@mmerterden/multi-agent-pipeline 20.21.0 → 20.22.0

package/pipeline/scripts/_code-graph.mjs

@@ -35,7 +35,7 @@ import { isExcludedBy } from "./_path-match.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-export const GRAPH_SCHEMA_VERSION = "1.0.0";
+export const GRAPH_SCHEMA_VERSION = "1.1.0";
 
 /**
  * Stack words the pipeline uses elsewhere, mapped to the rule-file id.
@@ -256,6 +256,74 @@ function indentOf(text, index) {
   return i - start;
 }
 
+const leading = (line) => line.length - line.replace(/^[ \t]+/, "").length;
+const ATTRIBUTE_RE = /^[ \t]*@/;
+const CLOSER_RE = /^[ \t]*[}\])]/;
+const OPENS_BLOCK_RE = /(?:[{:=]|=>|->)[ \t]*$/;
+const DIRECTIVE_RE = /^#(?:if|elseif|else|endif)\b/;
+const STORED_PROPERTY_RE = /\b(?:var|let|val)\b/;
+
+/**
+ * Give every definition a span: `startLine` (the declaration line, or the first
+ * of the attribute or decorator lines directly above it, never a stored
+ * property) and `endLine` (the last line indented deeper than the declaration,
+ * plus a closing bracket at the declaration's own indentation when one
+ * follows). A closing bracket that opens the body again - the end of a
+ * multi-line parameter list, `) -> Int {`, `):`, `) : Base() {` - continues the
+ * span, and compiler directives in column 0 (`#if`, `#endif`) are skipped like
+ * blank lines. Code after the span, at the same or a lower indentation,
+ * belongs to no declaration until the next one starts.
+ *
+ * Indentation is the nesting signal the engine already trusts (see indentOf),
+ * so this needs no parser and holds for Python as well as the brace languages.
+ *
+ * @param {Array<{line: number, indent: number}>} definitions - mutated in place
+ * @param {string[]} lines - the stripped body, one entry per source line
+ */
+export function assignSpans(definitions, lines) {
+  for (const d of definitions) {
+    let start = d.line;
+    while (start > 1) {
+      const above = lines[start - 2];
+      if (
+        !ATTRIBUTE_RE.test(above) ||
+        leading(above) !== d.indent ||
+        STORED_PROPERTY_RE.test(above)
+      )
+        break;
+      start--;
+    }
+    d.startLine = start;
+  }
+  const ordered = [...definitions].sort((a, b) => a.line - b.line || a.indent - b.indent);
+  for (let i = 0; i < ordered.length; i++) {
+    const d = ordered[i];
+    let limit = lines.length;
+    for (let j = i + 1; j < ordered.length; j++) {
+      if (ordered[j].line > d.line && ordered[j].indent <= d.indent) {
+        limit = ordered[j].startLine - 1;
+        break;
+      }
+    }
+    let end = d.line;
+    for (let n = d.line + 1; n <= limit; n++) {
+      const text = lines[n - 1];
+      if (!text.trim() || DIRECTIVE_RE.test(text)) continue;
+      const ind = leading(text);
+      if (ind > d.indent) {
+        end = n;
+        continue;
+      }
+      if (ind === d.indent && CLOSER_RE.test(text)) {
+        end = n;
+        if (OPENS_BLOCK_RE.test(text)) continue;
+      }
+      break;
+    }
+    d.endLine = end;
+  }
+}
+
 /**
  * Extract one file's definitions, imports and identifier set.
  *
@@ -303,11 +371,14 @@ export function extractFile(text, rules) {
         kind: pattern.kind || pattern.id,
         patternId: pattern.id,
         line: lineOf(body, m.index),
+        indent: indentOf(body, m.index),
         nested: indentOf(body, m.index) > 0,
       });
     }
   }
 
+  assignSpans(definitions, body.split("\n"));
+  for (const d of definitions) delete d.indent;
   return { definitions, imports, tokens: identifiers(body) };
 }
 
