Merge train: 43 reviewed PRs (2026-11-09) by tirth8205 · Pull Request #1186 · tirth8205/code-review-graph

tirth8205 · 2026-11-09T18:06:08Z

This merges 43 reviewed PRs into staging in one CI run. Merge it with a merge commit, so each PR is marked as merged under its author's name.

This is not a release. The version stays 2.3.9, with no tag and nothing sent to testing or main.

Included

Not included

fix(install): show each change in --dry-run and write nothing before the question #1173 (install --dry-run preview) sends every file read and write through a new install plan. fix(install): never wipe a hook settings file it cannot read as strict JSON #1157 replaced those same reads and writes with a JSONC-safe merge, and feat: add an opt-in steering hook for Claude Code #1155, fix: edit hook updates the repo that holds the edited file (#311) #1172 and feat(install): opt-in --gitignore block for the files install created (#471) #1180 build on that. The two cannot be joined by resolving conflicts: fix(install): show each change in --dry-run and write nothing before the question #1173 needs to be redone on top of this train, or a dry run would still write files.
Add Windows overrides for Codex hooks #877 waits on Windows.

How it was checked

Each PR was reviewed on its own first. Contributor PRs come in through their reviewed int/<number> branches. After each merge that clashed, the tests for the clashing files were run before the next merge.

Seven faults came from PRs meeting each other, not from any one PR. Each is fixed on the train as its own fix: ... (merge train) commit:

perf: accelerate MCP graph build/incremental updates and reduce resident memory (RSS) #1139 skips flows on an update that stored no file, so the C# rebind from fix(csharp): preserve namespace identity and lexical call binding #964 left flows stale. A dirty mark now ends the skip.
perf: accelerate MCP graph build/incremental updates and reduce resident memory (RSS) #1139 loads the tool modules on first use. A test that patched GraphStore while they first loaded left its mock in them, and the search test from feat(build): wire Jedi enrichment into builds; fix impact-accuracy benchmark #823 then found nothing. The test conftest now loads them up front.
perf: accelerate MCP graph build/incremental updates and reduce resident memory (RSS) #1139 made EdgeInfo a type-only name in graph.py, and fix(graph): preserve same-file nodes on qualified_name collision (#585) #715 builds EdgeInfo objects there. Every store raised NameError.
fix: find Java and Ruby tests in tests_for #1154 binds Java receivers typed by a same-package class, so the fix: a call to an inherited method finds the ancestor that declares it (#984) #1185 inherited pass now moves pet.getName(). The target is the same, so the test now checks how the move is recorded.
perf: accelerate MCP graph build/incremental updates and reduce resident memory (RSS) #1139 loads igraph through _load_igraph, so the Leiden test from feat(action): expose richer graph context in PR review reports #882 now stubs the loader too.
fix: an edge that names no node says so, and confidence means something (#984) #1171 settles an edge whose target is gone back to the plain name. fix(changes): name what a pure deletion removed, not the code around it #1184 then missed callers in other files of a deleted symbol, and a symbol still in use read as unused. It now reads the claimed target too.
The fix(query): bound remaining response lists #895 exact-count search test failed whenever sentence-transformers was installed, because vector search ranked every node. It now stubs vector search.

Larger joins made while resolving conflicts:

fix: a call to an inherited method finds the ancestor that declares it (#984) #1185 and perf: accelerate MCP graph build/incremental updates and reduce resident memory (RSS) #1139: the inherited-call evidence is part of perf: accelerate MCP graph build/incremental updates and reduce resident memory (RSS) #1139's cached resolver context. The Ruby constant calls from fix: find Java and Ruby tests in tests_for #1154 still bind.
fix(changes): name what a pure deletion removed, not the code around it #1184 and feat(action): opt-in, bounded graph context in the review comment #1177: risk_signals and the score of a removed symbol now come from the same evidence, so the comment can never disagree with the score.
[Feature]: Add JSON & YAML for AST parser #436 (feat(parser): index JSON keys without their values, and keep data out #1174), fix: keep translation files out of the YAML index and filter search first #1150 and Index Liquid templates #878: the kind filter, the hidden Liquid Output kind and the JSON filter are one full-text statement.
deps: Update fastmcp requirement from <4,>=3.2.4 to >=3.2.4,<5 #970 and perf: accelerate MCP graph build/incremental updates and reduce resident memory (RSS) #1139: Message comes from fastmcp.prompts, so the prompt module still loads late.
fix(graph): drop three tables nothing reads and three covered indexes #1162 and fix(query): a full name means that name, and ambiguous answers stay small #1149: the new idx_nodes_name index stays, and docs/schema.md lists it.

