sigmap 8.13.0 → 8.16.0

package/src/evidence/pack.js

@@ -1,12 +1,15 @@
 'use strict';
 
 /**
- * Evidence Pack v1 (v8.0 E1).
+ * Evidence Pack v2 (v8.0 E1; schema v2 adds a published schema URL, per-file
+ * multi-factor risk labels, measured test-discovery provenance, and generator
+ * identity — all additive over v1).
  *
  * A deterministic, machine-consumable signature-and-evidence map. Replaces the
  * "paste this into your prompt" workflow with a byte-stable JSON artifact that
  * an agent or CI can ingest directly — every entry anchored to a real file,
- * symbol, and line range.
+ * symbol, and line range. The published schema lives at
+ * docs-vp/public/schemas/evidence-pack-2.json (sigmap.io/schemas/).
  *
  * Composed entirely from shipped zero-dep modules:
  *   - retrieval/ranker        → ranked files, scores, signals
@@ -26,10 +29,21 @@ const crypto = require('crypto');
 const { buildSigIndex, rank, detectIntent } = require('../retrieval/ranker');
 const { scan } = require('../security/scanner');
 
-const SCHEMA_VERSION = '1.0';
+const SCHEMA_VERSION = '2.0';
+const SCHEMA_URL = 'https://sigmap.io/schemas/evidence-pack-2.json';
 const DEFAULT_BUDGET = 6000;
 const DEFAULT_TOP = 12;
 
+// Measured accuracy of the stem-affix test-discovery method (C2). Constants
+// are sourced from the committed benchmarks/reports/test-discovery.json and
+// guarded by a test that fails on drift — re-run `npm run
+// benchmark:test-discovery` and update together, never hand-invent.
+const TEST_DISCOVERY = {
+  method: 'stem-affix-match',
+  measured: { f1: 0.98, precision: 0.971, recall: 0.988, pairs: 3701, repos: 28 },
+  benchmark: 'npm run benchmark:test-discovery',
+};
+
 const GENERATED_RE = /(^|\/)(dist|build|out|vendor|node_modules)\/|\.(generated|min|bundle)\.|\.(pb|_pb)\.|\.pb\.go$|_pb2\.py$/;
 const TEST_RE = /(^|\/)(tests?|__tests__|spec|specs)\/|\.(test|spec)\.[a-z]+$|(^|\/)test_[^/]+\.py$|_test\.(go|py|rb)$/;
 const CONFIG_RE = /\.(json|ya?ml|toml|ini|conf|config|properties|env)$|(^|\/)(\.?[a-z]+rc)$|\.config\.[a-z]+$/i;
@@ -68,16 +82,29 @@ function parseAnchor(sig) {
  * @returns {'generated'|'test'|'migration'|'payment'|'auth'|'security'|'config'|'public-api'|'source'}
  */
 function riskLabelFor(relPath) {
+  return riskFactorsFor(relPath)[0];
+}
+
+/**
+ * Every risk category a file matches, in the same strict precedence order
+ * riskLabelFor uses (schema v2). Where v1 collapsed a migration touching
+ * payments to `migration`, the factors list carries both. Always non-empty:
+ * a file matching nothing is `['source']`.
+ * @param {string} relPath
+ * @returns {string[]}
+ */
+function riskFactorsFor(relPath) {
   const p = relPath.replace(/\\/g, '/');
-  if (GENERATED_RE.test(p)) return 'generated';
-  if (TEST_RE.test(p)) return 'test';
-  if (MIGRATION_RE.test(p)) return 'migration';
-  if (PAYMENT_RE.test(p)) return 'payment';
-  if (AUTH_RE.test(p)) return 'auth';
-  if (SECURITY_RE.test(p)) return 'security';
-  if (CONFIG_RE.test(p)) return 'config';
-  if (PUBLIC_API_RE.test(p)) return 'public-api';
-  return 'source';
+  const factors = [];
+  if (GENERATED_RE.test(p)) factors.push('generated');
+  if (TEST_RE.test(p)) factors.push('test');
+  if (MIGRATION_RE.test(p)) factors.push('migration');
+  if (PAYMENT_RE.test(p)) factors.push('payment');
+  if (AUTH_RE.test(p)) factors.push('auth');
+  if (SECURITY_RE.test(p)) factors.push('security');
+  if (CONFIG_RE.test(p)) factors.push('config');
+  if (PUBLIC_API_RE.test(p)) factors.push('public-api');
+  return factors.length ? factors : ['source'];
 }
 
