sigmap 8.13.0 → 8.14.0

package/AGENTS.md

@@ -33,15 +33,16 @@ Always run `sigmap ask` (or `sigmap --query`) before searching for files relevan
 src/extractors/python_ast.py ← ast
 ```
 
-## changes (last 5 commits — 1 second ago)
+## changes (last 5 commits — 0 seconds ago)
 ```
-src/format/terse.js                           +splitAnchor  +encodeTerseSig  +encodeTerseSigs  +_tokens
 src/graph/blast-radius.js                     +tierFor  +_normRel  +_bfs  +methodBlastRadius
+src/graph/call-graph.js                       +calls  +maskRust  +name  +goDefs
 src/mcp/handlers.js                           +that  +getMethodImpact  ~queryContext  ~squeezeOutput
 src/mcp/server.js                             ~dispatch
 src/mcp/tools.js                              +it
 src/review/pr-evidence.js                     ~buildPrEvidence  ~formatPrEvidenceMarkdown
 src/review/review-pr.js                       ~isSource  ~reviewPr
+src/format/terse.js                           +splitAnchor  +encodeTerseSig  +encodeTerseSigs  +_tokens
 src/wiki/generate.js                          +_rel  +_pct  +_identity  +_modules
 ```
 
@@ -174,21 +175,6 @@ code-fence ---
 
 ## src
 
-### src/config/defaults.js
-```
-module.exports = { DEFAULTS }  :161-161
-```
-
-### src/format/terse.js
-```
-module.exports = { encodeTerseSig, encodeTerseSigs, measureTerse, splitAnchor }  :86-86
-function splitAnchor(sig) → { text: string, suffix: s  :25-30
-function encodeTerseSig(sig) → string  :37-50
-function encodeTerseSigs(sigs) → string[]  :57-59
-function _tokens(sigs)  :62-64
-function measureTerse(sigsList) → { beforeTokens: number, a  :72-84
-```
-
 ### src/graph/blast-radius.js
 ```
 module.exports = { methodBlastRadius, tierFor, DIRECT_WEIGHT, TRANSITIVE_WEIGHT }  :132-132
@@ -198,6 +184,35 @@ function _bfs(seedIds, reverse, maxDepth)  :38-60
 function methodBlastRadius(changedFiles, cwd, opts = {}) → { * available: boolean, *  :78-130
 ```
 
+### src/graph/call-graph.js
+```
+module.exports = { buildCallGraph, methodImpact, methodCallees, formatCallGraph, formatCallGraphJSON, extractDefs, maskJs, maskPy, maskRust }  :527-531
+function normalizePath(p)  :41-41
+function toRel(cwd, f)  :42-42
+function symId(cwd, absFile, name)  :43-43
+function maskJs(src)  :49-65
+function maskRust(src)  :70-91
+function maskPy(src)  :93-110
+function matchDelim(masked, openIdx, open, close)  :113-120
+function lineAt(src, idx)  :122-127
+function jsDefs(masked)  :132-237
+function pyDefs(masked)  :200-220
+function goDefs(masked)  :224-344
+function javaDefs(masked)  :250-367
+function rustDefs(masked)  :278-401
+function maskFor(filePath, src)  :300-305
+function extractDefs(filePath, src)  :307-315
+function callsInRange(masked, start, end)  :318-330
+function _walk(dir, excludeSet, out, depth)  :334-347
+function buildCallGraph(cwd, opts = {}) → { * forward: Map<string,s  :363-446
+function _resolveSymbol(symbol, defs)  :449-454
+function _bfs(seedIds, graph, maxDepth)  :457-470
+function methodImpact(symbol, cwd, opts = {}) → { symbol:string, resolved  :480-486
+function methodCallees(symbol, cwd, opts = {}) → { symbol:string, resolved  :492-498
+function formatCallGraph(result, kind)  :501-513
+function formatCallGraphJSON(result, kind)  :515-525
+```
+
 ### src/mcp/handlers.js
 ```
 module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput }  :966-966
@@ -255,20 +270,6 @@ function isSource(p)  :35-37
 function reviewPr(changedFiles, cwd, opts = {}) → { findings: object[], bla  :48-148
 ```
 
-### src/wiki/generate.js
-```
-module.exports = { buildWiki, renderWikiMarkdown }  :250-250