@@ -325,11 +396,11 @@ export function extractFile(text, rules) {
 export function listSourceFiles(root, rules) {
   let candidates;
   try {
-    const out = execFileSync("git", ["-C", root, "ls-files", "-co", "--exclude-standard"], {
+    const out = execFileSync("git", ["-C", root, "ls-files", "-z", "-co", "--exclude-standard"], {
       encoding: "utf8",
       maxBuffer: 64 * 1024 * 1024,
     });
-    candidates = out.split("\n").filter(Boolean);
+    candidates = out.split("\0").filter(Boolean);
   } catch {
     candidates = walkDir(root, root);
   }
@@ -427,6 +498,8 @@ export function buildGraph({
           name: def.name,
           path,
           line: def.line,
+          ...(def.endLine ? { endLine: def.endLine } : {}),
+          ...(def.startLine && def.startLine !== def.line ? { startLine: def.startLine } : {}),
           symbolKind: def.kind,
           isTest: isTestPath(path, rules),
           nested: def.nested === true,

package/pipeline/scripts/_diff-impact.mjs

@@ -0,0 +1,312 @@
+/**
+ * @file _diff-impact.mjs  -  a diff, mapped onto the code graph.
+ *
+ * Three questions a reviewer or a planner asks of a change, answered from the
+ * graph without a model:
+ *
+ *   parseHunkRanges  which lines of each file the diff touched, on the side
+ *                    the graph was built from (graphSide)
+ *   changedSymbols   which declarations those lines fall in, innermost first,
+ *                    and which files the graph does not index at all
+ *   graphFreshness   how far the graph is behind the tree it describes
+ *
+ * The reverse walk itself is graph-affected.mjs; this module only produces its
+ * seeds. A graph built before definition spans existed (schema 1.0.0) has no
+ * `endLine`, so a hunk in such a file seeds the whole file and the file is
+ * listed in `fileLevel`: a coarser answer that says it is coarse.
+ *
+ * Zero runtime dependencies (ADR-0004).
+ *
+ * @module pipeline/scripts/_diff-impact
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { unquotePathIfNeeded } from "./git-path.mjs";
+
+const HUNK_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
+
+/** The path of a `---`/`+++` line: git-quoted or not, one-letter prefix removed. */
+function sidePath(raw, prefix) {
+  const text = raw.startsWith('"') ? raw : raw.replace(/\t.*$/, "");
+  const path = unquotePathIfNeeded(text);
+  if (path === "/dev/null") return null;
+  return path.startsWith(prefix) ? path.slice(prefix.length) : path;
+}
+
+function addLine(set, line) {
+  set.add(Math.max(1, line));
+}
+
+function toRanges(lines) {
+  const sorted = [...lines].sort((a, b) => a - b);
+  const out = [];
+  for (const l of sorted) {
+    const last = out[out.length - 1];
+    if (last && l === last.end + 1) last.end = l;
+    else if (!last || l > last.end) out.push({ start: l, end: l });
+  }
+  return out;
+}
+
+/**
+ * Every file of a unified diff with the lines it touched on each side.
+ *
+ * New side: an added line counts as itself, and a deletion as the line now
+ * standing where the removed lines were. Old side: a removed line counts as
+ * itself, and an insertion as the old line standing where it went in. Either way a hunk that
+ * only adds or only removes still lands inside the declaration it changed.
+ * Hunks are counted from their headers, so concatenated `diff -u` output with
+ * no `diff --git` lines parses too, CRLF included, at any context size.
+ *
+ * @param {string} diffText - unified diff
+ * @returns {Array<{oldPath: string|null, newPath: string|null, oldRanges: Array<{start: number, end: number}>, newRanges: Array<{start: number, end: number}>}>}
+ */
+export function parseDiffFiles(diffText) {
+  const files = [];
+  let cur = null;
+  let pendingOld;
+  let oldLine = 0;
+  let newLine = 0;
+  let oldLeft = 0;
+  let newLeft = 0;
+  for (const line of String(diffText).split("\n")) {
+    const raw = line.endsWith("\r") ? line.slice(0, -1) : line;