 /** Filename stem (basename minus the first extension chain). */
@@ -209,6 +236,7 @@ function buildEvidencePack(query, cwd, opts = {}) {
       if (start !== null) sourceLines.push({ symbol, start, end });
     }
 
+    const riskFactors = riskFactorsFor(r.file);
     files.push({
       path: r.file,
       symbols,
@@ -216,7 +244,8 @@ function buildEvidencePack(query, cwd, opts = {}) {
       confidence: maxScore > 0 ? Math.round((r.score / maxScore) * 100) / 100 : 0,
       sourceLines,
       relatedTests: findRelatedTests(r.file, allFiles),
-      riskLabel: riskLabelFor(r.file),
+      riskLabel: riskFactors[0],
+      riskFactors,
     });
   }
 
@@ -225,11 +254,14 @@ function buildEvidencePack(query, cwd, opts = {}) {
 
   const pack = {
     schemaVersion: SCHEMA_VERSION,
+    schemaUrl: SCHEMA_URL,
+    generator: { name: 'sigmap', version: typeof opts.version === 'string' ? opts.version : null },
     query,
     intent,
     files,
     tokenBudget: { limit: budget, used, remaining: Math.max(0, budget - used) },
     droppedFiles,
+    testDiscovery: TEST_DISCOVERY,
     grounding: {
       symbolCount,
       anchoredSymbols,
@@ -271,7 +303,8 @@ function formatMarkdown(pack) {
   L.push('');
 
   for (const f of pack.files) {
-    L.push(`## \`${f.path}\`  _(${f.riskLabel}, confidence ${f.confidence})_`);
+    const risk = (f.riskFactors && f.riskFactors.length > 1) ? f.riskFactors.join(' + ') : f.riskLabel;
+    L.push(`## \`${f.path}\`  _(${risk}, confidence ${f.confidence})_`);
     L.push(`_${f.reason}_`);
     if (f.relatedTests.length) L.push(`Related tests: ${f.relatedTests.map((t) => `\`${t}\``).join(', ')}`);
     L.push('');
@@ -296,6 +329,9 @@ module.exports = {
   formatMarkdown,
   parseAnchor,
   riskLabelFor,
+  riskFactorsFor,
   findRelatedTests,
   SCHEMA_VERSION,
+  SCHEMA_URL,
+  TEST_DISCOVERY,
 };

package/src/graph/call-graph.js

@@ -1,14 +1,16 @@
 'use strict';
 
 /**
- * Method/caller-level call-graph (D4 v1).
+ * Method/caller-level call-graph (D4 v1, languages expanded in GR1).
  *
- * Builds symbol-level edges — which function calls which function — for JS/TS
- * and Python. Deterministic, zero-dependency, regex + brace/indent matching.
- * Call sites are resolved with high precision: a call resolves to a definition
- * of that name in the *same file* first, then in a *directly-imported* file
- * (via the existing file-level import graph). Names that resolve to no repo
- * definition produce no edge — over-approximation noise is avoided.
+ * Builds symbol-level edges — which function calls which function — for JS/TS,
+ * Python, Java, Go, and Rust. Deterministic, zero-dependency, regex +
+ * brace/indent matching. Call sites are resolved with high precision: a call
+ * resolves to a definition of that name in the *same file* first, then in a
+ * *directly-imported* file (via the existing file-level import graph). Names
+ * that resolve to no repo definition produce no edge — over-approximation
+ * noise is avoided. Constructs that can't be parsed dependency-free are
+ * skipped (less fidelity, never a parser dep).
  *
  * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
  *
@@ -21,6 +23,9 @@ const { build } = require('./builder');
 
 const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
 const PY_EXTS = new Set(['.py', '.pyw']);
+const JAVA_EXTS = new Set(['.java']);
+const GO_EXTS = new Set(['.go']);
+const RS_EXTS = new Set(['.rs']);
 
 // Tokens that look like `name(` calls or definition headers but are language
 // keywords, not user symbols — never treated as a call or a definition.
@@ -30,6 +35,7 @@ const NON_CALL = new Set([
   'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
   'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
   'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
+  'synchronized',
 ]);
 
 function normalizePath(p) { return path.normalize(p).toLowerCase(); }
@@ -58,6 +64,32 @@ function maskJs(src) {
   return out.join('');
 }
 
