sigmap 8.12.0 → 8.14.0

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.12.0",
+  "version": "8.14.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.12.0",
+  "version": "8.14.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/graph/blast-radius.js

@@ -0,0 +1,132 @@
+'use strict';
+
+/**
+ * Method-level blast-radius scoring (GR2).
+ *
+ * Consumes the D4 call-graph (src/graph/call-graph.js): for each changed file,
+ * resolve the functions it defines, BFS the reverse call edges, and score how
+ * much of the codebase transitively calls into the change. The score is a
+ * documented deterministic formula — no heuristics that vary run to run — so
+ * review-pr findings and PR Evidence lines are byte-stable for a fixed tree.
+ *
+ * Score: min(100, direct×4 + transitive×1). Tiers:
+ *   0 → none · 1–9 → low · 10–29 → medium · 30–59 → high · 60+ → critical
+ */
+
+const path = require('path');
+const { buildCallGraph } = require('./call-graph');
+
+const DIRECT_WEIGHT = 4;
+const TRANSITIVE_WEIGHT = 1;
+const IMPACTED_FUNCTIONS_CAP = 12;
+
+const TEST_FILE_RE = /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.(py|go)$|(^|\/)(tests?|__tests__|spec)\//;
+
+function tierFor(score) {
+  if (score >= 60) return 'critical';
+  if (score >= 30) return 'high';
+  if (score >= 10) return 'medium';
+  if (score >= 1) return 'low';
+  return 'none';
+}
+
+function _normRel(p) {
+  return String(p).replace(/\\/g, '/');
+}
+
+// BFS the reverse edges from a set of symbol ids; returns direct/transitive id sets.
+function _bfs(seedIds, reverse, maxDepth) {
+  const direct = new Set();
+  const transitive = new Set();
+  const visited = new Set(seedIds);
+  let frontier = [];
+  for (const s of seedIds) {
+    for (const nb of (reverse.get(s) || [])) {
+      if (!visited.has(nb)) { direct.add(nb); visited.add(nb); frontier.push(nb); }
+    }
+  }
+  let depth = 1;
+  while (frontier.length && (maxDepth === 0 || depth < maxDepth)) {
+    const next = [];
+    for (const node of frontier) {
+      for (const nb of (reverse.get(node) || [])) {
+        if (!visited.has(nb)) { transitive.add(nb); visited.add(nb); next.push(nb); }
+      }
+    }
+    frontier = next;
+    depth++;
+  }
+  return { direct, transitive };
+}
+
+/**
+ * Score the method-level blast radius of a changed-file list.
+ *
+ * @param {string[]} changedFiles repo-relative paths
+ * @param {string} cwd
+ * @param {object} [opts]
+ * @param {object} [opts.graph]  injected call graph (tests); else built from cwd
+ * @param {number} [opts.depth=0] BFS depth limit (0 = unlimited)
+ * @returns {{
+ *   available: boolean,
+ *   files: Array<{ file:string, symbols:number, directCallers:number,
+ *                  transitiveCallers:number, testCallers:number,
+ *                  impactedFunctions:string[], score:number, tier:string }>,
+ *   aggregate: { score:number, tier:string, impactedFunctions:number }
+ * }}
+ */
+function methodBlastRadius(changedFiles, cwd, opts = {}) {
+  const empty = { available: false, files: [], aggregate: { score: 0, tier: 'none', impactedFunctions: 0 } };
+  let graph;
+  try {
+    graph = opts.graph || buildCallGraph(cwd, opts);
+  } catch (_) {
+    return empty;
+  }
+  if (!graph || !graph.defs || graph.defs.size === 0) return empty;
+
+  // Group defined symbol ids by their (normalized) defining file.
+  const idsByFile = new Map();
+  for (const [id, def] of graph.defs.entries()) {
+    const rel = _normRel(def.file);
+    if (!idsByFile.has(rel)) idsByFile.set(rel, []);
+    idsByFile.get(rel).push(id);
+  }
+
+  const depth = Number.isFinite(opts.depth) ? opts.depth : 0;
+  const files = [];
+  const allImpacted = new Set();
+
+  for (const changed of (changedFiles || []).map(_normRel).sort()) {
+    const ids = idsByFile.get(changed);
+    if (!ids || !ids.length) continue;
+    const { direct, transitive } = _bfs(ids, graph.reverse, depth);
+    const impacted = [...direct, ...transitive].sort();
+    for (const id of impacted) allImpacted.add(id);
+    const testCallers = impacted.filter((id) => {
+      const def = graph.defs.get(id);
+      return def && TEST_FILE_RE.test(_normRel(def.file));
+    }).length;
+    const score = Math.min(100, direct.size * DIRECT_WEIGHT + transitive.size * TRANSITIVE_WEIGHT);
+    files.push({
+      file: changed,
+      symbols: ids.length,
+      directCallers: direct.size,
+      transitiveCallers: transitive.size,
+      testCallers,
+      impactedFunctions: impacted.slice(0, IMPACTED_FUNCTIONS_CAP),
+      score,
+      tier: tierFor(score),
+    });
+  }
+
+  if (!files.length) return empty;
+  const maxScore = files.reduce((m, f) => Math.max(m, f.score), 0);
+  return {
+    available: true,
+    files,
+    aggregate: { score: maxScore, tier: tierFor(maxScore), impactedFunctions: allImpacted.size },
+  };
+}
+
+module.exports = { methodBlastRadius, tierFor, DIRECT_WEIGHT, TRANSITIVE_WEIGHT };

