feat: follow symlinked files and directories in the scan and the watcher (#935, #770)

.github/workflows/ci.yml

@@ -191,6 +191,44 @@ jobs:
       - name: Run long-lived MCP database replacement acceptance
         run: cargo test -p codegraph-rs --locked --test batch_m_long_lived_mcp
 
+  # FSEvents is the one native-recursive watcher backend no other job runs:
+  # Linux uses inotify and Windows ReadDirectoryChangesW. This job runs the
+  # symlink-following scan and watcher tests on macOS (#770).
+  macos-watcher:
+    name: macOS Watcher
+    needs: workspace-version
+    runs-on: macos-15
+    timeout-minutes: 40
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master 2026-08-21
+        with:
+          toolchain: 1.96.0
+
+      - name: Verify workspace version surfaces before Cargo/cache
+        run: bash scripts/check-workspace-versions.sh
+
+      - name: Cache Rust inputs
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          shared-key: cargo-home-${{ runner.os }}-${{ runner.arch }}
+          cache-targets: false
+
+      - name: Configure compiler cache
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: "v0.16.0"
+
+      - name: Run the symlink scan and watcher tests
+        run: |
+          cargo test -p codegraph-extract --locked --test scan_symlinks
+          cargo test -p codegraph-watch --locked symlink
+
   audit:
     name: Security Audit
     needs: workspace-version
@@ -268,7 +306,7 @@ jobs:
 
   ci-success:
     name: CI Success
-    needs: [workspace-version, linux, windows-clippy, windows-test, audit]
+    needs: [workspace-version, linux, windows-clippy, windows-test, macos-watcher, audit]
     if: always()
     runs-on: ubuntu-24.04
     timeout-minutes: 5

crates/codegraph-cli/Cargo.toml

@@ -44,6 +44,7 @@ tracing-subscriber = { workspace = true }
 time = { workspace = true }
 
 [dev-dependencies]
+rusqlite = { workspace = true }
 codegraph-bench = { path = "../codegraph-bench" }
 # Feature-unifies the Store's lease barrier into `CARGO_BIN_EXE_codegraph` only
 # while this package's test targets are built. A normal binary build uses the

crates/codegraph-cli/src/main.rs

@@ -5289,6 +5289,8 @@ fn index_project_inner(
     });
     top_unsupported_extensions.truncate(5);
     let files = scan.files;
+    // Recorded with the index so a later sync can tell a retargeted link (#935).
+    let followed_links = scan.links;
     let scan_duration = scan_started.elapsed();
     let mut diagnostic_run = DiagnosticRun::start(
         project,
@@ -5671,6 +5673,7 @@ fn index_project_inner(
         json!({}),
     );
     store.set_project_metadata("indexed_with_version", VERSION)?;
+    codegraph_watch::record_followed_links(&store, &followed_links)?;
     let after = store.counts()?;
     // Explicit fallible finalization: pragma restore -> checkpoint + compaction ->
     // extraction stamp -> stamp checkpoint -> close the final connection ->