…#1577)

Each of these produced a plausible-looking result rather than a failure,
which is the class an agent cannot detect and will act on.

get_repository_stats inflated every per-repo count (#1529)

The per-repository branch counted CONTAINS *paths*, not nodes. The writer
creates File->CONTAINS->Function, Class->CONTAINS->Function and
Function->CONTAINS->Function, so every method is reached 2+ times. On a
live single-repo database this reported 2202 functions against 1551 real
Function nodes, while the tool's own global branch reported 1551 — two
branches of one tool disagreeing by 42%. The module counter already used
count(DISTINCT m); the file, function and class counters now do too.

find_callers misattributed callers across same-named functions (#1530)

target_file_path was hoisted to the envelope from the first row and
stripped from the rest, on the assumption it is constant. Without
`context`, who_calls_function matches Function {name} across every file,
so rows legitimately carry different targets and every caller was
reported as calling whichever definition sorted first. Now hoisted only
when the rows agree; otherwise the field stays per-row and the envelope
carries a note naming the ambiguity.

graph_name silently discarded for dead_code and find_complexity (#1531)

Both inner methods default graph_name to None and re-assign the shared
_active_graph, so omitting it at the dispatch site redirected the query
to the default graph. On FalkorDB — the default, multi-graph backend —
that returns results for the wrong repository with no error.

count(*) after OPTIONAL MATCH, and a phantom collect() entry (#1533)

An unmatched OPTIONAL MATCH still emits one null row, so count(*) meant
injection_count was never 0 and every Spring bean reported at least one
injector; now counts the bound relationship. Separately, a map literal is
non-null even when every field inside is null, so collect() kept an
all-null entry for a datasource with no key patterns; now collects the
node and projects afterwards.

add_code_to_graph advertised an argument it ignored (#1558)

graph_name is in the tool schema but the handler never read it, so an
agent could index into "service-a", be told it succeeded, and find
nothing there. Honouring it needs a per-job writer threaded through the
pipeline (GraphBuilder binds its GraphWriter to the default driver at
construction), so this refuses explicitly instead. Full support stays
open on #1558.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…600, #1559) (#1578)

Two implementations existed and each got something the other got wrong, so
the same repository gave different answers depending which you asked.

Module-level JS calls were reported as dead (#600)

`find_dead_code` counted only `(caller:Function)` callers. A call at JS
module level is not inside a function, so the writer persists it as a
File-sourced edge — writer.py has an explicit `caller_label == "File"`
branch producing `(:File)-[:CALLS]->(:Function)`. Those edges exist and
were simply not counted, so any JS function called only at module level
came back dead. Python escapes this because its parser synthesizes a
`<module>` frame; javascript.py has no equivalent. The caller is now
anonymous, matching what the report generator already did correctly.

The entry-point filter hid real dead code (#1559)

`NOT func.name CONTAINS 'main'` also excluded `domain_check`,
`remainder` and `maintain_index`; the same applied to the 'application',
'entry' and 'entrypoint' substring tests. Genuinely unused functions were
never analyzed and nothing said so — the opposite failure from the false
positives #1332 is about. Now matched on the whole name.

`analyze dead-code` ignored its path argument (#1559)

The argument was accepted, labelled "(not yet implemented)", and dropped,
so running inside one repository reported dead code from every repository
in the database. Now forwarded as the repo scope.

The report generator disagreed with the CLI (#1559)

Its query had no name exclusions at all, so every dunder and `test_*`
appeared as dead in CGC_REPORT.md. Both now share `_ENTRY_POINT_NAMES` so
they cannot drift apart again.

The CLI help claimed classes were analyzed (#1559)

The query matches `(func:Function)` only. Corrected the help rather than
implement class-level dead code, which needs its own design.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…ract parameters (#1523, #1527) (#1581)

Nested classes overwrote their parent (#1523)

Class names were matched to class nodes by byte range: for each @name
capture the code walked the class list and assigned the name to the first
class whose range contained it. An outer class always contains an inner
class's name node, so the inner name landed on the outer class, and the
inner entry — never given a name — was dropped.

    class Client
      class TimeoutError < StandardError
      end
    end

yielded exactly one class: TimeoutError, carrying Client's line range,
with StandardError lost. Client vanished from the graph entirely.

Each class now reads its own `name` field. tree-sitter-ruby gives the
`class` keyword token the same node type as the definition, so nodes
without a name field are skipped.

Method parameters were always empty (#1527)

`_parse_method_parameters` scanned the method node's own children for
identifiers, but parameters live inside a `method_parameters` child; the
only direct identifier child is the method name, which the code
explicitly skipped. Every Ruby method reported no parameters, so no Ruby
function ever got a HAS_PARAMETER edge.

Now reads the parameters node and handles every Ruby form:

    def complex(a, b = 1, *rest, key:, **opts, &blk)
    -> ['a', 'b', '*rest', 'key', '**opts', '&blk']

Golden for sample_project_ruby regenerated: +11 Parameter nodes, no nodes
lost, no classes gained or lost (the fixture has no nested classes — that
case is covered by unit tests).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

#1524) (#1582)

The queries nested `pointer_declarator` inside `function_declarator`. The
real AST is the reverse — a pointer return type wraps the function
declarator from the outside:

    char* f() { }
    function_definition > pointer_declarator > function_declarator > identifier

So the second alternative in c.py matched nothing, and cpp.py had no
alternative at all. No function returning T*, T** or T& was extracted.