package/src/graph/call-graph.js

@@ -1,14 +1,16 @@
 'use strict';
 
 /**
- * Method/caller-level call-graph (D4 v1).
+ * Method/caller-level call-graph (D4 v1, languages expanded in GR1).
  *
- * Builds symbol-level edges — which function calls which function — for JS/TS
- * and Python. Deterministic, zero-dependency, regex + brace/indent matching.
- * Call sites are resolved with high precision: a call resolves to a definition
- * of that name in the *same file* first, then in a *directly-imported* file
- * (via the existing file-level import graph). Names that resolve to no repo
- * definition produce no edge — over-approximation noise is avoided.
+ * Builds symbol-level edges — which function calls which function — for JS/TS,
+ * Python, Java, Go, and Rust. Deterministic, zero-dependency, regex +
+ * brace/indent matching. Call sites are resolved with high precision: a call
+ * resolves to a definition of that name in the *same file* first, then in a
+ * *directly-imported* file (via the existing file-level import graph). Names
+ * that resolve to no repo definition produce no edge — over-approximation
+ * noise is avoided. Constructs that can't be parsed dependency-free are
+ * skipped (less fidelity, never a parser dep).
  *
  * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
  *
@@ -21,6 +23,9 @@ const { build } = require('./builder');
 
 const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
 const PY_EXTS = new Set(['.py', '.pyw']);
+const JAVA_EXTS = new Set(['.java']);
+const GO_EXTS = new Set(['.go']);
+const RS_EXTS = new Set(['.rs']);
 
 // Tokens that look like `name(` calls or definition headers but are language
 // keywords, not user symbols — never treated as a call or a definition.
@@ -30,6 +35,7 @@ const NON_CALL = new Set([
   'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
   'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
   'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
+  'synchronized',
 ]);
 
 function normalizePath(p) { return path.normalize(p).toLowerCase(); }
@@ -58,6 +64,32 @@ function maskJs(src) {
   return out.join('');
 }
 
