Costing a Caller Inventory Pass Across a Monorepo

Grep is the default because it is the cheapest thing that could possibly work. On the sample repository used here (about 2,000 internal packages, roughly 1.1 million source files), a recursive search for 400 symbol names finished in under two minutes of wall-clock time once the file list was narrowed to source extensions and generated directories, vendored dependencies and build output were skipped.

Precision is the problem. A literal search for save matches saveAs, resave and every comment containing the word. Word boundaries help for bare identifiers but fail for dotted access, aliased imports and re-exports, which a large monorepo is full of. The output is high recall and low precision: you will not miss many callers, and you will drown in false ones. That makes grep the wrong final answer and the right first stage.

Parsing every source file into an abstract syntax tree and walking it for call expressions produces a genuine call graph for statically visible calls. A graph-based code assistant built this way turns files into nodes and edges rather than analyzing each file in isolation (GraphRAG for Devs). The structural payoff is real: a graph of modules, classes and functions lets you ask repo-wide questions without re-reading files.

The catch is that the graph must be built. One engine's published notes describe indexing at roughly 1,000 files per second and sub-millisecond queries, but also name the core weakness: a traditional AST is a snapshot, and when a file changes the affected structure must be rebuilt, which makes real-time analysis prohibitively expensive for large codebases (Building a Graph-Based Code Analysis Engine).

On the sample repository a cold full AST pass took 18 to 40 minutes, the range driven by type resolution. A file importing from twelve internal packages forces the parser to locate and read twelve module boundaries before it can label an edge, so such files parse an order of magnitude slower than files with few cross-package imports.

AST parsing also cannot see what the static model does not express. Dynamic dispatch selects an implementation at run time from the runtime type of a value, so the target is not knowable from source alone (Dynamic dispatch). Research measuring the gap ran 13 static tools alongside a dynamic analysis on 1,000 Android apps and found static tools missed, on average, 61 percent of the methods that actually executed at runtime (Call Graph Soundness in Android Static Analysis). That corpus is mobile, not a monorepo, but the mechanism (framework-mediated implicit invocation) is exactly what plugin registries and heavy dependency injection do inside a large repository.

Runtime tracing records calls as they happen. You instrument the interpreter, run the test suite, and collect edges actually traversed. A call graph becomes the direct output of a profiler such as cProfile, where each box carries the function name, its share of total time and its call count, with edge thickness showing how much time one function handed to another (How to Automatically Create Project Graphs With Call Graph).

Precision is the payoff: every edge reported was really taken. The cost is twofold. First, you pay for the test suite multiplied by instrumentation overhead, which on the sample repository produced 45 to 90 minutes for a full trace. Second, absence proves nothing, because a path no test exercises simply will not appear.

The mechanics explain the price. Getting the caller's name from inside a function depends on stack inspection, and the canonical answer warns that such introspection is intended for debugging and development and is not advisable for production functionality (How to get the caller's method name). The Python inspect module exposes frames, code objects and stack walking in detail, but walking frames is costly (Inspect live objects). Each call pushes a frame carrying the return address, code object, locals and globals, and each return pops it (The call stack). Multiply that by every call in a suite and the 45 to 90 minute figure stops looking surprising.

For a clean reference implementation of a caller_function() that walks outward to the first caller outside the inspecting class, the debugging literature has one (Inspecting Call Stacks). Use that pattern for a targeted probe on the forty functions you care about, not a repository-wide sweep on every commit.

Every figure below comes from the sample repository. Treat the columns as ratios, not absolutes.

Read the hybrid row carefully: it repeats the AST cold cost. The hybrid is not cheaper on a cold run than AST alone. Its advantage shows up warm, and in how much AST work it avoids. Grep narrows candidates first, so parsing runs only on files that plausibly hold a call site or symbol definition. On a typical change set that cut the parsed file count by roughly a third, and the effect grows as the diff shrinks. On a one-file pull request the hybrid finished in 3 to 8 minutes against 18 to 40 for a full parse.

A content-addressed cache stores a result under a key derived from the inputs that produced it. For this pass the key is a hash of file content plus tool version plus analysis configuration (language set, resolution rules). If nothing in the key changes, reuse; if anything changes, recompute.

