fix: attribute liveness to Lua functions assigned to global/builtin identifiers

crates/codegraph-core/src/extractors/lua.rs

@@ -5,6 +5,21 @@ use crate::types::*;
 use super::helpers::*;
 use super::SymbolExtractor;
 
+/// Lua base-library global function names and standard-library module
+/// tables. Mirrors `LUA_BUILTIN_GLOBALS` in `src/extractors/lua.ts` — see
+/// `handle_lua_assignment_statement` (this file) and that file's
+/// `handleLuaAssignmentStatement` for the full rationale (issue #1776).
+const LUA_BUILTIN_GLOBALS: &[&str] = &[
+    "assert", "collectgarbage", "dofile", "error", "getfenv", "getmetatable",
+    "ipairs", "load", "loadfile", "loadstring", "module", "next", "pairs",
+    "pcall", "print", "rawequal", "rawget", "rawlen", "rawset", "require",
+    "select", "setfenv", "setmetatable", "tonumber", "tostring", "type",
+    "unpack", "xpcall",
+    // Standard-library module tables — wholesale replacement (e.g. sandboxing)
+    // is the same "escapes local scope" shape as a single builtin function.
+    "string", "table", "math", "io", "os", "coroutine", "debug", "utf8", "bit32",
+];
+
 pub struct LuaExtractor;
 
 impl SymbolExtractor for LuaExtractor {
@@ -20,6 +35,7 @@ fn match_lua_node(node: &Node, source: &[u8], symbols: &mut FileSymbols, _depth:
     match node.kind() {
         "function_declaration" => handle_lua_function_decl(node, source, symbols),
         "function_call" => handle_lua_function_call(node, source, symbols),
+        "assignment_statement" => handle_lua_assignment_statement(node, source, symbols),
         _ => {}
     }
 }
@@ -88,6 +104,52 @@ fn extract_lua_params(func_node: &Node, source: &[u8]) -> Vec<Definition> {
     params
 }
 
