixture.

Thrift, tRPC and JSON-RPC (#33 part 2)

On the 20 #39 corpora the only change is in tauri: the CLI's jsonrpsee options method (register_method, heuristic) and the three client.request("options", ..) calls that reach it, all correct; the JSON-RPC scan skips MCP files, so mcp-servers and python-sdk are unchanged. On the gRPC corpora above only the connect-es top-level clients changed (6 SENDS_TO, 1 TEST_CALLS from module nodes). A random 20 of the new Thrift / tRPC / JSON-RPC edges were checked by hand: 20 correct. tests/test_rpc.py covers Thrift (Python, Node, C++), tRPC (inline, nested, imported, procedure-variable mounts and clients) and JSON-RPC (jayson, jsonrpcserver, payloads, jsonrpsee) on the same fixtures.

C/C++: file-level macro statements and lock annotations (#131)

A file-level ABSL_FLAG(..); made tree-sitter-cpp read a function definition that ran to the next }, swallowing the class after it. Thread-safety annotations after a declarator (void Write() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_) {) became the declarator. Both are now blanked before parsing. Heuristic types and unique-name member calls stay within the files a caller can see, and the classes of separate programs (a main() per file) are not variants. Before -> after on the C/C++ corpora (heuristic mode):

A random 20 of the added edges were checked by hand against the source: 20 correct. The removed edges were spot-checked by group (the cross-program USES_TYPE / USES_VALUE mirrors and the .str() / .size() / handler guesses were all wrong before), except the 22 leveldb calls above.

GraphQL root fields (#34 part 1)

The 20 #39 corpora are unchanged except netbox (the 5 TEST_CALLS above and 1 endpoint at snapshot time; 260 endpoints with the final strawberry-django rule). A random 20 of the new edges across these corpora were checked by hand against the source: 20 correct. An earlier sample found per-test query = """...""" locals bound to the first one in the file; the binding now prefers the calling function's own assignment, then module level, then an import. tests/test_graphql.py covers the document parser, SDL, resolver maps, Apollo clients, a codegen hook, Nest twins in cg protocols, graphene, strawberry, ariadne and Python clients on tests/graphql_fixture.

Job queues: Celery, RQ, Dramatiq, Bull, Laravel, Messenger (#36)

The other 17 #39 corpora are unchanged (same nodes and edges; immich's BullMQ wrapper is a follow-up), and no corpus loses an edge. In saleor, netbox, flask and microblog the only entry rows added are those of the new endpoints. authentik's actors are new message_handler entries, so the entry counts of the code they reach change. A random 20 of the 320 new edges were checked by hand against the source: 20 correct (actor and task definitions, .send / send_with_options / actor= call sites, test sends). For part 2, a random 20 of the 476 new edges of pixelfed, outline, laravel.io and koel were checked: 20 correct. An earlier part-2 sample found a twin for a laravel.io App\Jobs class without ShouldQueue (a synchronous job); twins now need ShouldQueue. The queue edges were first RECEIVED_BY. On pixelfed that let an http route reach every job of the queue it sends to, and changed 5,485 entry rows; QUEUE_ROUTES does not propagate, and the entry rows are now unchanged. tests/test_jobs.py covers the cross-repo cases on tests/jobs_fixture:

• a Flask shop's send_task("billing.charge") links to the billing worker's task with cg link, while billing.refund stays no_receiver;
• a task_routes queue missing from the Procfile's -Q is no_consumer;
• RQ import paths and an f-string template resolve to the mailer repo's functions at link time;
• the compose rq worker / dramatiq -Q consumers are found;
• Django twins keep their DISPATCHES.
• a BullMQ emails.add("welcome") links to another repo's new Worker("emails", fn) through the emails:{name} template;
• Laravel $queue / ->onQueue() sends and Horizon consumers;
• Symfony Messenger handlers, messenger.yaml routing and messenger:consume workers.

Message brokers: Kafka, AMQP, Redis, MQTT, NATS (#35 part 1)

The other #39 corpora are unchanged: immich, opentelemetry-demo, aiocoap, alacritty, ansible, authentik, django, electron-fiddle, element-x-ios, eslint, flask, httpie, koel, ktor-samples, laravel.io, mcp-servers, microblog, netbox, opentelemetry-python, pixelfed, python-sdk, python-zeroconf, redis, saleor and tauri, and so is invoiceninja. opentelemetry-demo's Kafka producer is Go and its consumer Kotlin (part 2). A random 20 of the 95 new edges of the tutorial, example and outline rows were checked by hand against the source. In the first sample, 2 were wrong: a nested def callback in receive_logs.py and receive_logs_direct.py resolved to the same-named function of worker.py. A handler in another file is now taken only when it is imported. In a second sample, after the fix, all 20 were correct. tests/test_brokers.py covers tests/brokers_fixture:

