feat: experimental tree-sitter dataflow engine (unused-assignment)

[zmaril]

Before / After

Before: dataflow-grade checks (bindings, def-use) exist only for JS/TS, through oxc's React rules. Every other language straitjacket scans gets the non-parsing tiers: regex over lines, codepoint scans, indentation counting, cpd-finder tokens.

After: an opt-in --dataflow flag (config key dataflow, off by default) runs a language-generic unused-assignment check (Warning: a value assigned to a local variable that is never read before reassignment or scope end) over Rust, TypeScript/TSX/JS, and Python via tree-sitter binding specs.

oxc is untouched. The React rules keep their parser — oxc is genuinely better for JS/TS, especially anything type-adjacent (see the portability audit in notes/dataflow.md). The generic engine exists for reach into the languages oxc will never cover. The flag defaults off, so existing scans, the dogfood self-scan, and every current user are unaffected.

How

Per-language binding spec + one generic engine. Each language contributes a single tree-sitter query file (src/dataflow/queries/*.scm, 68–79 lines each) whose captures come from a fixed vocabulary (@def/@assign/@ref/@scope/@loop/@branch/...), plus a small quirks entry in src/dataflow/spec.rs. One generic engine (src/dataflow/analysis.rs) parses, runs the query, builds the scope tree, resolves names lexically, and runs a function-local def-use pass. The load-bearing safety property: every ambiguity degrades to a read — an unclassified identifier stays a read, closure-touched variables are exempt, unparseable files skip — so a gap in a .scm file can mask a real finding but can never invent a false one.

Measured on the fleet

Ran --no-config --only unused-assignment --dataflow over powdermonkey, entl, disponent, and straitjacket (752 files), inspecting every finding by hand:

• First working build: 4 findings, all 4 false positives (two classes: whole-construct branch regions letting if/else and try/catch arm writes kill each other; a Rust match-arm guard extracted as a binding). Both classes fixed and pinned with regression tests.
• Committed build: 0 findings, 0 FPs on the fleet — the expected steady state for a precision-first rule over compiler/clippy/biome-clean code.
• Recall probe: 4 known dead stores seeded into copies of real fleet files (TS, TSX, Rust, Python) — 4/4 detected, no extra findings. tests/dataflow.rs additionally pins 8 true-positive patterns and ~30 tricky negatives.
• Cost: powdermonkey full scan 0.15s → 0.47s with --dataflow (415 files, release build).

Honest limits (by design, documented in src/dataflow/mod.rs)

• No real CFG: branch nesting + a blanket loop back-edge exemption approximate it. Early return/?/break between two writes is unmodelled — false-negative-only by construction.
• No aliasing (writes through *p/obj.field never count as tracked writes), no cross-function flow, no type info.
• Python match patterns and del unmodelled (identifiers degrade to reads).
• Rust format!-style {name} recovery scans macro string literals, so a brace-name in any other macro string also counts as a read (conservative).
• Files that don't parse under the grammar are skipped silently — notably .js files containing JSX.

Full design rationale — the oxc portability audit, the design space considered (stack-graphs, Semgrep/Opengrep, CodeQL, Glean, SCIP, Joern), and the follow-up path (Go, use-before-def, CFG-lite if taint is ever required) — is in notes/dataflow.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WauUMFGGuk9J2rFa5ahHgr

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	straitjacket	9278411	Commit Preview URL Branch Preview URL	Jul 09 2026, 11:44 PM