-function _rel(cwd, f)  :22-24
-function _pct(fraction)  :26-28
-function _identity(cwd)  :31-37
-function _modules(index)  :40-67
-function _flow(cwd)  :70-97
-function _conventions(cwd, index)  :100-117
-function _health(cwd)  :119-127
-function buildWiki(cwd, opts = {}) → { data: object, markdown:  :137-162
-function renderWikiMarkdown(data, sigmapVersion) → string  :171-248
-```
-
 ### src/analysis/coverage-score.js
 ```
 module.exports = { coverageScore, CODE_EXTS }  :105-105
@@ -306,6 +307,11 @@ function getChangedFiles(files, cache) → { changed: string[], unch  :71-88
 function updateCacheEntries(cache, extracted)  :96-103
 ```
 
+### src/config/defaults.js
+```
+module.exports = { DEFAULTS }  :161-161
+```
+
 ### src/config/loader.js
 ```
 module.exports = { loadConfig, loadBaseConfig }  :313-313
@@ -980,6 +986,16 @@ function detectVersion(cwd)  :13-19
 function format(context, cwd, writtenFiles, sigmapVersion)  :21-69
 ```
 
+### src/format/terse.js
+```
+module.exports = { encodeTerseSig, encodeTerseSigs, measureTerse, splitAnchor }  :86-86
+function splitAnchor(sig) → { text: string, suffix: s  :25-30
+function encodeTerseSig(sig) → string  :37-50
+function encodeTerseSigs(sigs) → string[]  :57-59
+function _tokens(sigs)  :62-64
+function measureTerse(sigsList) → { beforeTokens: number, a  :72-84
+```
+
 ### src/format/usage-guidance.js
 ```
 module.exports = { usageBlock }  :28-28
@@ -1012,30 +1028,6 @@ function build(files, cwd, ctx) → { forward: Map<string,str  :387-426
 function buildFromCwd(cwd, opts) → { forward: Map<string,str  :438-492
 ```
 
-### src/graph/call-graph.js
-```
-module.exports = { buildCallGraph, methodImpact, methodCallees, formatCallGraph, formatCallGraphJSON, extractDefs, maskJs, maskPy }  :397-401
-function normalizePath(p)  :35-35
-function toRel(cwd, f)  :36-36
-function symId(cwd, absFile, name)  :37-37
-function maskJs(src)  :43-59
-function maskPy(src)  :61-78
-function matchDelim(masked, openIdx, open, close)  :81-88
-function lineAt(src, idx)  :90-95
-function jsDefs(masked)  :100-206
-function pyDefs(masked)  :168-188
-function extractDefs(filePath, src)  :190-195
-function callsInRange(masked, start, end)  :198-210
-function _walk(dir, excludeSet, out, depth)  :214-227
-function buildCallGraph(cwd, opts = {}) → { * forward: Map<string,s  :243-316
-function _resolveSymbol(symbol, defs)  :319-324
-function _bfs(seedIds, graph, maxDepth)  :327-340
-function methodImpact(symbol, cwd, opts = {}) → { symbol:string, resolved  :350-356
-function methodCallees(symbol, cwd, opts = {}) → { symbol:string, resolved  :362-368
-function formatCallGraph(result, kind)  :371-383
-function formatCallGraphJSON(result, kind)  :385-395
-```
-
 ### src/graph/impact.js
 ```
 module.exports = { getImpact, analyzeImpact, formatImpact, formatImpactJSON }  :240-240
@@ -1416,6 +1408,20 @@ function extractNpmScripts(text) → { name: string, line: num  :168-184
 function extractSymbols(text) → { name: string, line: num  :192-209
 ```
 
+### src/wiki/generate.js
+```
+module.exports = { buildWiki, renderWikiMarkdown }  :250-250
+function _rel(cwd, f)  :22-24
+function _pct(fraction)  :26-28
+function _identity(cwd)  :31-37
+function _modules(index)  :40-67
+function _flow(cwd)  :70-97
+function _conventions(cwd, index)  :100-117
+function _health(cwd)  :119-127
+function buildWiki(cwd, opts = {}) → { data: object, markdown:  :137-162
+function renderWikiMarkdown(data, sigmapVersion) → string  :171-248
+```
+
 ### src/workspace/detector.js
 ```
 module.exports = { detectWorkspaces, inferPackage, scopeToPackage }  :4-4