• a TS orders API producing to Kafka (enum topic, sendBatch, env default), a topic exchange, the default exchange, Redis, MQTT and NATS request;
• a Python fulfilment worker consuming them (confluent-kafka with group and imported constants, a pika server-named queue bound with order.eu.*, redis-py subscribe(**{ch: handler}) and psubscribe, paho on_message, nats-py queue group);
• a Laravel notifier (Redis::publish(self::CHANNEL), Redis::subscribe, php-amqplib);
• the cg link of the API and the worker (order.{region}.created -> order.eu.* heuristic, stock.check.{sku} -> stock.check.*, orders.cancelled no_receiver).

Message brokers: Kotlin and Rust clients, Spring listeners (#35 part 2)

The Rust examples of nats-by-example were copied into one crate (src/bin/<example>.rs) for indexing. The other Kotlin and Rust corpora have no broker clients and get no broker edges: KaMPKit, nowinandroid, spring-petclinic-kotlin, element-x-android, bitwarden-android, grpc-kotlin, ktor-samples, tokio, tonic, mini-redis (its own client crate is not taken for redis-rs), jsonrpsee, ripgrep, clash-verge-rev, alacritty and tauri. The part 1 corpora (JS / TS, Python, PHP) are unchanged as well. A random 20 of the 103 new edges of the tutorial, nats-by-example and fraud-detection rows were checked by hand against the source; all 20 were correct. tests/test_brokers.py adds:

• a Kotlin / Spring billing service: @KafkaListener with groupId, @RabbitListener with a QueueBinding on a topic exchange and with queues, KafkaTemplate.send(Topics.INVOICES), basicPublish to a getenv ?: "d" exchange, a jnats publish with a ${x} template;
• a Rust ledger: lapin basic_publish with format!, a queue.name() binding, rdkafka subscribe(&[topic.as_str()]) with env::var(..).unwrap_or_else(..);
• the cg link of the two (billing.invoices linked).

Plain JavaScript without tsconfig / jsconfig (#136)

Unchanged (same nodes and edges): django, sphinx, koel, thrift, full-stack-fastapi-template (other-language roots whose package.json only carries tooling or a frontend workspace), and statsd, jayson, kafkajs, eslint, cordova-toast, capacitor-plugins, create-t3-turbo, ws, express and amqplib, which one of the earlier rules already picked up. A scan of every corpus root finds no other project that the new rule adds. A random 20 of the 1,909 edges added in request and node-gyp were checked by hand against the source. 15 were correct and 1 was imprecise: request.get(..) resolves to request, because get is assigned at run time. 4 were wrong, all from one pattern the JS extractor already had: a variable that holds a call with a callback (var server = http.createServer(function (req, res) {..})) becomes a function node, and its later uses (server.url, s2.listen(..), return l) are recorded as calls of it. A jsconfig-configured index gives the same edges; the pattern is tracked in #138. tests/test_plain_js.py covers tests/plainjs_fixture: a CommonJS app (functions, require calls, a mocha test, an amqplib endpoint; its webpack.config.js is ignored), an ESM library ("type": "module", exports), and a Python project with a tooling-only package.json, which gets no JS program.

Socket.IO in JS / TS (#32 part 1)

Unchanged (same nodes and edges): ws, express, request, node-gyp, mocha, pino, nodemailer, amqplib, kafkajs, jayson, commander.js, electron-fiddle, nestjs-boilerplate, node-express-boilerplate, zigbee2mqtt, mcp-servers, elk, grpc-node, opentelemetry-demo, create-t3-app, saleor-dashboard, mattermost-mobile, social-app, cal.com and full-stack-fastapi-template. No edges were removed anywhere. A random 20 of the 154 new JS / TS edges in the five projects above were checked by hand against the source, and all 20 were correct. They include multi-line socket.on(\n "event", ..) calls, a WS_EVENTS.USER_FOLLOW_CHANGE constant, wrapper sends with their room argument, and immich's server-to-server server.on('AppRestart'). tests/test_realtime.py covers tests/realtime_fixture: a server with a namespace, middleware, rooms, an ack, a template event, an emit wrapper and a net socket that is not Socket.IO; a socket.io-client app with chained listeners; and a Nest gateway with a guard. Both pairs are linked with cg link, and a python-socketio server created under a module-level if is also covered.

