fix(native): resolve monorepo workspace package imports in the native engine

.claude/hooks/track-edits.sh

@@ -23,8 +23,27 @@ if [ -z "$FILE_PATH" ]; then
   exit 0
 fi
 
-# Use git worktree root so each worktree session has its own edit log
-PROJECT_DIR=$(git rev-parse --show-toplevel 2>/dev/null) || PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+# Resolve the git worktree that actually owns the edited file, rather than
+# the hook process's own ambient cwd. Edit/Write tool calls carry only an
+# absolute file_path with no associated "current directory" state, so the
+# hook's ambient cwd is not guaranteed to match the worktree the file lives
+# in (see issue #1838) — this mirrors the `-C "$WORK_DIR"` pattern
+# guard-git.sh already uses on the read side of this same check.
+#
+# Walk up to the nearest existing ancestor directory first: Write can target
+# a not-yet-created nested directory, and `git -C` requires an existing path.
+SEARCH_DIR=$(dirname -- "$FILE_PATH")
+while [ ! -d "$SEARCH_DIR" ] && [ "$SEARCH_DIR" != "/" ] && [ -n "$SEARCH_DIR" ]; do
+  SEARCH_DIR=$(dirname -- "$SEARCH_DIR")
+done
+
+PROJECT_DIR=""
+if [ -n "$SEARCH_DIR" ] && [ -d "$SEARCH_DIR" ]; then
+  PROJECT_DIR=$(git -C "$SEARCH_DIR" rev-parse --show-toplevel 2>/dev/null) || true
+fi
+if [ -z "$PROJECT_DIR" ]; then
+  PROJECT_DIR=$(git rev-parse --show-toplevel 2>/dev/null) || PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+fi
 LOG_FILE="$PROJECT_DIR/.claude/session-edits.log"
 
 # Normalize to relative path with forward slashes

.claude/hooks/update-graph.sh

@@ -24,23 +24,42 @@ if [ -z "$FILE_PATH" ]; then
   exit 0
 fi
 
-# Only rebuild for source files codegraph tracks
-# Skip docs, configs, test fixtures, and non-code files
-case "$FILE_PATH" in
-  *.js|*.ts|*.tsx|*.jsx|*.py|*.go|*.rs|*.java|*.cs|*.php|*.rb|*.tf|*.hcl)
-    ;;
-  *)
-    exit 0
-    ;;
-esac
+PROJECT_DIR=$(git rev-parse --show-toplevel 2>/dev/null) || PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+
+# Only rebuild for source files codegraph tracks.
+# Skip docs, configs, test fixtures, and non-code files.
+#
+# The real allowlist is EXTENSIONS (src/shared/constants.ts), derived from
+# LANGUAGE_REGISTRY (src/domain/parser.ts) — the single source of truth for
+# every language codegraph parses. `npm run build` snapshots it to
+# dist/hook-extensions.txt (see scripts/gen-hook-extensions.mjs) so this
+# hook can do a fast native bash/grep check on every Edit/Write instead of
+# spawning a second Node process, or hand-copying the list, on every edit.
+#
+# The case statement below is only a fallback for before the first build
+# (no dist/hook-extensions.txt yet). tests/unit/hook-extensions.test.ts
+# fails if it ever drifts behind EXTENSIONS — keep it updated when
+# LANGUAGE_REGISTRY gains a new extension.
+EXT=".${FILE_PATH##*.}"
+GENERATED_EXT_LIST="$PROJECT_DIR/dist/hook-extensions.txt"
+if [ -f "$GENERATED_EXT_LIST" ]; then
+  grep -qxF "$EXT" "$GENERATED_EXT_LIST" || exit 0
+else
+  case "$EXT" in
+    .R|.bash|.c|.cc|.cjs|.clj|.cljc|.cljs|.cpp|.cs|.cu|.cuh|.cxx|.dart|.erl|.ex|.exs|.fs|.fsi|.fsx|.gemspec|.gleam|.go|.groovy|.gvy|.h|.hcl|.hpp|.hrl|.hs|.java|.jl|.js|.jsx|.kt|.kts|.lua|.m|.mjs|.ml|.mli|.php|.phtml|.py|.pyi|.r|.rake|.rb|.rs|.scala|.sh|.sol|.sv|.swift|.tf|.ts|.tsx|.v|.zig)
+      ;;
+    *)
+      exit 0
+      ;;
+  esac
+fi
 
 # Skip test fixtures — they're copied to tmp dirs anyway
 if echo "$FILE_PATH" | grep -qE '(fixtures|__fixtures__|testdata)/'; then
   exit 0
 fi
 
