sigmap 8.12.0 → 8.14.0

package/gen-context.js

@@ -10304,6 +10304,142 @@ __factories["./src/format/verify-report"] = function(module, exports) {
   
 };
 
+// ── ./src/graph/blast-radius ──
+__factories["./src/graph/blast-radius"] = function(module, exports) {
+  
+  /**
+   * Method-level blast-radius scoring (GR2).
+   *
+   * Consumes the D4 call-graph (src/graph/call-graph.js): for each changed file,
+   * resolve the functions it defines, BFS the reverse call edges, and score how
+   * much of the codebase transitively calls into the change. The score is a
+   * documented deterministic formula — no heuristics that vary run to run — so
+   * review-pr findings and PR Evidence lines are byte-stable for a fixed tree.
+   *
+   * Score: min(100, direct×4 + transitive×1). Tiers:
+   *   0 → none · 1–9 → low · 10–29 → medium · 30–59 → high · 60+ → critical
+   */
+
+  const path = require('path');
+  const { buildCallGraph } = __require('./src/graph/call-graph');
+
+  const DIRECT_WEIGHT = 4;
+  const TRANSITIVE_WEIGHT = 1;
+  const IMPACTED_FUNCTIONS_CAP = 12;
+
+  const TEST_FILE_RE = /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.(py|go)$|(^|\/)(tests?|__tests__|spec)\//;
+
+  function tierFor(score) {
+    if (score >= 60) return 'critical';
+    if (score >= 30) return 'high';
+    if (score >= 10) return 'medium';
+    if (score >= 1) return 'low';
+    return 'none';
+  }
+
+  function _normRel(p) {
+    return String(p).replace(/\\/g, '/');
+  }
+
+  // BFS the reverse edges from a set of symbol ids; returns direct/transitive id sets.
+  function _bfs(seedIds, reverse, maxDepth) {
+    const direct = new Set();
+    const transitive = new Set();
+    const visited = new Set(seedIds);
+    let frontier = [];
+    for (const s of seedIds) {
+      for (const nb of (reverse.get(s) || [])) {
+        if (!visited.has(nb)) { direct.add(nb); visited.add(nb); frontier.push(nb); }
+      }
+    }
+    let depth = 1;
+    while (frontier.length && (maxDepth === 0 || depth < maxDepth)) {
+      const next = [];
+      for (const node of frontier) {
+        for (const nb of (reverse.get(node) || [])) {
+          if (!visited.has(nb)) { transitive.add(nb); visited.add(nb); next.push(nb); }
+        }
+      }
+      frontier = next;
+      depth++;
+    }
+    return { direct, transitive };
+  }
+
+  /**
+   * Score the method-level blast radius of a changed-file list.
+   *
+   * @param {string[]} changedFiles repo-relative paths
+   * @param {string} cwd
+   * @param {object} [opts]
+   * @param {object} [opts.graph]  injected call graph (tests); else built from cwd
+   * @param {number} [opts.depth=0] BFS depth limit (0 = unlimited)
+   * @returns {{
+   *   available: boolean,
+   *   files: Array<{ file:string, symbols:number, directCallers:number,
+   *                  transitiveCallers:number, testCallers:number,
+   *                  impactedFunctions:string[], score:number, tier:string }>,
+   *   aggregate: { score:number, tier:string, impactedFunctions:number }
+   * }}
+   */
+  function methodBlastRadius(changedFiles, cwd, opts = {}) {
+    const empty = { available: false, files: [], aggregate: { score: 0, tier: 'none', impactedFunctions: 0 } };
+    let graph;
+    try {
+      graph = opts.graph || buildCallGraph(cwd, opts);
+    } catch (_) {
+      return empty;
+    }
+    if (!graph || !graph.defs || graph.defs.size === 0) return empty;
+
+    // Group defined symbol ids by their (normalized) defining file.
+    const idsByFile = new Map();
+    for (const [id, def] of graph.defs.entries()) {
+      const rel = _normRel(def.file);
+      if (!idsByFile.has(rel)) idsByFile.set(rel, []);
+      idsByFile.get(rel).push(id);
+    }
+
+    const depth = Number.isFinite(opts.depth) ? opts.depth : 0;
+    const files = [];
+    const allImpacted = new Set();
+
+    for (const changed of (changedFiles || []).map(_normRel).sort()) {
+      const ids = idsByFile.get(changed);
+      if (!ids || !ids.length) continue;
+      const { direct, transitive } = _bfs(ids, graph.reverse, depth);
+      const impacted = [...direct, ...transitive].sort();
+      for (const id of impacted) allImpacted.add(id);
+      const testCallers = impacted.filter((id) => {
+        const def = graph.defs.get(id);
+        return def && TEST_FILE_RE.test(_normRel(def.file));
+      }).length;
+      const score = Math.min(100, direct.size * DIRECT_WEIGHT + transitive.size * TRANSITIVE_WEIGHT);
+      files.push({
+        file: changed,
+        symbols: ids.length,
+        directCallers: direct.size,
+        transitiveCallers: transitive.size,
+        testCallers,
+        impactedFunctions: impacted.slice(0, IMPACTED_FUNCTIONS_CAP),
+        score,
+        tier: tierFor(score),
+      });
+    }
+
+    if (!files.length) return empty;
+    const maxScore = files.reduce((m, f) => Math.max(m, f.score), 0);
+    return {
+      available: true,
+      files,
+      aggregate: { score: maxScore, tier: tierFor(maxScore), impactedFunctions: allImpacted.size },
+    };
+  }
+
+  module.exports = { methodBlastRadius, tierFor, DIRECT_WEIGHT, TRANSITIVE_WEIGHT };
+  
+};
+
 // ── ./src/graph/builder ──
 __factories["./src/graph/builder"] = function(module, exports) {
   