package/CHANGELOG.md

@@ -10,6 +10,15 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.14.0] — 2026-07-11
+
+Minor release — **call-graph support for Java, Go, and Rust** (GR1 language expansion). The method-level call-graph goes from 2 to 5 languages, and every consumer — `--callers`/`--callees`, blast-radius scoring, `review-pr` method-blast findings, `get_method_impact` — inherits them with no further changes.
+
+### Added
+- **Java/Go/Rust call-graph (#471, PR #472):** new def extractors in `src/graph/call-graph.js` — Go `func` + receiver methods (parenthesized return lists handled), Java methods + constructors (generics/`throws` tolerated; control-flow and `new Foo(){}` anonymous classes rejected), Rust `fn` incl. generics + `where` clauses and `impl` methods (bodiless trait declarations skipped). New **lifetime-safe `maskRust`** masker: `'a` lifetimes pass through untouched while char literals and strings are masked, preserving offsets. **Same-package resolution scope:** Go/Java call same-package functions across files with no import statement, so same-directory same-language siblings join the resolution scope (sorted, deterministic). Per North-Star #1, unparseable constructs are skipped — never a parser dep. Surface claims updated to "JS/TS, Python, Java, Go, Rust" in `--help`, the `get_method_impact` description, and the MCP guide.
+
+---
+
 ## [8.13.0] — 2026-07-11
 
 Minor release — **method-level blast-radius scoring** (GR2, the biggest Phase-2 lever in the master plan §7.4). The D4 call-graph finally has consumers: review findings, the PR Evidence report, and a 20th MCP tool now answer *which functions break*, not just which files.

package/README.md

@@ -122,7 +122,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.13-main (21 repositories, including R language)
+Benchmark : sigmap-v8.14-main (21 repositories, including R language)
 Date      : 2026-07-11
 
 Hit@5          : 87.8%   (baseline 13.6%  — 6.5× lift)

package/gen-context.js

@@ -10942,14 +10942,16 @@ __factories["./src/graph/builder"] = function(module, exports) {
 __factories["./src/graph/call-graph"] = function(module, exports) {
   
   /**
-   * Method/caller-level call-graph (D4 v1).
+   * Method/caller-level call-graph (D4 v1, languages expanded in GR1).
    *
-   * Builds symbol-level edges — which function calls which function — for JS/TS
-   * and Python. Deterministic, zero-dependency, regex + brace/indent matching.
-   * Call sites are resolved with high precision: a call resolves to a definition
-   * of that name in the *same file* first, then in a *directly-imported* file
-   * (via the existing file-level import graph). Names that resolve to no repo
-   * definition produce no edge — over-approximation noise is avoided.
+   * Builds symbol-level edges — which function calls which function — for JS/TS,
+   * Python, Java, Go, and Rust. Deterministic, zero-dependency, regex +
+   * brace/indent matching. Call sites are resolved with high precision: a call
+   * resolves to a definition of that name in the *same file* first, then in a
+   * *directly-imported* file (via the existing file-level import graph). Names
+   * that resolve to no repo definition produce no edge — over-approximation
+   * noise is avoided. Constructs that can't be parsed dependency-free are
+   * skipped (less fidelity, never a parser dep).
    *
    * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
    *
@@ -10962,6 +10964,9 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
 
   const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
   const PY_EXTS = new Set(['.py', '.pyw']);
+  const JAVA_EXTS = new Set(['.java']);
+  const GO_EXTS = new Set(['.go']);
+  const RS_EXTS = new Set(['.rs']);
 