+    if (oldLeft > 0 || newLeft > 0) {
+      if (raw.startsWith("+")) {
+        addLine(cur.newLines, newLine);
+        addLine(cur.oldLines, oldLine);
+        newLine++;
+        newLeft--;
+        continue;
+      }
+      if (raw.startsWith("-")) {
+        addLine(cur.oldLines, oldLine);
+        addLine(cur.newLines, newLine);
+        oldLine++;
+        oldLeft--;
+        continue;
+      }
+      if (raw.startsWith(" ") || raw === "") {
+        oldLine++;
+        newLine++;
+        oldLeft--;
+        newLeft--;
+        continue;
+      }
+      if (raw.startsWith("\\")) continue;
+      oldLeft = 0;
+      newLeft = 0;
+    }
+    if (raw.startsWith("diff --git ")) {
+      pendingOld = undefined;
+      continue;
+    }
+    if (raw.startsWith("--- ")) {
+      pendingOld = sidePath(raw.slice(4), "a/");
+      continue;
+    }
+    if (raw.startsWith("+++ ")) {
+      cur = {
+        oldPath: pendingOld === undefined ? null : pendingOld,
+        newPath: sidePath(raw.slice(4), "b/"),
+        oldLines: new Set(),
+        newLines: new Set(),
+      };
+      files.push(cur);
+      pendingOld = undefined;
+      continue;
+    }
+    const hunk = HUNK_RE.exec(raw);
+    if (hunk && cur) {
+      const oldCount = hunk[2] === undefined ? 1 : Number(hunk[2]);
+      const newCount = hunk[4] === undefined ? 1 : Number(hunk[4]);
+      oldLine = Number(hunk[1]);
+      newLine = Number(hunk[3]);
+      oldLeft = oldCount;
+      newLeft = newCount;
+      if (newCount === 0) addLine(cur.newLines, newLine);
+      if (oldCount === 0) addLine(cur.oldLines, oldLine);
+    }
+  }
+  return files
+    .filter((f) => f.oldPath || f.newPath)
+    .map((f) => ({
+      oldPath: f.oldPath,
+      newPath: f.newPath,
+      oldRanges: toRanges(f.oldLines),
+      newRanges: toRanges(f.newLines),
+    }));
+}
+
+/**
+ * Line ranges per file on one side of the diff. `new` (default) keys by the
+ * new path; a deleted file falls back to its old path. `old` keys by the old
+ * path; an added file falls back to its new path. Pick the side the graph was
+ * built from (`graphSide`): its spans are line numbers in that tree.
+ *
+ * @param {string} diffText - unified diff
+ * @param {"new"|"old"} [side]
+ * @returns {Map<string, Array<{start: number, end: number}>>} in diff order
+ */
+export function parseHunkRanges(diffText, side = "new") {
+  const out = new Map();
+  for (const f of parseDiffFiles(diffText)) {
+    const path = side === "old" ? f.oldPath || f.newPath : f.newPath || f.oldPath;
+    const ranges = side === "old" ? f.oldRanges : f.newRanges;
+    if (ranges.length) out.set(path, ranges);
+  }
+  return out;
+}
+
+/**
+ * Declarations a set of ranges falls in.
+ *
+ * `changed` holds the innermost declaration per range - what a person would
+ * call "the function I edited". `seeds` adds every enclosing declaration, since
+ * references in the graph point at types, not at the methods inside them, and a
+ * walk seeded with the method alone would find no dependents. A range that hits
+ * no declaration (top-level code) seeds its file.
+ *
+ * @param {object} graph
+ * @param {Map<string, Array<{start: number, end: number}>>} ranges
+ * @returns {{changed: object[], seeds: object[], fileLevel: string[], notIndexed: string[]}}
+ */
+export function changedSymbols(graph, ranges) {
+  const files = new Map();
+  const symbolsByPath = new Map();
+  for (const n of graph.nodes) {
+    if (n.kind === "file") files.set(n.path, n);
+    else if (n.kind === "symbol" && n.path) {
+      if (!symbolsByPath.has(n.path)) symbolsByPath.set(n.path, []);
+      symbolsByPath.get(n.path).push(n);
+    }
+  }
+
+  const changed = new Map();
+  const seeds = new Map();
+  const fileLevel = [];
+  const notIndexed = [];
+
+  for (const [path, list] of ranges) {
+    const fileNode = files.get(path);
+    if (!fileNode) {
