sigmap 8.13.0 → 8.16.0

package/gen-context.js

@@ -1531,6 +1531,8 @@ __factories["./src/config/defaults"] = function(module, exports) {
       topK: 10,
       // Multiplier applied to recently-changed files (>1 boosts them up)
       recencyBoost: 1.5,
+      // Boost files call-graph-connected to query matches (opt-in, measure-gated)
+      callGraphBoost: false,
     },
 
     // Impact layer settings (v2.5)
@@ -4731,12 +4733,15 @@ __factories["./src/eval/usefulness-scorer"] = function(module, exports) {
 __factories["./src/evidence/pack"] = function(module, exports) {
   
   /**
-   * Evidence Pack v1 (v8.0 E1).
+   * Evidence Pack v2 (v8.0 E1; schema v2 adds a published schema URL, per-file
+   * multi-factor risk labels, measured test-discovery provenance, and generator
+   * identity — all additive over v1).
    *
    * A deterministic, machine-consumable signature-and-evidence map. Replaces the
    * "paste this into your prompt" workflow with a byte-stable JSON artifact that
    * an agent or CI can ingest directly — every entry anchored to a real file,
-   * symbol, and line range.
+   * symbol, and line range. The published schema lives at
+   * docs-vp/public/schemas/evidence-pack-2.json (sigmap.io/schemas/).
    *
    * Composed entirely from shipped zero-dep modules:
    *   - retrieval/ranker        → ranked files, scores, signals
@@ -4756,10 +4761,21 @@ __factories["./src/evidence/pack"] = function(module, exports) {
   const { buildSigIndex, rank, detectIntent } = __require('./src/retrieval/ranker');
   const { scan } = __require('./src/security/scanner');
 
-  const SCHEMA_VERSION = '1.0';
+  const SCHEMA_VERSION = '2.0';
+  const SCHEMA_URL = 'https://sigmap.io/schemas/evidence-pack-2.json';
   const DEFAULT_BUDGET = 6000;
   const DEFAULT_TOP = 12;
 
+  // Measured accuracy of the stem-affix test-discovery method (C2). Constants
+  // are sourced from the committed benchmarks/reports/test-discovery.json and
+  // guarded by a test that fails on drift — re-run `npm run
+  // benchmark:test-discovery` and update together, never hand-invent.
+  const TEST_DISCOVERY = {
+    method: 'stem-affix-match',
+    measured: { f1: 0.98, precision: 0.971, recall: 0.988, pairs: 3701, repos: 28 },
+    benchmark: 'npm run benchmark:test-discovery',
+  };
+
   const GENERATED_RE = /(^|\/)(dist|build|out|vendor|node_modules)\/|\.(generated|min|bundle)\.|\.(pb|_pb)\.|\.pb\.go$|_pb2\.py$/;
   const TEST_RE = /(^|\/)(tests?|__tests__|spec|specs)\/|\.(test|spec)\.[a-z]+$|(^|\/)test_[^/]+\.py$|_test\.(go|py|rb)$/;
   const CONFIG_RE = /\.(json|ya?ml|toml|ini|conf|config|properties|env)$|(^|\/)(\.?[a-z]+rc)$|\.config\.[a-z]+$/i;
@@ -4798,16 +4814,29 @@ __factories["./src/evidence/pack"] = function(module, exports) {
    * @returns {'generated'|'test'|'migration'|'payment'|'auth'|'security'|'config'|'public-api'|'source'}
    */
   function riskLabelFor(relPath) {
+    return riskFactorsFor(relPath)[0];
+  }
+
+  /**
+   * Every risk category a file matches, in the same strict precedence order
+   * riskLabelFor uses (schema v2). Where v1 collapsed a migration touching
+   * payments to `migration`, the factors list carries both. Always non-empty:
+   * a file matching nothing is `['source']`.
+   * @param {string} relPath
+   * @returns {string[]}
+   */
+  function riskFactorsFor(relPath) {
     const p = relPath.replace(/\\/g, '/');
-    if (GENERATED_RE.test(p)) return 'generated';
-    if (TEST_RE.test(p)) return 'test';
-    if (MIGRATION_RE.test(p)) return 'migration';
-    if (PAYMENT_RE.test(p)) return 'payment';
-    if (AUTH_RE.test(p)) return 'auth';
-    if (SECURITY_RE.test(p)) return 'security';
-    if (CONFIG_RE.test(p)) return 'config';
-    if (PUBLIC_API_RE.test(p)) return 'public-api';
-    return 'source';
+    const factors = [];
+    if (GENERATED_RE.test(p)) factors.push('generated');
+    if (TEST_RE.test(p)) factors.push('test');
+    if (MIGRATION_RE.test(p)) factors.push('migration');
+    if (PAYMENT_RE.test(p)) factors.push('payment');
+    if (AUTH_RE.test(p)) factors.push('auth');
+    if (SECURITY_RE.test(p)) factors.push('security');
+    if (CONFIG_RE.test(p)) factors.push('config');
+    if (PUBLIC_API_RE.test(p)) factors.push('public-api');
+    return factors.length ? factors : ['source'];
   }
 