On the combined branch, on macOS only:

ruff, mypy (91 files) and bandit pass. Schema 15 matches SUPPORTED_SCHEMA_VERSION 15 in the VS Code extension.
Full suite: 7,708 passed, 0 failed, 948 skipped. The token-budget tests were counted with the long local temp path taken out of the output. Without that, 4 of them fail on plain staging here too, so CI is the real answer for those four.

Not tested

Windows and Linux on this branch: CI covers part of that.
The packaging gate and the opt-in cli_surface and surface suites. Here those run an older installed copy of the program, which refuses the schema 15 database.
Real clients other than the test MCP client.

Worth knowing

The schema goes to 15 (fix(graph): drop three tables nothing reads and three covered indexes #1162). The next open drops community_summaries, flow_snapshots, risk_index and three covered indexes. The file keeps its size until VACUUM.
After upgrading, run build once to pick up HTML, XSLT, JSON, Liquid, .cjs and .kts files.
JSON indexing (feat(parser): index JSON keys without their values, and keep data out #1174) can add many nodes. Lock files and data, test, docs and translation files keep only a file node.
Steering (feat: add an opt-in steering hook for Claude Code #1155), symlink following (feat(build): opt-in following of symlinked folders, inside or outside the repo #1179), --gitignore (feat(install): opt-in --gitignore block for the files install created (#471) #1180), context history (feat: opt-in local context history log and context-history command #1175) and Jedi enrichment (feat(build): wire Jedi enrichment into builds; fix impact-accuracy benchmark #823) are all off unless asked for.

🤖 Generated with Claude Code

…nchmark - full_build and incremental_update now run Jedi call-resolution enrichment after the other resolvers. Best-effort: skipped without the [enrichment] extra or with CRG_DISABLE_ENRICHMENT=1; stats surface as result['jedi_enrichment']. - jedi_resolver: rebase resolved target paths onto the repo root as given to full_build, so enriched CALLS edges match stored node qualified names (fixes /var vs /private/var mismatches). - impact_accuracy: normalize changed-file paths to the stored absolute form so seed/neighbor/flow lookups hit; count File-node-sourced (module-level and IMPORTS_FROM) edges as neighbor files. - tests: full_build/incremental_update wiring regression tests and the co-change mock guard.

…chment - Remove 'harness needs fixing' note (co-change mode now works) - Clarify why published eval CSVs show predicted_files=0 (non-code seeds) - Update limitations section to reflect working co-change mode

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Two comments carried a "ponytail" marker that appears nowhere else in the codebase and does not read as English. State the same limits directly: why loose .cs files fall back to the review root, and why C# rebinding forces a full flow retrace rather than a changed-file trace. Comment only; no behaviour change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Namespace-aware binding refused every constructed receiver, so a call on a repository-local generic type that main resolved was left raw: Box<int>::Run rather than App.Box.Run. Key generic declarations by arity instead of excluding them. The parser records the type-parameter count, the resolver indexes App.Box`1, and a receiver's key is derived from its syntax, so nested arguments and tuples count correctly. Arity is what separates the declarations, so I<int> reaches I<T> while the separate I stays out of reach, and Pair<int> matches neither when only Pair<K, V> exists. A constructed containing type carries a second arity that one key cannot describe, so Outer<T>.Inner stays unresolved. The receiver's spelling is retained on the call; only the lookup key is derived from it. Type argument substitution, constraints and overload selection remain out of scope. Identity version 4 -> 5 reparses graphs built without arity evidence. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Preserve staging's batch storage, import context, freshness reconciliation, and C++ identity retry handling alongside the C# namespace changes. Keep source offsets in batch edge identity and refresh target classification after project-only C# rebinding. Add integration regressions for project ownership changes and independent C++/C# retry checkpoints. Update staging's inheritance fixtures to query namespace-qualified C# declarations while retaining their ambiguity assertions.

Updates the requirements on [fastmcp](https://github.com/PrefectHQ/fastmcp) to permit the latest version. - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v3.2.4...v4.0.3) --- updated-dependencies: - dependency-name: fastmcp dependency-version: 4.0.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Combine staging's per-spec import scope with C# lexical using metadata. Keep C# identity and failed-file metadata ahead of the postprocess checkpoint. Cover both import metadata dictionaries on persisted edges and checkpoint ordering, and document the callers_of tradeoff for unresolved C# targets. Keep the C# changelog entries under Unreleased after staging's 2.3.9 release.