   // Tokens that look like `name(` calls or definition headers but are language
   // keywords, not user symbols — never treated as a call or a definition.
@@ -10971,6 +10976,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
     'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
     'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
+    'synchronized',
   ]);
 
   function normalizePath(p) { return path.normalize(p).toLowerCase(); }
@@ -10999,6 +11005,32 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     return out.join('');
   }
 
+  // Rust: `//`, `/* */`, and `"..."` mask like JS, but a bare `'` is usually a
+  // lifetime (`'a`), not a string — masking to the "closing" quote would corrupt
+  // offsets. Only char literals (`'x'`, `'\n'`) are masked; lifetimes pass through.
+  function maskRust(src) {
+    const out = src.split('');
+    const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+    let i = 0; const n = src.length;
+    while (i < n) {
+      const c = src[i], d = src[i + 1];
+      if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+      if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
+      if (c === '"') {
+        let j = i + 1;
+        while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === '"') break; j++; }
+        j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+      }
+      if (c === "'") {
+        if (d === '\\' && src[i + 3] === "'") { blank(i, i + 4); i += 4; continue; } // '\n'
+        if (d !== undefined && src[i + 2] === "'") { blank(i, i + 3); i += 3; continue; } // 'x'
+        i++; continue; // lifetime `'a` — leave untouched
+      }
+      i++;
+    }
+    return out.join('');
+  }
+
   function maskPy(src) {
     const out = src.split('');
     const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
@@ -11128,10 +11160,98 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     return defs;
   }
 
+  // Go:  func name(...) { }   |   func (r Recv) name(...) (T, error) { }
+  // The return list may itself be parenthesized, so scan past it to the body `{`.
+  function goDefs(masked) {
+    const defs = [];
+    const re = /(?:^|\n)func\s+(?:\([^)\n]*\)\s*)?([A-Za-z_]\w*)\s*\(/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      let k = close + 1;
+      let depth = 0;
+      while (k < masked.length) {
+        const ch = masked[k];
+        if (ch === '(') depth++;
+        else if (ch === ')') depth--;
+        else if (ch === '{' && depth === 0) break;
+        else if (ch === '\n' && depth === 0) { k = -1; break; } // no body on this header
+        k++;
+      }
+      if (k === -1 || k >= masked.length) continue;
+      defs.push({ name: m[1], line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Java: methods + constructors with braced bodies. Statement-shaped matches
+  // (calls, control flow) are rejected because their `)` is followed by `;`,
+  // and keyword headers (`if`, `while`, …) fall to the NON_CALL guard.
+  function javaDefs(masked) {
+    const defs = [];
+    const seen = new Set();
+    const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp)\s+)*)(?:<[^>\n]{0,80}>\s*)?(?:[\w$][\w$.<>\[\],?\s]*?\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      const name = m[2];
+      if (NON_CALL.has(name)) continue;
+      // `new Foo() { … }` anonymous classes are uses, not definitions.
+      const before = masked.slice(Math.max(0, m.index), m.index + m[0].length - name.length - 1);
+      if (/\bnew\s*$/.test(before)) continue;
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      // skip `throws A, B` up to the body `{` (same line — multi-line headers are skipped)
+      let k = close + 1;
+      while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n' && masked[k] !== '=') k++;
+      if (masked[k] !== '{') continue;
+      const key = name + ':' + k;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      defs.push({ name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Rust: fn name(...) { }  |  fn name<T>(...) -> T where … { }  — inside or
+  // outside impl/trait blocks. A `;` before the body brace (trait declaration)
+  // means no body: skipped.
+  function rustDefs(masked) {
+    const defs = [];
+    const re = /\bfn\s+([A-Za-z_]\w*)/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      let k = m.index + m[0].length;
+      while (k < masked.length && /\s/.test(masked[k])) k++;
+      if (masked[k] === '<') k = matchDelim(masked, k, '<', '>') + 1;
+      while (k < masked.length && /\s/.test(masked[k])) k++;
+      if (masked[k] !== '(') continue;
+      const close = matchDelim(masked, k, '(', ')');
+      // return type / where clause may span lines; stop at body `{` or decl `;`
+      let b = close + 1;
+      while (b < masked.length && masked[b] !== '{' && masked[b] !== ';') b++;
+      if (masked[b] !== '{') continue;
+      defs.push({ name: m[1], line: lineAt(masked, m.index), bodyStart: b, bodyEnd: matchDelim(masked, b, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Pick the masker whose comment/string syntax matches the language.
+  // Java and Go share JS syntax (Go raw strings mask like template literals).
+  function maskFor(filePath, src) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (PY_EXTS.has(ext)) return maskPy(src);
+    if (RS_EXTS.has(ext)) return maskRust(src);
+    return maskJs(src);
+  }
+
   function extractDefs(filePath, src) {
     const ext = path.extname(filePath).toLowerCase();
     if (JS_EXTS.has(ext)) return jsDefs(maskJs(src));
     if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
+    if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
+    if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
+    if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
     return null; // unsupported language
   }
 