   /** Filename stem (basename minus the first extension chain). */
@@ -4939,6 +4968,7 @@ __factories["./src/evidence/pack"] = function(module, exports) {
         if (start !== null) sourceLines.push({ symbol, start, end });
       }
 
+      const riskFactors = riskFactorsFor(r.file);
       files.push({
         path: r.file,
         symbols,
@@ -4946,7 +4976,8 @@ __factories["./src/evidence/pack"] = function(module, exports) {
         confidence: maxScore > 0 ? Math.round((r.score / maxScore) * 100) / 100 : 0,
         sourceLines,
         relatedTests: findRelatedTests(r.file, allFiles),
-        riskLabel: riskLabelFor(r.file),
+        riskLabel: riskFactors[0],
+        riskFactors,
       });
     }
 
@@ -4955,11 +4986,14 @@ __factories["./src/evidence/pack"] = function(module, exports) {
 
     const pack = {
       schemaVersion: SCHEMA_VERSION,
+      schemaUrl: SCHEMA_URL,
+      generator: { name: 'sigmap', version: typeof opts.version === 'string' ? opts.version : null },
       query,
       intent,
       files,
       tokenBudget: { limit: budget, used, remaining: Math.max(0, budget - used) },
       droppedFiles,
+      testDiscovery: TEST_DISCOVERY,
       grounding: {
         symbolCount,
         anchoredSymbols,
@@ -5001,7 +5035,8 @@ __factories["./src/evidence/pack"] = function(module, exports) {
     L.push('');
 
     for (const f of pack.files) {
-      L.push(`## \`${f.path}\`  _(${f.riskLabel}, confidence ${f.confidence})_`);
+      const risk = (f.riskFactors && f.riskFactors.length > 1) ? f.riskFactors.join(' + ') : f.riskLabel;
+      L.push(`## \`${f.path}\`  _(${risk}, confidence ${f.confidence})_`);
       L.push(`_${f.reason}_`);
       if (f.relatedTests.length) L.push(`Related tests: ${f.relatedTests.map((t) => `\`${t}\``).join(', ')}`);
       L.push('');
@@ -5026,8 +5061,11 @@ __factories["./src/evidence/pack"] = function(module, exports) {
     formatMarkdown,
     parseAnchor,
     riskLabelFor,
+    riskFactorsFor,
     findRelatedTests,
     SCHEMA_VERSION,
+    SCHEMA_URL,
+    TEST_DISCOVERY,
   };
   
 };
@@ -10942,14 +10980,16 @@ __factories["./src/graph/builder"] = function(module, exports) {
 __factories["./src/graph/call-graph"] = function(module, exports) {
   