WebSocket connections and SSE (#32 part 2)

Unchanged (same nodes and edges): ws, express, immich, excalidraw, excalidraw-room, authentik, tauri, gen, python-sdk, langgraph, httpie, invoiceninja, firefly-iii, opentelemetry-demo, mattermost-mobile, elk, social-app, saleor-dashboard and cal.com; clash-verge-rev differs only in Rust edges from the rust-analyzer index (no JS / TS change, its ws use is in an unindexed scripts/perf/). No edges were removed anywhere else. A random 20 of the 56 added edges and changed routes in the projects above were checked by hand against the source, and all 20 were correct; three are open-webui proxy routes that answer SSE only when the upstream or the stream flag asks for it. tests/test_websockets.py covers tests/ws_fixture: a ws server with a path, one on a port with an inline handler, a noServer server behind an upgrade prefix check, express-ws on a mounted router, @fastify/websocket and Hono WS routes, express / Hono / FastAPI SSE routes (and two that only look like it), python websockets.serve, and a browser client using WebSocket, ReconnectingWebSocket, EventSource and fetchEventSource, linked with cg link.

Webhook receivers (#37 part 1)

No receiver in vito (its routes are spatie/laravel-route-attributes #[Post] attributes, which give no routes yet), outline (the GitHub hook is a plugin router.post("github.webhooks", ..) RPC route, not indexed as a route), cal.com (no Stripe receiver in this checkout; its webhooks are outbound), firefly-iii, pixelfed, koel, open-webui, saleor (payment-plugin hooks are dispatched by plugin id at run time), authentik, nest, librenms, akaunting, UNIT3D, panel, netbox, monica, laravel.io, solidtime or express; their graphs are unchanged. Coolify's Sentinel route reads X-GitHub-Event only through auditLogWebhookFailure, a logger called from many functions, so it is not a receiver. No edges were removed anywhere. A random 20 of the 51 new edges and route markers in coolify and invoiceninja were checked by hand against the source, and all 20 were correct; one is a branch helper (webhookPushMatchesWatchPaths for github:push), which runs only for that event but is not its handler. tests/test_webhooks.py covers tests/webhooks_fixture: Express, FastAPI and Laravel receivers for Stripe, svix / standardwebhooks, GitHub (HMAC and @octokit/webhooks), Twilio, GitLab and a generic HMAC hook, verified and unverified, with switch / if / PHP match event dispatch and the cg routes markers.

Webhook senders (#37 part 2)

No sender in the other 18 projects, and no receiver edge changed anywhere. Two false positives found on the way were fixed before this run: librenms' Kayako transport (a signature form field of an API call, not a header) and request headers read with headers['X-Sig']. Not seen: saleor (its signature header is the constant SALEOR_SIGNATURE_HEADER), invoiceninja and coolify (their outgoing webhooks are unsigned; invoiceninja adds the subscriber's own headers). All 10 new edges (the 5 above and the fixture's 4 sends plus the cg link pairing of hooks-ts order.created with the hooks-py/hooks/acme receiver) were checked by hand against the source, and all 10 were correct. tests/test_webhooks.py covers svix, spatie/laravel-webhook-server and hand-signed fetch / requests senders, event names from a caller's argument, and the pairing.

Dart isolates (#38 part 3)

Unchanged: flutter-samples, dart_style and grpc-dart. All 13 new edges were checked against the source and were correct; reviewing them found the StreamQueue(port) reader and test-only isolates, both handled before landing. tests/test_dart_isolates.py covers tests/isolate_fixture.

Child processes, worker_threads and Android exposure (#38 part 3)

No edge was removed anywhere. Unchanged: electron-fiddle (its utilityProcess sample sits in static/, which is not indexed), socket.io (cluster.fork() is not linked), pino and mocha (their forks are in tests), and supervisor, mini-redis, tonic, beets, httpie, python-zeroconf, libuv, redis, tokio, flask, express, nodemailer, ws, jayson, request, panel, tauri, ktor-samples and capacitor. All 9 new edges outside the fixture were checked against the source and were correct. Reviewing the guards found launcher activities flagged unguarded, so they are now left unchecked. tests/test_process_ipc.py covers tests/process_ipc_fixture (Python -m, Node spawn / fork, Electron utilityProcess, fork messages both ways, worker_threads, a spawn in a test that stays a test call).