…ed paths Addresses the review on #823: - Incremental updates no longer make Jedi read every Python file. enrich_jedi_calls takes an optional files scope; incremental_update passes only the Python files it re-parsed. Full builds still scan all. - README: the co-change zeros were caused by the relative/absolute path bug, not doc seeds (code seeds such as cli.py and gin context.go were zero too). Note that the recall table predates the fix. - Co-change rows record seed_file relative to the repo root instead of the local clone path. - Merged latest staging. The Jedi step runs before _refresh_target_resolution, which stays last. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GDCA6EwHMWTPTSxZGBYHfa

#1139 makes graph.py load the parser on first use, so EdgeInfo is only a type name there. #715 builds EdgeInfo objects when it aligns edges with colliding names, which raised NameError on every store. The two methods now import it themselves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Deleting a function its callers still need breaks them, yet the overall score stayed 0.00 and fail-on-risk let it through. A removed symbol with users is now scored by compute_risk_score's own terms: the flows it was in are traced again with it put back, callers from other communities, test coverage, security names, caller count and churn. One nothing uses scores 0. The overall risk_score, and so the Action's gate, takes the maximum. On click, deleting echo (20 callers) scores 0.65; changing it scores 0.40. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…train/2026-11-09 # Conflicts: # code_review_graph/graph.py # code_review_graph/rescript_resolver.py

…ain/2026-11-09 # Conflicts: # code_review_graph/graph.py # code_review_graph/parser.py

…rge train) #1154 lets the parser bind a receiver typed by a class in the same Java package, so pet.getName() is written as Pet.getName and the #1185 inherited pass moves it to NamedEntity.getName. The target is the one #1185 expects; the edge records the move under inherited_endpoint, not inherited_through. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ain/2026-11-09 # Conflicts: # code_review_graph/main.py

…n/2026-11-09 # Conflicts: # code_review_graph/skills.py

…1-09 # Conflicts: # README.md # code_review_graph/cli.py # code_review_graph/docs/LLM-OPTIMIZED-REFERENCE.md # code_review_graph/graph.py # code_review_graph/main.py # code_review_graph/parser.py # code_review_graph/search.py # code_review_graph/visualization.py # docs/COMMANDS.md # docs/USAGE.md # docs/schema.md # tests/test_visualization.py

…rain/2026-11-09 # Conflicts: # CLAUDE.md # code_review_graph/tools/query.py

…train/2026-11-09 # Conflicts: # code_review_graph/tools/query.py # docs/COMMANDS.md

…ain/2026-11-09 # Conflicts: # CLAUDE.md # code_review_graph/communities.py

#1139 loads igraph on first use through _load_igraph, so setting IGRAPH_AVAILABLE alone no longer makes detect_communities take the Leiden path when igraph is not installed. The #882 test now stubs the loader too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…rain/2026-11-09 # Conflicts: # code_review_graph/incremental.py # code_review_graph/tools/build.py

…train/2026-11-09 # Conflicts: # code_review_graph/cli.py # docs/USAGE.md

… train/2026-11-09 # Conflicts: # code_review_graph/graph.py

…s' into train/2026-11-09 # Conflicts: # README.md # code_review_graph/changes.py # code_review_graph/tools/review.py

…rge train) #1171 turns an edge whose qualified target no longer exists back into the plain name and keeps the old target under claimed_endpoint. #1184 looked up the users of a deleted symbol by that old target, so a caller in another file was missed and the removed symbol read as unused. The lookup now also reads the claim. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The #895 test expects a search for helper_0_0_0 to fill less than its window. When sentence-transformers is installed, the embed_graph_tool case earlier in the module leaves vectors behind, vector search ranks every node and the window fills. The test now stubs vector search, so it gives the same answer whichever extras are present. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-11-09T18:07:29Z

code-review-graph review

Overall risk: 0.85 (CRITICAL) — 500 changed function(s)/class(es), 141 affected flow(s), 345 test gap(s) (142 with no tested caller found, 203 reached only through a caller)

