Unresolvable calls are bound to any same-named symbol (Jest `describe`, RxJS `take`) and trace_path exposes no confidence/strategy

[artaommahe]

Version

codebase-memory-mcp 0.9.1-rc.1

Platform

macOS (Apple Silicon)

Install channel

GitHub release archive / install.sh / install.ps1

Binary variant

standard

What happened, and what did you expect?

When a called name can't be resolved to a definition, the unique_name / qualified_suffix / suffix_match fallbacks bind it to any same-named symbol anywhere in the project — including test-runner globals and library operators that have no relationship to the matched symbol. trace_path then reports these as callers with no confidence or strategy column, so the caller list reads as fact.

Minimal case: a Jest/Jasmine describe('...', () => {}) block in a .spec.ts file becomes a CALLS edge to an application method named describe in an unrelated file, at confidence 0.75.

At scale on a private Angular monorepo (11,788 files, 63,840 nodes / 120,805 edges), the entire top of the inbound-call ranking is fabricated:

callee reported by the graph	inbound CALLS	what the call sites actually are
ScheduleOpenShiftViewComponent.take	457	the RxJS take(n) pipe operator (486 take( occurrences repo-wide; take imported from rxjs/operators in 326 files)
ReportService.describe	377	the Jest describe() global (794 spec files)
ReportApi.describe	275	same
PersonalScheduleComponent.date	264	see below
PermissionDirective.permission	207	unrelated permission references

Filtering on confidence does not rescue it: with WHERE r.confidence >= 0.9, the top callee is still PersonalScheduleComponent.date with 250 inbound edges.

Two of those recorded "call sites" are not calls at all. I opened the source and verified both:

• An @Input() set date(date: string | Date) { ... } setter declaration in file A is recorded as a CALLS edge (strategy import_map) to a set date(...) setter in unrelated file B. The edge's line property points at the setter's own declaration line, not at any call.
• lazySelect(getTimesheet(this.timesheet.id)) — where this.timesheet is a property access — is recorded as a CALLS edge to a method named timesheet on an unrelated API class.

I could not reduce those last two to dummy code (plain and @Input()-decorated setters in two files did not reproduce them in isolation), so I report them as observed-and-source-verified rather than minimally reduced. The test-global case reduces cleanly and is in the repro repo.

Expected, in rough priority order:

1. Prefer no edge over a guessed one when the callee is unresolvable — especially for known test-runner and library globals.
2. Never emit a CALLS edge for a setter declaration or a property access.
3. Surface strategy and confidence in trace_path output (a column, or a --min-confidence filter). That data exists in the store but today is only reachable by hand-writing query_graph, so the default path for an agent is the unfiltered, unlabelled one.

Reproduction

Public repro repo: https://github.com/artaommahe/codebase-memory-mcp-rc-repros — see Case B.

git clone https://github.com/artaommahe/codebase-memory-mcp-rc-repros
cd codebase-memory-mcp-rc-repros
codebase-memory-mcp cli index_repository --repo-path "$PWD" --mode full --name cbm-rc-repros

codebase-memory-mcp cli query_graph --project cbm-rc-repros \
  --query "MATCH (a)-[r:CALLS]->(b) RETURN a.file_path AS caller, b.qualified_name AS callee, r.strategy AS s, r.confidence AS c, r.line AS line LIMIT 10"

src/app/report.spec.ts contains only Jest describe/it/expect globals. src/app/report.service.ts defines an unrelated method named describe. Observed (row 2 of 5):

  src/app/report.spec.ts cbm-rc-repros.src.app.report.service.ReportService.describe unique_name "0.75" "9"

Line 9 is the describe('another suite', ...) block in the spec file. trace_path --function-name describe --direction inbound --include-tests true then lists the spec as a caller with no indication that the binding is a guess.

Project scale (if relevant)

Aggregate figures are from a private Angular monorepo: 11,788 files, 63,840 nodes / 120,805 edges, --mode full, 10,175 .ts files, 794 .spec.ts files. CALLS strategy mix across all 15,837 edges: unique_name 5,923, lsp_ts_method 3,051, suffix_match 2,147, import_map 1,923, same_module 1,490, qualified_suffix 707, lsp_ts_local 408, remainder <100 each. Roughly 5,500 edges carry confidence below 0.5. The linked repro is self-contained dummy code.

Confirmations

• I searched existing issues and this is not a duplicate.
• My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.

---

Posted by Claude Code on behalf of @artaommahe

[artaommahe]

I need to correct two bullets in the body that I got wrong, and in the process I found what I think is the actual root cause — it's more specific and more actionable than what I originally filed.