Android intents and AIDL (#38 part 3)

No edge was removed anywhere. Unchanged: KaMPKit, capacitor, ktor-samples, spring-petclinic-kotlin, grpc-kotlin and the 20 part 2 corpora run again (supervisor, mini-redis, tonic, beets, httpie, python-zeroconf, libuv, redis, tokio, pip, flask, express, nodemailer, ws, jayson, request, mocha, electron-fiddle, panel, tauri). Reviewing two random samples of 20 found these errors, all fixed before landing: mockk every { } / verify { } stubs counted as AIDL calls, a service whose onBind only returns null received at onBind, manifest receivers recorded at the Kotlin handler's line instead of the <action> line, consuming calls opened on an earlier line (PendingIntent.getActivity(\n ctx, .., Intent(..))) and PendingIntentCompat missing from via, and ComponentName(pkg, name) values built for an assertion or a Robolectric package-manager shadow taken as sends. After those fixes, a third random 20 of the new edges were checked: 19 were correct and one had a wrong via, read from a comment (// ... handles setResult/finish); consuming calls now skip comments, strings and coroutine launch { } blocks, and that edge reads launch(mainIntent). The authenticatorbridge client's calls inside ServiceConnection callbacks come from the class (heuristic): the Kotlin extractor gives the anonymous object's onServiceConnected and the private onServiceConnected(binder) one id. tests/test_android_ipc.py covers tests/android_ipc_fixture (an app module with a manifest, services, receivers and an AIDL Stub, and a client module binding to it by ComponentName(pkg, CONST)).

Unix sockets, named pipes / FIFOs and D-Bus (#38 part 2)

No edge was removed anywhere. Unchanged: supervisor, redis, ansible, pip, opentelemetry-python, authentik, immich, open-webui, mini-redis, alacritty, beets, httpie, python-zeroconf, tauri, panel, coolify, express, flask, ws, electron-fiddle, jayson, openai-agents-python, request and mocha. Where these projects use Unix sockets, the path is known only at run time: supervisor, redis and alacritty read it from configuration or the command line, ansible derives it from a connection hash, and authentik's Rust server connects to gunicorn through fn socket_path() -> PathBuf { temp_dir().join("authentik.sock") } while gunicorn's bind is set in its config. These calls are counted under unix_path_unknown (alacritty 4, supervisor 5, ansible 4, authentik 7). Four errors found while reviewing the zbus output were fixed before landing: fns nested in an interface method were taken as members, property setters became SetX members, r#match became R, and interfaces inside mod tests counted as application code. After those fixes, a random 20 of the 98 new edges then in libuv, tokio, tonic and zbus were checked by hand against the source, and all 20 were correct (tonic's GreeterClient::connect edge came later and was checked too). tests/test_local_sockets.py covers tests/local_sockets_fixture (Python socket / asyncio / socketserver / gRPC, Node net / http, Rust std / tokio / tonic / zbus, a FIFO and a named pipe, dbus-next) and tests/local_sockets_c_fixture (sockaddr_un + bind / connect).

Local IPC in JS / TS (#38 part 1)

No edge was removed anywhere. Unchanged: tauri, mattermost-mobile, socket.io, authentik, mkdocs, invoiceninja, vito, pixelfed, panel and express. In tauri and mattermost-mobile the postMessage calls are window.__TAURI_INTERNALS__ / window.ipc / React Native WebView bridges (cg bridges); authentik's web/ is a separate project from its Python root. Two errors found in the hand-check were fixed before landing: a port:* connection matched a * message listener (ports now match only port: listeners), and a type guard (isWidgetResizeAction(event.data)) was taken as a handler (callees named is* / has* / can* / should* / check* / validate* are skipped). Also fixed: this.#onmessage = h fields and typeof data.type !== 'string' are not listeners or types. A random 20 of the 210 new edges in the batch were checked by hand against the source: 18 correct and the 2 above wrong. tests/test_local_ipc.py covers tests/local_ipc_fixture: workers both ways (and through a getter), comlink, a service worker, BroadcastChannel, postMessage with and without an origin check, extension messages with literal and enum types, ports and a native-messaging host manifest.

Socket.IO and WebSocket in Dart / Kotlin / Swift / Rust (#32 part 3)

Rust routes now carry uri / method: tauri's 7 and authentik's 12 axum routes, with no edge change (authentik's /outpost.goauthentik.io/auth/envoy{*rest} becomes .../envoy{rest*}). Unchanged (same nodes and edges): swift-isowords, swift-Alamofire, flutter-samples, grpc-dart, http, nowinandroid, KaMPKit, element-x-android, grpc-kotlin, spring-petclinic-kotlin, element-x-ios, swift-template, bitwarden-ios, authentik, tokio, mini-redis, jsonrpsee, tonic, parity and alacritty. No edges were removed anywhere except the 11 moved ktor-samples calls and reads. A random 20 of the 25 added edges in the projects above (not counting the moved ones) were checked by hand against the source, and all 20 were correct. tests/test_realtime_native.py covers tests/sio_native_fixture: a socketioxide server with a namespace and a room, a rust_socketio bot, Dart, Kotlin and Swift clients with acks, string templates and constants, Ktor / Vapor / axum WebSocket routes, and Ktor, OkHttp and URLSession WebSocket clients.