@@ -11162,7 +11282,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
       if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
       else if (e.isFile()) {
         const ext = path.extname(e.name).toLowerCase();
-        if (JS_EXTS.has(ext) || PY_EXTS.has(ext)) out.push(full);
+        if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
       }
     }
   }
@@ -11229,10 +11349,20 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     };
 
     for (const [f, fileDefs] of perFileDefs.entries()) {
-      const masked = JS_EXTS.has(path.extname(f).toLowerCase()) ? maskJs(fs.readFileSync(f, 'utf8')) : maskPy(fs.readFileSync(f, 'utf8'));
+      const masked = maskFor(f, fs.readFileSync(f, 'utf8'));
       // resolution scope: this file's defs, then directly-imported files' defs
       const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
         .map((nf) => normToAbs.get(nf)).filter(Boolean);
+      // Go/Java: same-package symbols are visible with no import statement, and
+      // a package is (in practice) a directory — extend the scope to same-dir
+      // same-language siblings. Sorted for deterministic resolution order.
+      const ext = path.extname(f).toLowerCase();
+      if (GO_EXTS.has(ext) || JAVA_EXTS.has(ext)) {
+        const siblings = [...perFileDefs.keys()]
+          .filter((o) => o !== f && path.dirname(o) === path.dirname(f) && path.extname(o).toLowerCase() === ext)
+          .sort();
+        importedAbs.push(...siblings);
+      }
       for (const d of fileDefs) {
         const callerId = symId(cwd, f, d.name);
         if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
@@ -11338,7 +11468,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
   module.exports = {
     buildCallGraph, methodImpact, methodCallees,
     formatCallGraph, formatCallGraphJSON,
-    extractDefs, maskJs, maskPy,
+    extractDefs, maskJs, maskPy, maskRust,
   };
   