+/// Detect `<builtin> = <identifier>` assignments — a locally declared
+/// function bound to a Lua global/builtin identifier (e.g.
+/// `require = traced_require`), the monkey-patch pattern from issue #1776.
+/// Mirrors `handleLuaAssignmentStatement` in `src/extractors/lua.ts` — see
+/// that function's doc comment for the full rationale.
+///
+/// Emits a dynamic `value-ref` call for the RHS identifier, restricted to
+/// plain `identifier = identifier` pairs where the LHS matches
+/// `LUA_BUILTIN_GLOBALS`. `value-ref` is resolved downstream
+/// (build_edges.rs) against function/method-kind targets only, so a
+/// builtin reassigned to a non-function value is silently dropped rather
+/// than fabricating a nonsensical edge.
+///
+/// Multi-assignment (`a, b = f, g`) is handled positionally: each side is
+/// indexed independently by position (not pre-filtered to identifiers
+/// first), so mixed variable kinds (`t.b, a = f, g`) do not shift the
+/// pairing.
+fn handle_lua_assignment_statement(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
+    let Some(variable_list) = find_child(node, "variable_list") else { return };
+    let Some(expression_list) = find_child(node, "expression_list") else { return };
+
+    let pair_count = variable_list
+        .named_child_count()
+        .min(expression_list.named_child_count());
+
+    for i in 0..pair_count {
+        let Some(lhs) = variable_list.named_child(i) else { continue };
+        let Some(rhs) = expression_list.named_child(i) else { continue };
+        if lhs.kind() != "identifier" || rhs.kind() != "identifier" {
+            continue;
+        }
+        let lhs_text = node_text(&lhs, source);
+        let rhs_text = node_text(&rhs, source);
+        if !LUA_BUILTIN_GLOBALS.contains(&lhs_text) || LUA_BUILTIN_GLOBALS.contains(&rhs_text) {
+            continue;
+        }
+        symbols.calls.push(Call {
+            name: rhs_text.to_string(),
+            line: start_line(&rhs),
+            dynamic: Some(true),
+            dynamic_kind: Some("value-ref".to_string()),
+            ..Default::default()
+        });
+    }
+}
+
 fn handle_lua_function_call(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
     let name_node = match node.child_by_field_name("name") {
         Some(n) => n,
@@ -199,3 +261,102 @@ fn handle_lua_function_call(node: &Node, source: &[u8], symbols: &mut FileSymbol
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tree_sitter::Parser;
+
+    fn parse_lua(code: &str) -> FileSymbols {
+        let mut parser = Parser::new();
+        parser
+            .set_language(&tree_sitter_lua::LANGUAGE.into())
+            .unwrap();
+        let tree = parser.parse(code.as_bytes(), None).unwrap();
+        LuaExtractor.extract(&tree, code.as_bytes(), "test.lua")
+    }
+
+    // ── #1776: builtin/global reassignment value-ref extraction ─────────────
+
+    #[test]
+    fn extracts_value_ref_call_for_function_assigned_to_builtin_global() {
+        let s = parse_lua(
+            "local function traced_require(modname)\n  return modname\nend\nrequire = traced_require",
+        );
+        let value_refs: Vec<_> = s
+            .calls
+            .iter()
+            .filter(|c| c.dynamic_kind.as_deref() == Some("value-ref"))
+            .collect();
+        assert!(value_refs.iter().any(|c| c.name == "traced_require"));
+        assert!(value_refs.iter().all(|c| c.dynamic == Some(true)));
+    }
+
+    #[test]
+    fn extracts_value_ref_call_for_local_shadow_of_builtin() {
+        let s = parse_lua(
+            "local function traced_require(modname)\n  return modname\nend\nlocal require = traced_require",
+        );
+        assert!(s
+            .calls
+            .iter()
+            .any(|c| c.name == "traced_require" && c.dynamic_kind.as_deref() == Some("value-ref")));
+    }
+
+    #[test]
+    fn no_value_ref_call_when_lhs_is_not_a_recognized_builtin() {
+        let s = parse_lua("local function helper() end\nmyCustomGlobal = helper");
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
+    #[test]
+    fn no_value_ref_call_when_rhs_is_itself_a_builtin() {
+        let s = parse_lua("print = tostring");
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
+    #[test]
+    fn no_value_ref_call_for_local_non_builtin_alias() {
+        let s = parse_lua("local function helper() end\nlocal orig_helper = helper");
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
+    #[test]
+    fn no_value_ref_call_when_rhs_is_a_call_expression() {
+        let s = parse_lua("require = wrapRequire(require)");
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
+    #[test]
+    fn no_value_ref_call_when_rhs_is_a_member_expression() {
+        let s = parse_lua("require = mymodule.customRequire");
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
+    #[test]
+    fn pairs_multi_assignment_positionally() {
+        // `t.b` occupies position 0 (a dot_index_expression, not a plain
+        // identifier) — pairing must not shift, or `require` (position 1)
+        // would incorrectly pair with `helperA` (position 0).
+        let s = parse_lua(
+            "local function helperA() end\nlocal function helperB() end\nt.b, require = helperA, helperB",
+        );
+        let value_refs: Vec<&str> = s
+            .calls
+            .iter()
+            .filter(|c| c.dynamic_kind.as_deref() == Some("value-ref"))
+            .map(|c| c.name.as_str())
+            .collect();
+        assert!(value_refs.contains(&"helperB"));
+        assert!(!value_refs.contains(&"helperA"));
+    }
+
+    #[test]
+    fn extracts_value_ref_call_for_stdlib_module_table_reassignment() {
+        let s = parse_lua("local function fakeOs() end\nos = fakeOs");
+        assert!(s
+            .calls
+            .iter()
+            .any(|c| c.name == "fakeOs" && c.dynamic_kind.as_deref() == Some("value-ref")));
+    }
+}

