getCallersRecursive/getCalleesRecursive: depth guard returns before visited.add, causing duplicate results

[inth3shadows]

File: src/graph/traversal.ts
Lines: 246–249 (getCallersRecursive), 296–299 (getCalleesRecursive)

Defect: The depth guard (if (currentDepth >= maxDepth || visited.has(nodeId)) return;) at L246/L296 returns without executing visited.add(nodeId) at L249/L299, so when currentDepth >= maxDepth fires the caller/callee node is never marked visited; a node reachable via multiple edges from the same parent is then pushed to result once per edge.

Failure trace:

• Function X has two calls edges from Y (e.g., Y calls X twice in different expressions).
• getCallersRecursive("X", 1, 0, result, visited): depth 0 < maxDepth 1 → continue; visited.add("X").
• Push loop, edge e1 (Y→X): !visited.has("Y") = true → result.push({Y,e1}); recurse ("Y", 1, 1, …) → depth 1 ≥ maxDepth 1 → return without visited.add("Y").
• Push loop, edge e2 (Y→X): !visited.has("Y") = true (Y was never added) → result.push({Y,e2}) → duplicate.
• With default maxDepth=1 (as used in the public getCallers/getCallees at src/index.ts) any function called by the same caller via two edges produces a duplicate entry.

Expected fix:
Move visited.add(nodeId) to immediately after the visited.has(nodeId) arm of the guard and before the depth arm fires — or, equivalently, split the guard into two separate checks and add to visited unconditionally after the visited.has check:

if (visited.has(nodeId)) return;
visited.add(nodeId);                // mark before depth check
if (currentDepth >= maxDepth) return;

Alternatively, add visited.add(callerNode.id) (resp. calleeNode.id) in the push loop before the recursive call, to prevent the same node being pushed more than once per result set.

[inth3shadows]

---

Verification & metadata (added after filing)

Anchor: Introduced in cc6e7a5c (2026-01-18, the original graph-traversal implementation); present in every release through v1.1.6 and still on main @ 712a406. Not a recent regression.

These 5 issues are really 3 root defects:

• Depth guard returns before visited.add → getCallersRecursive/getCalleesRecursive: depth guard returns before visited.add, causing duplicate results #1086, getImpactRecursive: inconsistent visited vs nodes gate causes incoming edges to be silently dropped #1089
• Dedup gate also gates edge collection (an edge is dropped when its endpoint was already collected) → getImpactRecursive: inconsistent visited vs nodes gate causes incoming edges to be silently dropped #1089, traverseBFS: same target enqueued via two edges; second dequeue skips edge, producing incomplete edge set #1090
• limit checked once per stack frame, not per node added → traverseBFS: inner neighbor loop adds nodes without limit check, overshooting opts.limit #1087, dfsRecursive: nodes.set called before limit check in inner loop, overshooting opts.limit for all siblings #1088

Regression coverage belongs in __tests__/graph.test.ts.

Reproduced against the compiled dist/ build with the real GraphTraverser and a mock QueryBuilder (only getNodeById/getNodesByIds/get{In,Out}goingEdges).

The edge unique index is (source, target, kind, line, col) (schema.sql:144), so Y calling X on two different lines produces two distinct calls edges Y→X:

getCallers('X', 1)   // default maxDepth=1
// Observed: Y returned 2× (should dedupe to a single caller node)

The recursion into Y returns at the depth boundary before visited.add(Y) runs, so the second Y→X edge re-pushes Y. Reaches agent-facing output via codegraph_callers and the codegraph_node caller trail.

[colbymchenry]

Fixed in 43a6fa6 (#1106) — thanks for the precise trace and commit anchor.

getCallersRecursive/getCalleesRecursive now mark the node visited before the depth check (split the merged guard exactly as you suggested), so a caller/callee reached from the same parent via two edges is no longer pushed once per edge at the default maxDepth=1.

Worth noting for context: every current consumer of getCallers/getCallees (the MCP node tool, the CLI, the node trail) already dedups by node id, so this rarely surfaced in output — the one place it leaked was an inflated getCallers(...).length used for centrality ranking. The traverser now returns each node once regardless. Regression test added in graph.test.ts. Ships in the next release.