   /**
-   * Method/caller-level call-graph (D4 v1).
+   * Method/caller-level call-graph (D4 v1, languages expanded in GR1).
    *
-   * Builds symbol-level edges — which function calls which function — for JS/TS
-   * and Python. Deterministic, zero-dependency, regex + brace/indent matching.
-   * Call sites are resolved with high precision: a call resolves to a definition
-   * of that name in the *same file* first, then in a *directly-imported* file
-   * (via the existing file-level import graph). Names that resolve to no repo
-   * definition produce no edge — over-approximation noise is avoided.
+   * Builds symbol-level edges — which function calls which function — for JS/TS,
+   * Python, Java, Go, and Rust. Deterministic, zero-dependency, regex +
+   * brace/indent matching. Call sites are resolved with high precision: a call
+   * resolves to a definition of that name in the *same file* first, then in a
+   * *directly-imported* file (via the existing file-level import graph). Names
+   * that resolve to no repo definition produce no edge — over-approximation
+   * noise is avoided. Constructs that can't be parsed dependency-free are
+   * skipped (less fidelity, never a parser dep).
    *
    * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
    *
@@ -10962,6 +11002,9 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
 
   const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
   const PY_EXTS = new Set(['.py', '.pyw']);
+  const JAVA_EXTS = new Set(['.java']);
+  const GO_EXTS = new Set(['.go']);
+  const RS_EXTS = new Set(['.rs']);
 
   // Tokens that look like `name(` calls or definition headers but are language
   // keywords, not user symbols — never treated as a call or a definition.
@@ -10971,6 +11014,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
     'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
     'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
+    'synchronized',
   ]);
 
   function normalizePath(p) { return path.normalize(p).toLowerCase(); }
@@ -10999,6 +11043,32 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     return out.join('');
   }
 
+  // Rust: `//`, `/* */`, and `"..."` mask like JS, but a bare `'` is usually a
+  // lifetime (`'a`), not a string — masking to the "closing" quote would corrupt
+  // offsets. Only char literals (`'x'`, `'\n'`) are masked; lifetimes pass through.
+  function maskRust(src) {
+    const out = src.split('');
+    const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+    let i = 0; const n = src.length;
+    while (i < n) {
+      const c = src[i], d = src[i + 1];
+      if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+      if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
+      if (c === '"') {
+        let j = i + 1;
+        while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === '"') break; j++; }
+        j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+      }
+      if (c === "'") {
+        if (d === '\\' && src[i + 3] === "'") { blank(i, i + 4); i += 4; continue; } // '\n'
+        if (d !== undefined && src[i + 2] === "'") { blank(i, i + 3); i += 3; continue; } // 'x'
+        i++; continue; // lifetime `'a` — leave untouched
+      }
+      i++;
+    }
+    return out.join('');
+  }
+
   function maskPy(src) {
     const out = src.split('');
     const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
@@ -11128,10 +11198,98 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     return defs;
   }
 
