feat: add AST node storage, intraprocedural CFG, and expanded node/edge types

[carlos-alm]

Summary

Three interconnected features that expand codegraph's static analysis capabilities:

1. Expanded node types (parameter, property, constant)

• New SYMBOL_KINDS entries: parameter, property, constant
• All 9 language extractors (JS/TS, Python, Go, Rust, Java, C#, PHP, Ruby, HCL) updated
• Rust native engine extractors updated in parallel
• New test suite: tests/parsers/extended-kinds.test.js (504 lines)

2. Expanded edge types (contains, parameter_of, receiver)

• contains: parent-child structural relationships (class→method, module→function)
• parameter_of: parameter→function ownership edges
• receiver: Go receiver→method binding
• Builder integration for automatic edge creation during graph build

3. Stored queryable AST nodes (src/ast.js)

• New ast_nodes DB table storing call sites, new expressions, string/regex literals, throw, await
• codegraph ast-query CLI command with glob pattern matching
• ast_query MCP tool
• Collected during build via extractor collectAstNodes() functions across all languages
• Tests: tests/integration/ast.test.js, tests/parsers/ast-nodes.test.js

4. Intraprocedural Control Flow Graph (src/cfg.js)

• Builds per-function CFGs from tree-sitter AST
• Supports: if/else, loops (for/while/do-while/for-in/for-of), switch/case, try/catch/finally, break/continue (labeled), return, throw, ternary, logical operators, optional chaining
• Output formats: JSON, DOT, Mermaid
• codegraph cfg CLI command, cfg MCP tool
• Tests: tests/unit/cfg.test.js (457 lines), tests/integration/cfg.test.js (199 lines)

Files changed

• New: src/ast.js (392), src/cfg.js (1,035)
• Modified: src/builder.js, src/cli.js, src/db.js, src/mcp.js, src/queries.js, src/index.js, src/parser.js, src/structure.js, src/paginate.js, all 9 extractors, Rust crate extractors
• Tests: 5 new test files (1,579 lines total), updates to 3 existing test files

Test plan

• npm test passes all existing + new tests
• codegraph build . succeeds with new node/edge types and AST collection
• codegraph ast-query --kind call --pattern "build*" returns stored call sites
• codegraph cfg <function-name> produces valid CFG in JSON/DOT/Mermaid
• codegraph cfg <function-name> --format mermaid renders correctly
• MCP tools ast_query and cfg respond correctly
• Build parity between native and WASM engines for new node types

[claude]

Claude finished @carlos-alm's task —— View job

---

PR Review Complete ✅

Review Checklist:

• Phase 1: Root cause analysis - understand problem being solved
• Phase 2: Configuration change detection (HIGH SCRUTINY) ✅
• Phase 3: Test integrity verification ✅
• Phase 4: Code quality assessment ✅
• Final assessment and rating

Root Cause Analysis ✅

Problem Being Solved: This PR adds significant static analysis capabilities to codegraph:

1. Expanded node types (parameter, property, constant) - enables tracking of finer-grained symbols beyond just functions/classes
2. Expanded edge types (contains, parameter_of, receiver) - enables modeling structural relationships
3. Stored queryable AST nodes - enables querying specific syntactic constructs (calls, new, literals, throws, awaits)
4. Intraprocedural CFG - enables control flow analysis within functions

Why This Approach: These are legitimate feature additions that expand the tool's analytical capabilities. The changes appear to be net-new functionality rather than fixes to existing problems.