JS callback variables, property reads and returns (#138)

Call edges are CALLS, TEST_CALLS and RENDERS, counted by (kind, source, target, line), before -> after.

Unchanged: node-gyp, commander.js, capacitor-plugins, breeze-nuxt, examples-es and fullstack-tutorial (styled('img')(fn) stays a component). ws, pino, amqplib, kafkajs, nodemailer, express, nest, elk, mcp-servers, electron-fiddle, open-webui, excalidraw-room, create-t3-turbo, cordova-toast, statsd and capacitor lose 2 to 30 edges each, from the same patterns. A random 20 of the 2,380 changed call edges in ten of these projects were checked by hand against the source: 16 removed and 4 added. 19 were correct. They include six displayName / PreviewProps writes, a zod schema, an array result of .map(cb), s.url on a server, vi.hoisted(() => ({..})), a Mocha.prototype write, and callbacks' calls moved to their module. One added edge is in a minified bundle (socket.io.min.js) and could not be checked. tests/test_js_refs.py covers tests/jsref_fixture: a factory callback, a wrapper, expando assignments, return l and test-file reads of a server.

XPC and Darwin notifications (#38 part 3)

exelban/stats (shallow clone): 1 service (eu.exelban.Stats.SMC.Helper, SMCHelper.helperConnection -> Helper.listener), HelperProtocol with 6 methods all received by the privileged Helper, and 7 proxy calls in Kit/helpers.swift; 15 new edges, all hand-checked. Three self.setFanMode / self.uninstall calls on SMCHelper's own wrappers were false positives before calls on self / super were skipped. No corpus here posts Darwin notifications; that path is covered by tests/xpc_fixture only. Swift regression set (swift-template, Alamofire, Kingfisher, SwiftUIX, isowords, IceCubesApp, bitwarden-ios, element-x-ios): no node or edge changes.

Prisma datasources as external systems (#41)

umami-software/umami (shallow clone): the postgresql datasource's url is in prisma.config.ts (env('DATABASE_URL')), so the system stays external:postgres:env:DATABASE_URL (docker-compose sets the URL in the service environment, not an .env.example). 26 new CONNECTS_TO edges, one per @@map table, all checked against the schema; impact on the system goes from 429 callers / 198 entry points (the code reading DATABASE_URL) to 564 / 203 through the tables, and 5 sampled new callers (getTeamWebsiteCount, updateTeamUser, updateReplaySaved, canViewBatchWebsites, the 2FA setup POST) all call prisma.client.<model> directly. The other Prisma schemas in the corpora are sqlite (nest 22-graphql-prisma) or outside the indexed app (cal.com's packages/prisma, read by apps/web and apps/api/v2 through a workspace package), so they add nothing; no node or edge changes on the regression set.

TypeORM, Drizzle and Kysely as external systems (#41 step 2)

immich-app/immich server: 76 tables gain attrs.system and CONNECTS_TO external:postgres:env:DB_URL (via: sole postgres system) — 16 from @immich/sql-tools @Table (now recognised alongside sequelize-typescript) plus 60 from Kysely selectFrom / insertInto (orm: kysely). @Table also adds CONTAINS column edges from the schema decorators. impact on the system goes from 211 callers / 318 entry points to 1329 / 341; 5 sampled depth-2 callers (withSharedBy, withMetadata, updateThumbnailBuilder, checkSharedLinkAccess, ApiKeyRepository.update) all query through Kysely. nestjs-boilerplate: 5 @Entity tables attach via the new DataSource({ type: process.env.DATABASE_TYPE, url: process.env.DATABASE_URL }) in src/database/data-source.ts (via: typeorm datasource default); Mongoose @Schema collections stay out. koel (Laravel tables without an ORM tag) and outline / create-t3-turbo / solidtime: no node or edge changes.

Laravel tables, PHP PDO and Spring datasources (#41 step 3)

koel: 35 migration / Eloquent tables CONNECTS_TO external:mysql:env:DB_HOST through connection:mysql (via: laravel connection); inferred aliases (information_schema.*, *_new) stay unattached. impact on the system reaches 396 callers / 127 entry points. pixelfed: 135 tables the same way. spring-petclinic-kotlin: application-mysql.properties jdbc:mysql://localhost/petclinic becomes external:mysql:localhost:3306 (literal password location recorded, value not stored); 4 Spring Data tables (owners, pets, vets, visits) attach; the default H2 profile is skipped. outline and nestjs-boilerplate: no node or edge changes. shop-api fixture: table:orders -> default pgsql, table:reports -> the model's $connection = reporting.

Redis key prefixes and Elasticsearch indices (#41 step 4)

attrs.key_prefixes on redis externals and attrs.indices on elasticsearch externals, from call-site keys / f-string and template prefixes, Django KEY_PREFIX, and ES index / index-prefix defaults. Shown by cg external.

