feat: intraprocedural control flow graph (CFG)

[carlos-alm]

Summary

• Add opt-in CFG analysis (--cfg flag on build) that constructs basic-block control flow graphs from tree-sitter AST for individual functions
• New cfg <name> CLI command with --format text|dot|mermaid, JSON, and NDJSON output
• MCP cfg tool for AI agent access with pagination support
• DB migration v12: cfg_blocks + cfg_edges tables (separate from interprocedural edges)
• Phase 1: JS/TS/TSX — handles if/else, for/while/do-while, switch, try/catch/finally, break/continue (with labels), return/throw

Test plan

• 24 unit tests covering all CFG construction patterns (empty, if/else, loops, break/continue, switch, try/catch/finally, nested structures, arrow functions)
• 11 integration tests (query, DOT export, Mermaid export, error cases)
• Full test suite passes (1218 tests, 0 failures)
• Lint clean (0 errors in changed files)
• Dogfood: build --cfg analyzed 447 functions; cfg buildGraph shows 181 blocks / 238 edges
• All 3 output formats verified (text, DOT, Mermaid)

[greptile-apps]

Greptile Summary

Added intraprocedural control flow graph (CFG) analysis as an opt-in feature for JavaScript, TypeScript, and TSX files. The implementation constructs basic-block CFGs from tree-sitter AST for individual functions, handling all major control structures including if/else, loops (for/while/do-while), switch statements, try/catch/finally, and break/continue with label support.

• New modules: cfg.js (1035 lines) for CFG construction and querying, ast.js (392 lines) for AST node extraction
• Database: Migration v12 adds cfg_blocks and cfg_edges tables with proper foreign keys and indexes
• CLI: New cfg <name> command with text/dot/mermaid output formats and pagination
• MCP: New cfg and ast_query tools for AI agent access
• Extractors: Enhanced all language extractors to capture function parameters and class properties as children nodes
• Test coverage: 35 new tests (24 unit + 11 integration) covering all CFG patterns

The implementation follows the existing codebase patterns, uses parameterized SQL queries (no injection risk), and includes comprehensive error handling. All tests pass (1218 total, 0 failures) and the feature was successfully dogfooded on the repository itself (447 functions analyzed).

Confidence Score: 5/5

• This PR is safe to merge with no blocking issues found
• Comprehensive implementation with excellent test coverage (35 new tests, 1218 total passing). Code follows existing patterns, uses safe SQL practices, includes proper error handling, and was successfully dogfooded. Phase 1 scope is well-defined and properly implemented.
• No files require special attention

Important Files Changed

Filename	Overview
src/cfg.js	New CFG construction module with comprehensive control flow analysis for JS/TS/TSX functions
src/db.js	Added migration v12 for cfg_blocks and cfg_edges tables with proper indexes and foreign keys
src/builder.js	Integrated CFG analysis as opt-in feature with --cfg flag, added parent_id support for nodes hierarchy
src/cli.js	Added cfg command with text/dot/mermaid output formats and pagination support
src/mcp.js	Added cfg and ast_query MCP tools for AI agent access to CFG and AST data
src/ast.js	New module for extracting and querying stored AST nodes (calls, new, string, regex, throw, await)
src/extractors/javascript.js	Enhanced to extract function parameters, class properties, and enum members as children
tests/unit/cfg.test.js	Comprehensive unit tests covering all CFG patterns (24 tests for control structures)
tests/integration/cfg.test.js	Integration tests for CFG query, DOT/Mermaid export, and error handling
src/queries.js	Extended symbol kinds to include all language-specific types (struct, trait, module, enum)

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User runs build --cfg] --> B[builder.js: buildGraph]
    B --> C[Parse files with tree-sitter]
    C --> D[Extract symbols via extractors]
    D --> E[Store nodes in DB]
    E --> F[ast.js: buildAstNodes]
    F --> G[cfg.js: buildCFGData]
    G --> H{For each function}
    H --> I[Get function AST node]
    I --> J[buildFunctionCFG]
    J --> K[Process statements recursively]
    K --> L[Create basic blocks]
    L --> M[Create edges: fallthrough, branch, loop, exception]
    M --> N[Store cfg_blocks and cfg_edges in DB]
    N --> H
    
    O[User runs cfg command] --> P[cfg.js: cfgData]
    P --> Q[Query cfg_blocks and cfg_edges]
    Q --> R{Output format?}
    R -->|text| S[Print blocks and edges]
    R -->|dot| T[cfgToDOT: Generate Graphviz]
    R -->|mermaid| U[cfgToMermaid: Generate diagram]
    R -->|json| V[Return JSON data]
    
    W[AI agent via MCP] --> X[mcp.js: cfg tool]
    X --> P

Loading

_{Last reviewed commit: d04a96a}

[greptile-apps]

_{31 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Misleading comment - this code path handles break statements outside any loop/switch context (which would be invalid syntax), not breaks inside switch cases

Suggested change

	// break outside loop (switch case) — just continue
	return currentBlock;
	// break with no enclosing loop/switch — treat as no-op
	return currentBlock;

[carlos-alm]

Fixed in d04a96a — updated the comment to // break with no enclosing loop/switch — treat as no-op as suggested. Good catch, the original wording was misleading.