+  // Go:  func name(...) { }   |   func (r Recv) name(...) (T, error) { }
+  // The return list may itself be parenthesized, so scan past it to the body `{`.
+  function goDefs(masked) {
+    const defs = [];
+    const re = /(?:^|\n)func\s+(?:\([^)\n]*\)\s*)?([A-Za-z_]\w*)\s*\(/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      let k = close + 1;
+      let depth = 0;
+      while (k < masked.length) {
+        const ch = masked[k];
+        if (ch === '(') depth++;
+        else if (ch === ')') depth--;
+        else if (ch === '{' && depth === 0) break;
+        else if (ch === '\n' && depth === 0) { k = -1; break; } // no body on this header
+        k++;
+      }
+      if (k === -1 || k >= masked.length) continue;
+      defs.push({ name: m[1], line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Java: methods + constructors with braced bodies. Statement-shaped matches
+  // (calls, control flow) are rejected because their `)` is followed by `;`,
+  // and keyword headers (`if`, `while`, …) fall to the NON_CALL guard.
+  function javaDefs(masked) {
+    const defs = [];
+    const seen = new Set();
+    const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp)\s+)*)(?:<[^>\n]{0,80}>\s*)?(?:[\w$][\w$.<>\[\],?\s]*?\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      const name = m[2];
+      if (NON_CALL.has(name)) continue;
+      // `new Foo() { … }` anonymous classes are uses, not definitions.
+      const before = masked.slice(Math.max(0, m.index), m.index + m[0].length - name.length - 1);
+      if (/\bnew\s*$/.test(before)) continue;
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      // skip `throws A, B` up to the body `{` (same line — multi-line headers are skipped)
+      let k = close + 1;
+      while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n' && masked[k] !== '=') k++;
+      if (masked[k] !== '{') continue;
+      const key = name + ':' + k;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      defs.push({ name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Rust: fn name(...) { }  |  fn name<T>(...) -> T where … { }  — inside or
+  // outside impl/trait blocks. A `;` before the body brace (trait declaration)
+  // means no body: skipped.
+  function rustDefs(masked) {
+    const defs = [];
+    const re = /\bfn\s+([A-Za-z_]\w*)/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      let k = m.index + m[0].length;
+      while (k < masked.length && /\s/.test(masked[k])) k++;
+      if (masked[k] === '<') k = matchDelim(masked, k, '<', '>') + 1;
+      while (k < masked.length && /\s/.test(masked[k])) k++;
+      if (masked[k] !== '(') continue;
+      const close = matchDelim(masked, k, '(', ')');
+      // return type / where clause may span lines; stop at body `{` or decl `;`
+      let b = close + 1;
+      while (b < masked.length && masked[b] !== '{' && masked[b] !== ';') b++;
+      if (masked[b] !== '{') continue;
+      defs.push({ name: m[1], line: lineAt(masked, m.index), bodyStart: b, bodyEnd: matchDelim(masked, b, '{', '}') });
+    }
+    return defs;
+  }
+
+  // Pick the masker whose comment/string syntax matches the language.
+  // Java and Go share JS syntax (Go raw strings mask like template literals).
+  function maskFor(filePath, src) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (PY_EXTS.has(ext)) return maskPy(src);
+    if (RS_EXTS.has(ext)) return maskRust(src);
+    return maskJs(src);
+  }
+
   function extractDefs(filePath, src) {
     const ext = path.extname(filePath).toLowerCase();
     if (JS_EXTS.has(ext)) return jsDefs(maskJs(src));
     if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
+    if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
+    if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
+    if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
     return null; // unsupported language
   }
 
@@ -11162,7 +11320,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
       if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
       else if (e.isFile()) {
         const ext = path.extname(e.name).toLowerCase();
-        if (JS_EXTS.has(ext) || PY_EXTS.has(ext)) out.push(full);
+        if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
       }
     }
   }
@@ -11229,10 +11387,20 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     };
 
     for (const [f, fileDefs] of perFileDefs.entries()) {
-      const masked = JS_EXTS.has(path.extname(f).toLowerCase()) ? maskJs(fs.readFileSync(f, 'utf8')) : maskPy(fs.readFileSync(f, 'utf8'));
+      const masked = maskFor(f, fs.readFileSync(f, 'utf8'));
       // resolution scope: this file's defs, then directly-imported files' defs
       const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
         .map((nf) => normToAbs.get(nf)).filter(Boolean);
+      // Go/Java: same-package symbols are visible with no import statement, and
+      // a package is (in practice) a directory — extend the scope to same-dir
+      // same-language siblings. Sorted for deterministic resolution order.
+      const ext = path.extname(f).toLowerCase();
+      if (GO_EXTS.has(ext) || JAVA_EXTS.has(ext)) {
+        const siblings = [...perFileDefs.keys()]
+          .filter((o) => o !== f && path.dirname(o) === path.dirname(f) && path.extname(o).toLowerCase() === ext)
+          .sort();
+        importedAbs.push(...siblings);
+      }
       for (const d of fileDefs) {
         const callerId = symId(cwd, f, d.name);
         if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
@@ -11256,6 +11424,42 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     return { forward: toArr(forward), reverse: toArr(reverse), defs };
   }
 