Risk-scored changes

Risk	Level	Symbol	Location	Tested
0.85	critical	code_review_graph/changes.py::_sum_signals	code_review_graph/changes.py:1296	indirect
0.85	critical	code_review_graph/custom_languages.py::_validate_entry	code_review_graph/custom_languages.py:201	yes
0.85	critical	code_review_graph/graph.py::_certainty_tier_sql	code_review_graph/graph.py:644	indirect
0.85	critical	code_review_graph/graph.py::GraphStore._invalidate_cache	code_review_graph/graph.py:1156	yes
0.85	critical	code_review_graph/graph.py::GraphStore._semantic_signature	code_review_graph/graph.py:1283	indirect
0.85	critical	code_review_graph/graph.py::GraphStore._row_semantic_signature	code_review_graph/graph.py:1297	indirect
0.80	high	code-review-graph-vscode/src/backend/sqlite.ts::SqliteReader.checkSchemaCompatibility	code-review-graph-vscode/src/backend/sqlite.ts:194	no
0.80	high	code_review_graph/communities.py::_reassign_test_nodes	code_review_graph/communities.py:271	yes
0.80	high	code_review_graph/npm_alias_resolver.py::_token_comparators	code_review_graph/npm_alias_resolver.py:362	indirect
0.75	high	code_review_graph/changes.py::is_test_gap_exempt	code_review_graph/changes.py:67	indirect

Affected execution flows

activate — criticality 0.76, 37 node(s) across 8 file(s)
benchmark_debug_workflow — criticality 0.74, 839 node(s) across 20 file(s)
benchmark_pre_merge_workflow — criticality 0.74, 789 node(s) across 19 file(s)
benchmark_architecture_workflow — criticality 0.74, 780 node(s) across 19 file(s)
benchmark_onboard_workflow — criticality 0.74, 770 node(s) across 17 file(s)
...and 136 more affected flow(s)

Test gaps

code-review-graph-vscode/src/backend/sqlite.ts::SqliteReader (code-review-graph-vscode/src/backend/sqlite.ts:160)
code-review-graph-vscode/src/backend/sqlite.ts::SqliteReader.checkSchemaCompatibility (code-review-graph-vscode/src/backend/sqlite.ts:194)
code_review_graph/changes.py::_OldSide (code_review_graph/changes.py:796)
code_review_graph/changes.py::_bare_call_reaches (code_review_graph/changes.py:859)
code_review_graph/changes.py::_RemovedUsers (code_review_graph/changes.py:886)
...and 137 more with no direct test

Reached only through a caller

No test names these directly, but a tested caller reaches them along the call path shown. That is a path in the call graph, not a record of execution -- the caller's tests may never take this branch. Treat it as where to look, not as coverage: these count as gaps and are scored as untested.

code_review_graph/analysis.py::_shortest_loop (code_review_graph/analysis.py:130) — via code_review_graph/analysis.py::find_import_cycles, 1 hop(s)
code_review_graph/analysis.py::short (code_review_graph/analysis.py:206) — via code_review_graph/analysis.py::find_import_cycles, 1 hop(s)
code_review_graph/analysis.py::adjacency (code_review_graph/analysis.py:210) — via code_review_graph/analysis.py::find_import_cycles, 1 hop(s)
code_review_graph/change_details.py::_changed_nodes (code_review_graph/change_details.py:142) — via code_review_graph/change_details.py::build_change_details, 1 hop(s)
code_review_graph/change_details.py::_where (code_review_graph/change_details.py:157) — via code_review_graph/change_details.py::build_change_details, 2 hop(s)
...and 198 more reached only through a caller

Token savings: this graph-backed report used ~1,314,833 fewer tokens (~67%) than reading every changed file in full (estimated, chars/4 approximation).

Note: analysis was capped at the configured maximum number of changed functions (set CRG_MAX_CHANGED_FUNCS to adjust).

Powered by code-review-graph — local-first analysis; no code leaves the CI runner.

The multi-repo HTTP tests unpacked three values from the Streamable HTTP client, but mcp 2.x yields two. The Jedi tests matched the stored path against root.resolve(), which Windows can spell differently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mcp 2.x takes the client read timeout in seconds rather than a timedelta, and renamed CallToolResult.isError to is_error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

MrB1ZZ and others added 30 commits August 4, 2026 05:24

fix(graph): preserve qualified-name collisions

93cc8ad

fix(graph): stabilize collision identities across reindex

502f668

fix(graph): stabilize collision-set transitions

0cea862

feat(skills): add documentary skill generator

29bb9f9

fix(graph): preserve unique identity and indexed lookup

398adda

docs: update README for fixed co-change benchmark + working Jedi enri…

6f7ef11

…chment - Remove 'harness needs fixing' note (co-change mode now works) - Clarify why published eval CSVs show predicted_files=0 (non-code seeds) - Update limitations section to reflect working co-change mode