docs/architecture/decisions/002-dynamic-call-resolution.md

@@ -77,9 +77,12 @@ export type DynamicKind =
   | 'reflection'          // .call/.apply/.bind, getattr, Method.invoke, $obj->$m()
   | 'eval'               // eval(), new Function() — undecidable
   | 'unresolved-dynamic' // detected dynamic call we cannot resolve
-  | 'value-ref';          // bare identifier used as an object-literal property value
-                          // (dispatch tables, e.g. `{ resolve: someFn }`) — resolvable
-                          // against function/method-kind targets only (#1771)
+  | 'value-ref';          // bare identifier used as a value reference, not a call site —
+                          // object-literal property value (dispatch tables, e.g.
+                          // `{ resolve: someFn }`, #1771) or assignment to a Lua
+                          // global/builtin identifier (e.g. `require = tracedRequire`,
+                          // #1776) — resolvable against function/method-kind targets
+                          // only
 ```
 
 `dynamic?: boolean` is kept to avoid churning every `call.dynamic ? 1 : 0` site.
@@ -90,6 +93,18 @@ plain data reference like `{ name: SOME_CONSTANT }`), that's the common case, no
 an undecidable dynamic call site — so it's silently dropped rather than flagged,
 unlike `eval`/`computed-key`/`unresolved-dynamic`.
 
+`value-ref` is deliberately syntax-position-agnostic: any bare identifier that
+names a known function/method and appears somewhere other than a call site
+qualifies, regardless of which language or grammar shape produced it.
+Object-literal property values (#1771) and Lua assignment to a
+global/builtin identifier (#1776, `require = tracedRequire` — a builtin name
+isn't a locally-scoped variable that alias/points-to resolution could ever
+observe, so this is the narrow, language-specific case where a plain
+reference edge is the correct substitute for real alias tracking) are two
+independent extraction sites feeding the same resolution/filtering logic
+downstream; new languages/positions can add a third without touching
+`build-edges.ts` / `incremental.ts` / `build_edges.rs` again.
+
 ### Sink edges reuse `kind='calls'`, not a new edge kind
 
 A new `EdgeKind` would ripple through every edge-kind switch, role classifier, exporter, MCP tool, and the viewer — high blast radius. Instead: DB migration adds `dynamic_kind TEXT` column to `edges`; sink edges use `kind='calls'`, `dynamic=1`, `dynamic_kind=<kind>`, `confidence=0.0`. Confidence below `DEFAULT_MIN_CONFIDENCE=0.5` means they never pollute normal queries or exports but remain queryable when explicitly requested.

src/extractors/lua.ts

@@ -5,7 +5,60 @@ import type {
   TreeSitterNode,
   TreeSitterTree,
 } from '../types.js';
-import { findChild, nodeEndLine } from './helpers.js';
+import { findChild, nodeEndLine, nodeStartLine } from './helpers.js';
+
+/**
+ * Lua base-library global function names and standard-library module
+ * tables. A plain `identifier = identifier` assignment whose LHS is one of
+ * these escapes local/lexical scoping entirely: the LHS names a language
+ * builtin rather than a locally declared variable that scope-based tracking
+ * could follow, so a function assigned here (`require = tracedRequire`, the
+ * monkey-patch pattern from issue #1776) becomes reachable through every
+ * later unqualified use of the builtin name — anywhere in the codebase,
+ * since it's a genuine global, not just within this file's call graph.
+ * Mirrors `LUA_BUILTIN_GLOBALS` in `crates/codegraph-core/src/extractors/lua.rs`.
+ */
+export const LUA_BUILTIN_GLOBALS: Set<string> = new Set([
+  'assert',
+  'collectgarbage',
+  'dofile',
+  'error',
+  'getfenv',
+  'getmetatable',
+  'ipairs',
+  'load',
+  'loadfile',
+  'loadstring',
+  'module',
+  'next',
+  'pairs',
+  'pcall',
+  'print',
+  'rawequal',
+  'rawget',
+  'rawlen',
+  'rawset',
+  'require',
+  'select',
+  'setfenv',
+  'setmetatable',
+  'tonumber',
+  'tostring',
+  'type',
+  'unpack',
+  'xpcall',
+  // Standard-library module tables — wholesale replacement (e.g. sandboxing)
+  // is the same "escapes local scope" shape as a single builtin function.
+  'string',
+  'table',
+  'math',
+  'io',
+  'os',
+  'coroutine',
+  'debug',
+  'utf8',
+  'bit32',
+]);
 
 /**
  * Extract symbols from Lua files.
@@ -35,6 +88,9 @@ function walkLuaNode(node: TreeSitterNode, ctx: ExtractorOutput): void {
     case 'function_call':
       handleLuaFunctionCall(node, ctx);
       break;