+// Rust: `//`, `/* */`, and `"..."` mask like JS, but a bare `'` is usually a
+// lifetime (`'a`), not a string — masking to the "closing" quote would corrupt
+// offsets. Only char literals (`'x'`, `'\n'`) are masked; lifetimes pass through.
+function maskRust(src) {
+  const out = src.split('');
+  const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+  let i = 0; const n = src.length;
+  while (i < n) {
+    const c = src[i], d = src[i + 1];
+    if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+    if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
+    if (c === '"') {
+      let j = i + 1;
+      while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === '"') break; j++; }
+      j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+    }
+    if (c === "'") {
+      if (d === '\\' && src[i + 3] === "'") { blank(i, i + 4); i += 4; continue; } // '\n'
+      if (d !== undefined && src[i + 2] === "'") { blank(i, i + 3); i += 3; continue; } // 'x'
+      i++; continue; // lifetime `'a` — leave untouched
+    }
+    i++;
+  }
+  return out.join('');
+}
+
 function maskPy(src) {
   const out = src.split('');
   const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
@@ -187,10 +219,98 @@ function pyDefs(masked) {
   return defs;
 }
 
+// Go:  func name(...) { }   |   func (r Recv) name(...) (T, error) { }
+// The return list may itself be parenthesized, so scan past it to the body `{`.
+function goDefs(masked) {
+  const defs = [];
+  const re = /(?:^|\n)func\s+(?:\([^)\n]*\)\s*)?([A-Za-z_]\w*)\s*\(/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    let k = close + 1;
+    let depth = 0;
+    while (k < masked.length) {
+      const ch = masked[k];
+      if (ch === '(') depth++;
+      else if (ch === ')') depth--;
+      else if (ch === '{' && depth === 0) break;
+      else if (ch === '\n' && depth === 0) { k = -1; break; } // no body on this header
+      k++;
+    }
+    if (k === -1 || k >= masked.length) continue;
+    defs.push({ name: m[1], line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+  }
+  return defs;
+}
+
+// Java: methods + constructors with braced bodies. Statement-shaped matches
+// (calls, control flow) are rejected because their `)` is followed by `;`,
+// and keyword headers (`if`, `while`, …) fall to the NON_CALL guard.
+function javaDefs(masked) {
+  const defs = [];
+  const seen = new Set();
+  const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp)\s+)*)(?:<[^>\n]{0,80}>\s*)?(?:[\w$][\w$.<>\[\],?\s]*?\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    const name = m[2];
+    if (NON_CALL.has(name)) continue;
+    // `new Foo() { … }` anonymous classes are uses, not definitions.
+    const before = masked.slice(Math.max(0, m.index), m.index + m[0].length - name.length - 1);
+    if (/\bnew\s*$/.test(before)) continue;
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    // skip `throws A, B` up to the body `{` (same line — multi-line headers are skipped)
+    let k = close + 1;
+    while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n' && masked[k] !== '=') k++;
+    if (masked[k] !== '{') continue;
+    const key = name + ':' + k;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    defs.push({ name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+  }
+  return defs;
+}
+
+// Rust: fn name(...) { }  |  fn name<T>(...) -> T where … { }  — inside or
+// outside impl/trait blocks. A `;` before the body brace (trait declaration)
+// means no body: skipped.
+function rustDefs(masked) {
+  const defs = [];
+  const re = /\bfn\s+([A-Za-z_]\w*)/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    let k = m.index + m[0].length;
+    while (k < masked.length && /\s/.test(masked[k])) k++;
+    if (masked[k] === '<') k = matchDelim(masked, k, '<', '>') + 1;
+    while (k < masked.length && /\s/.test(masked[k])) k++;
+    if (masked[k] !== '(') continue;
+    const close = matchDelim(masked, k, '(', ')');
+    // return type / where clause may span lines; stop at body `{` or decl `;`
+    let b = close + 1;
+    while (b < masked.length && masked[b] !== '{' && masked[b] !== ';') b++;
+    if (masked[b] !== '{') continue;
+    defs.push({ name: m[1], line: lineAt(masked, m.index), bodyStart: b, bodyEnd: matchDelim(masked, b, '{', '}') });
+  }
+  return defs;
+}
+
+// Pick the masker whose comment/string syntax matches the language.
+// Java and Go share JS syntax (Go raw strings mask like template literals).
+function maskFor(filePath, src) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (PY_EXTS.has(ext)) return maskPy(src);
+  if (RS_EXTS.has(ext)) return maskRust(src);
+  return maskJs(src);
+}
+
 function extractDefs(filePath, src) {
   const ext = path.extname(filePath).toLowerCase();
   if (JS_EXTS.has(ext)) return jsDefs(maskJs(src));
   if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
+  if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
+  if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
+  if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
   return null; // unsupported language
 }
 
