fix: add MAX_WALK_DEPTH guard to native engine AST walkers

crates/codegraph-core/src/cfg.rs

@@ -1,4 +1,5 @@
 use tree_sitter::Node;
+use crate::constants::MAX_WALK_DEPTH;
 use crate::types::{CfgBlock, CfgData, CfgEdge};
 
 // ─── CFG Rules ──────────────────────────────────────────────────────────
@@ -617,6 +618,17 @@ impl<'a> CfgBuilder<'a> {
 
     /// Process if/else-if/else chain (handles patterns A, B, C).
     fn process_if(&mut self, if_stmt: &Node, current: u32) -> Option<u32> {
+        self.process_if_depth(if_stmt, current, 0)
+    }
+
+    fn process_if_depth(&mut self, if_stmt: &Node, current: u32, depth: usize) -> Option<u32> {
+        if depth >= MAX_WALK_DEPTH {
+            // Depth limit reached: return `current` so the caller can still
+            // wire up a fallthrough edge to its join block. The else-if chain
+            // will be silently truncated — the resulting CFG is structurally
+            // valid but incomplete for very deeply nested if-else ladders.
+            return Some(current);
+        }
         self.set_end_line(current, node_line(if_stmt));
 
         let cond_block = self.make_block("condition", Some(node_line(if_stmt)), Some(node_line(if_stmt)), Some("if"));
@@ -653,7 +665,7 @@ impl<'a> CfgBuilder<'a> {
                     if matches_opt(alt_kind, self.rules.if_node) || matches_slice(alt_kind, self.rules.if_nodes) {
                         let false_block = self.make_block("branch_false", None, None, Some("else-if"));
                         self.add_edge(cond_block, false_block, "branch_false");
-                        let else_if_end = self.process_if(&alternative, false_block);
+                        let else_if_end = self.process_if_depth(&alternative, false_block, depth + 1);
                         if let Some(eie) = else_if_end {
                             self.add_edge(eie, join_block, "fallthrough");
                         }
@@ -679,7 +691,7 @@ impl<'a> CfgBuilder<'a> {
                         // else-if: recurse
                         let false_block = self.make_block("branch_false", None, None, Some("else-if"));
                         self.add_edge(cond_block, false_block, "branch_false");
-                        let else_if_end = self.process_if(&else_children[0], false_block);
+                        let else_if_end = self.process_if_depth(&else_children[0], false_block, depth + 1);
                         if let Some(eie) = else_if_end {
                             self.add_edge(eie, join_block, "fallthrough");
                         }

crates/codegraph-core/src/complexity.rs

@@ -1,5 +1,6 @@
 use tree_sitter::Node;
 
+use crate::constants::MAX_WALK_DEPTH;
 use crate::types::ComplexityMetrics;
 
 // ─── Language-Configurable Complexity Rules ───────────────────────────────
@@ -373,6 +374,7 @@ pub fn compute_function_complexity(
         &mut cognitive,
         &mut cyclomatic,
         &mut max_nesting,
+        0,
     );
 
     ComplexityMetrics::basic(cognitive, cyclomatic, max_nesting)
@@ -386,7 +388,11 @@ fn walk_children(
     cognitive: &mut u32,
     cyclomatic: &mut u32,
     max_nesting: &mut u32,
+    depth: usize,
 ) {
+    if depth >= MAX_WALK_DEPTH {
+        return;
+    }
     for i in 0..node.child_count() {
         if let Some(child) = node.child(i) {
             walk(
@@ -397,6 +403,7 @@ fn walk_children(
                 cognitive,
                 cyclomatic,
                 max_nesting,
+                depth + 1,
             );
         }
     }
@@ -410,7 +417,11 @@ fn walk(
     cognitive: &mut u32,
     cyclomatic: &mut u32,
     max_nesting: &mut u32,
+    depth: usize,
 ) {
+    if depth >= MAX_WALK_DEPTH {
+        return;
+    }
     let kind = node.kind();
 