Index Liquid templates

33df30d

fix(typescript): resolve npm aliases to workspace packages

8900441

fix(query): bound remaining response lists

097f8ce

fix(deps): test declared minimum versions

75515d4

fix(csharp): bind calls with namespace-aware identities

7696119

fix(csharp): preserve lexical context for each call

a6c2573

fix(csharp): refresh rebound flows and preserve lexical lookup

ced4f45

docs(changelog): record C# namespace identity and rebinding

b7e713d

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

fix(csharp): preserve arity in partial type lookup

f718e09

feat(container): add Docker and Podman support

7a47f2d

Merge branch 'staging' into feat/container-image

69456a6

Merge branch 'staging' into dependabot/pip/fastmcp-gte-3.2.4-and-lt-5

268a370

Merge branch 'staging' into fix/343-npm-alias-imports

1baf821

Merge branch 'staging' into fix/348-liquid-indexing

7fb0c43

Merge branch 'staging' into codex/documentary-skills-generator

c9686fd

Merge branch 'staging' into feat/container-image

21d8fd0

fix(container): trust workspace mounts and document graph paths

7d3af0d

tirth8205 and others added 18 commits November 9, 2026 21:16

Merge remote-tracking branch 'origin/fix/984-honest-confidence' into …

1a7f159

…train/2026-11-09 # Conflicts: # code_review_graph/graph.py # code_review_graph/rescript_resolver.py

Merge remote-tracking branch 'origin/fix/984-inherited-calls' into tr…

22ff126

…ain/2026-11-09 # Conflicts: # code_review_graph/graph.py # code_review_graph/parser.py

Merge remote-tracking branch 'origin/fix/607-multi-repo-http' into tr…

c75334a

…ain/2026-11-09 # Conflicts: # code_review_graph/main.py

Merge remote-tracking branch 'origin/fix/311-sibling-repos' into trai…

f248218

…n/2026-11-09 # Conflicts: # code_review_graph/skills.py

Merge remote-tracking branch 'origin/feat/813-context-history' into t…

3390a58

…rain/2026-11-09 # Conflicts: # CLAUDE.md # code_review_graph/tools/query.py

Merge remote-tracking branch 'origin/fix/850-laravel-tests-for' into …

b9007c0

…train/2026-11-09 # Conflicts: # code_review_graph/tools/query.py # docs/COMMANDS.md

Merge remote-tracking branch 'origin/feat/882-action-context' into tr…

3597612

…ain/2026-11-09 # Conflicts: # CLAUDE.md # code_review_graph/communities.py

Merge remote-tracking branch 'origin/feat/269-follow-symlinks' into t…

19f6f09

…rain/2026-11-09 # Conflicts: # code_review_graph/incremental.py # code_review_graph/tools/build.py

Merge remote-tracking branch 'origin/feat/471-gitignore-opt-in' into …

319c2fa

…train/2026-11-09 # Conflicts: # code_review_graph/cli.py # docs/USAGE.md

Merge remote-tracking branch 'origin/fix/tests-for-stable-order' into…

ba9c7df

… train/2026-11-09 # Conflicts: # code_review_graph/graph.py

Merge remote-tracking branch 'origin/fix/pure-deletion-removed-symbol…

b372869

…s' into train/2026-11-09 # Conflicts: # README.md # code_review_graph/changes.py # code_review_graph/tools/review.py

tirth8205 mentioned this pull request Nov 9, 2026

fix(install): show each change in --dry-run and write nothing before the question #1173

Merged

fix: multi-repo HTTP tests work on mcp 1.x and 2.x (merge train)

0785dfd

mcp 2.x takes the client read timeout in seconds rather than a timedelta, and renamed CallToolResult.isError to is_error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tirth8205 merged commit d01c1fd into staging Nov 9, 2026
45 of 46 checks passed

Navigation Menu

Repository navigation

Merge train: 43 reviewed PRs (2026-11-09) - #1186

Merge train: 43 reviewed PRs (2026-11-09)#1186
tirth8205 merged 233 commits into
stagingfrom
train/2026-11-09

tirth8205 commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Conversation

tirth8205 commented Nov 9, 2026

Included

Query and search

Review and change analysis

Languages

Build, update, watch and storage

Install, server and platforms

Dependencies and tests

Not included

How it was checked

Not tested

Worth knowing

Uh oh!

github-actions Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

code-review-graph review

Risk-scored changes

Affected execution flows

Test gaps

Reached only through a caller

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

github-actions Bot commented Nov 9, 2026 •

edited

Loading