+  /**
+   * Collapse the symbol-level call-graph to FILE-level bidirectional edges for
+   * the ranker's neighbor boost (opt-in via `retrieval.callGraphBoost`). A file
+   * whose functions call into — or are called by — another file gets an edge in
+   * both directions. Keys are `path.resolve`-form absolute paths (matching the
+   * ranker's lookups); entries and neighbor lists are sorted for determinism.
+   *
+   * @param {string} cwd
+   * @param {object} [opts] { graph } to inject a prebuilt call graph (tests)
+   * @returns {{ forward: Map<string,string[]> }}
+   */
+  function buildCallFileGraph(cwd, opts = {}) {
+    const graph = opts.graph || buildCallGraph(cwd, opts);
+    const edges = new Map(); // absFile → Set<absFile>
+    const add = (a, b) => {
+      if (a === b) return;
+      if (!edges.has(a)) edges.set(a, new Set());
+      edges.get(a).add(b);
+    };
+    for (const [callerId, calleeIds] of graph.forward.entries()) {
+      const callerDef = graph.defs.get(callerId);
+      if (!callerDef) continue;
+      for (const calleeId of calleeIds) {
+        const calleeDef = graph.defs.get(calleeId);
+        if (!calleeDef || calleeDef.file === callerDef.file) continue;
+        const a = path.resolve(cwd, callerDef.file);
+        const b = path.resolve(cwd, calleeDef.file);
+        add(a, b);
+        add(b, a);
+      }
+    }
+    const forward = new Map();
+    for (const k of [...edges.keys()].sort()) forward.set(k, [...edges.get(k)].sort());
+    return { forward };
+  }
+
   // Resolve a user-supplied symbol (bare name or full `file#name` id) to ids.
   function _resolveSymbol(symbol, defs) {
     if (defs.has(symbol)) return [symbol];
@@ -11336,9 +11540,9 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
   }
 
   module.exports = {
-    buildCallGraph, methodImpact, methodCallees,
+    buildCallGraph, buildCallFileGraph, methodImpact, methodCallees,
     formatCallGraph, formatCallGraphJSON,
-    extractDefs, maskJs, maskPy,
+    extractDefs, maskJs, maskPy, maskRust,
   };
   
 };
@@ -13488,7 +13692,16 @@ __factories["./src/mcp/handlers"] = function(module, exports) {
       // Build dependency graph for neighbor boost — non-fatal if it fails
       let graph = null;
       try { graph = buildFromCwd(cwd); } catch (_) {}
-      const results = rank(args.query, index, { topK, cwd, graph });
+      // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
+      let callGraph = null;
+      try {
+        const { loadConfig } = __require('./src/config/loader');
+        const retrieval = loadConfig(cwd).retrieval;
+        if (retrieval && retrieval.callGraphBoost) {
+          callGraph = __require('./src/graph/call-graph').buildCallFileGraph(cwd);
+        }
+      } catch (_) {}
+      const results = rank(args.query, index, { topK, cwd, graph, callGraph });
       return formatRankTable(results, args.query);
     } catch (err) {
       return `_query_context failed: ${err.message}_`;
@@ -14201,7 +14414,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.13.0',
+    version: '8.16.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -14482,7 +14695,7 @@ __factories["./src/mcp/tools"] = function(module, exports) {
         'Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — ' +
         'or, with direction "callees", every repo function it calls. Finer-grained than the ' +
         'file-level get_impact: tells an agent which functions break, not just which files. ' +
-        'JS/TS + Python call-graph; deterministic, no LLM.',
+        'JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -15266,6 +15479,7 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
   const GRAPH_BOOST_AMOUNTS = {
     hop1: 0.40,   // direct import neighbor of a file with score > 0
     hop2: 0.15,   // 2 hops away (transitive), with decay
+    callHop: 0.30, // call-graph file neighbor (opt-in retrieval.callGraphBoost)
   };
 
