Flow Detection Recall Limitations for JavaScript and Go in code-review-graph: What Developers Need to Know

Flow detection recall for JavaScript and Go in the code-review-graph tool is approximately 33%, meaning the analyzer misses roughly two-thirds of true execution flows due to entry-point heuristics tuned primarily for Python and PHP.

The code-review-graph repository provides automated code analysis capabilities, but its flow detection component remains experimental for JavaScript and Go. While the parser recognizes basic syntactic constructs—functions, imports, and calls—it fails to reliably identify program entry points and execution paths in these languages.

Why Flow Detection Recall Is Low for JavaScript and Go

The ≈ 33 % recall figure stems from fundamental architectural decisions in how the tool detects code flows. The current implementation prioritizes language-specific frameworks where entry-point patterns are well-established and predictable.

How Entry-Point Heuristics Drive Recall Rates

The detection strategy varies dramatically by language:

Language	Detection Strategy	Current Coverage
Python	Framework-specific hooks (Flask.app.run, Django manage.py)	High
PHP/Laravel	Route-to-controller conventions	High
JavaScript	Generic function-entry heuristics (require, import, IIFE)	Low
Go	Simple main detection + static call graph	Low

Specific JavaScript Patterns That Are Missed

For JavaScript, the detector struggles with:

• Dynamic module loading — import() expressions and runtime module resolution
• Babel/TypeScript transpilation entry points — compiled output paths that differ from source
• Async bootstraps — Promise-based and EventEmitter initialization patterns
• Common Node.js patterns — cluster forks, worker threads, and PM2-style process managers

Specific Go Patterns That Are Missed

For Go, the detector misses:

• init functions — package-level initialization that runs before main
• Goroutine entry points — concurrent execution paths launched via go statements
• cmd/* patterns — multi-binary project structures
• Build tags — conditional compilation that alters available entry points

Where These Limitations Are Documented

The 33% recall figure is explicitly acknowledged in two locations within the repository:

• README.md line 286: "Flow detection (33 % recall): … JavaScript and Go flow detection needs work."
• docs/FAQ.md line 142: "Flow detection on JS/Go … (33 % recall, documented in the README limitations)."

These citations demonstrate that the maintainers transparently document current capabilities rather than presenting incomplete results as authoritative.

How Recall Is Measured

The evaluation logic resides in code_review_graph/eval/benchmarks/flow_completeness.py. This benchmark compares found flows against known flows to compute the recall ratio:

# Conceptual structure from flow_completeness.py

recall = len(found_flows) / len(known_flows)

The "known flows" are established through manual annotation or alternative static analysis tools, creating a ground truth against which the heuristic-based detector is judged.

Working Around Flow Detection Limitations

When analyzing JavaScript or Go repositories, you have three practical options:

1. Accept Partial Results

Run the standard detection command and interpret flow results as a sample rather than exhaustive list:

code-review-graph detect-changes --brief

Review the "Flows" section knowing that approximately two-thirds of actual flows are absent.

2. Disable Flow Detection Entirely

If incomplete flow data creates confusion or false confidence, suppress the feature:

code-review-graph detect-changes --brief --no-flows

This avoids presenting stakeholders with misleadingly sparse flow information.

3. Query Flows Programmatically with Caveats

For custom tooling, use the Python API while implementing your own validation:

from code_review_graph import query_graph_tool

# Retrieve flows for a Go file — expect incomplete results

flows = query_graph_tool(
    pattern="flows_of",
    path="path/to/main.go"
)

# flows will likely miss init(), goroutine launches, and cmd/ subpackages

print(f"Detected {len(flows)} flows; manual review recommended for Go projects")

Key Implementation Files

Understanding the source structure helps diagnose why these limitations persist:

File	Purpose
code_review_graph/flows.py	Core flow-detection implementation with entry-point heuristics for all supported languages
code_review_graph/eval/benchmarks/flow_completeness.py	Benchmark script that calculates the 33% recall metric

Contributors seeking to improve JavaScript or Go support would focus their efforts on flows.py, specifically the heuristic classification logic that currently prioritizes Python and PHP conventions.

Summary

• Flow detection recall for JavaScript and Go is approximately 33% in code-review-graph due to heuristic bias toward Python and PHP patterns.
• The parser recognizes syntax but misses critical entry points: dynamic module loading, init functions, goroutines, and framework-specific bootstraps.
• Limitations are transparently documented in README.md and docs/FAQ.md with specific line references.
• Use --no-flows to disable the feature when incomplete results would mislead, or interpret results as partial samples rather than exhaustive analysis.
• Improvement requires extending flows.py with JavaScript and Go-specific entry-point conventions.

Frequently Asked Questions

Why does flow detection work better for Python than JavaScript or Go?

Python benefits from dominant framework conventions that create predictable entry-point patterns. Flask's app.run(), Django's manage.py, and similar hooks allow reliable heuristic detection. JavaScript and Go have more diverse execution models—dynamic imports, multiple main packages, init functions, and goroutine-based concurrency—that resist simple pattern matching.

Will the 33% recall improve in future releases?

The README and FAQ explicitly mark JavaScript and Go flow detection as "needs work," indicating planned improvements. However, achieving parity with Python would require substantial engineering to model each language's unique bootstrap semantics, including build-time transformations that alter runtime structure.

How can I verify if my project's critical flows are detected?

Cross-reference the tool's output against your manual understanding of execution paths. For Go, check that init() functions and cmd/ subpackages appear. For JavaScript, verify that your application's actual entry file (not just imported modules) is listed. Missing critical paths confirms the 33% recall limitation is affecting your specific codebase.

Is there an alternative to code-review-graph for JavaScript or Go flow analysis?

Dedicated language-specific tools often provide higher recall. For JavaScript, consider ESLint with control-flow plugins or proprietary SAST platforms. For Go, go callgraph and golang.org/x/tools/go/callgraph provide static analysis with native language understanding. These alternatives trade the unified interface of code-review-graph for language-appropriate accuracy.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}