 # Guard: codegraph DB must exist (project has been built at least once)
-PROJECT_DIR=$(git rev-parse --show-toplevel 2>/dev/null) || PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
 DB_PATH="$PROJECT_DIR/.codegraph/graph.db"
 if [ ! -f "$DB_PATH" ]; then
   exit 0
@@ -78,7 +97,7 @@ BUILD_OK=0
 if command -v codegraph &>/dev/null; then
   codegraph build "$PROJECT_DIR" -d "$DB_PATH" $BUILD_FLAGS 2>/dev/null && BUILD_OK=1 || true
 else
-  node "${CLAUDE_PROJECT_DIR:-$PROJECT_DIR}/src/cli.js" build "$PROJECT_DIR" -d "$DB_PATH" $BUILD_FLAGS 2>/dev/null && BUILD_OK=1 || true
+  node "${CLAUDE_PROJECT_DIR:-$PROJECT_DIR}/dist/cli.js" build "$PROJECT_DIR" -d "$DB_PATH" $BUILD_FLAGS 2>/dev/null && BUILD_OK=1 || true
 fi
 
 # Update marker only if we did a full rebuild AND it succeeded

.claude/skills/titan-gate/SKILL.md

@@ -45,6 +45,8 @@ codegraph check --staged --cycles --blast-radius 30 --boundaries -T --json
 
 This checks: manifesto rules, new cycle introduction, blast radius threshold, and architecture boundary violations. Exit code 0 = pass, 1 = fail.
 
+The `blast-radius` predicate is call-graph-shape-aware: a touched function's absolute transitive-caller count only counts toward the threshold if the diff actually changed that function's own declaration line or the set of call targets referenced in its body. A function whose body changed without touching a call expression or its own signature (e.g. an inline literal replaced by a named constant) is exempt even with a high absolute caller count — that fan-in is pre-existing risk already accepted by the codebase, not risk this diff introduced. This is the authoritative blast-radius pass/fail — see Step 8.
+
 Also run detailed impact analysis:
 
 ```bash
@@ -302,9 +304,9 @@ Advisory — prevents jumping ahead and creating conflicts.
 
 ## Step 8 — Blast radius check
 
-From diff-impact results:
-- Transitive blast radius > 30 → FAIL
-- Transitive blast radius > 15 → WARN
+The FAIL/PASS decision comes from Step 1's `codegraph check --staged --blast-radius 30` predicate — do not re-derive it from diff-impact's raw numbers, which are absolute transitive-caller counts and are NOT shape-aware:
+- Step 1's `blast-radius` predicate failed → FAIL (a touched function's own call graph shape genuinely changed and its transitive callers exceed 30)
+- Step 1's `blast-radius` predicate passed but a changed function's raw `transitiveCallers` (from diff-impact) > 15 → WARN (worth a second look even though not gating — this may include functions Step 1 exempted as pre-existing fan-in)
 - Historically coupled file NOT staged? → WARN ("consider also updating X")
 
 ---

.claude/skills/titan-grind/SKILL.md

@@ -109,8 +109,9 @@ Forge shapes the metal. Grind smooths the rough edges. Your goal: find helpers t
 
 12. **Capture dead-symbol baseline** (only if `grind.deadSymbolBaseline` is null):
     ```bash
-    codegraph roles --role dead -T --json | node -e "const d=[];process.stdin.on('data',c=>d.push(c));process.stdin.on('end',()=>{const items=JSON.parse(Buffer.concat(d));console.log(JSON.stringify({total:items.length,byRole:items.reduce((a,i)=>{a[i.role]=(a[i.role]||0)+1;return a},{})}));})"
+    codegraph roles --role dead -T --json | node -e "const d=[];process.stdin.on('data',c=>d.push(c));process.stdin.on('end',()=>{const data=JSON.parse(Buffer.concat(d));console.log(JSON.stringify({total:data.count,byRole:data.summary}));})"
     ```
+    `codegraph roles --json` returns `{ count, summary, symbols }` (not a bare array) — `summary` is already the per-role breakdown (e.g. `dead-leaf`, `dead-entry`, `dead-ffi`, `dead-unresolved`), so no manual reduce is needed.
     Store the total in `grind.deadSymbolBaseline`. Write `titan-state.json` immediately.
 
 13. **Drift detection.** Compare `titan-state.json → mainSHA` against current origin/main:
@@ -304,8 +305,8 @@ const tokens = helperName
   .slice(0, 3);
 const d=[];process.stdin.on('data',c=>d.push(c));
 process.stdin.on('end',()=>{ try {
-  const items=JSON.parse(Buffer.concat(d));
-  const candidates = items.filter(i =>
+  const data=JSON.parse(Buffer.concat(d));
+  const candidates = (data.symbols || []).filter(i =>
     i.name !== helperName &&
     tokens.some(t => i.name.toLowerCase().includes(t))
   );
@@ -579,7 +580,7 @@ After all targets in the phase are processed:
 