     // Track nesting depth
@@ -450,6 +461,7 @@ fn walk(
                     cognitive,
                     cyclomatic,
                     max_nesting,
+                    depth,
                 );
                 return;
             }
@@ -481,6 +493,7 @@ fn walk(
                         cognitive,
                         cyclomatic,
                         max_nesting,
+                        depth,
                     );
                     return;
                 }
@@ -494,6 +507,7 @@ fn walk(
                     cognitive,
                     cyclomatic,
                     max_nesting,
+                    depth,
                 );
                 return;
             }
@@ -512,6 +526,7 @@ fn walk(
                     cognitive,
                     cyclomatic,
                     max_nesting,
+                    depth,
                 );
                 return;
             }
@@ -558,6 +573,7 @@ fn walk(
                 cognitive,
                 cyclomatic,
                 max_nesting,
+                depth,
             );
             return;
         }
@@ -580,6 +596,7 @@ fn walk(
                 cognitive,
                 cyclomatic,
                 max_nesting,
+                depth,
             );
             return;
         }
@@ -604,6 +621,7 @@ fn walk(
                                 cognitive,
                                 cyclomatic,
                                 max_nesting,
+                                depth,
                             );
                             return;
                         }
@@ -628,6 +646,7 @@ fn walk(
             cognitive,
             cyclomatic,
             max_nesting,
+            depth,
         );
         return;
     }
@@ -641,6 +660,7 @@ fn walk(
         cognitive,
         cyclomatic,
         max_nesting,
+        depth,
     );
 }
 

crates/codegraph-core/src/constants.rs

@@ -0,0 +1,3 @@
+/// Maximum recursion depth for AST traversal to prevent stack overflow
+/// on deeply nested trees. Used by extractors, complexity, CFG, and dataflow.
+pub const MAX_WALK_DEPTH: usize = 200;

crates/codegraph-core/src/dataflow.rs

@@ -1,15 +1,12 @@
 use std::collections::HashMap;
 use tree_sitter::{Node, Tree};
 
+use crate::constants::MAX_WALK_DEPTH;
 use crate::types::{
     DataflowArgFlow, DataflowAssignment, DataflowMutation, DataflowParam, DataflowResult,
     DataflowReturn,
 };
 
-/// Maximum recursion depth for AST traversal to prevent stack overflow
-/// on deeply nested trees. Matches the approach used in cfg.rs.
-const MAX_VISIT_DEPTH: usize = 200;
-
 // ─── Param Strategy ──────────────────────────────────────────────────────
 
 /// Per-language parameter extraction strategy.
@@ -852,7 +849,7 @@ fn member_receiver(member_expr: &Node, rules: &DataflowRules, source: &[u8]) ->
 
 /// Collect all identifier names referenced within a node.
 fn collect_identifiers(node: &Node, out: &mut Vec<String>, rules: &DataflowRules, source: &[u8], depth: usize) {
-    if depth >= MAX_VISIT_DEPTH {
+    if depth >= MAX_WALK_DEPTH {
         return;
     }
     if is_ident(rules, node.kind()) {
@@ -964,7 +961,7 @@ fn visit(
     mutations: &mut Vec<DataflowMutation>,
     depth: usize,
 ) {
-    if depth >= MAX_VISIT_DEPTH {
+    if depth >= MAX_WALK_DEPTH {
         return;
     }
 

crates/codegraph-core/src/extractors/csharp.rs

@@ -34,6 +34,13 @@ fn find_csharp_parent_type<'a>(node: &Node<'a>, source: &[u8]) -> Option<String>
 }
 
 fn walk_node(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
+    walk_node_depth(node, source, symbols, 0);
+}
+
+fn walk_node_depth(node: &Node, source: &[u8], symbols: &mut FileSymbols, depth: usize) {
+    if depth >= MAX_WALK_DEPTH {
+        return;
+    }
     match node.kind() {
         "class_declaration" => {
             if let Some(name_node) = node.child_by_field_name("name") {
@@ -293,7 +300,7 @@ fn walk_node(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
 
     for i in 0..node.child_count() {
         if let Some(child) = node.child(i) {
-            walk_node(&child, source, symbols);
+            walk_node_depth(&child, source, symbols, depth + 1);
         }
     }
 }

crates/codegraph-core/src/extractors/go.rs

@@ -17,6 +17,13 @@ impl SymbolExtractor for GoExtractor {
 }
 
 fn walk_node(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
+    walk_node_depth(node, source, symbols, 0);
+}
+
+fn walk_node_depth(node: &Node, source: &[u8], symbols: &mut FileSymbols, depth: usize) {
+    if depth >= MAX_WALK_DEPTH {
+        return;
+    }
     match node.kind() {
         "function_declaration" => {
             if let Some(name_node) = node.child_by_field_name("name") {
@@ -228,7 +235,7 @@ fn walk_node(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
 