Configuration Change Detection ✅

NO CONCERNING CHANGES DETECTED:

• ✅ No linting rule changes in biome.json
• ✅ Only version bump in package.json (2.5.1 → 2.6.0)
• ✅ No test timeout/coverage threshold modifications
• ✅ No TypeScript/build config changes
• ✅ No eslint-disable or rule bypass additions

Test Integrity ✅

STRONG TEST COVERAGE:

• ✅ 5 new test files (1,579+ lines total)
• ✅ Comprehensive unit tests for CFG (457 lines in tests/unit/cfg.test.js)
• ✅ Extended kinds tested across all 9 languages (504 lines in tests/parsers/extended-kinds.test.js)
• ✅ Integration tests for AST queries and CFG functionality
• ✅ No weakened assertions or disabled tests found
• ✅ Tests follow proper patterns with beforeAll, proper cleanup

Code Quality Assessment ✅

SECURITY & PERFORMANCE:

• ✅ No unsafe SQL concatenation - uses parameterized queries throughout
• ✅ Proper transaction handling in database operations
• ✅ No eval/exec/Function usage detected
• ✅ File path validation with safePath() function
• ✅ Input truncation (TEXT_MAX = 200) prevents excessive memory usage
• ✅ Graceful fallbacks when tables don't exist

DATABASE DESIGN:

• ✅ Proper schema migrations (versions 11-13) with foreign keys and indexes
• ✅ DELETE operations are scoped and safe (file-based cleanup)
• ✅ Transaction-wrapped bulk operations
• ✅ Backward compatibility maintained with existing tables

CODE ORGANIZATION:

• ✅ Well-structured modules with clear responsibilities
• ✅ Comprehensive error handling and logging
• ✅ Proper separation of build-time vs query-time functions
• ✅ Export format support (JSON, DOT, Mermaid)

Minor Observations:

1. Large PR scope (17 files, 2,771 additions) - could have been split into smaller PRs
2. CFG currently JS/TS/TSX only - documented limitation for Phase 1
3. AST node collection has language-specific limitations - only full AST walk for JS/TS/TSX

---

Root Cause Analysis

Problem Being Solved: Adding advanced static analysis capabilities (finer-grained symbol tracking, structural relationships, queryable AST nodes, control flow analysis)
Why This Approach: Legitimate feature expansion using established patterns and robust database design
Risk Assessment: Low risk - well-tested, secure implementation with proper fallbacks

Critical Concerns

None identified. This is a substantial but well-engineered feature addition.

Final Recommendation

• Rating: ⭐⭐⭐⭐☆ (4/5)
• Action: APPROVE WITH CONDITIONS
• Reasoning: High-quality implementation with comprehensive test coverage and no security/configuration concerns. The large scope is the only significant concern - future similar PRs should be split into smaller chunks for easier review.

Approval Conditions:

• Verify npm test passes before merge
• Consider documenting the new CLI commands (ast-query, cfg) in user-facing documentation

---

[greptile-apps]

Greptile Summary

This PR adds three interconnected static analysis features to codegraph:

1. AST Node Storage (src/ast.js) - Always-on extraction of queryable AST nodes (calls, new, string/regex literals, throw, await) stored in the ast_nodes table. Accessible via codegraph ast CLI command and ast_query MCP tool with GLOB pattern matching.

2. Intraprocedural CFG (src/cfg.js) - Opt-in per-function control flow graph construction supporting if/else, loops, switch, try/catch/finally, and labeled break/continue. Outputs JSON/DOT/Mermaid formats via codegraph cfg CLI and cfg MCP tool.

3. Expanded Node Types - Added parameter, property, and constant symbol kinds plus new edge types (contains, parameter_of, receiver) for richer graph structure.

Implementation Quality:

• Clean separation between build-time extraction and query-time retrieval
• Proper SQL parameterization preventing injection
• Safe memory management (AST extraction before complexity releases tree references)
• Two new DB migrations (v12 for CFG, v13 for AST) with proper foreign keys and indexes
• Comprehensive test suite: 1,579 lines across 5 new test files covering unit, integration, and parser levels
• Previous cleanup issue (missing CFG table deletion in full rebuild) has been resolved

Integration:

• CFG is opt-in via --cfg flag to avoid build overhead
• AST extraction is always-on (minimal cost, high value)
• Clean CLI/MCP tool additions matching existing patterns
• Documentation updated for new tools and consolidated MCP reference