+      notIndexed.push(path);
+      continue;
+    }
+    const symbols = symbolsByPath.get(path) || [];
+    const spanned = symbols.filter((s) => Number.isInteger(s.endLine));
+    if (symbols.length && !spanned.length) {
+      fileLevel.push(path);
+      seeds.set(fileNode.id, fileNode);
+      continue;
+    }
+    for (const r of list) {
+      const containing = spanned
+        .filter((s) => (s.startLine ?? s.line) <= r.end && s.endLine >= r.start)
+        .sort((a, b) => b.line - a.line);
+      if (!containing.length) {
+        seeds.set(fileNode.id, fileNode);
+        continue;
+      }
+      const inner = containing[0];
+      changed.set(inner.id, inner);
+      for (const s of containing) seeds.set(s.id, s);
+    }
+  }
+
+  return { changed: [...changed.values()], seeds: [...seeds.values()], fileLevel, notIndexed };
+}
+
+function gitOut(root, args) {
+  try {
+    return execFileSync("git", ["-C", root, ...args], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * How far the graph is behind the tree. `changedFiles` compares each indexed
+ * file's size and mtime with the manifest written at build time, so an edit
+ * that was never committed counts; `commitMoved` compares the build commit with
+ * HEAD. Either makes the graph stale - an answer from it is about the tree as
+ * it was, and callers say so instead of presenting it as current.
+ *
+ * @param {object} graph
+ * @param {{root?: string}} [opts] - defaults to the root recorded in the graph
+ * @returns {{stale: boolean, commitMoved: boolean|null, baseCommit: string|null, head: string|null, changedFiles: string[], removedFiles: string[]}}
+ */
+export function graphFreshness(graph, { root = graph.root } = {}) {
+  const manifest = graph.manifest || {};
+  const changedFiles = [];
+  const removedFiles = [];
+  for (const [path, prev] of Object.entries(manifest)) {
+    const abs = join(root, path);
+    if (!existsSync(abs)) {
+      removedFiles.push(path);
+      continue;
+    }
+    const st = statSync(abs);
+    if (st.size !== prev.size || Math.floor(st.mtimeMs) !== prev.mtimeMs) changedFiles.push(path);
+  }
+  const head = root ? gitOut(root, ["rev-parse", "HEAD"]) : null;
+  const baseCommit = graph.baseCommit || null;
+  const commitMoved = head && baseCommit ? head !== baseCommit : null;
+  return {
+    stale: Boolean(commitMoved) || changedFiles.length > 0 || removedFiles.length > 0,
+    commitMoved,
+    baseCommit,
+    head,
+    changedFiles: changedFiles.sort(),
+    removedFiles: removedFiles.sort(),
+  };
+}
+
+/**
+ * Which side of a diff the graph's line numbers describe. A graph that matches
+ * the tree at `root` (same HEAD, no file edited since the build) describes the
+ * new side; any other graph was built before the change - on the base checkout,
+ * or before the edit - and its spans are old-side line numbers.
+ *
+ * @param {object} graph
+ * @param {{root?: string}} [opts]
+ * @returns {"new"|"old"}
+ */
+export function graphSide(graph, opts = {}) {
+  return graphFreshness(graph, opts).stale ? "old" : "new";
+}
+
+const REF_RE = /^(?!-)[A-Za-z0-9._/~^@{}-]{1,200}$/;
+
+/**
+ * The unified diff for `<base>` (working tree against base, uncommitted work
+ * included) or `<base>..<head>` (two commits), with no context lines.
+ *
+ * @param {string} root
+ * @param {string} spec
+ * @returns {string}
+ */
+export function diffFor(root, spec) {
+  const parts = String(spec).split("..");
+  if (parts.length > 2 || parts.some((p) => !REF_RE.test(p))) {
+    throw new Error(`not a ref or ref range: ${JSON.stringify(String(spec).slice(0, 80))}`);
+  }
+  const args = [
+    "-C",
+    root,
+    "diff",
+    "-U0",
+    "--no-color",
+    "--no-ext-diff",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    "--end-of-options",
+    ...parts,
+  ];
+  return execFileSync("git", args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+}