@@ -10806,14 +10942,16 @@ __factories["./src/graph/builder"] = function(module, exports) {
 __factories["./src/graph/call-graph"] = function(module, exports) {
   
   /**
-   * Method/caller-level call-graph (D4 v1).
+   * Method/caller-level call-graph (D4 v1, languages expanded in GR1).
    *
-   * Builds symbol-level edges — which function calls which function — for JS/TS
-   * and Python. Deterministic, zero-dependency, regex + brace/indent matching.
-   * Call sites are resolved with high precision: a call resolves to a definition
-   * of that name in the *same file* first, then in a *directly-imported* file
-   * (via the existing file-level import graph). Names that resolve to no repo
-   * definition produce no edge — over-approximation noise is avoided.
+   * Builds symbol-level edges — which function calls which function — for JS/TS,
+   * Python, Java, Go, and Rust. Deterministic, zero-dependency, regex +
+   * brace/indent matching. Call sites are resolved with high precision: a call
+   * resolves to a definition of that name in the *same file* first, then in a
+   * *directly-imported* file (via the existing file-level import graph). Names
+   * that resolve to no repo definition produce no edge — over-approximation
+   * noise is avoided. Constructs that can't be parsed dependency-free are
+   * skipped (less fidelity, never a parser dep).
    *
    * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
    *
@@ -10826,6 +10964,9 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
 
   const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
   const PY_EXTS = new Set(['.py', '.pyw']);
+  const JAVA_EXTS = new Set(['.java']);
+  const GO_EXTS = new Set(['.go']);
+  const RS_EXTS = new Set(['.rs']);
 
   // Tokens that look like `name(` calls or definition headers but are language
   // keywords, not user symbols — never treated as a call or a definition.
@@ -10835,6 +10976,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
     'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
     'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
+    'synchronized',
   ]);
 
   function normalizePath(p) { return path.normalize(p).toLowerCase(); }
@@ -10863,6 +11005,32 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     return out.join('');
   }
 