Confidence Score: 5/5

• Safe to merge with no critical issues found
• Well-architected implementation with comprehensive test coverage, proper SQL parameterization, safe memory management, and clean integration into existing codebase. Previous cleanup issue has been addressed. All 17 files reviewed show solid engineering practices
• No files require special attention

Important Files Changed

Filename	Overview
src/ast.js	New file implementing AST node storage and querying. Well-structured with proper SQL parameterization, clean separation between build and query phases, and comprehensive extraction for JS/TS/TSX
src/cfg.js	New intraprocedural CFG with solid algorithm design. Handles complex control flow correctly with proper block/edge creation and multiple output formats
src/builder.js	Clean integration of AST and CFG into build pipeline. Proper cleanup in full rebuild and purge paths. Previous CFG cleanup issue resolved
src/db.js	Added migrations v12 (CFG tables) and v13 (AST nodes) with proper schema, foreign keys, and indexes
src/cli.js	Added cfg and ast commands with comprehensive options. Clean integration matching existing command patterns
src/mcp.js	Added cfg and ast_query MCP tools with proper schemas, pagination limits, and format support
tests/unit/cfg.test.js	Comprehensive CFG unit tests (457 lines) covering all control flow constructs with clear assertions
tests/integration/cfg.test.js	Integration tests for CFG queries with fixture DB. Tests data retrieval and export formats
tests/integration/ast.test.js	Integration tests for AST queries. Tests pattern matching, filtering, and pagination with fixture data

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Start([Build Process Start]) --> Parse[Parse Files with tree-sitter]
    Parse --> Extract[Extract Symbols & Calls]
    Extract --> Resolve[Resolve Imports]
    Resolve --> StoreNodes[Store nodes & edges in DB]
    
    StoreNodes --> AST[AST Node Extraction]
    AST --> ASTWalk[Walk JS/TS/TSX ASTs]
    ASTWalk --> ASTStore[(Store in ast_nodes table)]
    ASTStore --> Complexity
    
    StoreNodes --> Complexity[Compute Complexity Metrics]
    Complexity --> CFGCheck{--cfg flag?}
    
    CFGCheck -->|Yes| CFGBuild[Build CFG per function]
    CFGCheck -->|No| DataflowCheck
    
    CFGBuild --> CFGAlgo[buildFunctionCFG algorithm]
    CFGAlgo --> CFGBlocks[Create blocks: entry, exit, conditions, loops]
    CFGBlocks --> CFGEdges[Create edges: fallthrough, branch, loop_back, return]
    CFGEdges --> CFGStore[(Store in cfg_blocks & cfg_edges)]
    CFGStore --> DataflowCheck
    
    DataflowCheck{--dataflow flag?} -->|Yes| Dataflow[Extract Data Flow]
    DataflowCheck -->|No| Complete
    Dataflow --> Complete([Build Complete])
    
    style AST fill:#e1f5ff
    style CFGBuild fill:#fff4e1
    style ASTStore fill:#d4edda
    style CFGStore fill:#d4edda

Loading

_{Last reviewed commit: 8a0b8cf}

[greptile-apps]

_{17 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Missing DELETE FROM cfg_edges and DELETE FROM cfg_blocks in full rebuild cleanup, which will leave orphaned CFG data in the database.

Suggested change

	'PRAGMA foreign_keys = OFF; DELETE FROM node_metrics; DELETE FROM edges; DELETE FROM function_complexity; DELETE FROM dataflow; DELETE FROM ast_nodes; DELETE FROM nodes; PRAGMA foreign_keys = ON;';
	'PRAGMA foreign_keys = OFF; DELETE FROM cfg_edges; DELETE FROM cfg_blocks; DELETE FROM node_metrics; DELETE FROM edges; DELETE FROM function_complexity; DELETE FROM dataflow; DELETE FROM ast_nodes; DELETE FROM nodes; PRAGMA foreign_keys = ON;';

[carlos-alm]

Fixed the Greptile review comment in 8a0b8cf: added DELETE FROM cfg_edges and DELETE FROM cfg_blocks to the full rebuild cleanup chain in builder.js:560. The incremental rebuild path already handled per-file CFG cleanup correctly (lines 408, 416).