+// Rust: `//`, `/* */`, and `"..."` mask like JS, but a bare `'` is usually a
+// lifetime (`'a`), not a string — masking to the "closing" quote would corrupt
+// offsets. Only char literals (`'x'`, `'\n'`) are masked; lifetimes pass through.
+function maskRust(src) {
+  const out = src.split('');
+  const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+  let i = 0; const n = src.length;
+  while (i < n) {
+    const c = src[i], d = src[i + 1];
+    if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+    if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
+    if (c === '"') {
+      let j = i + 1;
+      while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === '"') break; j++; }
+      j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+    }
+    if (c === "'") {
+      if (d === '\\' && src[i + 3] === "'") { blank(i, i + 4); i += 4; continue; } // '\n'
+      if (d !== undefined && src[i + 2] === "'") { blank(i, i + 3); i += 3; continue; } // 'x'
+      i++; continue; // lifetime `'a` — leave untouched
+    }
+    i++;
+  }
+  return out.join('');
+}
+
 function maskPy(src) {
   const out = src.split('');
   const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
@@ -187,10 +219,98 @@ function pyDefs(masked) {
   return defs;
 }
 
+// Go:  func name(...) { }   |   func (r Recv) name(...) (T, error) { }
+// The return list may itself be parenthesized, so scan past it to the body `{`.
+function goDefs(masked) {
+  const defs = [];
+  const re = /(?:^|\n)func\s+(?:\([^)\n]*\)\s*)?([A-Za-z_]\w*)\s*\(/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    let k = close + 1;
+    let depth = 0;
+    while (k < masked.length) {
+      const ch = masked[k];
+      if (ch === '(') depth++;
+      else if (ch === ')') depth--;
+      else if (ch === '{' && depth === 0) break;
+      else if (ch === '\n' && depth === 0) { k = -1; break; } // no body on this header
+      k++;
+    }
+    if (k === -1 || k >= masked.length) continue;
+    defs.push({ name: m[1], line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+  }
+  return defs;
+}
+
+// Java: methods + constructors with braced bodies. Statement-shaped matches
+// (calls, control flow) are rejected because their `)` is followed by `;`,
+// and keyword headers (`if`, `while`, …) fall to the NON_CALL guard.
+function javaDefs(masked) {
+  const defs = [];
+  const seen = new Set();
+  const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp)\s+)*)(?:<[^>\n]{0,80}>\s*)?(?:[\w$][\w$.<>\[\],?\s]*?\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    const name = m[2];
+    if (NON_CALL.has(name)) continue;
+    // `new Foo() { … }` anonymous classes are uses, not definitions.
+    const before = masked.slice(Math.max(0, m.index), m.index + m[0].length - name.length - 1);
+    if (/\bnew\s*$/.test(before)) continue;
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    // skip `throws A, B` up to the body `{` (same line — multi-line headers are skipped)
+    let k = close + 1;
+    while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n' && masked[k] !== '=') k++;
+    if (masked[k] !== '{') continue;
+    const key = name + ':' + k;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    defs.push({ name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+  }
+  return defs;
+}
+
+// Rust: fn name(...) { }  |  fn name<T>(...) -> T where … { }  — inside or
+// outside impl/trait blocks. A `;` before the body brace (trait declaration)
+// means no body: skipped.
+function rustDefs(masked) {
+  const defs = [];
+  const re = /\bfn\s+([A-Za-z_]\w*)/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    let k = m.index + m[0].length;
+    while (k < masked.length && /\s/.test(masked[k])) k++;
+    if (masked[k] === '<') k = matchDelim(masked, k, '<', '>') + 1;
+    while (k < masked.length && /\s/.test(masked[k])) k++;
+    if (masked[k] !== '(') continue;
+    const close = matchDelim(masked, k, '(', ')');
+    // return type / where clause may span lines; stop at body `{` or decl `;`
+    let b = close + 1;
+    while (b < masked.length && masked[b] !== '{' && masked[b] !== ';') b++;
+    if (masked[b] !== '{') continue;
+    defs.push({ name: m[1], line: lineAt(masked, m.index), bodyStart: b, bodyEnd: matchDelim(masked, b, '{', '}') });
+  }
+  return defs;
+}
+
+// Pick the masker whose comment/string syntax matches the language.
+// Java and Go share JS syntax (Go raw strings mask like template literals).
+function maskFor(filePath, src) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (PY_EXTS.has(ext)) return maskPy(src);
+  if (RS_EXTS.has(ext)) return maskRust(src);
+  return maskJs(src);
+}
+
 function extractDefs(filePath, src) {
   const ext = path.extname(filePath).toLowerCase();
   if (JS_EXTS.has(ext)) return jsDefs(maskJs(src));
   if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
+  if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
+  if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
+  if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
   return null; // unsupported language
 }
 
