fix: extraction/resolution accuracy (BOM, retry strip, framework regex)

[mschreib28]

Summary\n\nThree extraction/resolution accuracy bugs caught by an audit pass, bundled in one PR for review tractability.\n\n### 1. UTF-8 BOM caused spurious "modified" hash mismatches\n\nsrc/extraction/index.ts (hashContent)\n\nA file written with a BOM by one editor and re-saved without a BOM by another (VSCode strips by default; some Windows editors preserve it) hashed to two different values. Sync then reported the file as modified on every run despite no real change. hashContent now strips a leading U+FEFF before hashing.\n\n### 2. Parse-retry comment strip was a no-op for Python, Ruby, etc.\n\nsrc/extraction/index.ts (last-resort retry path), src/utils.ts\n\nThe "shrink the file by removing comment-only lines" fallback (which fires when a file repeatedly crashes the WASM parser) used /^\\s*\\/\\//.test(line) for every language. Python (#), Ruby (#), shell, etc. had nothing stripped — the retry parsed the same content that had already crashed and the file silently stayed unindexed. Added a per-language LINE_COMMENT_MARKER table and a stripCommentLinesForRetry helper at the retry call site.\n\n### 3. Framework route extractors matched docstrings and comments\n\nsrc/resolution/frameworks/{python,express,laravel,rust,csharp}.ts\n\npattern.exec(content) ran the route regex over raw file content, so a route example in a Python docstring or a commented-out route in JS/Rust/C# XML-doc comment was extracted as a real route node. AI assistants then saw phantom routes that don't exist in the running app.\n\nAdded stripCommentsForRegex(content, language) in utils.ts which neutralizes:\n- Block comments (/* ... */) for C-family languages\n- Whole-line single-line comments per language (//, #)\n- Triple-quoted strings ("""…""", '''…''') for Python (the docstring carrier)\n- =begin…=end blocks for Ruby\n\nNewlines are preserved so match.index derived from the stripped content maps back to the same line number in the original. Deliberately does not strip arbitrary string literals — those carry the real route paths the regex needs to see.\n\nApplied at the top of every affected framework extractor (django, flask, fastapi, express, laravel, actix/rocket/axum, aspnet).\n\n## Files changed\n\n| File | Change |\n|---|---|\n| src/utils.ts | Add stripBom, stripCommentsForRegex, stripCommentLinesForRetry, LINE_COMMENT_MARKER |\n| src/extraction/index.ts | Strip BOM in hashContent; use language-aware retry strip |\n| src/resolution/frameworks/python.ts | Strip comments before django/flask/fastapi route regex |\n| src/resolution/frameworks/express.ts | Strip comments before express route regex |\n| src/resolution/frameworks/laravel.ts | Strip comments before laravel route regex |\n| src/resolution/frameworks/rust.ts | Strip comments before actix/rocket/axum route regex |\n| src/resolution/frameworks/csharp.ts | Strip comments before aspnet route regex |\n| __tests__/extraction-resolution-accuracy.test.ts | 21 regression tests |\n\n## Test plan\n\n- [x] npm test: 400/400 pass on macOS (one pre-existing fs.watch flake under parallel load, passes in isolation — unrelated to this change)\n- [x] npx tsc --noEmit clean\n- [x] 21 new tests cover: BOM normalization, per-language line stripping (including unknown-language no-op), and false-positive prevention for every affected framework\n\n🤖 Generated with Claude Code\n

---

Copied from colbymchenry/codegraph#101