[bompus]

Ports the resolution behaviour upstream added after the last merged batch (#586, pinned through 8e854d11): browser-host calls (colbymchenry#2907), enclosing-class member calls, Go receiver typing through parameters, func-typed fields and call results (colbymchenry#2543, colbymchenry#2581), library-method names on untyped receivers, and same-module copies. One commit, 19 files, +2,096/−44.

What changed

• Browser host globals (JS/TS): window.open(), localStorage.getItem(), location.reload(), a worker's self.postMessage() link no project method unless the file binds or imports the name. The rule reads whether the file mentions the name only as a receiver or after typeof; the collapsed-object path returns a tri-state (found / the browser's / not ours) so window.localStorage.getItem() declines while window.App.init() still resolves; an unbound self is the global object in both receiver readers.
• Enclosing-class members: render(), this.render(), super.render() bind to the caller's own class along Python's C3 order, Java's nested-type headers and Scala's siblings.
• Go receiver typing: parameters, func-typed fields (get func() A → the call is A), call results, range elements, and package shadowing (shadowPkg(store *Holder) makes store.New() the method, not the package).
• Library-method names: a std name on an untyped receiver (m.getOrElse, data.put, size) declines unless the receiver's own words name the type; a typed field, this., or a receiver named for the owner keeps it.
• Visibility: isVisibleAcrossFiles guards the name strategies only, as upstream does (index.ts:1867), so a typed store action and an imported component value are not treated as unexported module bindings; every language's own privacy still applies.

Gaps the port's tests found

• tree-sitter-cpp writes d.operator+=(c) as a call on the receiver with the operator name in an ERROR sibling, so no argument list was read and operator+=(int) took a call operator+=(const Counter&) fits. The operator_name node is matched instead, comments in the access included.
• go_field_type kept only a func-typed field's first token (func()), losing its result.
• Go result typing read a package function even when a parameter of the package's name shadowed it.
• A Python local was read by the strict scope rule alone, so store = A(); store = B(); store.get() resolved to nothing; the invocation-time binding decides now, with the fix(python): calls like reg.get() on a typed local or parameter reach the class's method colbymchenry/codegraph#2821 refusals (branch/loop/with bindings, outside-project bases) intact.
• Python inherited members were walked breadth-first, so Adapter(Left, Right) with Left(Root) reached Right's method before Root's; the walk is depth-first along the header and *bases expands its module-level tuple.

Checks

• vitest run: 11,142 passed, 11 failed, 44 skipped (934 files). All 11 failures reproduce on pristine origin/fork/consolidated (a7e5714b): 8 in js-builtin-method-calls, plus library-receiver-calls (fetch Response), route-inline-handler-calls, sync-typed-local-member-retry. The branch adds none.
• The port's own suites: 78/78 (browser-host-globals, enclosing-class-member-call, three Go files, library-method-calls, same-module-copy-resolution), and the Python suites the receiver change touches (python-self-call-not-import 61/61, receiver-scope-lookup 69/69, python-typed-builtin-method-calls 26/26).
• Golden dumps: torture-multilang re-baselined for one Java edge, confidence 0.4 → 0.9 (refName: norm, target unchanged) because the enclosing-class lookup now reads the bare norm() call inside Point.compareTo.
• npm test's check:kernel-rules gate fails on pascal_scope.rs on origin too (fixed separately by fix(kernel): unblock npm test on the default branch #584); the suite above is vitest run directly.

README rows

Checked the "About this fork" tables and the benchmark rows: none move. Resolution correctness only, no command, language, framework, config key or measured README number changes.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: bompus/codegraph
• Branch: fix/upstream-drift-batch3
• File: .coderabbit.yaml
• Commit: 028cdba
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: eee1e057-90dd-49c4-a35b-63c6cf8972b2

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[bompus]

Review round (GPT-6.1 Sol, xhigh) returned fix-then-ship with seven findings, all fixed in 028cdba8, each with a regression test.

• P1 Unicode panic: the typeof lookbehind starts on a character boundary now. Test: π before window.open().
• P2 C3 order: inherited_through reads Python's C3 order and each class's own member, so a diamond (Left(Root), Right(Root), both Root and Right defining the name) reaches Right's. Test: the diamond.
• P2 base sorting: the header-position sort in python_mro is reverted; it could match the subclass's own name first (class Model(Mixin, parent.Model)). Test: that header.
• P2 func field: stops at ; and a struct tag. Test: get func() *A; other *B \json:"other"`→A::Run`.
• P2 generic exception: limited to Recv/RecvMsg on a binding that is still a parameter.
• P2 template interpolation: a lexical binding of the name at the call keeps it the file's own; a ${…} interpolation's blanked contents cannot hide the parameter. Test: ${((document: Model) => document.save())(model)} → Model::save.
• P2 splat base scope: *bases is read from the module-level tuple written before the class.

Also fixed the pre-existing defect the review found: python_types.rs had a literal backspace instead of regex \b in the conditional-binding guard; the chosen conditional binding is now refused when the evidence conflicts.

The golden explanation is corrected too: TortureRecord.java:24 calls bare norm() inside Point.compareTo, so the enclosing-class lookup explains the 0.4 → 0.9 confidence, not a var initializer.

Full suite after the fixes: 11,146 passed, 11 failed — the same 11 that reproduce on pristine origin.