@@ -221,7 +341,7 @@ function _walk(dir, excludeSet, out, depth) {
     if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
     else if (e.isFile()) {
       const ext = path.extname(e.name).toLowerCase();
-      if (JS_EXTS.has(ext) || PY_EXTS.has(ext)) out.push(full);
+      if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
     }
   }
 }
@@ -288,10 +408,20 @@ function buildCallGraph(cwd, opts = {}) {
   };
 
   for (const [f, fileDefs] of perFileDefs.entries()) {
-    const masked = JS_EXTS.has(path.extname(f).toLowerCase()) ? maskJs(fs.readFileSync(f, 'utf8')) : maskPy(fs.readFileSync(f, 'utf8'));
+    const masked = maskFor(f, fs.readFileSync(f, 'utf8'));
     // resolution scope: this file's defs, then directly-imported files' defs
     const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
       .map((nf) => normToAbs.get(nf)).filter(Boolean);
+    // Go/Java: same-package symbols are visible with no import statement, and
+    // a package is (in practice) a directory — extend the scope to same-dir
+    // same-language siblings. Sorted for deterministic resolution order.
+    const ext = path.extname(f).toLowerCase();
+    if (GO_EXTS.has(ext) || JAVA_EXTS.has(ext)) {
+      const siblings = [...perFileDefs.keys()]
+        .filter((o) => o !== f && path.dirname(o) === path.dirname(f) && path.extname(o).toLowerCase() === ext)
+        .sort();
+      importedAbs.push(...siblings);
+    }
     for (const d of fileDefs) {
       const callerId = symId(cwd, f, d.name);
       if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
@@ -315,6 +445,42 @@ function buildCallGraph(cwd, opts = {}) {
   return { forward: toArr(forward), reverse: toArr(reverse), defs };
 }
 
+/**
+ * Collapse the symbol-level call-graph to FILE-level bidirectional edges for
+ * the ranker's neighbor boost (opt-in via `retrieval.callGraphBoost`). A file
+ * whose functions call into — or are called by — another file gets an edge in
+ * both directions. Keys are `path.resolve`-form absolute paths (matching the
+ * ranker's lookups); entries and neighbor lists are sorted for determinism.
+ *
+ * @param {string} cwd
+ * @param {object} [opts] { graph } to inject a prebuilt call graph (tests)
+ * @returns {{ forward: Map<string,string[]> }}
+ */
+function buildCallFileGraph(cwd, opts = {}) {
+  const graph = opts.graph || buildCallGraph(cwd, opts);
+  const edges = new Map(); // absFile → Set<absFile>
+  const add = (a, b) => {
+    if (a === b) return;
+    if (!edges.has(a)) edges.set(a, new Set());
+    edges.get(a).add(b);
+  };
+  for (const [callerId, calleeIds] of graph.forward.entries()) {
+    const callerDef = graph.defs.get(callerId);
+    if (!callerDef) continue;
+    for (const calleeId of calleeIds) {
+      const calleeDef = graph.defs.get(calleeId);
+      if (!calleeDef || calleeDef.file === callerDef.file) continue;
+      const a = path.resolve(cwd, callerDef.file);
+      const b = path.resolve(cwd, calleeDef.file);
+      add(a, b);
+      add(b, a);
+    }
+  }
+  const forward = new Map();
+  for (const k of [...edges.keys()].sort()) forward.set(k, [...edges.get(k)].sort());
+  return { forward };
+}
+
 // Resolve a user-supplied symbol (bare name or full `file#name` id) to ids.
 function _resolveSymbol(symbol, defs) {
   if (defs.has(symbol)) return [symbol];
@@ -395,7 +561,7 @@ function formatCallGraphJSON(result, kind) {
 }
 
 module.exports = {
-  buildCallGraph, methodImpact, methodCallees,
+  buildCallGraph, buildCallFileGraph, methodImpact, methodCallees,
   formatCallGraph, formatCallGraphJSON,
-  extractDefs, maskJs, maskPy,
+  extractDefs, maskJs, maskPy, maskRust,
 };

