find a bug? #2122

Version

codebase-memory-mcp 0.10.5

Platform

macOS (Apple Silicon)

Install channel

GitHub release archive / install.sh / install.ps1

Binary variant

standard

What happened, and what did you expect?

PHP builtin functions (sprintf, str_replace, exit) are being resolved to unrelated browser-side JavaScript functions in minified libraries, producing fabricated cross-language CALLS edges that violate runtime boundaries:

• sprintf(...) in PHP server code → CALLS edge to sprintf in public/assets/libs/iCMS/iCMS.js
• str_replace(...) in PHP → CALLS edge to str_replace in iCMS.js
• exit() in PHP → CALLS edge to exit in pdfmake.min.js

Runtime boundary violation: These edges represent server-side PHP process calling browser-side JavaScript closures — physically impossible at runtime. The only commonality is method name coincidence in compressed assets.

Measured impact (iCMS v8.0.0 project)

Total: 751 fabricated PHP→JS edges (100% targeting assets/libs/*/min.js or vendor bundles)

Grep verification:

grep -r "sprintf\|str_replace\|exit" public/assets/libs/iCMS/iCMS.js  # finds JS var names
grep -c "iCMS.js" app/  # 0 — server code never imports browser assets

Consequences

1. Phantom callers: Browser libraries appear to be called by server code → dead-code analysis reports them as live
2. Architecture pollution: get_architecture hotspots rank browser utility functions as "core server logic"
3. Blast radius inflation: Impact analysis includes nodes that cannot be affected (server→client boundary crossed)
4. Cross-service trace poisoning: trace_path returns impossible call chains (PHP backend → browser frontend)

This is more severe than #2121 (C# BCL) / #2053 (Rust std) — those are same-language stdlib confusion; this is cross-language + runtime boundary violation.

Reproduction

Minimal setup

composer.json:

{
  "name": "test/php-js-repro",
  "require": {"php": ">=7.4"}
}

public/assets/libs/compressed.min.js (browser bundle):

(function(){var sprintf=function(a,b){return a+b};window.util={sprintf:sprintf}})();

app/Controller.php (server code):

<?php
namespace App;

class Controller {
    public function render($template, $vars) {
        // PHP builtin sprintf — server-side only
        return sprintf("Template: %s", $template);
    }
}

Commands

codebase-memory-mcp cli index_repository --repo-path /tmp/php-js-repro --mode full
codebase-memory-mcp cli query_graph --project tmp-php-js-repro \
  --query "MATCH (php)-[:CALLS]->(js) WHERE php.file_path ENDS WITH '.php' AND js.file_path ENDS WITH '.js' RETURN php.qualified_name AS caller, js.qualified_name AS callee, js.file_path"

Expected vs Actual

Expected: Zero edges (PHP builtin sprintf is not a project symbol; browser compressed.min.js is never imported by server code)

Actual:

app.Controller.render → public.assets.libs.compressed.min.sprintf

Evidence (trace_path --function app.Controller.render --direction outbound):

callees_total: 1
  sprintf  hop 1  heuristic  0.75
  file_path: public/assets/libs/compressed.min.js

Detection heuristic

All 751 false edges in the real repo match this pattern:

MATCH (php)-[:CALLS]->(js)
WHERE php.file_path ENDS WITH '.php'
  AND js.file_path ENDS WITH '.js'
  AND (js.file_path CONTAINS '/assets/' OR js.file_path CONTAINS '/static/' 
       OR js.file_path CONTAINS '/libs/' OR js.file_path CONTAINS 'min.js' 
       OR js.file_path CONTAINS 'vendor')
RETURN COUNT(*) AS false_edge_count

Result on iCMS v8.0.0: 751 (100% false positive rate — no legitimate server-side require/import of browser assets)

Root cause hypothesis

1. Builtin function blind spot: PHP sprintf/exit/str_replace are language builtins (no user-defined node) → indexer falls back to global name search
2. Cross-language namespace leak: Name resolution doesn't respect runtime boundaries (PHP process vs browser context)
3. Confidence inflation: Heuristic edges carry 0.75-0.85 confidence → indistinguishable from real edges

Expected behavior

When the caller language and callee language differ:

• If edge type is HTTP_CALLS or HANDLES: legitimate cross-language boundary (browser fetch → server route) → keep edge
• If edge type is CALLS: runtime boundary violation → either:
  1. Emit no edge (preferred)
  2. Emit low-confidence marker edge (cross_language_unverified) excluded from architecture/hotspot/trace queries by default

For builtin functions (sprintf, exit, define, etc.): should never produce CALLS edges to any project symbol.

Related issues

• BCL/external calls fabricate CALLS edges to unrelated internal classes (phantom callers; e.g. int.TryParse → internal TryParse) #2121: C# BCL → internal class (same-language stdlib confusion)
• Rust: std-typed receivers hijack same-named project methods, fabricating CALLS edges (37.6% of edges stdlib-shaped on 0.10.8) — minimal repro #2053: Rust std → project method (37.6% false edge rate)
• Python stdlib import binds to a same-named TypeScript function (cross-language, strategy=unique_name) — poisons hotspots and Louvain clusters #1572: Cross-language Louvain cluster pollution

This is the first reported instance of cross-language + runtime boundary violation (server→browser).

Project scale

Real repo (iCMS v8.0.0):

• 13,495 nodes / 65,573 edges / ~1,200 PHP files
• 751 false PHP→JS edges (1.1% of total edges)
• 100% targeting assets/, libs/, vendor/, or *.min.js

Reproduction

https://www.icmsdev.com/

Logs

Diagnostics trajectory (memory / performance / leak issues)

Project scale (if relevant)

No response

Confirmations

• I searched existing issues and this is not a duplicate.
• My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.