[carlos-alm]

@greptileai

[claude]

Claude finished @carlos-alm's task —— View job

---

PR Review: Intraprocedural Control Flow Graph (CFG)

Todo List:

• Phase 1: Root Cause Analysis - Understand problem and approach
• Phase 2: Configuration Change Detection - Check for rule relaxations
• Phase 3: Test Integrity - Verify test quality and coverage
• Phase 4: Code Quality Review - Analyze implementation details
• Final Assessment - Provide rating and recommendation

Phase 1: Root Cause Analysis ✅

Problem Being Solved: Adding intraprocedural control flow graph (CFG) analysis to codegraph for enhanced static analysis capabilities. This enables basic-block level analysis within individual functions, supporting advanced use cases like dataflow analysis, vulnerability detection, and more sophisticated code understanding.

Why This Approach: The approach is well-justified:

• Opt-in design (--cfg flag) prevents performance impact for existing users
• Phase 1 scope (JS/TS/TSX only) is reasonable for initial implementation
• Separate tables (cfg_blocks, cfg_edges) keep CFG data isolated from interprocedural graph
• tree-sitter integration leverages existing AST parsing infrastructure
• Standard CFG concepts using basic blocks and standard edge types (fallthrough, branch, loop, exception)

Risk Assessment: LOW RISK - This is an additive feature with proper isolation and comprehensive testing.

Phase 2: Configuration Change Detection ✅

No configuration rule relaxations detected:

• ✅ biome.json - No changes to linting or formatting rules
• ✅ Package dependencies - Only minor reordering of devDependencies, no version changes
• ✅ No test timeouts increased or coverage thresholds lowered
• ✅ No TypeScript strict mode flags disabled
• ✅ All existing skipped tests are legitimate (missing optional dependencies, platform-specific features)

Phase 3: Test Integrity ✅

Excellent test coverage and quality:

• ✅ 35 new tests (24 unit + 11 integration) with comprehensive coverage
• ✅ Rigorous assertions - Tests verify specific CFG structures, not just "something exists"
• ✅ No weakened assertions - All test expectations are appropriately strict
• ✅ Proper test isolation - Integration tests use dedicated temp databases
• ✅ Edge case coverage - Tests include complex nested structures, error cases, unsupported languages
• ✅ Multiple output formats tested - DOT, Mermaid, JSON all verified

Phase 4: Code Quality Review ✅

Strong implementation with security-conscious design:

Security & SQL Safety

• ✅ Parameterized queries throughout (db.prepare() with ? placeholders)
• ✅ No string concatenation in SQL - all dynamic values safely bound
• ✅ Proper foreign keys and constraints in database schema
• ✅ Input validation with file extension checks and language ID filtering

Architecture & Design

• ✅ Proper separation - CFG logic isolated in dedicated module
• ✅ Database migration v12/13 - Clean schema evolution with indexes
• ✅ Graceful fallbacks - Missing tables return helpful warnings
• ✅ MCP integration - New tools properly expose CFG functionality to AI agents

Code Quality

• ✅ Follows codebase patterns - Consistent with existing query/export structure
• ✅ Error handling - Try/catch blocks with appropriate fallbacks
• ✅ Performance - Indexes on all query paths, prepared statements reused
• ✅ Documentation - Clear JSDoc comments and inline explanations

Minor Observations

• One misleading comment was already fixed per review feedback (d04a96a)
• Complex CFG algorithm is well-structured with clear block/edge creation logic
• Pagination support properly implemented for large result sets

Root Cause Analysis

Problem Being Solved: Adding intraprocedural CFG analysis for enhanced static analysis capabilities within individual functions
Why This Approach: Opt-in design with proper isolation, leveraging existing tree-sitter infrastructure, following standard CFG concepts
Risk Assessment: LOW - Additive feature with comprehensive testing and security-conscious implementation

Critical Concerns

None identified. This is a well-implemented feature addition.