The headline holds up

Re-verified independently: of 40 sampled inbound edges to …ScheduleOpenShiftViewComponent.take, 40/40 land on a source line literally containing take(, in files importing take from rxjs. Of 30 sampled edges into the two describe methods, 30/30 land on a describe( line in a spec file. So the misattribution is real and not a misreading of the call sites. (Two small figure corrections: take is imported from 'rxjs/operators' in 228 files and from any 'rxjs*' specifier in 327; there are 796 .spec.ts files, not 794.)

trace_path exposing no confidence or strategy is also confirmed — no column in tree or json format, no --min-confidence flag.

Correction 1: my two "not calls at all" bullets are wrong about the mechanism

I claimed an @Input() set date(...) setter declaration was recorded as a call, with the edge's line pointing at the declaration. That is not what happens. In the case I looked at, line 98 is the setter declaration and line 99 — the line the edge actually points to — is a real call, const updatedDate = parseDate(date);. I misread the offset and then generalised from it. Same error on the timesheet bullet: pulling r.callee for all edges into nodes named timesheet gives real function names (getTimesheet 6, hasTimesheetPermission 3, sumApprovedTimesheets 3, …), all import_map @ 0.95 — not the property access I described.

Please disregard both bullets, and my "Expected #2" ("never emit a CALLS edge for a setter declaration or a property access") — it asks for the wrong fix.

There is a smaller property-access class, but it's a different strategy and I should have separated it: of the 264 edges into PersonalScheduleComponent.date, 19 have r.callee = "this.date" via suffix_match @ 0.55, and one of the timesheet edges is r.callee = "this.timesheet", also suffix_match @ 0.55. So bare this.<prop> receivers do become call edges, but at low confidence and in small numbers — not the main event.

The actual root cause: import_map discards the imported identifier

This is the part worth acting on. import_map appears to reduce the import target to a path segment — a directory name, or a dot-segment of a dotted filename — and then binds the imported symbol to any node whose qualified name ends in that segment, ignoring which identifier was actually imported. Grouping all import_map edges by r.callee against the node they landed on:

imported symbol (r.callee)	node it was bound to	edges
parseDate	date	145
hasPermission	permission	136
getDayListWithoutTotals	employee	41
permissionDepartments	permission	24
getTimesheet	timesheet	6
AppStateBuilder	AppStateBuilder	102 ✅
mergeEntities	mergeEntities	32 ✅

Where the imported name happens to coincide with the segment the edge is correct; otherwise the call is attributed to an unrelated symbol that merely shares a name with a directory or a *.helper.ts / *.service.ts filename stem.

Why this matters more than the unique_name cases I led with:

1. import_map fires at confidence 0.95, which is exactly why filtering on confidence doesn't clean up the ranking — the date cluster survives >= 0.9.
2. It's triggered by ordinary Angular file-naming conventions (date.helper.ts, permission-util.ts, feature folders), so it will hit essentially every Angular codebase.

Revised ask, replacing my original #2: import_map should key on the imported identifier and must not reduce a module path to a bare directory or dot-segment.

Correction 2: "the entire top of the inbound-call ranking is fabricated" overstates it

The real unfiltered top 10 is:

project.inject                                            1627
ScheduleOpenShiftViewComponent.take                        457
integrations-ui.component.stories.Input                    383
ReportService.describe                                     377
no-readonly.filter                                         352
provideTranslateServiceTesting                             345
ReportApi.describe                                         275
project.input                                              265
PersonalScheduleComponent.date                             264
PermissionDirective.permission                             207

provideTranslateServiceTesting is a genuinely-called test helper, and I haven't characterised project.inject / project.input. "Several of the top 10", not "the entire top" — I'd filtered the ranking and then described the filtered result as though it were the whole.

On my third ask

Exposing strategy/confidence through trace_path overlaps #786 (MCP freshness/provenance evidence for client trust decisions) — happy to have it folded in there rather than tracked here.

Likely shared code site with #1354

cbm_tsjs_suppress_weak_method_match(is_tsjs, is_method, strategy) in src/pipeline/registry.c (called from pass_calls.c / pass_parallel.c) is asserted in tests/test_registry.c to return true for ("unique_name", is_method=true) — i.e. weak matches should already be suppressed for TS member calls. Yet the cross-file Method→Method population contains 557 unique_name + 215 suffix_match edges. Either those sites aren't flagged is_method or the guard isn't reached, which would explain both the fabricated edges here and the missing ones in #1354.

---

Posted by Claude Code on behalf of @artaommahe