+  // Rust: `//`, `/* */`, and `"..."` mask like JS, but a bare `'` is usually a
+  // lifetime (`'a`), not a string — masking to the "closing" quote would corrupt
+  // offsets. Only char literals (`'x'`, `'\n'`) are masked; lifetimes pass through.
+  function maskRust(src) {
+    const out = src.split('');
+    const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+    let i = 0; const n = src.length;
+    while (i < n) {
+      const c = src[i], d = src[i + 1];
+      if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+      if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
+      if (c === '"') {
+        let j = i + 1;
+        while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === '"') break; j++; }
+        j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+      }
+      if (c === "'") {
+        if (d === '\\' && src[i + 3] === "'") { blank(i, i + 4); i += 4; continue; } // '\n'
+        if (d !== undefined && src[i + 2] === "'") { blank(i, i + 3); i += 3; continue; } // 'x'
+        i++; continue; // lifetime `'a` — leave untouched
+      }
+      i++;
+    }
+    return out.join('');
+  }
+
   function maskPy(src) {
     const out = src.split('');
     const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
@@ -10992,10 +11160,98 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     return defs;
   }
 
+  // Go:  func name(...) { }   |   func (r Recv) name(...) (T, error) { }
+  // The return list may itself be parenthesized, so scan past it to the body `{`.
+  function goDefs(masked) {
+    const defs = [];
+    const re = /(?:^|\n)func\s+(?:\([^)\n]*\)\s*)?([A-Za-z_]\w*)\s*\(/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      let k = close + 1;
+      let depth = 0;
+      while (k < masked.length) {
+        const ch = masked[k];
+        if (ch === '(') depth++;
+        else if (ch === ')') depth--;
+        else if (ch === '{' && depth === 0) break;
+        else if (ch === '\n' && depth === 0) { k = -1; break; } // no body on this header
+        k++;
+      }
+      if (k === -1 || k >= masked.length) continue;
+      defs.push({ name: m[1], line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Java: methods + constructors with braced bodies. Statement-shaped matches
+  // (calls, control flow) are rejected because their `)` is followed by `;`,
+  // and keyword headers (`if`, `while`, …) fall to the NON_CALL guard.
+  function javaDefs(masked) {
+    const defs = [];
+    const seen = new Set();
+    const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp)\s+)*)(?:<[^>\n]{0,80}>\s*)?(?:[\w$][\w$.<>\[\],?\s]*?\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      const name = m[2];
+      if (NON_CALL.has(name)) continue;
+      // `new Foo() { … }` anonymous classes are uses, not definitions.
+      const before = masked.slice(Math.max(0, m.index), m.index + m[0].length - name.length - 1);
+      if (/\bnew\s*$/.test(before)) continue;
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      // skip `throws A, B` up to the body `{` (same line — multi-line headers are skipped)
+      let k = close + 1;
+      while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n' && masked[k] !== '=') k++;
+      if (masked[k] !== '{') continue;
+      const key = name + ':' + k;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      defs.push({ name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Rust: fn name(...) { }  |  fn name<T>(...) -> T where … { }  — inside or
+  // outside impl/trait blocks. A `;` before the body brace (trait declaration)
+  // means no body: skipped.
+  function rustDefs(masked) {
+    const defs = [];
+    const re = /\bfn\s+([A-Za-z_]\w*)/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      let k = m.index + m[0].length;
+      while (k < masked.length && /\s/.test(masked[k])) k++;
+      if (masked[k] === '<') k = matchDelim(masked, k, '<', '>') + 1;
+      while (k < masked.length && /\s/.test(masked[k])) k++;
+      if (masked[k] !== '(') continue;
+      const close = matchDelim(masked, k, '(', ')');
+      // return type / where clause may span lines; stop at body `{` or decl `;`
+      let b = close + 1;
+      while (b < masked.length && masked[b] !== '{' && masked[b] !== ';') b++;
+      if (masked[b] !== '{') continue;
+      defs.push({ name: m[1], line: lineAt(masked, m.index), bodyStart: b, bodyEnd: matchDelim(masked, b, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Pick the masker whose comment/string syntax matches the language.
+  // Java and Go share JS syntax (Go raw strings mask like template literals).
+  function maskFor(filePath, src) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (PY_EXTS.has(ext)) return maskPy(src);
+    if (RS_EXTS.has(ext)) return maskRust(src);
+    return maskJs(src);
+  }
+
   function extractDefs(filePath, src) {
     const ext = path.extname(filePath).toLowerCase();
     if (JS_EXTS.has(ext)) return jsDefs(maskJs(src));
     if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
+    if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
+    if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
+    if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
     return null; // unsupported language
   }
 