Edge-only ddiff is silent for this step (attrs only). Leftover FPs / missed helper-only keys -> follow-up.

pydantic-settings broker field defaults (#157)

settings-bus fixture: Settings.events_topic = "events" / jobs_queue = "jobs" / Field(default="audit.orders"). producer.send_and_wait(settings.events_topic) and consumer.subscribe([settings.events_topic]) share endpoint:kafka:events; default_exchange.publish(..., routing_key=settings.jobs_queue) pairs with declare_queue(settings.jobs_queue) + consume on endpoint:amqp:queue:jobs. self.settings.events_topic on a wrapper class resolves the same way.

Broker helper parameters and consumer constructor topics (#137)

settings-bus TaskQueue._publish(queue, ...) with callers passing module constants: five / two AMQP queue sends from the helper; AIOKafkaConsumer(settings.events_topic, group_id=...) is a kafka receive (no separate .subscribe needed).

Third-party HTTP hosts as external nodes (#42 part 1)

http nodes with origin_kind other become external:http:<host>:80 / external:https:<host>:443 (or the explicit port) with CONNECTS_TO (via http). Loopback, templates, and test-only callers stay out. https-client fixture: GitHub + Slack (https) and httpbin (http). outline: updates.getoutline.com. cal.com / saleor / open-webui / immich server: no app-called other-origin hosts in this pass (same-origin / unknown / none). Query-time https adapter removed; cg link still skips other-origin URLs.

Cloud / SaaS SDKs as external nodes (#42 part 2)

SDK construction and operations become resource nodes (external:s3:<bucket-or-env>, external:gcs:…, external:azure-blob:…, external:aws:<service>[:resource], external:saas:stripe, external:llm:<provider>). Fixtures: s3-py (PutObject + ambient creds, explicit keys, SQS, Secrets Manager), gcs-py, azure-py, stripe-py, openai-chat, laravel-disk, django-storages. Test-only callers and HTTP hosts already attached as external:http(s) are not duplicated.

Attack surface (#47)

Run of cg index and cg surface --format json on shallow clones of the default branch (October 2026), indexed in full unless noted. Clone shas: juice-shop 1618a61, DVWA 088256f, NodeGoat c5cb68a, netbox 726a2bb, saleor bb75f87, outline 6e6eaf6, nextcloud/server 21bf334 (whole repo), ansible bf2610e (whole repo), plus for #42 calcom/cal.com 54343aa (web app only, as before), appwrite 8a47c4b, open-webui 8bd8b4f, documenso a166cab. Each finding was compared with the cited source line: TP is the finding as described, FP is a route that is public by design or guarded in a way the index does not see, or text that is not code, unclear needs a decision from the owner (an opt-in switch, a check in another file). Up to 20 findings per type per corpus were sampled (seeded random sample, all when fewer). The counts below are from the tree after the precision fixes of this pass; the "before" figure is the same corpus on 871328e.

Recall on the vulnerable apps

Items are the ones each project documents for the types cg covers (hardcoded credentials, plaintext, TLS off, SSRF, unguarded routes). Nothing is counted that the project does not document.

Found 2 of 11 documented items. The vulnerable apps document few items of the covered types, and most of those depend on code shapes the index does not model (see Known limitations).

Precision by finding type

A number in brackets is the count before this pass. appwrite had one ssrf and documenso one, both false positives that are fixed here; ansible and open-webui lost one or two tls-off that were text, not code (see below).

Notes from the sampled checks:

• unguarded is the noisiest type (counts above are from part 2c; part 2d below has the new ones). The false positives have four causes: routes that are public by design (health, robots, share links, login, jwks, static, OAuth token endpoints); a check inside the handler (a session lookup, a cron key, a getServerSession call, tRPC procedure middleware) that is not a guard fact; a framework-wide default set in settings (a DRF DEFAULT_PERMISSION_CLASSES that applies to every route of one corpus, so all of its sampled findings are false positives, most from router registrations); and Socket.IO events whose auth is checked at connect or in the first lines of the handler (7 of 13 sampled handlers in one corpus). NodeGoat's session() middleware is read as an auth guard, so its /login and /signup routes show as guarded (fixed in part 2d).
• tls-off: 4 of 4 sampled true positives in one corpus (pattern: an opt-in branch that switches certificate verification off for a database, mail or cache client); two corpora have 5 sampled findings in total that are unclear (verification is off only when the user switches validation off).
• ipc-exposed: 25 of 25 sampled true positives, all one pattern class (a wildcard target origin in postMessage). Whether the data sent is sensitive was not judged.
• hardcoded and plaintext: one corpus, 2 findings from example env files (a placeholder DSN, a compose service name); both are by design for example files.
• Precision fixes made in this pass (each has a regression case): from ssl import CERT_NONE, docstrings and module documentation string blocks no longer match tls-off; a derived URL variable keeps its part (a template that appends a path to a base URL returned by a call is a path, not a whole URL); a value wrapped in realpath / basename / intval / (int) / parseInt / Number / int / float is no longer a URL; a template that starts with the tainted piece (`${id}/x`) is a whole URL; and an index run that crashed on a destructured parameter (const { url } = obj) now completes. One ssrf false positive remains: taint that passes through the result of a call that gets the input only as an argument.
• Follow-ups, not fixed: guards inside handler bodies and framework defaults (above); taint through call results; getenv('X') ?: 'literal' and config-object literals as hardcoded; http.createServer as plaintext; file-per-page PHP routes; a role check as a guard; the exact items in the recall table. Listed in Known limitations.