`pre_scan_c` and `pre_scan_cpp` carried their own copies of the same
inverted shape, so these functions were also missing from the cross-file
name map — invisible as call targets, not merely absent as nodes. Both
copies are fixed here, which is the half that restores resolution.

Covered forms: T*, T**, T& (C++), and the qualified out-of-line method
`char* Buf::data()`, whose class context survives the extra wrap.

Accessors returning T*/T&, factory functions and operator[] are pervasive
in C and C++, so this was a large silent gap.

No golden moved. The only pointer-returning function in the C/C++ fixtures
is `const char* get_color_name` in tough_macros.c, which sits inside an
X-macro region tree-sitter cannot parse (ERROR node at line 79) — so it is
unreachable for reasons unrelated to this fix.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

`variables` was hardcoded to `[]` and CSHARP_QUERIES had no `variables`
entry at all, so C# produced zero Variable nodes.

The larger cost was downstream: `resolution/calls.py` uses local-variable
declarations to infer a receiver's type, so

    var svc = new UserService();
    svc.Save();

could not resolve Save to UserService.Save — C# method calls fell back to
name-only heuristics.

Fields and locals share a shape: `variable_declaration` carries the type
and holds one `variable_declarator` per name, so `int A = 1, B = 2;`
yields two rows sharing a type. Both are captured, with the enclosing
method as `context` and the enclosing type as `class_context`.

One grammar detail worth recording: tree-sitter-c-sharp has no
`equals_value_clause`. The initialiser is a direct sibling after the `=`
token, which is what makes `var svc = new UserService()` usable for
receiver-type inference.

Golden for sample_project_csharp regenerated: +15 Variable nodes and the
+15 File->CONTAINS->Variable edges, nothing else.

Note the committed golden was already stale before this change —
regenerating on an unmodified main alone yields +3 Directory, +5 File,
+3 Module, CALLS 12->7 and IMPORTS 21->32. That drift is unrelated to this
work and is carried along here because the file had to be regenerated;
measured against a clean-main regeneration, this change contributes only
the Variable nodes and their CONTAINS edges.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Add regression tests to verify tool definitions remain consistent with MCPServer wrapper methods and declared tool names.

…gress <= 100% (#1583)

Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>

…instead of site-packages dir (#1586)

* fix(package-resolver): return .py file for flat single-file packages instead of site-packages dir

Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>

* test: drop the hardcoded contributor path from the flat-module test

sys.path.insert of an absolute /home/<user>/... path only works on the
machine it was written on, and shadows the package under test everywhere
else. The repo's own venv already puts src on the path.

---------

Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>
Co-authored-by: Shashank Shekhar Singh <Shashankshekharsingh1205@gmail.com>

…_parameters (#1591)

* fix(js): extract destructured, array, and rest parameters in _extract_parameters

Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>

* fix(js): record destructuring binding names, not a placeholder

Emitting '{...}' / '[...]' preserved arity but created Parameter nodes
whose names mean nothing. The binding is the name later code refers to —
`function Button({label})` is the dominant React idiom and `label` is
what appears in the body — so record it:

    function Button({label, onClick})  -> ['{label, onClick}']
    function renamed({c: cc, d = 1})   -> ['{cc, d}']      (local, not key)
    function nested({a: {b}})          -> ['{b}']
    function mixed(a, {b}, [c], ...r)  -> ['a','{b}','[c]','...r']

Still one entry per parameter position, so arity — which call resolution
matches on — is unchanged.

Golden for sample_project_javascript: +3 Parameter nodes, nothing lost.

---------

Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>
Co-authored-by: Shashank Shekhar Singh <Shashankshekharsingh1205@gmail.com>

Ten PRs since 0.5.6 — mostly parser correctness, all with regression tests.

Parsers
- Ruby nested classes no longer delete their parent; method parameters
  extracted at all (#1523, #1527, #1581)
- C/C++ functions returning a pointer or reference are extracted, and
  registered in pre_scan so they resolve as call targets (#1524, #1582)
- C# fields and locals parsed, restoring receiver-type inference for
  `var x = new T(); x.M();` (#1525, #1584)
- JavaScript destructured, array and rest parameters extracted, recording
  the binding names rather than a placeholder (#1527, #1591)

Queries and analysis
- Five defects that returned wrong answers without erroring: inflated
  repository stats, misattributed callers, discarded graph_name,
  count(*) after OPTIONAL MATCH, an ignored tool argument (#1577)
- Dead-code detection made correct and self-consistent, including the
  JS module-level false positive (#600, #1559, #1578)

Indexing
- add_package_to_graph on a flat module no longer indexes the whole
  virtualenv (#1528, #1586)
- SCIP job progress no longer exceeds 100% (#1535, #1583)

Docs and tests
- Database Options table columns realigned (#1590)
- MCP tool definition contract validation (#1580)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>