   // Intent-specific weight adjustments
@@ -15398,6 +15612,8 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
    * @param {object}  [opts.weights]               - override scoring weights
    * @param {string}  [opts.cwd]                   - project root for learned ranking weights
    * @param {{ forward: Map<string,string[]> }} [opts.graph] - dependency graph for neighbor boost
+   * @param {{ forward: Map<string,string[]> }} [opts.callGraph] - file-level call-graph edges
+   *        (from buildCallFileGraph) for the opt-in call-neighbor boost
    * @returns {{ file: string, score: number, sigs: string[], tokens: number, intent: string, signals: object }[]}
    */
   function rank(query, sigIndex, opts) {
@@ -15521,6 +15737,31 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
       }
     }
 
+    // Call-graph neighbor boost (opt-in via retrieval.callGraphBoost): a file
+    // whose functions call into — or are called by — a positively-scored file is
+    // relevant even when no import edge exists (Go/Java same-package, dynamic
+    // dispatch). Single hop; seeds snapshotted first so boosts never cascade.
+    const callGraph = (opts && opts.callGraph && opts.callGraph.forward instanceof Map) ? opts.callGraph : null;
+    if (callGraph && cwd) {
+      const path = require('path');
+      const relToIdx = new Map();
+      for (let i = 0; i < scored.length; i++) relToIdx.set(scored[i].file, i);
+      const hubs = _computeHubs(callGraph);
+      const seeds = scored.filter((e) => e.score > 0).map((e) => e.file);
+      for (const file of seeds) {
+        const abs = path.resolve(cwd, file);
+        for (const neighborAbs of (callGraph.forward.get(abs) || [])) {
+          if (_isHub(neighborAbs) || hubs.has(neighborAbs)) continue;
+          const neighborRel = path.relative(cwd, neighborAbs).replace(/\\/g, '/');
+          const idx = relToIdx.get(neighborRel);
+          if (idx !== undefined && scored[idx].file !== file) {
+            scored[idx].score += GRAPH_BOOST_AMOUNTS.callHop;
+            scored[idx].signals.callGraphBoost = (scored[idx].signals.callGraphBoost || 0) + GRAPH_BOOST_AMOUNTS.callHop;
+          }
+        }
+      }
+    }
+
     // Compute confidence levels based on score distribution
     if (scored.length > 0) {
       const scores = scored.map(s => s.score);
@@ -19214,7 +19455,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.13.0';
+const VERSION = '8.16.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -21075,7 +21316,7 @@ Usage:
   ${cmd} --impact <file>                   Show every file impacted by changing <file>
   ${cmd} --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
   ${cmd} --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
-  ${cmd} --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS + Python)
+  ${cmd} --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS, Python, Java, Go, Rust)
   ${cmd} --callees <symbol>                Every repo function that <symbol> (transitively) calls
   ${cmd} --callers <symbol> --json --depth <n>   Call-graph edges as JSON (depth 0 = unlimited)
   ${cmd} verify <answer.md>                Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)
@@ -21537,7 +21778,13 @@ function main() {
       } catch (_) { /* squeeze is best-effort — never break ask */ }
     }
 
-    let ranked = rank(query, sigIndex, { topK: 5, weights: intentWeights, cwd });
+    // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
+    let askCallGraph = null;
+    if (config && config.retrieval && config.retrieval.callGraphBoost) {
+      try { askCallGraph = requireSourceOrBundled('./src/graph/call-graph').buildCallFileGraph(cwd); } catch (_) {}
+    }
+
+    let ranked = rank(query, sigIndex, { topK: 5, weights: intentWeights, cwd, callGraph: askCallGraph });
 
     // v6.10: Workspace scoping — infer package from query and apply boost
     const workspaces = detectWorkspaces(cwd);
@@ -21694,7 +21941,7 @@ function main() {
 
     const { buildEvidencePack, formatJSON, formatMarkdown } = requireSourceOrBundled('./src/evidence/pack');
 