Part 2d: unguarded precision, index time, fingerprints

Same clones as above (base 2542c89, which equals origin/main when this pass ran), indexed in full with cg index into a fresh database for the "before" (2542c89, in a separate worktree) and the "after" (this change), and read with cg surface --finding unguarded --format json. The "sampled" column is the full list when it has 20 or fewer entries, a seeded random sample of 20 otherwise (seed 47), so every finding below was classified. TP: no guard and no check, as described; FP: public by design or guarded in a way the index does not see; unclear: depends on a setting or a check in other code.

The 2c table above reports 858 for netbox; recounting the clone used here on 2542c89 gives 199, which is the "before" number in this table.

Target: precision of at least 60% or a cut of at least 80% on netbox, outline and the cal.com web app. Met by the cut on all three (97.5%, 82%, 82%). Not met by precision: no TP remains on those three, because what is left is public-by-design, checked in code the index does not read, or depends on a setting, and no sampled finding on them was a missing guard. The remaining findings are low severity except saleor's three plugin webhook dispatchers, which stay medium (no guard, no recognised check, a write is reached; each plugin verifies its own request).

Recall on juice-shop's four true positives (all sampled before and after, server.ts):

All four are still reported, so there is no recall loss; their severity falls to low because none reaches a database write the graph can see (file system writes are not writes in this model). The two security.txt routes (public by design) are no longer reported. NodeGoat's two new findings are tutorial pages: they appear because an Express session() middleware is no longer read as authentication, so routes with only session() in front of them are now unguarded (low) where they used to be guarded.

What caused the cuts: framework defaults (DRF REST_FRAMEWORK default permission classes, Laravel global and group middleware, Nest APP_GUARD and @Public()), the public-by-design route list (Attack surface), checks at the top of a handler or of a Socket.IO connection, Express app.use(auth) ordering and mount path, and a DRF permission_classes = [] taken as explicit public access. --strict keeps route-level guards only: on netbox it reports 200 (199 before; one route that only session() guarded) and on outline 28, unchanged.

Index time against 8172833 (outline and the cal.com web app, three alternating runs, each run a fresh cg index from a separate worktree outside the repository; "before" is 8172833, "after" is this change). The profile on cal.com web app before the change put ssrf_input.apply at 5.7 s and insecure_transport.apply at 1.3 s of a 17.2 s profiled run. Fixes (output unchanged): ssrf_input skips files and functions that contain no sink text, insecure_transport checks one lowercase substring list per file before running its 35 regexes and finds the client library only when a rule matches, and the SDK file prefilter in sdk_systems lowercases the text once instead of two re.I scans. After the change on cal.com web app: ssrf_input.apply 0.6 s, insecure_transport.apply 0.6 s.

The box is shared and its speed drifted between sessions. Earlier complete sets, taken on slower periods, are in the same range but noisier (outline before / after: 41.15 / 43.04 s with the first two fixes only, 30.09 / 35.46 s and 38.29 / 40.90 s with all of them; cal.com web app: 14.23 / 17.49, 12.70 / 14.02 and 16.44 / 16.09 s). The target is at most +10% against 8172833; the last alternating set meets it, and the noisy sets show the error of one run is larger than the margin.

Output check, cg surface --format json on outline, cal.com web app, open-webui and documenso, with the guard change held fixed (commit before the speed-up vs after): ssrf, tls-off and ipc-exposed findings are identical in all three types on all four corpora (outline 0 / 4 / 1, cal.com web app 0 / 1 / 2, open-webui 4 / 2 / 2, documenso 0 / 0 / 28), as are the node and edge counts and every attr that holds an insecure_transport, url_from_input or tls_verify fact. The only graph change comes from the SES v2 work: documenso gains external:aws:ses and 4 CONNECTS_TO edges (below).