@@ -221,7 +341,7 @@ function _walk(dir, excludeSet, out, depth) {
     if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
     else if (e.isFile()) {
       const ext = path.extname(e.name).toLowerCase();
-      if (JS_EXTS.has(ext) || PY_EXTS.has(ext)) out.push(full);
+      if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
     }
   }
 }
@@ -288,10 +408,20 @@ function buildCallGraph(cwd, opts = {}) {
   };
 
   for (const [f, fileDefs] of perFileDefs.entries()) {
-    const masked = JS_EXTS.has(path.extname(f).toLowerCase()) ? maskJs(fs.readFileSync(f, 'utf8')) : maskPy(fs.readFileSync(f, 'utf8'));
+    const masked = maskFor(f, fs.readFileSync(f, 'utf8'));
     // resolution scope: this file's defs, then directly-imported files' defs
     const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
       .map((nf) => normToAbs.get(nf)).filter(Boolean);
+    // Go/Java: same-package symbols are visible with no import statement, and
+    // a package is (in practice) a directory — extend the scope to same-dir
+    // same-language siblings. Sorted for deterministic resolution order.
+    const ext = path.extname(f).toLowerCase();
+    if (GO_EXTS.has(ext) || JAVA_EXTS.has(ext)) {
+      const siblings = [...perFileDefs.keys()]
+        .filter((o) => o !== f && path.dirname(o) === path.dirname(f) && path.extname(o).toLowerCase() === ext)
+        .sort();
+      importedAbs.push(...siblings);
+    }
     for (const d of fileDefs) {
       const callerId = symId(cwd, f, d.name);
       if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
@@ -397,5 +527,5 @@ function formatCallGraphJSON(result, kind) {
 module.exports = {
   buildCallGraph, methodImpact, methodCallees,
   formatCallGraph, formatCallGraphJSON,
-  extractDefs, maskJs, maskPy,
+  extractDefs, maskJs, maskPy, maskRust,
 };

package/src/mcp/handlers.js

@@ -428,6 +428,28 @@ function queryContext(args, cwd) {
   }
 }
 
+/**
+ * get_method_impact({ symbol, direction?, depth? }) → string
+ *
+ * Method-level blast radius (GR2): every function that transitively calls
+ * `symbol` (direction 'callers', default), or everything it calls ('callees').
+ */
+function getMethodImpact(args, cwd) {
+  if (!args || !args.symbol) return 'Missing required argument: symbol';
+
+  try {
+    const { methodImpact, methodCallees, formatCallGraph } = require('../graph/call-graph');
+    const kind = args.direction === 'callees' ? 'callees' : 'callers';
+    const depth = Math.max(0, parseInt(args.depth, 10) || 0);
+    const result = kind === 'callees'
+      ? methodCallees(args.symbol, cwd, { depth })
+      : methodImpact(args.symbol, cwd, { depth });
+    return formatCallGraph(result, kind);
+  } catch (err) {
+    return `_get_method_impact failed: ${err.message}_`;
+  }
+}
+
 /**
  * get_impact({ file, depth? }) → string
  *
@@ -941,4 +963,4 @@ function squeezeOutput(args, cwd) {
   return header + sq.squeezed;
 }
 