@@ -11026,7 +11282,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
       if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
       else if (e.isFile()) {
         const ext = path.extname(e.name).toLowerCase();
-        if (JS_EXTS.has(ext) || PY_EXTS.has(ext)) out.push(full);
+        if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
       }
     }
   }
@@ -11093,10 +11349,20 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     };
 
     for (const [f, fileDefs] of perFileDefs.entries()) {
-      const masked = JS_EXTS.has(path.extname(f).toLowerCase()) ? maskJs(fs.readFileSync(f, 'utf8')) : maskPy(fs.readFileSync(f, 'utf8'));
+      const masked = maskFor(f, fs.readFileSync(f, 'utf8'));
       // resolution scope: this file's defs, then directly-imported files' defs
       const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
         .map((nf) => normToAbs.get(nf)).filter(Boolean);
+      // Go/Java: same-package symbols are visible with no import statement, and
+      // a package is (in practice) a directory — extend the scope to same-dir
+      // same-language siblings. Sorted for deterministic resolution order.
+      const ext = path.extname(f).toLowerCase();
+      if (GO_EXTS.has(ext) || JAVA_EXTS.has(ext)) {
+        const siblings = [...perFileDefs.keys()]
+          .filter((o) => o !== f && path.dirname(o) === path.dirname(f) && path.extname(o).toLowerCase() === ext)
+          .sort();
+        importedAbs.push(...siblings);
+      }
       for (const d of fileDefs) {
         const callerId = symId(cwd, f, d.name);
         if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
@@ -11202,7 +11468,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
   module.exports = {
     buildCallGraph, methodImpact, methodCallees,
     formatCallGraph, formatCallGraphJSON,
-    extractDefs, maskJs, maskPy,
+    extractDefs, maskJs, maskPy, maskRust,
   };
   
 };
@@ -13359,6 +13625,28 @@ __factories["./src/mcp/handlers"] = function(module, exports) {
     }
   }
 
+  /**
+   * get_method_impact({ symbol, direction?, depth? }) → string
+   *
+   * Method-level blast radius (GR2): every function that transitively calls
+   * `symbol` (direction 'callers', default), or everything it calls ('callees').
+   */
+  function getMethodImpact(args, cwd) {
+    if (!args || !args.symbol) return 'Missing required argument: symbol';
+
+    try {
+      const { methodImpact, methodCallees, formatCallGraph } = __require('./src/graph/call-graph');
+      const kind = args.direction === 'callees' ? 'callees' : 'callers';
+      const depth = Math.max(0, parseInt(args.depth, 10) || 0);
+      const result = kind === 'callees'
+        ? methodCallees(args.symbol, cwd, { depth })
+        : methodImpact(args.symbol, cwd, { depth });
+      return formatCallGraph(result, kind);
+    } catch (err) {
+      return `_get_method_impact failed: ${err.message}_`;
+    }
+  }
+
   /**
    * get_impact({ file, depth? }) → string
    *
@@ -13872,7 +14160,7 @@ __factories["./src/mcp/handlers"] = function(module, exports) {
     return header + sq.squeezed;
   }
 