 };
@@ -14201,7 +14331,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.13.0',
+    version: '8.14.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -14482,7 +14612,7 @@ __factories["./src/mcp/tools"] = function(module, exports) {
         'Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — ' +
         'or, with direction "callees", every repo function it calls. Finer-grained than the ' +
         'file-level get_impact: tells an agent which functions break, not just which files. ' +
-        'JS/TS + Python call-graph; deterministic, no LLM.',
+        'JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -19214,7 +19344,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.13.0';
+const VERSION = '8.14.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -21075,7 +21205,7 @@ Usage:
   ${cmd} --impact <file>                   Show every file impacted by changing <file>
   ${cmd} --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
   ${cmd} --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
-  ${cmd} --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS + Python)
+  ${cmd} --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS, Python, Java, Go, Rust)
   ${cmd} --callees <symbol>                Every repo function that <symbol> (transitively) calls
   ${cmd} --callers <symbol> --json --depth <n>   Call-graph edges as JSON (depth 0 = unlimited)
   ${cmd} verify <answer.md>                Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.13.0 | Benchmark: sigmap-v8.13-main (2026-07-11)
+# Version: 8.14.0 | Benchmark: sigmap-v8.14-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.13-main, 2026-07-11)
+## Core metrics (benchmark: sigmap-v8.14-main, 2026-07-11)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -101,7 +101,7 @@ sigmap weights --json                    Learned weights as JSON
 sigmap --impact <file>                   Show every file impacted by changing <file>
 sigmap --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
 sigmap --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
-sigmap --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS + Python)
+sigmap --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS, Python, Java, Go, Rust)
 sigmap --callees <symbol>                Every repo function that <symbol> (transitively) calls
 sigmap --callers <symbol> --json --depth <n>   Call-graph edges as JSON (depth 0 = unlimited)
 sigmap verify <answer.md>                Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)
@@ -210,7 +210,7 @@ Input:  { query: string, topK?: number }
 