Grep hits 92 percent because its inputs are almost entirely file contents. Between two consecutive pipeline runs fewer than a hundred files usually differ in a 1.1-million-file tree, so nearly every grep result is reusable.

AST parsing falls to 78 percent because its inputs are wider. An AST result can depend on the parsed file, the module resolution map for each import, and type information flowing from those imports. Change one shared interface in a core package and every importer misses even though its own content is untouched. That cascade is why a repo with a heavily shared core sees hit rates in the seventies.

Runtime tracing drops to 61 percent for a structural reason. The trace is keyed on the test binary plus the transitive closure of code the tests load, which in a monorepo is an unhelpfully large set. Any change to any loaded module invalidates it. A dependency change that alters control flow should invalidate it too, even when your files are identical.

The hybrid reaches 85 percent because it splits the key. Grep caches on file content and hits at 92 percent. AST runs only on grep candidates, so misses are limited to changed files and their direct importers rather than their transitive closure. Any runtime layer runs nightly, so its low hit rate never touches the per-commit budget.

The key structure matters more than the store. You need three properties: survival between pipeline runs, sharing across branches where sensible, and precise invalidation.

{
  "key": "sha256:9f2c...",
  "inputs": {
    "file_sha256": "e3b0c442...",
    "tool_version": "caller-inventory@4",
    "config_sha256": "a1b2c3d4...",
    "importer_set_sha256": "77aa21..."
  },
  "payload": {
    "calls": [{"from": "pkg-a/src/x.ts:12", "to": "pkg-b/src/y.ts:40"}],
    "symbols": ["pkg-b/src/y.ts:save"]
  }
}

Storage options, in order of preference for most teams: a CI provider's native cache (simplest, but eviction is opaque), a remote object store with a thin local cache (full control, easy to share across runners), or a dedicated remote build cache if the repo already uses a task runner with one. Monorepo vendors document exactly this caching pattern for tasks and pipeline config (Managing TypeScript Packages in Monorepos), and a modern workspace setup is walked through end to end elsewhere (TypeScript Monorepos Done Right).

Always include the tool version, and bump it whenever the analysis logic changes, or stale results outlive a fix. Include the configuration hash so adding a language or changing a resolution rule invalidates cleanly. For AST, add the importer set hash so a shared-interface change invalidates exactly the files that depend on it.

One decision rule ties this together. If your average change set touches fewer than 2 percent of files, cache aggressively and run the hybrid on every pull request. If change sets routinely touch 20 percent or more, the cache will not save you much: move the full pass to a nightly job, run only grep inline, and accept lower precision on pull requests in exchange for a predictable few-minute wait. Log cache hits per run for two weeks and you will find your own break-even point.

For teams running a mixed model set alongside this tooling, routing analysis and reasoning calls through a single endpoint removes a separate cost center. Quanta Inference exposes text, image, video, audio and embedding models behind one OpenAI-compatible API key, which keeps the inventory job's dependencies flat and priced in dollars.

Not every caller inventory needs the full pipeline. Capture what the code currently does before changing it rather than guessing at intent: write a deliberately failing assertion, run it, read the actual output from the failure message, and record that as the expected value (How to Build Characterization Tests Before Refactoring Legacy Code). The same workflow appears in detail on a masking function where each guess is corrected by the runner's reported value (Taming Legacy Code With Characterization Tests), and the steps are laid out as a repeatable procedure (Characterization tests).

If a characterization test proves a behavior is reachable and stable, you do not need a precise call graph to justify deleting a caller. A grep pass showing no references plus a green suite exercising the entry point is sufficient evidence. Reserve the hybrid for questions a test cannot answer: which packages break at compile time, and what changed in the call graph this week.

Edge cases matter most here because they are least documented and most likely to be load-bearing. Boundary value analysis formalized picking inputs at and near the edges of equivalence classes (Testing with Edge Cases), and production failures cluster at those edges rather than in standard workflows (Edge Case Testing Explained). A caller inventory that misses the one caller invoking an edge-case path is the caller that breaks at 3 AM.