-  module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput };
+  module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput };
   
 };
 
@@ -14039,11 +14327,11 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const readline = require('readline');
   const { TOOLS } = __require('./src/mcp/tools');
-  const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput } = __require('./src/mcp/handlers');
+  const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput } = __require('./src/mcp/handlers');
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.12.0',
+    version: '8.14.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -14099,6 +14387,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
         else if (name === 'explain_file') text = explainFile(args, cwd);
         else if (name === 'list_modules') text = listModules(args, cwd);
         else if (name === 'query_context') text = queryContext(args, cwd);
+        else if (name === 'get_method_impact') text = getMethodImpact(args, cwd);
         else if (name === 'get_impact') text = getImpact(args, cwd);
         else if (name === 'get_lines') text = getLines(args, cwd);
         else if (name === 'read_memory') text = readMemory(args, cwd);
@@ -14170,12 +14459,12 @@ __factories["./src/mcp/server"] = function(module, exports) {
 __factories["./src/mcp/tools"] = function(module, exports) {
   
   /**
-   * MCP tool definitions for SigMap (19 tools).
+   * MCP tool definitions for SigMap (20 tools).
    * read_context, search_signatures, get_map, create_checkpoint, get_routing,
-   * explain_file, list_modules, query_context, get_impact, get_lines, read_memory,
-   * get_callee_signatures, sigmap_notify_file_created, sigmap_notify_symbol_added,
-   * sigmap_notify_file_deleted, get_diff_context, get_architecture_overview,
-   * verify_suggestion, squeeze_output.
+   * explain_file, list_modules, query_context, get_method_impact, get_impact,
+   * get_lines, read_memory, get_callee_signatures, sigmap_notify_file_created,
+   * sigmap_notify_symbol_added, sigmap_notify_file_deleted, get_diff_context,
+   * get_architecture_overview, verify_suggestion, squeeze_output.
    */
 
   const TOOLS = [
@@ -14317,6 +14606,35 @@ __factories["./src/mcp/tools"] = function(module, exports) {
         required: ['query'],
       },
     },
+    {
+      name: 'get_method_impact',
+      description:
+        'Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — ' +
+        'or, with direction "callees", every repo function it calls. Finer-grained than the ' +
+        'file-level get_impact: tells an agent which functions break, not just which files. ' +
+        'JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          symbol: {
+            type: 'string',
+            description:
+              'Function/method name (e.g. "validateToken") or a full "file#name" id ' +
+              '(e.g. "src/auth/session.js#validateToken") to disambiguate.',
+          },
+          direction: {
+            type: 'string',
+            enum: ['callers', 'callees'],
+            description: '"callers" (default) = blast radius; "callees" = what the symbol calls.',
+          },
+          depth: {
+            type: 'number',
+            description: 'BFS depth limit (default 0 = unlimited).',
+          },
+        },
+        required: ['symbol'],
+      },
+    },
     {
       name: 'get_impact',
       description:
@@ -15723,6 +16041,12 @@ __factories["./src/review/pr-evidence"] = function(module, exports) {
       impactByFile = new Map(analyzeImpact(srcPaths, cwd, { depth }).map((r) => [r.file, r.impact]));
     } catch (_) { /* graph optional */ }
 