Mail (#42), documenso re-run: the SES v2 identity commands (CreateEmailIdentityCommand, GetEmailIdentityCommand, DeleteEmailIdentityCommand from @aws-sdk/client-sesv2) are now recognised: 1 new external node and 4 CONNECTS_TO edges, one from each of the 4 functions that call them (checked against the source). The nodemailer SES and Resend transports are recognised too, but documenso uses neither with a transport the extractor can resolve, so they add nothing there.

Fingerprints: a marker is redacted:hmac:<8 hex>, keyed by a per-graph salt in meta redact_salt, so a common password no longer gives a known value (the unsalted marker of password was 5e884898) and the same value in two different graphs gives different markers.

Redaction check

Values counted are strings containing redacted:sha256: in any node or edge attr, and in doc after the fix below.

All values of saleor, ansible and nextcloud were checked and are credentials in test data, so no wrong redaction there. No *_PASSWORD / *_SECRET default or DSN password from a sampled source file is stored verbatim (a test-settings password in one corpus, the NodeGoat cookieSecret / cryptoKey, and DVWA's p@ssw0rd do not appear in the database; a scan of every string attr of every corpus for scheme://user:pw@ and for literals under a credential-named attr found none). Found and fixed: an example DSN with a placeholder password in a doc comment (one corpus) was kept in the doc column, which the sweep did not cover; the sweep now replaces URL passwords there too. Fixed in part 2d: the marker was an unsalted 8-hex SHA-256 of the value, so a common password (password gave 5e884898) could be recognised from it; it is now a keyed HMAC with a per-graph salt (redacted:hmac:). The counts above were taken with the old redacted:sha256: marker.

Mail / SMS / push / infra SDKs (#42 parts 3a and 3b)

Δ of external nodes and CONNECTS_TO edges for mail, SMS, push, Firebase, Kubernetes, Docker and key-management systems, on 8172833 (before 3a) and 871328e (after 3b, same code as the attack-surface runs above). Both indexed from a separate worktree.

No corpus gains an external node or a CONNECTS_TO edge from 3a or 3b, so the requested hand check of at least 10 new edges could not be made. The same harness does detect them: tests/external_fixture/mail-sms-py has 0 external nodes on 8172833 and 5 on 871328e. Reasons found by reading each corpus:

• outline and saleor send mail through plain SMTP (external:smtp:env:SMTP_HOST, external:smtp:env:EMAIL_URL, present before), which 3a leaves out on purpose (smtp is an ignored mailer).
• documenso uses nodemailer transports, a Resend transport package and AWS SES v2 identity commands. Before part 2d none was recognised; the SES v2 commands now are (see Part 2d above); its nodemailer and Resend transports are still not resolved.
• appwrite reaches Twilio, Resend and others through its own Utopia\Messaging\Adapter classes, which are not an SDK from the extractor's list (follow-up).
• cal.com apps/web and open-webui have no mail, SMS, push, Firebase, Kubernetes, Docker or key-management SDK calls in the indexed tree.

Index time: the 871328e runs are 12% to 54% slower than 8172833 on 9 of 12 corpora, within 5% on DVWA and NodeGoat, and 21% faster on documenso (single runs on a shared box, so noisy at about 20%). Three alternating runs: cal.com apps/web 10.06 s before and 13.21 s after (+31%), outline 25.93 s and 32.72 s (+26%). The rise is above 5% and is explained by the 2a and 2b index passes, not by 3a or 3b: a profile of apps/web (profiling inflates it) puts ssrf_input.apply at about 28% and insecure_transport.apply at about 7% of the index time, and the 3a / 3b changes add no external nodes on these corpora. The node and edge counts are identical before and after for every corpus except ansible (+3 file:config: nodes for shell scripts and YAML).

Part 2d recovered this cost: against 8172833, the mean of three alternating runs is +1.4% on outline and +0.7% on cal.com apps/web (all runs in Part 2d). The ssrf and insecure_transport passes skip files and functions that cannot contain a sink or a rule hit, and the SDK file prefilter lowercases once.

TypeScript / JavaScript frameworks

Moved from the TS frameworks page. Shallow clones, CODEGRAPH_NO_CACHE=1, 8-core box. Index time is wall time for cg index. Spot-checks were compared by hand with decorators, router files and file-system routes. "Found" counts come from the graph.

Spot-checks were done by hand against the source (decorators, router files, file-system routes). The "found" counts come from the graph (SELECT count(*) FROM nodes WHERE kind='route' etc.).

React Router / Remix (shallow clones, CG_NO_CACHE=1). Counts are pages, layouts, route: nodes and NAVIGATES_TO edges.