-    const opts = {};
+    const opts = { version: VERSION };
     const topIdx = args.indexOf('--top');
     if (topIdx !== -1 && args[topIdx + 1]) opts.top = parseInt(args[topIdx + 1], 10);
     const budgetIdx = args.indexOf('--budget');
@@ -23709,7 +23956,12 @@ function main() {
       const topK = topIdx >= 0 ? Math.min(Math.max(1, parseInt(args[topIdx + 1], 10) || 10), 25)
                                : ((config && config.retrieval && config.retrieval.topK) || 10);
       const recencyBoost = (config && config.retrieval && config.retrieval.recencyBoost) || 1.5;
-      const results = rank(query, index, { topK, recencyBoost, cwd });
+      // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
+      let queryCallGraph = null;
+      if (config && config.retrieval && config.retrieval.callGraphBoost) {
+        try { queryCallGraph = requireSourceOrBundled('./src/graph/call-graph').buildCallFileGraph(cwd); } catch (_) {}
+      }
+      const results = rank(query, index, { topK, recencyBoost, cwd, callGraph: queryCallGraph });
       if (args.includes('--context')) {
         const miniCtx  = buildMiniContext(results, cwd);
         const ctxOut   = path.join(cwd, '.context', 'query-context.md');

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.13.0 | Benchmark: sigmap-v8.13-main (2026-07-11)
+# Version: 8.16.0 | Benchmark: sigmap-v8.16-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.13-main, 2026-07-11)
+## Core metrics (benchmark: sigmap-v8.16-main, 2026-07-11)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -101,7 +101,7 @@ sigmap weights --json                    Learned weights as JSON
 sigmap --impact <file>                   Show every file impacted by changing <file>
 sigmap --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
 sigmap --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
-sigmap --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS + Python)
+sigmap --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS, Python, Java, Go, Rust)
 sigmap --callees <symbol>                Every repo function that <symbol> (transitively) calls
 sigmap --callers <symbol> --json --depth <n>   Call-graph edges as JSON (depth 0 = unlimited)
 sigmap verify <answer.md>                Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)
@@ -210,7 +210,7 @@ Input:  { query: string, topK?: number }
 
 ### get_method_impact
 
-Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — or, with direction "callees", every repo function it calls. Finer-grained than the file-level get_impact: tells an agent which functions break, not just which files. JS/TS + Python call-graph; deterministic, no LLM.
+Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — or, with direction "callees", every repo function it calls. Finer-grained than the file-level get_impact: tells an agent which functions break, not just which files. JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.
 
 ```
 Input:  { symbol: string, direction?: string, depth?: number }
@@ -343,7 +343,7 @@ testCoverage = false
 testDirs = ["tests","test","__tests__","spec"]
 sigCache = false
 impactRadius = false
-retrieval = {"topK":10,"recencyBoost":1.5}
+retrieval = {"topK":10,"recencyBoost":1.5,"callGraphBoost":false}
 impact = {"depth":3,"includeSigs":true}
 ```
 

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.13.0 | Benchmark: sigmap-v8.13-main (2026-07-11)
+# Version: 8.16.0 | Benchmark: sigmap-v8.16-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.13-main, 2026-07-11)
+## Core metrics (benchmark: sigmap-v8.16-main, 2026-07-11)
 
 - hit@5 retrieval: 87.8% vs 13.6% random baseline (6.5× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.13.0",
+  "version": "8.16.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {
@@ -30,6 +30,7 @@
     "benchmark:squeeze": "node scripts/run-squeeze-benchmark.mjs --save",
     "benchmark:test-discovery": "node scripts/run-test-discovery-benchmark.mjs --save",
     "benchmark:terse": "node scripts/run-terse-benchmark.mjs --save",
+    "benchmark:callgraph-boost": "node scripts/run-callgraph-boost-benchmark.mjs --save",
     "validate:squeeze": "node scripts/run-squeeze-benchmark.mjs --gate",
     "health": "node gen-context.js --health",
     "map": "node gen-project-map.js",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.13.0",
+  "version": "8.16.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.13.0",
+  "version": "8.16.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/config/defaults.js

@@ -147,6 +147,8 @@ const DEFAULTS = {
     topK: 10,
     // Multiplier applied to recently-changed files (>1 boosts them up)
     recencyBoost: 1.5,
+    // Boost files call-graph-connected to query matches (opt-in, measure-gated)
+    callGraphBoost: false,
   },
 
   // Impact layer settings (v2.5)