-module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput };
+module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput };

package/src/mcp/server.js

@@ -14,11 +14,11 @@
 
 const readline = require('readline');
 const { TOOLS } = require('./tools');
-const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput } = require('./handlers');
+const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput } = require('./handlers');
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.12.0',
+  version: '8.14.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 
@@ -74,6 +74,7 @@ function dispatch(msg, cwd) {
       else if (name === 'explain_file') text = explainFile(args, cwd);
       else if (name === 'list_modules') text = listModules(args, cwd);
       else if (name === 'query_context') text = queryContext(args, cwd);
+      else if (name === 'get_method_impact') text = getMethodImpact(args, cwd);
       else if (name === 'get_impact') text = getImpact(args, cwd);
       else if (name === 'get_lines') text = getLines(args, cwd);
       else if (name === 'read_memory') text = readMemory(args, cwd);

package/src/mcp/tools.js

@@ -1,12 +1,12 @@
 'use strict';
 
 /**
- * MCP tool definitions for SigMap (19 tools).
+ * MCP tool definitions for SigMap (20 tools).
  * read_context, search_signatures, get_map, create_checkpoint, get_routing,
- * explain_file, list_modules, query_context, get_impact, get_lines, read_memory,
- * get_callee_signatures, sigmap_notify_file_created, sigmap_notify_symbol_added,
- * sigmap_notify_file_deleted, get_diff_context, get_architecture_overview,
- * verify_suggestion, squeeze_output.
+ * explain_file, list_modules, query_context, get_method_impact, get_impact,
+ * get_lines, read_memory, get_callee_signatures, sigmap_notify_file_created,
+ * sigmap_notify_symbol_added, sigmap_notify_file_deleted, get_diff_context,
+ * get_architecture_overview, verify_suggestion, squeeze_output.
  */
 
 const TOOLS = [
@@ -148,6 +148,35 @@ const TOOLS = [
       required: ['query'],
     },
   },
+  {
+    name: 'get_method_impact',
+    description:
+      'Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — ' +
+      'or, with direction "callees", every repo function it calls. Finer-grained than the ' +
+      'file-level get_impact: tells an agent which functions break, not just which files. ' +
+      'JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        symbol: {
+          type: 'string',
+          description:
+            'Function/method name (e.g. "validateToken") or a full "file#name" id ' +
+            '(e.g. "src/auth/session.js#validateToken") to disambiguate.',
+        },
+        direction: {
+          type: 'string',
+          enum: ['callers', 'callees'],
+          description: '"callers" (default) = blast radius; "callees" = what the symbol calls.',
+        },
+        depth: {
+          type: 'number',
+          description: 'BFS depth limit (default 0 = unlimited).',
+        },
+      },
+      required: ['symbol'],
+    },
+  },
   {
     name: 'get_impact',
     description:

package/src/review/pr-evidence.js

@@ -50,6 +50,12 @@ function buildPrEvidence(changedFiles, cwd, opts = {}) {
     impactByFile = new Map(analyzeImpact(srcPaths, cwd, { depth }).map((r) => [r.file, r.impact]));
   } catch (_) { /* graph optional */ }
 
