Build or incrementally update the code graph for a project.

Parses every supported source file (Python/JS/TS/PHP/Ruby/Go) under root, honouring .gitignore. Incremental by content hash - unchanged files are skipped. Run this after edits to refresh blast-radius queries. force=True reparses all. On a large unscoped repo the result includes a scope_suggestion - act on it via scope.

Scope which files codegraph indexes for this project, then force-reindex. On a big vendor monorepo this is the highest-leverage action - and it's YOURS to do for the user, not theirs. Pass exclude to drop vendor trees (recommended: keeps ALL the user's code, auto-includes anything they add later) or include to index ONLY listed dirs. Globs are relative to the project root; * spans directories (e.g. "wp-content/plugins/woocommerce/*"). Merges with any existing config and writes /.codegraph/config.json. Apply an index() scope_suggestion straight through here. Returns the new config + post-scope stats.

Call with NO include/exclude for an instant DRY RUN: a suggested exclude list derived from the directory layout (no indexing) - so you can scope a huge repo BEFORE paying for a full index, then apply it. Returns {"dry_run": True, "suggested_exclude": [...], "current": ...}.

Graph overview: file/symbol/edge counts, resolution quality (exact vs inferred vs ambiguous vs unresolved), and breakdown by language and symbol kind.

Locate where a symbol is DEFINED. Returns every matching definition with file:line and signature. Use before callers/callees when a name is ambiguous.

Reverse reachability - everything that (transitively) calls symbol. This is the blast radius of changing it: who breaks if its behaviour or signature moves. depth bounds the hops. Each node carries a resolution tag: exact (proven by call shape - a certain dependency), inferred (single plausible target, receiver type unverified), or ambiguous (multiple candidates). Audit the exact callers first.

Forward reachability - everything symbol (transitively) calls. What it depends on; what you'd have to mock to test it in isolation.

Immediate in/out edges of a symbol: its direct callers and direct callees, each with the call-site line and resolution tag. One hop, full detail.

Full impact set of touching target - a symbol name OR a file path. For a file, unions the blast radius of every symbol defined in it. Returns the affected symbols grouped by file: the audit surface before an edit.

Shortest call path from src to dst - how one symbol reaches another through the call graph. Empty if no path exists.

Circular dependencies in the call graph: strongly-connected components (mutual recursion / dependency loops) and self-recursive functions.

Load-bearing symbols ranked by fan-in (how many things depend on them) - where a careless edit hurts most. Betweenness centrality (how often a node sits on dependency paths) is ALSO returned, but only for graphs up to ~1500 nodes (it's all-pairs and too costly above that); past that, betweenness_computed is false and only fan-in ranks. Tip: on a large vendor monorepo, scope the graph to your own code (.codegraph/config.json include) so fan-in reflects your app, not a re-declared core function in a vendor file.

Relationship drift from UNCOMMITTED edits. For every file changed on disk since the last index, diffs its RESOLVED call edges (caller -> resolved target, container-qualified) against the stored graph and reports what each edit ADDED or REMOVED - catching a re-pointed call (Foo.save -> Bar.save) a name diff would miss. Run after an edit to prove you didn't silently sever a relationship. Folds the changes into the graph as part of the diff.

WordPress hook/filter dispatch - the string-named action/filter coupling a call graph CANNOT see (add_action/add_filter/register_rest_route/do_action/apply_filters).

• name = a hook/action/filter name or REST route -> its in-repo listeners + fire sites.

• name = a symbol -> the hooks it's registered on (the high-confidence callback->hook direction: "register_routes fires on rest_api_init").

• entry_points=True or empty name -> the public attack surface: every wp_ajax_* / wp_ajax_nopriv_* / register_rest_route callback, with UNAUTH flagged.

Blind spots (honest): dynamic/interpolated hook names, closures, and variable callbacks (call_user_func($x)) cannot be resolved and are not edges.

This tool - NOT the edges_hook count - is the source of truth for whether WordPress coupling was captured. edges_hook: 0 is normal for a pure-listener plugin (its callbacks are fired by WP core / the REST framework, not by its own do_action), and REST routes never contribute to that count by design. If a hook seems missing, check here first.