@greptileai

[claude]

Claude finished @carlos-alm's task —— View job

---

PR Review Complete ✅

Review Checklist:

• Phase 1: Root cause analysis - understand problem being solved
• Phase 2: Configuration change detection (HIGH SCRUTINY) ✅
• Phase 3: Test integrity verification ✅
• Phase 4: Code quality assessment ✅
• Final assessment and rating

Root Cause Analysis ✅

Problem Being Solved: This PR adds significant static analysis capabilities to codegraph:

1. Expanded node types (parameter, property, constant) - enables tracking of finer-grained symbols beyond just functions/classes
2. Expanded edge types (contains, parameter_of, receiver) - enables modeling structural relationships
3. Stored queryable AST nodes - enables querying specific syntactic constructs (calls, new, literals, throws, awaits)
4. Intraprocedural CFG - enables control flow analysis within functions

Why This Approach: These are legitimate feature additions that expand the tool's analytical capabilities. The changes appear to be net-new functionality rather than fixes to existing problems.

Configuration Change Detection ✅

NO CONCERNING CHANGES DETECTED:

• ✅ No linting rule changes in biome.json
• ✅ Only version bump in package.json (2.5.1 → 2.6.0)
• ✅ No test timeout/coverage threshold modifications
• ✅ No TypeScript/build config changes
• ✅ No eslint-disable or rule bypass additions

Test Integrity ✅

STRONG TEST COVERAGE:

• ✅ 5 new test files (1,579+ lines total)
• ✅ Comprehensive unit tests for CFG (457 lines in tests/unit/cfg.test.js)
• ✅ Extended kinds tested across all 9 languages (504 lines in tests/parsers/extended-kinds.test.js)
• ✅ Integration tests for AST queries and CFG functionality
• ✅ No weakened assertions or disabled tests found
• ✅ Tests follow proper patterns with beforeAll, proper cleanup

Code Quality Assessment ✅

SECURITY & PERFORMANCE:

• ✅ No unsafe SQL concatenation - uses parameterized queries throughout
• ✅ Proper transaction handling in database operations
• ✅ No eval/exec/Function usage detected
• ✅ File path validation with safePath() function
• ✅ Input truncation (TEXT_MAX = 200) prevents excessive memory usage
• ✅ Graceful fallbacks when tables don't exist

DATABASE DESIGN:

• ✅ Proper schema migrations (versions 11-13) with foreign keys and indexes
• ✅ DELETE operations are scoped and safe (file-based cleanup)
• ✅ Transaction-wrapped bulk operations
• ✅ Backward compatibility maintained with existing tables

CODE ORGANIZATION:

• ✅ Well-structured modules with clear responsibilities
• ✅ Comprehensive error handling and logging
• ✅ Proper separation of build-time vs query-time functions
• ✅ Export format support (JSON, DOT, Mermaid)

Minor Observations:

1. Large PR scope (17 files, 2,771 additions) - could have been split into smaller PRs
2. CFG currently JS/TS/TSX only - documented limitation for Phase 1
3. AST node collection has language-specific limitations - only full AST walk for JS/TS/TSX

---

Root Cause Analysis

Problem Being Solved: Adding advanced static analysis capabilities (finer-grained symbol tracking, structural relationships, queryable AST nodes, control flow analysis)
Why This Approach: Legitimate feature expansion using established patterns and robust database design
Risk Assessment: Low risk - well-tested, secure implementation with proper fallbacks

Critical Concerns

None identified. This is a substantial but well-engineered feature addition.

Final Recommendation

• Rating: ⭐⭐⭐⭐☆ (4/5)
• Action: APPROVE WITH CONDITIONS
• Reasoning: High-quality implementation with comprehensive test coverage and no security/configuration concerns. The large scope is the only significant concern - future similar PRs should be split into smaller chunks for easier review.

