fix(call-graph): TS/JS spread qualifier, namespace-import aliases, package self-reference (#3787 #3788 #3789)

[squid-protocol]

Three TS/JS call-graph and import-graph fixes, measured against the TypeScript compiler reference (zod, the only TS reference repo in tests/import_graph_corpus.json).

#3787: a spread ...f() is not a receiver

• Root cause: _call_qualifier read the first dot of ... as a member-access separator with no identifier before it, so ...parseCaseValue(x) got qualifier <expr> and resolved as an untyped receiver (methods only), missing the same-file function.
• Fix: a spread ends the receiver walk: ...f() is a bare call (''), ...ns.f() is a call on ns.
• Test: test_calls_out_qualifiers_3329.py::test_spread_operator_is_not_a_receiver (fails without the fix).

#3788: ns.f() when the alias differs from the file name

• Root cause: the import step matched a qualifier only against imported file stems/dirs; no alias to module map existed.
• Fix: JS/TS files record namespace aliases (import * as, import x = require, const x = require) as file_data.namespace_imports (new nullable column with schema heal, rehydrated for delta scans; an alias bound to two different modules is dropped). The import pass resolves each to a file (NetworkRiskSensor.namespace_aliases), and ns.f() resolves at the import step to that module or what a barrel (index.*, 2 hops) re-exports. explain_call.py passes the aliases too.
• Test: tests/core_engine/test_namespace_imports_3788.py (13 tests: capture, resolution, barrel, negatives, persist/rehydrate).

#3789: a package importing itself by name

• Root cause: _resolve_path_mirror treated zod/v4 as an external package.
• Fix: new core/package_self_reference.py. The nearest package.json name must equal the specifier's package, then exports (subpaths, * patterns, conditions in declaration order, null hides; with no exports: main/module/the subpath) names the target, which must be a scanned file (.js maps to .ts). Another package, an undeclared subpath, or a nameless/nested manifest resolves to nothing. Reads via source_text.read_source, bounded (1 MB, depth 6, 24 targets, per-directory cache). Needs the scan root (set by galaxyscope). Workspace siblings are not handled.
• Test: tests/core_engine/test_package_self_reference_3789.py (18 tests).

Measurements (zod, vs tsc 6.0.2)

	confident precision	strict precision	confident judged	recall	resolution recall
main	99.9	96.6	1520	57.1	73.7
+ #3787	99.9	96.7		58.6	75.8
+ #3788	99.9	96.8		60.6	78.4
+ #3789	99.9	96.8	1614	60.6	78.4

Confident precision does not drop; ambiguous precision stays 32.1. #3789 adds nothing to the call graph by itself: the 133 z.x() calls need the self-import edge AND a re-export chain (see follow-ups). Its evidence is the import graph:

import graph (zod)	resolvable imports	engine edges	precision	recall
main	666	629	100.0	100.0
branch, old reference	666	817	77.0	100.0
branch, reference scores self-reference	859	817	100.0	100.0

The 188 new engine edges all read as false positives because the tree-sitter reference treated every bare specifier as external. Samples are real (import { z } from "zod/v3" in src/v3/benchmarks/*.ts to src/v3/index.ts, declared by package.json exports). The reference now implements Node self-reference independently (_self_reference in import_graph_accuracy.py). javascript (express) was not measured: the corpus repo is not fetched here.

Baselines

• call_graph_resolution_typescript_baseline.json: recall 57.1 to 60.6, resolution recall 73.7 to 78.4, judged 1520 to 1614, strict precision 96.6 to 96.8.
• import_graph_accuracy_baseline.json, typescript only: edges 629 to 817, imports 666 to 859 (hand-edited: --regenerate needs every language fetched).

Golden drift (both legs re-blessed with crucible_check --update, scope audited with bless_scope.py)

• fp-ts: TaskEither.getApplicativeTaskValidation now links to Either.getApplicativeValidation (fan_out 0 to 1, fan_in 3 to 4, PageRank 4e-05 to 5.6e-05). TS, fixed by [TS/JS] A spread call ...f() records qualifier <expr>, so a bare call resolves as an untyped receiver and finds nothing #3787/Call resolver (TS/JS): ns.f() misses when the namespace import's alias differs from the file name (import * as processors from "./json-schema-processors.js") #3788.
• PageRank ripples of about 1e-6 in racket fun.c (_apply) and apollo WAITLIST.agc (TASKOVER): global PageRank renormalisation after the new edge. No other field moved. 0 files newly parsed/excluded.
• Note for reviewers: blessing from ~/venvs/galaxy_venv directly drifts ~2,900 leaves on origin/main itself (that venv differs from the gate's); bless via crucible_check.py --update instead. Also, a bless under heavy load can time out bootstrap.rtl.css and fake drift.

Gates

pr_gates.py: 7/7 pass (lint, audits, secrets, xray, gauntlet, golden, full suite) on the tree merged with main.

Follow-ups (not filed)

• zod's z.x() recall needs re-export tracking: v4/index -> classic/index -> external -> schemas; external.ts is not barrel-named, so alias scope stops there. Needs per-file export * from capture.
• explain_call.py builds its sensor without a scan root, so self-reference aliases do not reproduce there.
• Workspace siblings importing each other by package name are not handled.
• Call resolver: an untyped receiver's built-in method call (str.trim(), map.get()) links confidently to a same-named repo method via file/import #3756 (same resolver): the untyped-receiver fallback is the _ladder(bucket.methods, ...) call in _resolve_one, after the new alias rule; nothing here changes it.
• This PR should merge before the Golden master signal coverage: 20 signals never fire on the crucible (mostly security/AI), so regressions in them are invisible #4108 crucible-pin PR; any other PR touching golden masters re-blesses after merging main.

Closes #3787
Closes #3788
Closes #3789

🤖 Generated with Claude Code

https://claude.ai/code/session_013sNMtAg6s9dyyjNgnjRHi8

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab