feat(bash): index shell scripts (functions, call edges, source imports)

[Nickcom4]

Adds Shell / Bash support (.sh, .bash, .zsh, .ksh, .bats). Closes #239.

Infrastructure repos are the case this helps: a hooks or scripts tree is dozens of small files wired together by source, and none of that was visible to the graph before.

What it extracts

Functions	both foo() { } and function foo { }
Call edges	the command word of every command node
Imports	source x / . x, resolved to the sourced file
Variables	file-scope assignments; readonly / declare -r become constants

Two choices worth reviewing

The grammar is vendored. tree-sitter-wasms ships an ABI-14 bash build that traps under web-tree-sitter 0.25 the moment it meets a case statement:

TypeError: resolved is not a function
    at stubs.<computed> (web-tree-sitter/tree-sitter.js:2947:24)
    at Parser.parse (...)

The whole parse dies, so nearly every real script would have failed. check-grammar.mjs does not catch it unless the sample happens to contain a case. The prebuilt ABI-15 wasm from the tree-sitter-bash 0.25.1 npm package (MIT, byte-identical to the tarball artifact) parses the same files cleanly, so it is vendored under src/extraction/wasm/ the same way Lua and C# are, and there is a regression test pinning the case behaviour.

Builtins are filtered out of call edges. Every command node is a call site, so without a filter echo, printf and local outnumber real function calls by about an order of magnitude and bury them. Calls to external tools (git, jq, curl) are deliberately kept as unresolved references, since that is what makes "which scripts shell out to jq" answerable at all. The filter is a list of names a function definition can never legally take.

Function-local local x=... is deliberately not indexed; it is not a symbol anyone queries and it was roughly 6 locals per function on the corpus below.

Extraction measured on a real shell tree

339 files of Claude Code hooks and operational scripts (about 170k lines):

files=339 nodes=10339 edges=19772   (491ms)
nodesByKind: {"file":339,"function":1466,"import":276,"variable":8258}
edges:       {"contains":10000,"calls":9496,"imports":276}
verify-extraction.mjs: PASS

Cross-file resolution through source works, which is the point of the feature:

$ codegraph callers log_hook_audit
Callers of "log_hook_audit" (20):
  function audit_exit    hooks/auto-advance-worktree-to-main.sh:93
  function _audit        hooks/auto-arm-pr-automerge.sh:241
  function _audit_hook   hooks/auto-cleanup-after-merge.sh:149
  ...

$ codegraph impact log_hook_audit
Impact of changing "log_hook_audit" — 147 affected symbols

Diff

• src/types.ts, src/extraction/grammars.ts, src/extraction/languages/{bash.ts,index.ts}: the standard four-file wiring plus the new extractor
• src/extraction/tree-sitter.ts: one bash branch in extractCall (the generic path reads namedChild(0), which is the assignment in a FOO=1 cmd prefix, and cannot drop builtins)
• src/resolution/import-resolver.ts: resolveBashSource, mirroring resolveLuaRequire. Sourced paths arrive as a literal tail (lib/_log.sh) because the directory is nearly always an expansion
• __tests__/extraction.test.ts: 6 extraction tests plus a detection test
• src/extraction/wasm/tree-sitter-bash.wasm: the vendored grammar

Full suite green: 3,015 passed, 0 failed.

Not covered

• Extensionless scripts identified only by shebang. Detection is extension-based, and a shebang fallback would change behaviour for every extensionless file in every repo, so it belongs in its own change.
• zsh-only syntax degrades to local ERROR nodes rather than failing the file; functions and calls still extract.
• I did not run the paid with/without A/B benchmark from the /add-lang skill.