+    case 'assignment_statement':
+      handleLuaAssignmentStatement(node, ctx);
+      break;
   }
 
   for (let i = 0; i < node.childCount; i++) {
@@ -128,6 +184,68 @@ function checkForRequire(node: TreeSitterNode, ctx: ExtractorOutput): void {
   }
 }
 
+/**
+ * Detect `<builtin> = <identifier>` assignments — a locally declared
+ * function bound to a Lua global/builtin identifier (e.g.
+ * `require = tracedRequire`), the monkey-patch pattern from issue #1776.
+ * Every later unqualified call to the builtin name (`require(...)`)
+ * anywhere in the codebase actually invokes the RHS function, but that call
+ * site names the builtin, never the RHS function directly — so without
+ * this, the RHS function has no inbound edge at all and is misclassified
+ * dead-unresolved.
+ *
+ * Emits a dynamic `value-ref` call for the RHS identifier — the same
+ * classification #1771 uses for bare identifiers referenced as
+ * object-literal property values: a bare identifier used in a value
+ * position, not a call site. Resolution downstream (build-edges.ts /
+ * incremental.ts / build_edges.rs) already restricts `value-ref` calls to
+ * function/method-kind targets only, so a builtin reassigned to a
+ * non-function value (`unpack = someTable`) is silently dropped rather than
+ * fabricating a nonsensical edge — no further changes needed there.
+ *
+ * Scoped narrowly to plain `identifier = identifier` pairs where the LHS
+ * matches a known Lua builtin/stdlib-module name (`LUA_BUILTIN_GLOBALS`).
+ * General local-to-local variable aliasing (`local a = someFunc; a()`) is a
+ * much larger points-to/alias-tracking problem this fix does not attempt to
+ * solve — see #1776 for the scoping rationale.
+ *
+ * Handles both the bare top-level form (`require = tracedRequire`, a
+ * standalone `assignment_statement`) and the `local`-declared form
+ * (`local require = tracedRequire`, an `assignment_statement` nested inside
+ * `variable_declaration`) identically: shadowing a builtin name with
+ * `local` is the same "redirect every later unqualified use" idiom, just
+ * lexically scoped rather than truly global.
+ *
+ * Multi-assignment (`a, b = f, g`) is handled positionally, matching Lua's
+ * own assignment semantics — mixed variable kinds (`t.b, a = f, g`) do not
+ * shift the pairing, since each side is indexed independently by position
+ * rather than pre-filtered to identifiers first.
+ */
+function handleLuaAssignmentStatement(node: TreeSitterNode, ctx: ExtractorOutput): void {
+  const variableList = findChild(node, 'variable_list');
+  const expressionList = findChild(node, 'expression_list');
+  if (!variableList || !expressionList) return;
+
+  const variables = variableList.namedChildren;
+  const expressions = expressionList.namedChildren;
+  const pairCount = Math.min(variables.length, expressions.length);
+
+  for (let i = 0; i < pairCount; i++) {
+    const lhs = variables[i];
+    const rhs = expressions[i];
+    if (!lhs || !rhs) continue;
+    if (lhs.type !== 'identifier' || rhs.type !== 'identifier') continue;
+    if (!LUA_BUILTIN_GLOBALS.has(lhs.text) || LUA_BUILTIN_GLOBALS.has(rhs.text)) continue;
+
+    ctx.calls.push({
+      name: rhs.text,
+      line: nodeStartLine(rhs),
+      dynamic: true,
+      dynamicKind: 'value-ref',
+    });
+  }
+}
+
 function handleLuaFunctionCall(node: TreeSitterNode, ctx: ExtractorOutput): void {
   const nameNode = node.childForFieldName('name');
   if (!nameNode) return;

src/types.ts

@@ -488,7 +488,7 @@ export type DynamicKind =
   | 'reflection' // .call/.apply/.bind / Reflect.* / callable-ref — resolved when target is in codebase; sink edge emitted if unresolved
   | 'eval' // eval() / new Function() — undecidable; always flagged
   | 'unresolved-dynamic' // any other detected dynamic pattern; flagged
-  | 'value-ref'; // bare identifier used as an object-literal property value (dispatch-table pattern, e.g. `{ resolve: someFn }`) — resolved only against function/method-kind targets; unresolved (e.g. plain data references) are dropped silently, NOT flagged
+  | 'value-ref'; // bare identifier used as a value reference rather than a call site — object-literal property value (dispatch-table pattern, e.g. `{ resolve: someFn }`, #1771) or assignment to a Lua global/builtin identifier (e.g. `require = tracedRequire`, #1776) — resolved only against function/method-kind targets; unresolved (e.g. plain data references) are dropped silently, NOT flagged
 
 /** A function/method call detected by an extractor. */
 export interface Call {