package/src/mcp/handlers.js

@@ -421,7 +421,16 @@ function queryContext(args, cwd) {
     // Build dependency graph for neighbor boost — non-fatal if it fails
     let graph = null;
     try { graph = buildFromCwd(cwd); } catch (_) {}
-    const results = rank(args.query, index, { topK, cwd, graph });
+    // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
+    let callGraph = null;
+    try {
+      const { loadConfig } = require('../config/loader');
+      const retrieval = loadConfig(cwd).retrieval;
+      if (retrieval && retrieval.callGraphBoost) {
+        callGraph = require('../graph/call-graph').buildCallFileGraph(cwd);
+      }
+    } catch (_) {}
+    const results = rank(args.query, index, { topK, cwd, graph, callGraph });
     return formatRankTable(results, args.query);
   } catch (err) {
     return `_query_context failed: ${err.message}_`;

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.13.0',
+  version: '8.16.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/mcp/tools.js

@@ -154,7 +154,7 @@ const TOOLS = [
       'Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it — ' +
       'or, with direction "callees", every repo function it calls. Finer-grained than the ' +
       'file-level get_impact: tells an agent which functions break, not just which files. ' +
-      'JS/TS + Python call-graph; deterministic, no LLM.',
+      'JS/TS, Python, Java, Go, and Rust call-graph; deterministic, no LLM.',
     inputSchema: {
       type: 'object',
       properties: {

package/src/retrieval/ranker.js

@@ -37,6 +37,7 @@ const DEFAULT_WEIGHTS = {
 const GRAPH_BOOST_AMOUNTS = {
   hop1: 0.40,   // direct import neighbor of a file with score > 0
   hop2: 0.15,   // 2 hops away (transitive), with decay
+  callHop: 0.30, // call-graph file neighbor (opt-in retrieval.callGraphBoost)
 };
 
 // Intent-specific weight adjustments
@@ -169,6 +170,8 @@ function scoreFile(filePath, sigs, queryTokens, weights) {
  * @param {object}  [opts.weights]               - override scoring weights
  * @param {string}  [opts.cwd]                   - project root for learned ranking weights
  * @param {{ forward: Map<string,string[]> }} [opts.graph] - dependency graph for neighbor boost
+ * @param {{ forward: Map<string,string[]> }} [opts.callGraph] - file-level call-graph edges
+ *        (from buildCallFileGraph) for the opt-in call-neighbor boost
  * @returns {{ file: string, score: number, sigs: string[], tokens: number, intent: string, signals: object }[]}
  */
 function rank(query, sigIndex, opts) {
@@ -292,6 +295,31 @@ function rank(query, sigIndex, opts) {
     }
   }
 
+  // Call-graph neighbor boost (opt-in via retrieval.callGraphBoost): a file
+  // whose functions call into — or are called by — a positively-scored file is
+  // relevant even when no import edge exists (Go/Java same-package, dynamic
+  // dispatch). Single hop; seeds snapshotted first so boosts never cascade.
+  const callGraph = (opts && opts.callGraph && opts.callGraph.forward instanceof Map) ? opts.callGraph : null;
+  if (callGraph && cwd) {
+    const path = require('path');
+    const relToIdx = new Map();
+    for (let i = 0; i < scored.length; i++) relToIdx.set(scored[i].file, i);
+    const hubs = _computeHubs(callGraph);
+    const seeds = scored.filter((e) => e.score > 0).map((e) => e.file);
+    for (const file of seeds) {
+      const abs = path.resolve(cwd, file);
+      for (const neighborAbs of (callGraph.forward.get(abs) || [])) {
+        if (_isHub(neighborAbs) || hubs.has(neighborAbs)) continue;
+        const neighborRel = path.relative(cwd, neighborAbs).replace(/\\/g, '/');
+        const idx = relToIdx.get(neighborRel);
+        if (idx !== undefined && scored[idx].file !== file) {
+          scored[idx].score += GRAPH_BOOST_AMOUNTS.callHop;
+          scored[idx].signals.callGraphBoost = (scored[idx].signals.callGraphBoost || 0) + GRAPH_BOOST_AMOUNTS.callHop;
+        }
+      }
+    }
+  }
+
   // Compute confidence levels based on score distribution
   if (scored.length > 0) {
     const scores = scored.map(s => s.score);