+    // GR2: method-level blast radius per changed file (reviewPr already computed
+    // it when the call graph resolved — reuse, don't rebuild the graph).
+    const methodBlastByFile = new Map(
+      (review.methodBlast && review.methodBlast.files || []).map((m) => [m.file, m])
+    );
+
     const fileReports = files.map((f) => {
       const deleted = f.status === 'D';
       let signatures = [];
@@ -15731,6 +16055,7 @@ __factories["./src/review/pr-evidence"] = function(module, exports) {
       }
       const impact = impactByFile.get(f.path) || null;
       return {
+        methodBlast: methodBlastByFile.get(f.path.replace(/\\/g, '/')) || null,
         path: f.path,
         status: f.status,
         riskLabel: riskLabelFor(f.path),
@@ -15773,6 +16098,7 @@ __factories["./src/review/pr-evidence"] = function(module, exports) {
         else if (f.type === 'security-file') L.push(`- ⚠️ **sensitive path touched** (path heuristic, not a content scan) — \`${f.file}\``);
         else if (f.type === 'secret-detected') L.push(`- 🔑 **secret detected** (${f.secret}) — \`${f.file}\``);
         else if (f.type === 'god-node') L.push(`- ⚠️ **god node** — \`${f.file}\` → ${f.count} dependents (high blast radius)`);
+        else if (f.type === 'method-blast') L.push(`- ⚠️ **method blast radius ${f.tier}** — \`${f.file}\` → ${f.functions} function(s) transitively call into this change (score ${f.score}/100)`);
         else if (f.type === 'scope-drift') L.push(`- ⚠️ **scope drift** — ${f.count} top-level dirs touched (${f.dirs.join(', ')})`);
       }
       L.push('');
@@ -15794,6 +16120,15 @@ __factories["./src/review/pr-evidence"] = function(module, exports) {
       } else {
         L.push('**Blast radius:** _(not in dependency graph — new or leaf file)_');
       }
+      if (f.methodBlast && (f.methodBlast.directCallers + f.methodBlast.transitiveCallers) > 0) {
+        const mb = f.methodBlast;
+        const total = mb.directCallers + mb.transitiveCallers;
+        L.push(
+          `**Method blast radius:** ${total} function(s) impacted (score ${mb.score}/100, ${mb.tier}) — ` +
+          mb.impactedFunctions.slice(0, 6).map((id) => '`' + id + '`').join(', ') +
+          (total > 6 ? ` +${total - 6} more` : '')
+        );
+      }
       if (f.relatedTests.length) L.push(`Related tests: ${f.relatedTests.slice(0, 8).map((t) => '`' + t + '`').join(', ')}`);
 
       if (f.signatures.length) {
@@ -15860,7 +16195,7 @@ __factories["./src/review/review-pr"] = function(module, exports) {
    * @param {object} [opts]
    * @param {number} [opts.godNodeThreshold=15]
    * @param {number} [opts.scopeThreshold=5]
-   * @returns {{ findings: object[], blast: object[], summary: object }}
+   * @returns {{ findings: object[], blast: object[], methodBlast: object|null, summary: object }}
    */
   function reviewPr(changedFiles, cwd, opts = {}) {
     const godThreshold = opts.godNodeThreshold != null ? opts.godNodeThreshold : GOD_NODE_THRESHOLD;
@@ -15921,6 +16256,27 @@ __factories["./src/review/review-pr"] = function(module, exports) {
       blast.sort((a, b) => b.totalImpact - a.totalImpact);
     }
 