package/pipeline/scripts/capture-flush.sh

@@ -110,8 +110,37 @@ fi
 # Phase 4 removes the worktree once the PR is open, so the salvaged copy under
 # artifactsPath is tried FIRST. Reading the worktree path first would degrade
 # silently for exactly the runs this script exists to rescue.
+#
+# After those, each worktree's newest `.pipeline/triage-round-<N>.json`: Phase 3
+# writes every round there itself, and the copy to triage-output.json is a
+# separate step a run can die before. A multi-repo run names its worktrees only
+# under projects[], so those are read too, and the state directory last.
+newest_round() {
+  [ -d "$1/.pipeline" ] || return 0
+  ls -t "$1"/.pipeline/triage-round-*.json 2>/dev/null | head -1
+}
+WORKTREES=$( { [ -n "$WORKTREE" ] && printf '%s\n' "$WORKTREE"; jq -r '.projects[]?.worktreePath // empty' "$STATE" 2>/dev/null; } | awk 'NF && !seen[$0]++')
 TRIAGE=""
-for cand in "${ARTIFACTS:+$ARTIFACTS/triage-output.json}" "${WORKTREE:+$WORKTREE/triage-output.json}"; do
+CANDIDATES=("${ARTIFACTS:+$ARTIFACTS/triage-output.json}")
+# Within one worktree the newer of the copy and the newest round wins: a run
+# that died before the copy step leaves the previous round in the copy.
+newest_in_worktree() {
+  local copy="$1/triage-output.json" round
+  round=$(newest_round "$1")
+  if [ -f "$copy" ] && [ -n "$round" ]; then
+    ls -t "$copy" "$round" 2>/dev/null | head -1
+  elif [ -f "$copy" ]; then
+    printf '%s\n' "$copy"
+  else
+    printf '%s\n' "$round"
+  fi
+}
+while IFS= read -r wt; do
+  [ -n "$wt" ] || continue
+  CANDIDATES+=("$(newest_in_worktree "$wt")")
+done <<< "$WORKTREES"
+CANDIDATES+=("$(dirname "$STATE")/triage-output.json")
+for cand in "${CANDIDATES[@]}"; do
   [ -n "$cand" ] && [ -f "$cand" ] && { TRIAGE="$cand"; break; }
 done
 