+  // GR2: method-level blast radius per changed file (reviewPr already computed
+  // it when the call graph resolved — reuse, don't rebuild the graph).
+  const methodBlastByFile = new Map(
+    (review.methodBlast && review.methodBlast.files || []).map((m) => [m.file, m])
+  );
+
   const fileReports = files.map((f) => {
     const deleted = f.status === 'D';
     let signatures = [];
@@ -58,6 +64,7 @@ function buildPrEvidence(changedFiles, cwd, opts = {}) {
     }
     const impact = impactByFile.get(f.path) || null;
     return {
+      methodBlast: methodBlastByFile.get(f.path.replace(/\\/g, '/')) || null,
       path: f.path,
       status: f.status,
       riskLabel: riskLabelFor(f.path),
@@ -100,6 +107,7 @@ function formatPrEvidenceMarkdown(evidence, opts = {}) {
       else if (f.type === 'security-file') L.push(`- ⚠️ **sensitive path touched** (path heuristic, not a content scan) — \`${f.file}\``);
       else if (f.type === 'secret-detected') L.push(`- 🔑 **secret detected** (${f.secret}) — \`${f.file}\``);
       else if (f.type === 'god-node') L.push(`- ⚠️ **god node** — \`${f.file}\` → ${f.count} dependents (high blast radius)`);
+      else if (f.type === 'method-blast') L.push(`- ⚠️ **method blast radius ${f.tier}** — \`${f.file}\` → ${f.functions} function(s) transitively call into this change (score ${f.score}/100)`);
       else if (f.type === 'scope-drift') L.push(`- ⚠️ **scope drift** — ${f.count} top-level dirs touched (${f.dirs.join(', ')})`);
     }
     L.push('');
@@ -121,6 +129,15 @@ function formatPrEvidenceMarkdown(evidence, opts = {}) {
     } else {
       L.push('**Blast radius:** _(not in dependency graph — new or leaf file)_');
     }
+    if (f.methodBlast && (f.methodBlast.directCallers + f.methodBlast.transitiveCallers) > 0) {
+      const mb = f.methodBlast;
+      const total = mb.directCallers + mb.transitiveCallers;
+      L.push(
+        `**Method blast radius:** ${total} function(s) impacted (score ${mb.score}/100, ${mb.tier}) — ` +
+        mb.impactedFunctions.slice(0, 6).map((id) => '`' + id + '`').join(', ') +
+        (total > 6 ? ` +${total - 6} more` : '')
+      );
+    }
     if (f.relatedTests.length) L.push(`Related tests: ${f.relatedTests.slice(0, 8).map((t) => '`' + t + '`').join(', ')}`);
 
     if (f.signatures.length) {

package/src/review/review-pr.js

@@ -43,7 +43,7 @@ function isSource(p) {
  * @param {object} [opts]
  * @param {number} [opts.godNodeThreshold=15]
  * @param {number} [opts.scopeThreshold=5]
- * @returns {{ findings: object[], blast: object[], summary: object }}
+ * @returns {{ findings: object[], blast: object[], methodBlast: object|null, summary: object }}
  */
 function reviewPr(changedFiles, cwd, opts = {}) {
   const godThreshold = opts.godNodeThreshold != null ? opts.godNodeThreshold : GOD_NODE_THRESHOLD;
@@ -104,6 +104,27 @@ function reviewPr(changedFiles, cwd, opts = {}) {
     blast.sort((a, b) => b.totalImpact - a.totalImpact);
   }
 
+  // 3b. Method-level blast radius (GR2) — how many FUNCTIONS transitively call
+  // into the change, scored deterministically. Graph optional, like 3.
+  let methodBlast = null;
+  if (srcChanged.length) {
+    try {
+      const { methodBlastRadius } = require('../graph/blast-radius');
+      const mb = methodBlastRadius(srcChanged, cwd, opts.methodBlastOpts || {});
+      if (mb.available) {
+        methodBlast = mb;
+        for (const f of mb.files) {
+          if (f.tier === 'high' || f.tier === 'critical') {
+            findings.push({
+              type: 'method-blast', file: f.file, severity: 'warn',
+              functions: f.directCallers + f.transitiveCallers, score: f.score, tier: f.tier,
+            });
+          }
+        }
+      }
+    } catch (_) { /* call graph optional */ }
+  }
+
   // 4. Scope drift: distinct top-level directories touched.
   const dirs = [...new Set(paths.map((p) => (p.includes('/') ? p.split('/')[0] : '.')))];
   if (dirs.length > scopeThreshold) {
@@ -114,6 +135,7 @@ function reviewPr(changedFiles, cwd, opts = {}) {
   return {
     findings,
     blast,
+    methodBlast,
     summary: {
       filesChanged: files.length,
       sourceChanged: srcChanged.length,