Parser correctness release. Ten PRs since 0.5.6, every fix with regression tests verified to fail without the change.

Parsers — silent data loss

Each of these produced no error; the graph was simply missing nodes and edges.

Ruby (#1523, #1527) — a nested class deleted its parent. Class names were matched to classes by byte range, so an inner class's name landed on the outer one, which then had no entry of its own. class Client wrapping class TimeoutError produced exactly one class. Separately, every Ruby method reported zero parameters, so no HAS_PARAMETER edge was ever created.

C/C++ (#1524) — no function returning a pointer or reference was extracted. The queries nested pointer_declarator inside function_declarator; the real AST wraps it from the outside. pre_scan_c/pre_scan_cpp carried the same inverted shape, so these functions were invisible as call targets too. Accessors returning T*, factory functions and operator[] are pervasive in C++.

C# (#1525) — variables was hardcoded to [] with no query at all. Beyond the missing nodes, this broke receiver-type inference: var svc = new UserService(); svc.Save(); could not resolve Save.

JavaScript (#1527) — destructured, array and rest parameters were dropped. function Button({label}) yielded nothing, which is the dominant React idiom. Bindings are now recorded by name ({label, onClick}), with {c: cc} correctly binding the local cc rather than the key.

Queries and analysis

#1577 — five defects that returned plausible wrong answers instead of erroring, the class an agent cannot detect:

• repository stats counted CONTAINS paths, not nodes — 2202 functions reported where 1551 exist, while the same tool's global branch said 1551
• find_callers attributed every caller to whichever definition sorted first
• graph_name was dropped, returning results from the wrong repository on FalkorDB
• count(*) after an unmatched OPTIONAL MATCH counted the null row, so injection_count was never 0
• add_code_to_graph advertised graph_name and silently ignored it

#1578 — dead-code detection made correct and self-consistent, including #600 (open since March): a module-level JS call is a File-sourced edge, and the query counted only Function callers. Also fixed a substring filter that hid real findings — NOT name CONTAINS 'main' also excluded domain_check and remainder.

Indexing

• #1528 — add_package_to_graph("six") resolved to the entire site-packages directory and would have indexed every installed dependency.
• #1535 — SCIP job progress could report 400% and negative time remaining.

Docs and tests

• #1590 — the Database Options table had 4 cells against 5 columns, shifting the last column.
• #1580 — bidirectional MCP tool/wrapper contract validation.

Full changelog: v0.5.6...v0.5.7

Bug-fix release. Four PRs since 0.5.5, all from external contributors.

Visualizer

LadybugDB graphs are no longer empty in the live viz server (#1458, #1506). KùzuDB spells its internal dict fields lowercase (_id/_label/_src/_dst); LadybugDB spells the same fields uppercase. v0.5.5 fixed only the offline renderer — the live server's /api/graph still keyed on lowercase alone and silently discarded every row on Ladybug. This covers the second call site, with 90 lines of new parsing tests.

A node name containing </script> no longer corrupts the offline page (#1514, #1562). json.dumps escapes quotes and backslashes but not <, > or &, and the graph is inlined straight into a <script> block — so an identifier or file path containing </script> closed the element early and the rest of the document was parsed as markup. Those three characters are now emitted in \uXXXX form, which keeps the payload valid JSON and valid JavaScript while making it inert as markup. title is HTML-escaped at both interpolation sites.

Tools

advanced_language_query(language="java") no longer crashes (#1534, #1560). JavaToolkit was the only toolkit with a non-zero-arg constructor, but the dispatcher builds them all as TOOLKITS[language]() — so Java raised an uncaught TypeError before reaching the error handling. Construction now also happens inside the try, so a future signature mismatch degrades to a structured error rather than escaping the tool contract.

Tests

Unit coverage for git_utils failure modes — success, empty output, CalledProcessError, FileNotFoundError, OSError (#1571, #1572).

Full changelog: v0.5.5...v0.5.6

Bug-fix release. Seven PRs since 0.5.4.

Indexing

cgc index no longer reports a partial index forever (#1565, #1566). On the SCIP path, files with no tree-sitter parser — README.md, appsettings.json, Dockerfile, .gitignore and friends — were skipped entirely, while the "expected" count included them. A 46-file C# project reported only 32 of 46 files indexed. Continuing. on every run, and no amount of re-indexing cleared it. Both pipelines now agree on what counts as a file.

Parsers

Python annotated parameters are no longer dropped (#1520, #1561). typed_parameter has no name field in tree-sitter-python, so every x: int parameter was silently discarded — x: int = 5 survived only because it is a different node type. Measured against the stdlib ast module over this repo's own source: 1952 → 3271 parameters, 40.3% loss → 0%.

Go grouped imports are recovered (#1521, #1561). The query only matched the single-line import "fmt" shape; gofmt groups any file with more than one import, so essentially every real Go file lost all of them.

PHP imports work at all (#1522, #1563). The query captured use_declaration — the trait use inside a class body — instead of namespace_use_declaration. Real imports were dropped, and trait uses were recorded as imports: one fixture's use Alpha, Beta { ... insteadof ... } became a Module node whose import name was the entire conflict-resolution block. Group forms like use Foo\Bar\{A, B as C}; now expand correctly.

Queries and safety

• Read-only Cypher validation could be bypassed by a quote inside a comment; literals and comments are now matched in a single pass (#1508).
• MCP-over-SSE endpoints were registered outside the authenticated router, leaving the tool surface reachable without a key when CGC_API_KEY was set — and the transport never delivered a message anyway, because the request body was read twice (#1508).
• Import aliases are read from the IMPORTS relationship rather than the Module node, so find_importers stops returning null (#1515, #1540).
• Bundle filenames are always sanitized, not just when the extension differs (#1517, #1541).
• GCF encode failures fall back to JSON instead of turning a successful tool call into an internal error (#1518, #1539).
• Plus indexing-crash fixes: a rebound path variable that aborted a whole run on one unwritable file, an f-string that made inheritance re-resolution raise before any query ran, and a TypeError in PHP trait-method resolution (#1508).

Note on graph counts

The parser fixes change what the graph contains — that is the point — so node and edge counts will move upward after re-indexing. Parameter and Module counts in particular.

Full changelog: v0.5.2...v0.5.5

🚀 CodeGraphContext for VS Code (v0.1.0 Alpha)

Transform your code understanding with a native, interactive call graph directly inside VS Code. This release introduces the first stable version of the CGC extension, bridging the gap between your editor and the powerful CodeGraphContext engine.

✨ Key Features

• Interactive 2D Call Graph: Visualize function relationships (Callers and Callees) in a dynamic, force-directed graph.
• Deep Editor Integration:
  • Context Menu: Right-click any function and select CGC: Show Call Graph.
  • Click-to-Navigate: Click any node in the graph to jump directly to the source code.
  • Real-time Intelligence: Built-in CodeLens and Hover support for complexity and call metrics.
• Performance First: A lightweight (30KB) implementation optimized for large-scale monorepos.

🛠️ How to Install

1. Install the Engine: The extension requires the CGC CLI.

   pip install codegraphcontext

2. Install the Extension:
   • Download the codegraphcontext-vscode-0.1.0.vsix asset from this release.
   • In VS Code, open the Extensions view (Ctrl+Shift+X).
   • Click ... (top right) -> Install from VSIX... -> Select the downloaded file.

🚦 Getting Started

1. Open your project in VS Code.
2. Run CGC: Refresh Index from the Command Palette (Ctrl+Shift+P) to index your workspace.
3. Right-click any function and select CGC: Show Call Graph to begin exploring.

📦 Assets

• codegraphcontext-vscode-0.1.0.vsix