@@ -136,12 +165,38 @@ run_store() {
   esac
 }
 
+# The store is named after the run's repository, never after the directory this
+# script happens to run in: a SessionEnd hook fires wherever the session was.
+# A live worktree resolves to its main checkout's folder, the same name the
+# readers derive; otherwise the project recorded in the state.
+slug_of_worktree() {
+  [ -d "$1" ] || return 0
+  local main
+  main=$(git -C "$1" worktree list --porcelain 2>/dev/null | sed -n '1s/^worktree //p')
+  [ -n "$main" ] || return 0
+  basename "$main" .git
+}
+SLUG=""
+while IFS= read -r wt; do
+  [ -n "$wt" ] && [ -z "$SLUG" ] && SLUG=$(slug_of_worktree "$wt")
+done <<< "$WORKTREES"
+plain_slug() {
+  case "$1" in
+    "" | .* | *[!A-Za-z0-9._-]*) return 0 ;;
+  esac
+  printf '%s' "$1"
+}
+SLUG=$(plain_slug "$SLUG")
+[ -n "$SLUG" ] || SLUG=$(plain_slug "$(jq -r '.project // .projects[0].name // empty' "$STATE" 2>/dev/null)")
+SLUG_ARGS=()
+[ -n "$SLUG" ] && SLUG_ARGS=(--repo-slug "$SLUG")
+
 if [ -n "$TRIAGE" ]; then
   INGESTED=$(run_store ingest \
-    node "$SCRIPTS/triage-memory.mjs" ingest --triage "$TRIAGE" --state "$STATE")
+    node "$SCRIPTS/triage-memory.mjs" ingest --triage "$TRIAGE" --state "$STATE" ${SLUG_ARGS[@]+"${SLUG_ARGS[@]}"})
   if [ -n "$TASK_ID" ]; then
     DISTILLED=$(run_store distill \
-      node "$SCRIPTS/learnings-ledger.mjs" from-triage --triage "$TRIAGE" --task "$TASK_ID")
+      node "$SCRIPTS/learnings-ledger.mjs" from-triage --triage "$TRIAGE" --task "$TASK_ID" ${SLUG_ARGS[@]+"${SLUG_ARGS[@]}"})
   fi
 fi
 

package/pipeline/scripts/diff-risk-score.mjs

@@ -16,11 +16,18 @@
  *   ui_critical       -  *View.swift / *Screen.kt / Configuration   w=1.5
  *   migration         -  DB schema / migration path                 w=4.0
  *   test_lines_removed -  test file shrinks (removed > added)       w=3.0
+ *   dependents_reached -  distinct non-test files that depend on the  w=2.0
+ *                         changed declarations, two rings out, from
+ *                         the code graph; only with --graph, capped
+ *                         at 20 so one hub cannot outweigh a
+ *                         security path
  *
  * Inputs:
  *   --base <ref>     Base ref. Default: origin/main, fallback: main
  *   --head <ref>     Head ref. Default: HEAD
  *   --diff <path>    Pre-computed diff file (skip git invocation)
+ *   --graph <path>   Code graph (graph-build.mjs). Adds dependents_reached;
+ *                    an unreadable graph is reported on stderr and skipped
  *   --root <path>    Repo root for git -C. Default: cwd
  *   --task-id <id>   Tag the output with a task id (no functional effect)
  *   --top <N>        Truncate `files` to top N. Default: keep all,
@@ -40,7 +47,9 @@
 
 import { readFileSync, existsSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { unquoteGitPath, unquotePathIfNeeded } from "./git-path.mjs";
+import { unquoteGitPath } from "./git-path.mjs";
+import { affected } from "./graph-affected.mjs";
+import { parseDiffFiles, changedSymbols, graphSide } from "./_diff-impact.mjs";
 
 const argv = process.argv.slice(2);
 const flags = {};
@@ -65,6 +74,9 @@ const DIFF_FILE = flags.diff || null;
 const TASK_ID = flags["task-id"] || null;
 const TOP = flags.top ? Number(flags.top) : null;
 const PRETTY = flags.json === true;
+const GRAPH_FILE = flags.graph && flags.graph !== true ? flags.graph : null;
+const DEPENDENTS_CAP = 20;
+const DEPENDENTS_DEPTH = 2;
 
 function git(args) {
   return execFileSync("git", ["-C", ROOT, ...args], { encoding: "utf8" }).trim();
@@ -95,7 +107,7 @@ function loadDiff() {
     if (!existsSync(DIFF_FILE)) throw new Error(`diff file not found: ${DIFF_FILE}`);
     return readFileSync(DIFF_FILE, "utf8");
   }
-  return git(["diff", "--unified=0", `${BASE}...${HEAD}`]);
+  return git(["diff", "--unified=0", "--src-prefix=a/", "--dst-prefix=b/", `${BASE}...${HEAD}`]);
 }
 