 ```bash
 codegraph build
-codegraph roles --role dead -T --json | node -e "const d=[];process.stdin.on('data',c=>d.push(c));process.stdin.on('end',()=>{const items=JSON.parse(Buffer.concat(d));console.log(JSON.stringify({total:items.length,byRole:items.reduce((a,i)=>{a[i.role]=(a[i.role]||0)+1;return a},{})}));})"
+codegraph roles --role dead -T --json | node -e "const d=[];process.stdin.on('data',c=>d.push(c));process.stdin.on('end',()=>{const data=JSON.parse(Buffer.concat(d));console.log(JSON.stringify({total:data.count,byRole:data.summary}));})"
 ```
 
 Store in `grind.deadSymbolCurrent`. Write `titan-state.json`.

.github/workflows/claude.yml

@@ -52,8 +52,11 @@ jobs:
         uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          model: claude-sonnet-4-6
-          direct_prompt: |
+          # claude-code-action v1 dropped the `model` input; model selection now goes
+          # through `claude_args` (see anthropics/claude-code-action migration guide).
+          claude_args: |
+            --model claude-sonnet-4-6
+          prompt: |
             ## Review this pull request
 
             You are reviewing a PR for **codegraph** — a local code dependency graph CLI that parses
@@ -211,6 +214,9 @@ jobs:
         uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          model: claude-sonnet-4-6
+          # claude-code-action v1 dropped the `model` input; model selection now goes
+          # through `claude_args` (see anthropics/claude-code-action migration guide).
+          claude_args: |
+            --model claude-sonnet-4-6
           additional_permissions: |
             actions: read

.gitignore

@@ -14,6 +14,7 @@ crates/codegraph-core/*.node
 .claude/worktrees/
 generated/DEPENDENCIES.md
 generated/DEPENDENCIES.json
+token-benchmark.partial.json
 artifacts/
 pkg/
 target/

CLAUDE.md

@@ -74,6 +74,7 @@ npm run test:coverage            # Coverage report
 npx vitest run tests/parsers/javascript.test.ts   # Single test file
 npx vitest run -t "finds cycles"                  # Single test by name
 npm run build:wasm               # Rebuild WASM grammars from devDeps (built automatically on npm install)
+npm run doctor                   # Check this worktree for a stale native binary / missing WASM grammars (runs automatically via pretest)
 ```
 
 **Linter/Formatter:** [Biome](https://biomejs.dev/) — config in `biome.json`, scoped to `src/` and `tests/`.
@@ -103,6 +104,7 @@ Source is TypeScript in `src/`, compiled via `tsup`. The Rust native engine live
 | `shared/paginate.ts` | Pagination helpers for bounded query results |
 | **`infrastructure/`** | **Platform and I/O plumbing** |
 | `infrastructure/config.ts` | `.codegraphrc.json` loading, env overrides, `apiKeyCommand` secret resolution |
+| `infrastructure/doctor.ts` | Environment health checks — stale `better-sqlite3` native ABI, incomplete `grammars/`; see `npm run doctor` |
 | `infrastructure/logger.ts` | Structured logging (`warn`, `debug`, `info`, `error`) |
 | `infrastructure/native.ts` | Native napi-rs addon loader with WASM fallback |
 | `infrastructure/registry.ts` | Global repo registry (`~/.codegraph/registry.json`) for multi-repo MCP |
@@ -126,7 +128,7 @@ Source is TypeScript in `src/`, compiled via `tsup`. The Rust native engine live
 | `features/boundaries.ts` | Architecture boundary rules with onion architecture preset |
 | `features/cfg.ts` | Control-flow graph generation |
 | `features/check.ts` | CI validation predicates (cycles, complexity, blast radius, boundaries) |
-| `features/communities.ts` | Louvain community detection, drift analysis (delegates to `graph/` subsystem) |
+| `features/communities.ts` | Leiden community detection, drift analysis (delegates to `graph/` subsystem) |
 | `features/complexity.ts` | Cognitive, cyclomatic, Halstead, MI computation from AST |
 | `features/dataflow.ts` | Dataflow analysis |
 | `features/export.ts` | Graph export orchestration: loads data from DB, delegates to `presentation/` serializers |
@@ -146,7 +148,7 @@ Source is TypeScript in `src/`, compiled via `tsup`. The Rust native engine live
 | `presentation/sequence-renderer.ts` | Mermaid sequence diagram rendering |
 | `presentation/table.ts`, `result-formatter.ts`, `colors.ts` | CLI table formatting, JSON/NDJSON output, color constants |
 | **`graph/`** | **Unified graph model** |
-| `graph/` | `CodeGraph` class (`model.ts`), algorithms (Tarjan SCC, Louvain, BFS, shortest path, centrality), classifiers (role, risk), builders (dependency, structure, temporal) |
+| `graph/` | `CodeGraph` class (`model.ts`), algorithms (Tarjan SCC, Leiden, BFS, shortest path, centrality), classifiers (role, risk), builders (dependency, structure, temporal) |
 | **`mcp/`** | **MCP server** |
 | `mcp/` | MCP server exposing graph queries to AI agents; single-repo by default, `--multi-repo` to enable cross-repo access |
 | `ast-analysis/` | Unified AST analysis framework: shared DFS walker (`visitor.ts`), engine orchestrator (`engine.ts`), extracted metrics (`metrics.ts`), and pluggable visitors for complexity, dataflow, and AST-store |