harden: graceful merge-graphs --previous errors; JS/TS super fail-close

Two small follow-ups on the 0.9.75 batch:
- merge-graphs --previous now reports a clear error and exits 1 on a
  malformed/unreadable JSON file instead of crashing with an uncaught
  traceback (follow-up to #4006).
- JS/TS super.m() fails closed (no edge) instead of falling back to the
  file-wide name map, which bound it to the overriding method as a wrong
  self-loop. The extends chain is unknown at this pass, so super can
  never be resolved here; inherited this.m() still keeps the plain
  lookup (follow-up to #4012).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: safishamsi

graphify/cli.py

@@ -2712,7 +2712,11 @@ def _load_graph(p: str):
             if not previous_path.exists():
                 print(f"error: --previous file not found: {previous_path}", file=sys.stderr)
                 sys.exit(1)
-            _prev_raw = json.loads(previous_path.read_text(encoding="utf-8"))
+            try:
+                _prev_raw = json.loads(previous_path.read_text(encoding="utf-8"))
+            except (json.JSONDecodeError, OSError, UnicodeDecodeError) as e:
+                print(f"error: --previous file is not readable JSON: {previous_path} ({e})", file=sys.stderr)
+                sys.exit(1)
             for _n in _prev_raw.get("nodes", []):
                 if isinstance(_n, dict) and isinstance(_n.get("community"), int) and _n.get("id"):
                     previous_community[_n["id"]] = _n["community"]

graphify/extractors/engine.py

@@ -1406,7 +1406,11 @@ class to whichever class declared save() last. A file-wide hit that is not
             if hits:
                 return hits.pop() if len(hits) == 1 else None
         if not walk_bases:
-            return fallback
+            # JS/TS: the `extends` chain is unknown at this pass. An inherited
+            # `this.m()` must keep the plain lookup, but `super.m()` can never
+            # mean the caller's own method, so a file-wide fallback here is just
+            # a wrong self-loop onto the overriding method — fail closed instead.
+            return None if skip_own else fallback
         skip_own = False
         level = list(dict.fromkeys(
             base for c in level for base in class_bases.get(c, ()) if base not in seen

tests/test_cli_export.py

@@ -1002,11 +1002,12 @@ def test_cluster_only_preserves_parallel_edges_across_an_id_remap(tmp_path):
 
     data = json.loads((out / "graph.json").read_text())
     node_ids = {n["id"] for n in data["nodes"]}
+    # both endpoints remap: claude_alpha -> claude_claude_alpha, beta -> pkg_beta
     assert "claude_claude_alpha" in node_ids, node_ids  # remap fired
     assert "claude_alpha" not in node_ids
     pairs = sorted((l["source"], l["target"], l["relation"]) for l in data["links"])
-    # both parallel edges survive AND are keyed on the remapped id
+    # both parallel edges survive AND track the remapped endpoint ids
     assert pairs == [
-        ("claude_claude_alpha", "beta", "mentions"),
-        ("claude_claude_alpha", "beta", "references"),
+        ("claude_claude_alpha", "pkg_beta", "mentions"),
+        ("claude_claude_alpha", "pkg_beta", "references"),
     ], pairs

tests/test_extract.py

@@ -2278,6 +2278,23 @@ def test_js_this_call_to_inherited_method_keeps_its_edge(tmp_path, ext):
     assert ("svc_server_run", "svc_base_ping") in calls
 
 
+@pytest.mark.parametrize("ext", ["ts", "js"])
+def test_js_super_call_does_not_self_loop_onto_the_overriding_method(tmp_path, ext):
+    """`super.greet()` can never mean the caller's own method. The `extends`
+    chain is unknown at this pass, so it fails closed (no edge) rather than
+    falling back to the file-wide name map and binding to the overriding
+    `greet` as a wrong self-loop."""
+    calls = _single_file_call_pairs(tmp_path, (
+        "class Base {\n"
+        "  greet() { return 0; }\n"
+        "}\n"
+        "class Server extends Base {\n"
+        "  greet() { return super.greet(); }\n"
+        "}\n"
+    ), ext)
+    assert ("svc_server_greet", "svc_server_greet") not in calls
+
+
 def test_swift_self_calls_bind_within_own_class_chain(tmp_path):
     """`self.save()`, a bare `save()` (implicit self) and `super.ping()` must stay
     on Server's chain, not jump to the class the file declares last."""

tests/test_merge_graphs_cli.py

@@ -365,3 +365,23 @@ def test_merge_graphs_previous_drops_community_for_a_new_node(tmp_path):
     by_id = {n["id"]: n for n in data["nodes"]}
     assert by_id["alpha::a0"]["community"] == 7
     assert "community" not in by_id["beta::b0"]
+
+
+def test_merge_graphs_previous_malformed_json_errors_gracefully(tmp_path):
+    """A malformed --previous file must fail with a clear message and exit 1,
+    not crash with an uncaught JSONDecodeError traceback."""
+    a = tmp_path / "r1" / "graphify-out" / "graph.json"
+    b = tmp_path / "r2" / "graphify-out" / "graph.json"
+    _write(a, directed=False, multigraph=False, node_id="x")
+    _write(b, directed=False, multigraph=False, node_id="y")
+    out = tmp_path / "merged.json"
+    previous = tmp_path / "previous.json"
+    previous.write_text("{ not valid json ,,, ")
+
+    r = _run(
+        ["merge-graphs", str(a), str(b), "--out", str(out), "--previous", str(previous)],
+        tmp_path,
+    )
+    assert r.returncode == 1, r.stdout + r.stderr
+    assert "--previous file is not readable JSON" in r.stderr
+    assert "Traceback" not in r.stderr