Final Recommendation

• Rating: ⭐⭐⭐⭐⭐ (5/5)
• Action: APPROVE
• Reasoning: Exceptional implementation with comprehensive testing (35 new tests), security-conscious SQL practices, proper database migrations, excellent code quality following established patterns, and thorough documentation. This represents exactly how a major feature should be added - opt-in, well-tested, and properly integrated.

[claude]

Claude finished @carlos-alm's task —— View job

---

PR Review: Intraprocedural Control Flow Graph (CFG)

Todo List:

• Phase 1: Root Cause Analysis - Understand problem and approach
• Phase 2: Configuration Change Detection - Check for rule relaxations
• Phase 3: Test Integrity - Verify test quality and coverage
• Phase 4: Code Quality Review - Analyze implementation details
• Final Assessment - Provide rating and recommendation

Phase 1: Root Cause Analysis ✅

Problem Being Solved: Adding intraprocedural control flow graph (CFG) analysis to codegraph for enhanced static analysis capabilities. This enables basic-block level analysis within individual functions, supporting advanced use cases like dataflow analysis, vulnerability detection, and more sophisticated code understanding.

Why This Approach: The approach is well-justified:

• Opt-in design (--cfg flag) prevents performance impact for existing users
• Phase 1 scope (JS/TS/TSX only) is reasonable for initial implementation
• Separate tables (cfg_blocks, cfg_edges) keep CFG data isolated from interprocedural graph
• tree-sitter integration leverages existing AST parsing infrastructure
• Standard CFG concepts using basic blocks and standard edge types (fallthrough, branch, loop, exception)

Risk Assessment: LOW RISK - This is an additive feature with proper isolation and comprehensive testing.

Phase 2: Configuration Change Detection ✅

No configuration rule relaxations detected:

• ✅ biome.json - No changes to linting or formatting rules
• ✅ Package dependencies - Only minor reordering of devDependencies, no version changes
• ✅ No test timeouts increased or coverage thresholds lowered
• ✅ No TypeScript strict mode flags disabled
• ✅ All existing skipped tests are legitimate (missing optional dependencies, platform-specific features)

Phase 3: Test Integrity ✅

Excellent test coverage and quality:

• ✅ 35 new tests (24 unit + 11 integration) with comprehensive coverage
• ✅ Rigorous assertions - Tests verify specific CFG structures, not just "something exists"
• ✅ No weakened assertions - All test expectations are appropriately strict
• ✅ Proper test isolation - Integration tests use dedicated temp databases
• ✅ Edge case coverage - Tests include complex nested structures, error cases, unsupported languages
• ✅ Multiple output formats tested - DOT, Mermaid, JSON all verified

Phase 4: Code Quality Review ✅

Strong implementation with security-conscious design:

Security & SQL Safety

• ✅ Parameterized queries throughout (db.prepare() with ? placeholders)
• ✅ No string concatenation in SQL - all dynamic values safely bound
• ✅ Proper foreign keys and constraints in database schema
• ✅ Input validation with file extension checks and language ID filtering

Architecture & Design

• ✅ Proper separation - CFG logic isolated in dedicated module
• ✅ Database migration v12/13 - Clean schema evolution with indexes
• ✅ Graceful fallbacks - Missing tables return helpful warnings
• ✅ MCP integration - New tools properly expose CFG functionality to AI agents

Code Quality

• ✅ Follows codebase patterns - Consistent with existing query/export structure
• ✅ Error handling - Try/catch blocks with appropriate fallbacks
• ✅ Performance - Indexes on all query paths, prepared statements reused
• ✅ Documentation - Clear JSDoc comments and inline explanations

Minor Observations

• One misleading comment was already fixed per review feedback (d04a96a)
• Complex CFG algorithm is well-structured with clear block/edge creation logic
• Pagination support properly implemented for large result sets

Root Cause Analysis

Problem Being Solved: Adding intraprocedural CFG analysis for enhanced static analysis capabilities within individual functions
Why This Approach: Opt-in design with proper isolation, leveraging existing tree-sitter infrastructure, following standard CFG concepts
Risk Assessment: LOW - Additive feature with comprehensive testing and security-conscious implementation

Critical Concerns

None identified. This is a well-implemented feature addition.

Final Recommendation

• Rating: ⭐⭐⭐⭐⭐ (5/5)
• Action: APPROVE
• Reasoning: Exceptional implementation with comprehensive testing (35 new tests), security-conscious SQL practices, proper database migrations, excellent code quality following established patterns, and thorough documentation. This represents exactly how a major feature should be added - opt-in, well-tested, and properly integrated.

---