 ### get_method_impact
 
-Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — or, with direction "callees", every repo function it calls. Finer-grained than the file-level get_impact: tells an agent which functions break, not just which files. JS/TS + Python call-graph; deterministic, no LLM.
+Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — or, with direction "callees", every repo function it calls. Finer-grained than the file-level get_impact: tells an agent which functions break, not just which files. JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.
 
 ```
 Input:  { symbol: string, direction?: string, depth?: number }

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.13.0 | Benchmark: sigmap-v8.13-main (2026-07-11)
+# Version: 8.14.0 | Benchmark: sigmap-v8.14-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.13-main, 2026-07-11)
+## Core metrics (benchmark: sigmap-v8.14-main, 2026-07-11)
 
 - hit@5 retrieval: 87.8% vs 13.6% random baseline (6.5× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.13.0",
+  "version": "8.14.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.13.0",
+  "version": "8.14.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.13.0",
+  "version": "8.14.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/graph/call-graph.js

@@ -1,14 +1,16 @@
 'use strict';
 
 /**
- * Method/caller-level call-graph (D4 v1).
+ * Method/caller-level call-graph (D4 v1, languages expanded in GR1).
  *
- * Builds symbol-level edges — which function calls which function — for JS/TS
- * and Python. Deterministic, zero-dependency, regex + brace/indent matching.
- * Call sites are resolved with high precision: a call resolves to a definition
- * of that name in the *same file* first, then in a *directly-imported* file
- * (via the existing file-level import graph). Names that resolve to no repo
- * definition produce no edge — over-approximation noise is avoided.
+ * Builds symbol-level edges — which function calls which function — for JS/TS,
+ * Python, Java, Go, and Rust. Deterministic, zero-dependency, regex +
+ * brace/indent matching. Call sites are resolved with high precision: a call
+ * resolves to a definition of that name in the *same file* first, then in a
+ * *directly-imported* file (via the existing file-level import graph). Names
+ * that resolve to no repo definition produce no edge — over-approximation
+ * noise is avoided. Constructs that can't be parsed dependency-free are
+ * skipped (less fidelity, never a parser dep).
  *
  * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
  *
@@ -21,6 +23,9 @@ const { build } = require('./builder');
 
 const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
 const PY_EXTS = new Set(['.py', '.pyw']);
+const JAVA_EXTS = new Set(['.java']);
+const GO_EXTS = new Set(['.go']);
+const RS_EXTS = new Set(['.rs']);
 
 // Tokens that look like `name(` calls or definition headers but are language
 // keywords, not user symbols — never treated as a call or a definition.
@@ -30,6 +35,7 @@ const NON_CALL = new Set([
   'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
   'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
   'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
+  'synchronized',
 ]);
 
 function normalizePath(p) { return path.normalize(p).toLowerCase(); }
@@ -58,6 +64,32 @@ function maskJs(src) {
   return out.join('');
 }
 
+// Rust: `//`, `/* */`, and `"..."` mask like JS, but a bare `'` is usually a
+// lifetime (`'a`), not a string — masking to the "closing" quote would corrupt
+// offsets. Only char literals (`'x'`, `'\n'`) are masked; lifetimes pass through.
+function maskRust(src) {
+  const out = src.split('');
+  const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+  let i = 0; const n = src.length;
+  while (i < n) {
+    const c = src[i], d = src[i + 1];
+    if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+    if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
+    if (c === '"') {
+      let j = i + 1;
+      while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === '"') break; j++; }
+      j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+    }
+    if (c === "'") {
+      if (d === '\\' && src[i + 3] === "'") { blank(i, i + 4); i += 4; continue; } // '\n'
+      if (d !== undefined && src[i + 2] === "'") { blank(i, i + 3); i += 3; continue; } // 'x'
+      i++; continue; // lifetime `'a` — leave untouched
+    }
+    i++;
+  }
+  return out.join('');
+}
+
 function maskPy(src) {
   const out = src.split('');
   const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
@@ -187,10 +219,98 @@ function pyDefs(masked) {
   return defs;
 }
 
+// Go:  func name(...) { }   |   func (r Recv) name(...) (T, error) { }
+// The return list may itself be parenthesized, so scan past it to the body `{`.
+function goDefs(masked) {
+  const defs = [];
+  const re = /(?:^|\n)func\s+(?:\([^)\n]*\)\s*)?([A-Za-z_]\w*)\s*\(/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    let k = close + 1;
+    let depth = 0;
+    while (k < masked.length) {
+      const ch = masked[k];
+      if (ch === '(') depth++;
+      else if (ch === ')') depth--;
+      else if (ch === '{' && depth === 0) break;
+      else if (ch === '\n' && depth === 0) { k = -1; break; } // no body on this header
+      k++;
+    }
+    if (k === -1 || k >= masked.length) continue;
+    defs.push({ name: m[1], line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+  }