 function loadNumstat() {
@@ -118,16 +130,30 @@ function loadNumstat() {
     }
     return Array.from(map.entries()).map(([path, v]) => ({ path, ...v }));
   }
-  const out = git(["diff", "--numstat", `${BASE}...${HEAD}`]);
+  // -z: paths are raw (never quoted), and a rename is `A\tR\t\0old\0new\0`,
+  // so the new path is read directly instead of parsed out of `{a => b}`.
+  const out = execFileSync("git", ["-C", ROOT, "diff", "--numstat", "-z", `${BASE}...${HEAD}`], {
+    encoding: "utf8",
+  });
   if (!out) return [];
-  return out.split("\n").map((line) => {
-    const [a, r, ...rest] = line.split("\t");
-    return {
-      path: unquotePathIfNeeded(rest.join("\t")),
+  const fields = out.split("\0");
+  const rows = [];
+  for (let i = 0; i < fields.length; i++) {
+    const head = fields[i];
+    if (!head) continue;
+    const [a, r, path] = head.split("\t");
+    let name = path;
+    if (path === "") {
+      name = fields[i + 2];
+      i += 2;
+    }
+    rows.push({
+      path: name,
       added: a === "-" ? 0 : Number(a) || 0,
       removed: r === "-" ? 0 : Number(r) || 0,
-    };
-  });
+    });
+  }
+  return rows;
 }
 
 const SECURITY_GLOBS = [
@@ -332,6 +358,47 @@ function buildRow(stat, addedLines, allChangedPaths) {
   };
 }
 
+function loadGraphOrNull(path) {
+  try {
+    const graph = JSON.parse(readFileSync(path, "utf8"));
+    if (!Array.isArray(graph.nodes) || !Array.isArray(graph.edges))
+      throw new Error("not a code graph");
+    return graph;
+  } catch (e) {
+    process.stderr.write(
+      `diff-risk-score: graph unreadable at ${path}, dependents_reached skipped: ${e.message}\n`,
+    );
+    return null;
+  }
+}
+
+/**
+ * Add dependents_reached to each row whose changed declarations have
+ * dependents in the graph. Test files are not counted as dependents: a change
+ * that only its own tests use is not wide.
+ */
+function addGraphSignal(rows, graph, diffText, root) {
+  const side = graphSide(graph, { root });
+  const diffFiles = parseDiffFiles(diffText);
+  for (const row of rows) {
+    const f = diffFiles.find((x) => (x.newPath || x.oldPath) === row.path);
+    if (!f) continue;
+    const path = side === "old" ? f.oldPath || f.newPath : f.newPath || f.oldPath;
+    const r = side === "old" ? f.oldRanges : f.newRanges;
+    if (!r.length) continue;
+    const { seeds } = changedSymbols(graph, new Map([[path, r]]));
+    if (!seeds.length) continue;
+    const hits = affected({ graph, seeds, depth: DEPENDENTS_DEPTH });
+    const files = new Set(
+      hits.filter((h) => h.node?.path && !h.node.isTest).map((h) => h.node.path),
+    );
+    if (!files.size) continue;
+    const w = 2.0;
+    row.signals.push({ name: "dependents_reached", weight: w, value: files.size });
+    row.score = Math.round((row.score + Math.min(files.size, DEPENDENTS_CAP) * 2 * w) * 100) / 100;
+  }
+}
+
 function main() {
   // Resolve the base ref ONCE, before any git diff runs. loadNumstat() and
   // loadDiff() both interpolate BASE; resolving it lazily inside loadDiff()
@@ -348,6 +415,10 @@ function main() {
   const rows = numstat.map((stat) =>
     buildRow(stat, perFileAdded.get(stat.path) || [], allChangedPaths),
   );
+  if (GRAPH_FILE) {
+    const graph = loadGraphOrNull(GRAPH_FILE);
+    if (graph) addGraphSignal(rows, graph, diffText, ROOT);
+  }
   rows.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
 
   const totals = {