Approval Conditions:

• Verify npm test passes before merge
• Consider documenting the new CLI commands (ast-query, cfg) in user-facing documentation

---

[claude]

Claude finished @carlos-alm's task —— View job

---

PR Review Complete ✅

Review Checklist:

• Phase 1: Root cause analysis - understand problem being solved
• Phase 2: Configuration change detection (HIGH SCRUTINY) ✅
• Phase 3: Test integrity verification ✅
• Phase 4: Code quality assessment ✅
• Final assessment and rating

Root Cause Analysis ✅

Problem Being Solved: This PR adds significant static analysis capabilities to codegraph:

1. Expanded node types (parameter, property, constant) - enables tracking of finer-grained symbols beyond just functions/classes
2. Expanded edge types (contains, parameter_of, receiver) - enables modeling structural relationships
3. Stored queryable AST nodes - enables querying specific syntactic constructs (calls, new, literals, throws, awaits)
4. Intraprocedural CFG - enables control flow analysis within functions

Why This Approach: These are legitimate feature additions that expand the tool's analytical capabilities. The changes appear to be net-new functionality rather than fixes to existing problems.

Configuration Change Detection ✅

NO CONCERNING CHANGES DETECTED:

• ✅ No linting rule changes in biome.json
• ✅ Only version bump in package.json (2.5.1 → 2.6.0)
• ✅ No test timeout/coverage threshold modifications
• ✅ No TypeScript/build config changes
• ✅ No eslint-disable or rule bypass additions

Test Integrity ✅

STRONG TEST COVERAGE:

• ✅ 5 new test files (1,579+ lines total)
• ✅ Comprehensive unit tests for CFG (457 lines in tests/unit/cfg.test.js)
• ✅ Extended kinds tested across all 9 languages (504 lines in tests/parsers/extended-kinds.test.js)
• ✅ Integration tests for AST queries and CFG functionality
• ✅ No weakened assertions or disabled tests found
• ✅ Tests follow proper patterns with beforeAll, proper cleanup

Code Quality Assessment ✅

SECURITY & PERFORMANCE:

• ✅ No unsafe SQL concatenation - uses parameterized queries throughout
• ✅ Proper transaction handling in database operations
• ✅ No eval/exec/Function usage detected
• ✅ File path validation with safePath() function
• ✅ Input truncation (TEXT_MAX = 200) prevents excessive memory usage
• ✅ Graceful fallbacks when tables don't exist

DATABASE DESIGN:

• ✅ Proper schema migrations (versions 11-13) with foreign keys and indexes
• ✅ DELETE operations are scoped and safe (file-based cleanup)
• ✅ Transaction-wrapped bulk operations
• ✅ Backward compatibility maintained with existing tables

CODE ORGANIZATION:

• ✅ Well-structured modules with clear responsibilities
• ✅ Comprehensive error handling and logging
• ✅ Proper separation of build-time vs query-time functions
• ✅ Export format support (JSON, DOT, Mermaid)

Minor Observations:

1. Large PR scope (17 files, 2,771 additions) - could have been split into smaller PRs
2. CFG currently JS/TS/TSX only - documented limitation for Phase 1
3. AST node collection has language-specific limitations - only full AST walk for JS/TS/TSX

---

Root Cause Analysis

Problem Being Solved: Adding advanced static analysis capabilities (finer-grained symbol tracking, structural relationships, queryable AST nodes, control flow analysis)
Why This Approach: Legitimate feature expansion using established patterns and robust database design
Risk Assessment: Low risk - well-tested, secure implementation with proper fallbacks

Critical Concerns

None identified. This is a substantial but well-engineered feature addition.

Final Recommendation

• Rating: ⭐⭐⭐⭐☆ (4/5)
• Action: APPROVE WITH CONDITIONS
• Reasoning: High-quality implementation with comprehensive test coverage and no security/configuration concerns. The large scope is the only significant concern - future similar PRs should be split into smaller chunks for easier review.

Approval Conditions:

• Verify npm test passes before merge
• Consider documenting the new CLI commands (ast-query, cfg) in user-facing documentation

---