     for i in 0..node.child_count() {
         if let Some(child) = node.child(i) {
-            walk_node(&child, source, symbols);
+            walk_node_depth(&child, source, symbols, depth + 1);
         }
     }
 }

crates/codegraph-core/src/extractors/hcl.rs

@@ -14,6 +14,13 @@ impl SymbolExtractor for HclExtractor {
 }
 
 fn walk_node(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
+    walk_node_depth(node, source, symbols, 0);
+}
+
+fn walk_node_depth(node: &Node, source: &[u8], symbols: &mut FileSymbols, depth: usize) {
+    if depth >= MAX_WALK_DEPTH {
+        return;
+    }
     if node.kind() == "block" {
         let mut identifiers = Vec::new();
         let mut strings = Vec::new();
@@ -111,7 +118,7 @@ fn walk_node(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
 
     for i in 0..node.child_count() {
         if let Some(child) = node.child(i) {
-            walk_node(&child, source, symbols);
+            walk_node_depth(&child, source, symbols, depth + 1);
         }
     }
 }

crates/codegraph-core/src/extractors/helpers.rs

@@ -1,6 +1,9 @@
 use tree_sitter::Node;
 use crate::types::{AstNode, Definition};
 
+// Re-export so extractors that `use super::helpers::*` still see it.
+pub use crate::constants::MAX_WALK_DEPTH;
+
 /// Get the text of a node from the source bytes.
 pub fn node_text<'a>(node: &Node, source: &'a [u8]) -> &'a str {
     node.utf8_text(source).unwrap_or("")
@@ -211,6 +214,19 @@ pub fn walk_ast_nodes_with_config(
     ast_nodes: &mut Vec<AstNode>,
     config: &LangAstConfig,
 ) {
+    walk_ast_nodes_with_config_depth(node, source, ast_nodes, config, 0);
+}
+
+fn walk_ast_nodes_with_config_depth(
+    node: &Node,
+    source: &[u8],
+    ast_nodes: &mut Vec<AstNode>,
+    config: &LangAstConfig,
+    depth: usize,
+) {
+    if depth >= MAX_WALK_DEPTH {
+        return;
+    }
     let kind = node.kind();
 
     if config.new_types.contains(&kind) {
@@ -276,7 +292,7 @@ pub fn walk_ast_nodes_with_config(
         if content.chars().count() < 2 {
             for i in 0..node.child_count() {
                 if let Some(child) = node.child(i) {
-                    walk_ast_nodes_with_config(&child, source, ast_nodes, config);
+                    walk_ast_nodes_with_config_depth(&child, source, ast_nodes, config, depth + 1);
                 }
             }
             return;
@@ -307,7 +323,7 @@ pub fn walk_ast_nodes_with_config(
 
     for i in 0..node.child_count() {
         if let Some(child) = node.child(i) {
-            walk_ast_nodes_with_config(&child, source, ast_nodes, config);
+            walk_ast_nodes_with_config_depth(&child, source, ast_nodes, config, depth + 1);
         }
     }
 }

crates/codegraph-core/src/extractors/java.rs

@@ -33,6 +33,13 @@ fn find_java_parent_class<'a>(node: &Node<'a>, source: &[u8]) -> Option<String>
 }
 
 fn walk_node(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
+    walk_node_depth(node, source, symbols, 0);
+}
+
+fn walk_node_depth(node: &Node, source: &[u8], symbols: &mut FileSymbols, depth: usize) {
+    if depth >= MAX_WALK_DEPTH {
+        return;
+    }
     match node.kind() {
         "class_declaration" => {
             if let Some(name_node) = node.child_by_field_name("name") {
@@ -252,7 +259,7 @@ fn walk_node(node: &Node, source: &[u8], symbols: &mut FileSymbols) {
 
     for i in 0..node.child_count() {
         if let Some(child) = node.child(i) {
-            walk_node(&child, source, symbols);
+            walk_node_depth(&child, source, symbols, depth + 1);
         }
     }
 }