[harsharajkumar-273]

What changes

The pull request comment says whether existing callers can break, shows the evidence, puts findings on the diff, and can optionally add a model's reading of what the change is for.

Facts (deterministic, no model):

• A verdict at the top: 🔴 likely breaking (a removed or renamed function is still called, or a call site no longer fits a changed signature, naming the file and line) · 🟠 may change public API · 🟡 changes shared code · 🟢 contained or additive.
• Which edit reaches whom, riskiest first; test command once with "N of M test files".
• Line comments on the diff: a removed function that is still called goes on its deleted definition; a changed signature on the new signature, naming the calls that no longer fit; public API removed on the deleted lines. Replaced on each push; answered threads never deleted. The action now analyses the PR's own commit so line numbers match GitHub's diff.

New in this push, an optional reading by a model (the reason: the facts describe the graph, they cannot say what a change is for):

• With anthropic-api-key set, the comment gains: what the change does in plain language, whether the diff matches the author's description (it will notice a change the description does not mention), and up to three things to check.
• Off unless a key is set. Never runs for a pull request from a fork. When on, the source-file diff, the title and description, and the comment's facts are sent to the Anthropic API on every push (a few thousand tokens in, at most 700 out).
• The verdict and facts go to the model as ground truth; the verdict does not depend on it.
• Untrusted input: the title, description and diff are written by whoever opens the PR, so they are quoted inside tags the model is told never to obey; closing tags inside them are neutralised; the model's answer is stripped of markup, links, images and mentions and capped. A failing call never blocks the comment, and the key is never printed.

Evidence

• Facts on real history: 132 real commits (Requests, Gin, Hono, this repo): no 🔴 or 🟠, and 0 inline comments by default on 118 of them. A rename and a new required argument injected into real Python, TypeScript and Go code are caught with the real call sites and anchored on the right diff line.
• A correction made earlier: my first false-positive measurement analysed old commits against a clone at its newest state; I caught it and redid it correctly.
• Typecheck, 185 tests, including: the exact request sent to the API (headers, body, key only as a header), a closing tag inside the diff cannot break out of its quotes, output cleaning, no call without a key or without --ai, the comment still posts when the API fails, and the key never appears in output or in the request body; end-to-end tests with real git commits for each verdict and each comment anchor.

Not verified

• The model's answers have not been evaluated: that needs an API key, and I did not use one. I checked the request it would receive (it contains the diff, the facts and the description, so it can see a change the description omits), not what it would say. Please try it on a few of your own pull requests before relying on it.
• The line-comment posting step has run on GitHub (it read the review comments and correctly posted nothing, since this PR has no finding) but has not yet created real line comments; that needs a PR with a finding.
• Argument counts only (not names, order or types); calls only (not imports); every top-level Python function counts as public.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ENHRK3kgqcVwqwyjswRViM

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
codegraph	Ready	Preview	Oct 24, 2026 5:14am UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 507d7be4-26f7-4f1b-abe2-5f02035e4168

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CodeGraph: what this change can reach

Verdict: 🟡 changes shared code. No argument list changed incompatibly and nothing was removed, but the behaviour of code others call is different.

18 symbols in 14 files you did not edit could be affected by the 14 existing symbols this change edits (🟢 18 proven · 🟡 0 probable · 🔴 0 guessed by name).

Which edit reaches whom

• packages/extractors/src/go.ts#extractGo.visit is reached by 16 in 14 files
  • 🟢 packages/extractors/src/extract.ts#extractFile, 🟢 packages/extractors/src/index-files.ts#indexFiles, 🟢 packages/extractors/test/browser-parity.test.ts (top-level code), 🟢 packages/extractors/test/go.test.ts (top-level code), and 12 more
• packages/analysis/src/diff.ts#parseUnifiedDiff is reached by 2 in 1 file
  • 🟢 packages/cli/src/mcp.ts#buildTools, 🟢 packages/cli/src/mcp.ts#cmdMcp

Also: edits top-level code in 12 files; adds 88 new symbols.

12 of 14 test files to run

That is most of the suite: this change touches widely used code.

npx vitest run packages/analysis/test/analysis.test.ts packages/cli/test/ai.test.ts packages/cli/test/cli.test.ts packages/cli/test/inline.test.ts packages/extractors/test/browser-parity.test.ts packages/extractors/test/collisions.test.ts packages/extractors/test/go.test.ts packages/extractors/test/python.test.ts packages/extractors/test/typescript.test.ts packages/extractors/test/variables.test.ts packages/web/test/model.test.ts packages/web/test/sources.test.ts

_{Static analysis of calls and imports (TypeScript, JavaScript, Python, Go). 🟡 and 🔴 links are name matches, so check them before relying on them. Dynamic calls are invisible to it. CodeGraph}