+  return defs;
+}
+
+// Java: methods + constructors with braced bodies. Statement-shaped matches
+// (calls, control flow) are rejected because their `)` is followed by `;`,
+// and keyword headers (`if`, `while`, …) fall to the NON_CALL guard.
+function javaDefs(masked) {
+  const defs = [];
+  const seen = new Set();
+  const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp)\s+)*)(?:<[^>\n]{0,80}>\s*)?(?:[\w$][\w$.<>\[\],?\s]*?\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    const name = m[2];
+    if (NON_CALL.has(name)) continue;
+    // `new Foo() { … }` anonymous classes are uses, not definitions.
+    const before = masked.slice(Math.max(0, m.index), m.index + m[0].length - name.length - 1);
+    if (/\bnew\s*$/.test(before)) continue;
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    // skip `throws A, B` up to the body `{` (same line — multi-line headers are skipped)
+    let k = close + 1;
+    while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n' && masked[k] !== '=') k++;
+    if (masked[k] !== '{') continue;
+    const key = name + ':' + k;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    defs.push({ name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+  }
+  return defs;
+}
+
+// Rust: fn name(...) { }  |  fn name<T>(...) -> T where … { }  — inside or
+// outside impl/trait blocks. A `;` before the body brace (trait declaration)
+// means no body: skipped.
+function rustDefs(masked) {
+  const defs = [];
+  const re = /\bfn\s+([A-Za-z_]\w*)/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    let k = m.index + m[0].length;
+    while (k < masked.length && /\s/.test(masked[k])) k++;
+    if (masked[k] === '<') k = matchDelim(masked, k, '<', '>') + 1;
+    while (k < masked.length && /\s/.test(masked[k])) k++;
+    if (masked[k] !== '(') continue;
+    const close = matchDelim(masked, k, '(', ')');
+    // return type / where clause may span lines; stop at body `{` or decl `;`
+    let b = close + 1;
+    while (b < masked.length && masked[b] !== '{' && masked[b] !== ';') b++;
+    if (masked[b] !== '{') continue;
+    defs.push({ name: m[1], line: lineAt(masked, m.index), bodyStart: b, bodyEnd: matchDelim(masked, b, '{', '}') });
+  }
+  return defs;
+}
+
+// Pick the masker whose comment/string syntax matches the language.
+// Java and Go share JS syntax (Go raw strings mask like template literals).
+function maskFor(filePath, src) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (PY_EXTS.has(ext)) return maskPy(src);
+  if (RS_EXTS.has(ext)) return maskRust(src);
+  return maskJs(src);
+}
+
 function extractDefs(filePath, src) {
   const ext = path.extname(filePath).toLowerCase();
   if (JS_EXTS.has(ext)) return jsDefs(maskJs(src));
   if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
+  if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
+  if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
+  if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
   return null; // unsupported language
 }
 
@@ -221,7 +341,7 @@ function _walk(dir, excludeSet, out, depth) {
     if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
     else if (e.isFile()) {
       const ext = path.extname(e.name).toLowerCase();
-      if (JS_EXTS.has(ext) || PY_EXTS.has(ext)) out.push(full);
+      if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
     }
   }
 }
@@ -288,10 +408,20 @@ function buildCallGraph(cwd, opts = {}) {
   };
 
   for (const [f, fileDefs] of perFileDefs.entries()) {
-    const masked = JS_EXTS.has(path.extname(f).toLowerCase()) ? maskJs(fs.readFileSync(f, 'utf8')) : maskPy(fs.readFileSync(f, 'utf8'));
+    const masked = maskFor(f, fs.readFileSync(f, 'utf8'));
     // resolution scope: this file's defs, then directly-imported files' defs
     const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
       .map((nf) => normToAbs.get(nf)).filter(Boolean);
+    // Go/Java: same-package symbols are visible with no import statement, and
+    // a package is (in practice) a directory — extend the scope to same-dir
+    // same-language siblings. Sorted for deterministic resolution order.
+    const ext = path.extname(f).toLowerCase();
+    if (GO_EXTS.has(ext) || JAVA_EXTS.has(ext)) {
+      const siblings = [...perFileDefs.keys()]
+        .filter((o) => o !== f && path.dirname(o) === path.dirname(f) && path.extname(o).toLowerCase() === ext)
+        .sort();
+      importedAbs.push(...siblings);
+    }
     for (const d of fileDefs) {
       const callerId = symId(cwd, f, d.name);
       if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
@@ -397,5 +527,5 @@ function formatCallGraphJSON(result, kind) {
 module.exports = {
   buildCallGraph, methodImpact, methodCallees,
   formatCallGraph, formatCallGraphJSON,
-  extractDefs, maskJs, maskPy,
+  extractDefs, maskJs, maskPy, maskRust,
 };

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.13.0',
+  version: '8.14.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/mcp/tools.js

@@ -154,7 +154,7 @@ const TOOLS = [
       'Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — ' +
       'or, with direction "callees", every repo function it calls. Finer-grained than the ' +
       'file-level get_impact: tells an agent which functions break, not just which files. ' +
-      'JS/TS + Python call-graph; deterministic, no LLM.',
+      'JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.',
     inputSchema: {
       type: 'object',
       properties: {