+    // 3b. Method-level blast radius (GR2) — how many FUNCTIONS transitively call
+    // into the change, scored deterministically. Graph optional, like 3.
+    let methodBlast = null;
+    if (srcChanged.length) {
+      try {
+        const { methodBlastRadius } = __require('./src/graph/blast-radius');
+        const mb = methodBlastRadius(srcChanged, cwd, opts.methodBlastOpts || {});
+        if (mb.available) {
+          methodBlast = mb;
+          for (const f of mb.files) {
+            if (f.tier === 'high' || f.tier === 'critical') {
+              findings.push({
+                type: 'method-blast', file: f.file, severity: 'warn',
+                functions: f.directCallers + f.transitiveCallers, score: f.score, tier: f.tier,
+              });
+            }
+          }
+        }
+      } catch (_) { /* call graph optional */ }
+    }
+
     // 4. Scope drift: distinct top-level directories touched.
     const dirs = [...new Set(paths.map((p) => (p.includes('/') ? p.split('/')[0] : '.')))];
     if (dirs.length > scopeThreshold) {
@@ -15931,6 +16287,7 @@ __factories["./src/review/review-pr"] = function(module, exports) {
     return {
       findings,
       blast,
+      methodBlast,
       summary: {
         filesChanged: files.length,
         sourceChanged: srcChanged.length,
@@ -18987,7 +19344,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.12.0';
+const VERSION = '8.14.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -20848,7 +21205,7 @@ Usage:
   ${cmd} --impact <file>                   Show every file impacted by changing <file>
   ${cmd} --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
   ${cmd} --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
-  ${cmd} --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS + Python)
+  ${cmd} --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS, Python, Java, Go, Rust)
   ${cmd} --callees <symbol>                Every repo function that <symbol> (transitively) calls
   ${cmd} --callers <symbol> --json --depth <n>   Call-graph edges as JSON (depth 0 = unlimited)
   ${cmd} verify <answer.md>                Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.12.0 | Benchmark: sigmap-v8.12-main (2026-07-11)
+# Version: 8.14.0 | Benchmark: sigmap-v8.14-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.12-main, 2026-07-11)
+## Core metrics (benchmark: sigmap-v8.14-main, 2026-07-11)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -26,7 +26,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 | Task success proxy | 10% | 67.8% |
 | Prompts per task | 2.84 | 1.44 (49.2% fewer) |
 | Supported languages | — | 33 |
-| MCP tools | — | 19 |
+| MCP tools | — | 20 |
 | npm runtime dependencies | — | 0 |
 
 ---
@@ -101,7 +101,7 @@ sigmap weights --json                    Learned weights as JSON
 sigmap --impact <file>                   Show every file impacted by changing <file>
 sigmap --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
 sigmap --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
-sigmap --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS + Python)
+sigmap --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS, Python, Java, Go, Rust)
 sigmap --callees <symbol>                Every repo function that <symbol> (transitively) calls
 sigmap --callers <symbol> --json --depth <n>   Call-graph edges as JSON (depth 0 = unlimited)
 sigmap verify <answer.md>                Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)
@@ -136,7 +136,7 @@ sigmap --version                         Show version
 
 ---
 
-## MCP server — 19 tools
+## MCP server — 20 tools
 
 Start with `sigmap --mcp` (stdio JSON-RPC). Configure once:
 
@@ -208,6 +208,14 @@ Rank and return the most relevant files for a specific task or question. Uses ke
 Input:  { query: string, topK?: number }
 ```
 
+### get_method_impact
+
+Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — or, with direction "callees", every repo function it calls. Finer-grained than the file-level get_impact: tells an agent which functions break, not just which files. JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.
+
+```
+Input:  { symbol: string, direction?: string, depth?: number }
+```
+
 ### get_impact
 
 Show every file that is impacted when a given file changes — direct importers, transitive importers, affected tests, and affected routes/controllers. Gives agents instant blast-radius awareness before making a change. Handles circular dependencies safely (no infinite loops).

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.12.0 | Benchmark: sigmap-v8.12-main (2026-07-11)
+# Version: 8.14.0 | Benchmark: sigmap-v8.14-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,13 +23,13 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.12-main, 2026-07-11)
+## Core metrics (benchmark: sigmap-v8.14-main, 2026-07-11)
 
 - hit@5 retrieval: 87.8% vs 13.6% random baseline (6.5× lift)
 - Token reduction: 97.0% average across benchmark repos
 - Task success: 67.8% vs 10% without SigMap
 - Prompts per task: 1.44 vs 2.84 baseline (49.2% fewer)
-- Languages: 33 supported · MCP tools: 19
+- Languages: 33 supported · MCP tools: 20
 - Dependencies: zero npm runtime dependencies · fully offline
 
 ## Quick start

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.12.0",
+  "version": "8.14.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {