sigmap 8.29.0 → 8.31.0

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.29.0 | Benchmark: sigmap-v8.29-main (2026-09-01)
+# Version: 8.31.0 | Benchmark: sigmap-v8.31-main (2026-09-08)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.29-main, 2026-09-01)
+## Core metrics (benchmark: sigmap-v8.31-main, 2026-09-08)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -132,6 +132,8 @@ sigmap tune                              Recommend config from repo detection
 sigmap tune --apply                      Write the recommendations into gen-context.config.json (merges; your keys preserved)
 sigmap skills list                       List skill clients (Claude/Cursor/Windsurf/Copilot/AGENTS.md) and install state (--json)
 sigmap skills install                    Install the SigMap agent playbooks for detected clients (--client <name> | --all)
+sigmap lines <file> <start>-<end>        Print an exact line range — CLI twin of get_lines (secrets redacted)
+sigmap lines <file> :<line> --context <n>  Window around one signature anchor (default ±10)
 sigmap note "<text>"                     Append a note to the cross-session decision log
 sigmap note                              List recent notes (also: note --list <N>)
 sigmap status                            Show repo state — branch, dirty files, index freshness, notes

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.29.0 | Benchmark: sigmap-v8.29-main (2026-09-01)
+# Version: 8.31.0 | Benchmark: sigmap-v8.31-main (2026-09-08)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.29-main, 2026-09-01)
+## Core metrics (benchmark: sigmap-v8.31-main, 2026-09-08)
 
 - hit@5 retrieval: 81.1% vs 44.0% single-shot grep baseline (1.73× lift)
 - Token reduction: 96.8% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.29.0",
+  "version": "8.31.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {
@@ -31,6 +31,8 @@
     "benchmark:test-discovery": "node scripts/run-test-discovery-benchmark.mjs --save",
     "benchmark:terse": "node scripts/run-terse-benchmark.mjs --save",
     "benchmark:callgraph-boost": "node scripts/run-callgraph-boost-benchmark.mjs --save",
+    "benchmark:callgraph-jvm": "node scripts/run-callgraph-jvm-benchmark.mjs",
+    "validate:callgraph-jvm": "node scripts/run-callgraph-jvm-benchmark.mjs --gate",
     "benchmark:centrality-blend": "node scripts/run-centrality-blend-benchmark.mjs --save",
     "benchmark:surface-enrichment": "node scripts/run-surface-enrichment-benchmark.mjs --save",
     "validate:squeeze": "node scripts/run-squeeze-benchmark.mjs --gate",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.29.0",
+  "version": "8.31.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.29.0",
+  "version": "8.31.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/extractors/java.js

@@ -1,6 +1,19 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
+
+// Class bodies are scanned to this many characters. Generated JVM sources
+// (MyBatis/JPA entities) routinely run past 10KB, so the ceiling only guards
+// against pathological input rather than trimming ordinary classes.
+const MAX_CLASS_BODY_CHARS = 200000;
+
+// Per-class member ceiling. Sits above the default `maxSigsPerFile` so the
+// caller's configured budget governs the output rather than this file.
+const MAX_MEMBERS_PER_CLASS = 120;
+
+// Per-file signature ceiling, likewise above the configured default.
+const MAX_SIGS_PER_FILE = 200;
 
 /**
  * Extract signatures from Java source code.
@@ -28,17 +41,20 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(hinted(withAnchor(`${m[1]} ${m[2]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)), m[2]));
     for (const meth of extractMembers(block)) {
-      sigs.push(hinted(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + meth.declIdx), lineAt(stripped, bodyStart + meth.endIdx)), meth.name));
+      // The disclosure marker carries no offsets; anchor it at the class body.
+      const declIdx = meth.declIdx || 0;
+      const endIdx = meth.endIdx || 0;
+      sigs.push(hinted(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + declIdx), lineAt(stripped, bodyStart + endIdx)), meth.name));
     }
   }
 
-  return sigs.slice(0, 25);
+  return capWithNotice(sigs, MAX_SIGS_PER_FILE, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
   let depth = 1;
   let i = startIndex;
-  const end = Math.min(src.length, startIndex + 5000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;
@@ -60,7 +76,7 @@ function extractMembers(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return members.slice(0, 8);
+  return capMembersWithNotice(members, MAX_MEMBERS_PER_CLASS);
 }
 
 function normalizeParams(params) {

package/src/graph/builder.js

@@ -434,24 +434,60 @@ function build(files, cwd, ctx) {
   return { forward, reverse };
 }
 
+// Directory names assumed when neither the caller nor the project config says
+// otherwise. A Maven/Gradle module (`mall-portal/`, `service-api/`) matches none
+// of them, which is why the config is consulted first.
+const DEFAULT_SRC_DIRS = ['src', 'app', 'lib', 'R', 'inst'];
+
+// Walk depth measured from EACH srcDir root, not from cwd — so this is not the
+// same quantity as the extractor's cwd-relative `maxDepth` and must not be read
+// from it. A standard Maven tree reaches `src/main/java/<group>/<artifact>/…`
+// nine directories below its module root, so the previous ceiling of 8 silently
+// dropped the deepest packages (on macrozheng/mall: every `service/impl/` class).
+const DEFAULT_WALK_DEPTH = 12;
+
+/**
+ * Source directories declared in the project's own config, or null when there
+ * is no readable config. Read directly rather than through `loadConfig`, which
+ * can fetch `extends` over the network and spawn a child process — neither is
+ * acceptable inside a graph build.
+ */
+function _configuredSrcDirs(cwd) {
+  try {
+    const raw = fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8');
+    const cfg = JSON.parse(raw);
+    if (Array.isArray(cfg.srcDirs) && cfg.srcDirs.length > 0) return cfg.srcDirs;
+  } catch (_) { /* absent or unparsable — fall back to the defaults */ }
+  return null;
+}
+
 /**
  * Build a dependency graph scoped to a single cwd by walking all JS/TS/Py/Go
  * files under srcDirs. Useful for the MCP tool handler.
  *
+ * srcDirs resolution order: explicit `opts.srcDirs` → `gen-context.config.json`
+ * → DEFAULT_SRC_DIRS. Without the config step the graph is empty on any repo
+ * whose sources do not sit under a conventionally-named directory.
+ *
  * @param {string} cwd
  * @param {object} [opts]
  * @param {string[]} [opts.srcDirs]
  * @param {string[]} [opts.exclude]
+ * @param {number}   [opts.maxDepth] - walk depth from each srcDir root
  * @returns {{ forward: Map<string,string[]>, reverse: Map<string,string[]> }}
  */
 function buildFromCwd(cwd, opts) {
   // R-package layouts use `R/` and `inst/`; Shiny apps put helpers in `R/`.
   // The existence check below makes these no-ops in non-R projects.
-  const { srcDirs = ['src', 'app', 'lib', 'R', 'inst'], exclude = ['node_modules', '.git', 'dist', 'build'] } = opts || {};
+  const {
+    srcDirs = _configuredSrcDirs(cwd) || DEFAULT_SRC_DIRS,
+    exclude = ['node_modules', '.git', 'dist', 'build'],
+    maxDepth = DEFAULT_WALK_DEPTH,
+  } = opts || {};
   const excludeSet = new Set(exclude);
 
   function walkDir(dir, depth) {
-    if (depth > 8) return [];
+    if (depth > maxDepth) return [];
     let entries;
     try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return []; }
     const out = [];
@@ -500,4 +536,4 @@ function buildFromCwd(cwd, opts) {
   return build(files, cwd, ctx);
 }
 
-module.exports = { build, buildFromCwd, extractFileDeps, normalizePath, loadAliasMap, resolveAlias };
+module.exports = { build, buildFromCwd, extractFileDeps, normalizePath, loadAliasMap, resolveAlias, _configuredSrcDirs, DEFAULT_SRC_DIRS, DEFAULT_WALK_DEPTH };

package/src/graph/call-graph.js

@@ -248,6 +248,44 @@ function goDefs(masked) {
 // Java: methods + constructors with braced bodies. Statement-shaped matches
 // (calls, control flow) are rejected because their `)` is followed by `;`,
 // and keyword headers (`if`, `while`, …) fall to the NON_CALL guard.
+// Words that can precede `name(` in a STATEMENT, so their presence means the
+// line is not a method declaration.
+const STMT_KEYWORDS = new Set([
+  'return', 'throw', 'else', 'do', 'try', 'case', 'yield', 'assert', 'new',
+  'if', 'while', 'for', 'switch', 'catch', 'synchronized', 'instanceof', 'await',
+]);
+
+// Types a Java class declares it implements or extends, with generic arguments
+// stripped and any package qualifier dropped: `implements Foo<Bar, Baz>` yields
+// ['Foo'], never 'Baz>'. Also records whether the class is a Spring bean and
+// whether it is @Primary, which is what disambiguates several implementations.
+function javaTypeDecl(masked) {
+  const m = /(?:^|\n)[^\n]*?\bclass\s+([A-Za-z_$][\w$]*)([^{]*)\{/.exec(masked);
+  if (!m) return null;
+  const [, className, tail] = m;
+  const supers = [];
+  for (const kw of ['implements', 'extends']) {
+    const k = new RegExp('\\b' + kw + '\\s+([^{]*?)(?=\\b(?:implements|extends)\\b|$)').exec(tail);
+    if (!k) continue;
+    let depth = 0;
+    let cur = '';
+    for (const ch of k[1]) {
+      if (ch === '<') { depth++; continue; }
+      if (ch === '>') { depth--; continue; }
+      if (ch === ',' && depth === 0) { if (cur.trim()) supers.push(cur.trim()); cur = ''; continue; }
+      if (depth === 0) cur += ch;
+    }
+    if (cur.trim()) supers.push(cur.trim());
+  }
+  const head = masked.slice(0, m.index + m[0].length);
+  return {
+    className,
+    supers: supers.map((t) => t.split('.').pop().trim()).filter(Boolean),
+    isBean: /@(Service|Component|Repository|Controller|RestController)\b/.test(head),
+    isPrimary: /@Primary\b/.test(head),
+  };
+}
+
 function javaDefs(masked) {
   const defs = [];
   const seen = new Set();
@@ -264,11 +302,24 @@ function javaDefs(masked) {
     // skip `throws A, B` up to the body `{` (same line — multi-line headers are skipped)
     let k = close + 1;
     while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n' && masked[k] !== '=') k++;
-    if (masked[k] !== '{') continue;
+    // A `;` here is an interface or abstract method DECLARATION. It owns no body,
+    // so it emits no calls — but in Spring the declared interface is what callers
+    // name, so without it as a node every controller→service edge has no target.
+    // Recorded with an empty body range: can receive edges, never produces them.
+    // `before` is everything between line start and the method name. A real
+    // declaration has modifiers or a return type there (`void chargeCard(`);
+    // a call statement has only whitespace (`identity(1);`) or a statement
+    // keyword (`return helper(a);`) — neither may be read as a declaration,
+    // or the call resolves to a phantom local def instead of the real target.
+    const headWord = (before.match(/([A-Za-z_$][\w$]*)\s*$/) || [])[1];
+    const isDecl = masked[k] === ';' && /\S/.test(before) && !STMT_KEYWORDS.has(headWord);
+    if (masked[k] !== '{' && !isDecl) continue;
     const key = name + ':' + k;
     if (seen.has(key)) continue;
     seen.add(key);
-    defs.push({ name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
+    defs.push(isDecl
+      ? { name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: k }
+      : { name, line: lineAt(masked, m.index + 1), bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') });
   }
   return defs;
 }
@@ -322,7 +373,7 @@ function callsInRange(masked, start, end) {
   const re = /([A-Za-z_$][\w$]*)\s*\(/g;
   let m;
   while ((m = re.exec(slice)) !== null) {
-    // skip a `.name(` method access (can't resolve the receiver deterministically)
+    // skip a `.name(` method access — resolved separately via receiverCallsInRange
     const before = slice[m.index - 1];
     if (before === '.') continue;
     if (!NON_CALL.has(m[1])) names.add(m[1]);
@@ -330,16 +381,75 @@ function callsInRange(masked, start, end) {
   return names;
 }
 
+// Collect `receiver.method(` pairs within [start,end). A chained or computed
+// receiver (`a.b().c(`, `arr[0].c(`) is skipped: only a plain identifier can be
+// looked up in the declaration map, and guessing is worse than no edge.
+function receiverCallsInRange(masked, start, end) {
+  const slice = masked.slice(start, end);
+  const out = [];
+  const re = /([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)\s*\(/g;
+  let m;
+  while ((m = re.exec(slice)) !== null) {
+    const before = slice[m.index - 1];
+    if (before === '.' || before === ')' || before === ']') continue;
+    if (NON_CALL.has(m[2])) continue;
+    out.push({ receiver: m[1], method: m[2] });
+  }
+  return out;
+}
+
+// `private UserService userService;` / `UserService svc = new UserService();`
+// / `for (OmsOrderItem item : list)` → { userService: 'UserService', … }.
+// Declarations only: a bare assignment carries no type and is not inferred.
+const DECL_RE = /(?:^|[;{}(,\n])\s*(?:(?:public|private|protected|static|final|volatile|transient)\s+)*([A-Z][\w$]*)(?:\s*<[^>;=(){}]*>)?(?:\s*\[\s*\])?\s+([a-z_$][\w$]*)\s*(?=[;=:)])/g;
+
+function buildTypeMap(masked) {
+  const map = new Map();
+  let m;
+  DECL_RE.lastIndex = 0;
+  while ((m = DECL_RE.exec(masked)) !== null) {
+    const [, type, name] = m;
+    if (JVM_KEYWORDS.has(type) || JVM_KEYWORDS.has(name)) continue;
+    if (!map.has(name)) map.set(name, type);   // first declaration wins — deterministic
+  }
+  return map;
+}
+
+// Type names that are never a user class, so never a resolvable receiver type.
+const JVM_KEYWORDS = new Set([
+  'return', 'new', 'if', 'else', 'for', 'while', 'switch', 'case', 'throw', 'catch',
+  'String', 'Integer', 'Long', 'Boolean', 'Double', 'Float', 'Object', 'List', 'Map',
+  'Set', 'Collection', 'Optional', 'Override', 'Autowired', 'Resource', 'Deprecated',
+]);
+
 // ── Public API ───────────────────────────────────────────────────────────────
 
-function _walk(dir, excludeSet, out, depth) {
-  if (depth > 8) return;
+// Walk depth from each srcDir root (not from cwd). A Maven module reaches
+// `src/main/java/<group>/<artifact>/service/impl` nine directories down, so the
+// previous ceiling of 8 never saw the classes that own the method bodies.
+const DEFAULT_WALK_DEPTH = 12;
+
+/**
+ * Source directories declared in the project's own config, or null. Read
+ * directly rather than through `loadConfig`, which can fetch `extends` over the
+ * network and spawn a child process — neither belongs inside a graph build.
+ */
+function _configuredSrcDirs(cwd) {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8'));
+    if (Array.isArray(cfg.srcDirs) && cfg.srcDirs.length > 0) return cfg.srcDirs;
+  } catch (_) { /* absent or unparsable — fall back to the defaults */ }
+  return null;
+}
+
+function _walk(dir, excludeSet, out, depth, maxDepth) {
+  if (depth > (maxDepth === undefined ? DEFAULT_WALK_DEPTH : maxDepth)) return;
   let entries;
   try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
   for (const e of entries) {
     if (excludeSet.has(e.name) || e.name.startsWith('.')) continue;
     const full = path.join(dir, e.name);
-    if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
+    if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1, maxDepth);
     else if (e.isFile()) {
       const ext = path.extname(e.name).toLowerCase();
       if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
@@ -365,9 +475,13 @@ function buildCallGraph(cwd, opts = {}) {
   const excludeSet = new Set(opts.exclude || ['node_modules', '.git', 'dist', 'build', 'coverage', 'vendor']);
   let files = opts.files ? opts.files.map((f) => path.resolve(f)) : [];
   if (!opts.files) {
-    for (const sd of (opts.srcDirs || ['src', 'app', 'lib'])) {
+    // Same resolution order as the dependency graph (#560): explicit opts →
+    // the project's own config → the historical defaults. Without the config
+    // step this is empty on any repo whose sources are not under src/app/lib.
+    const srcDirs = opts.srcDirs || _configuredSrcDirs(cwd) || ['src', 'app', 'lib'];
+    for (const sd of srcDirs) {
       const abs = path.resolve(cwd, sd);
-      if (fs.existsSync(abs)) _walk(abs, excludeSet, files, 0);
+      if (fs.existsSync(abs)) _walk(abs, excludeSet, files, 0, opts.maxDepth);
     }
   }
 
@@ -381,6 +495,44 @@ function buildCallGraph(cwd, opts = {}) {
   const normToAbs = new Map();      // normalized abs → abs
   const defs = new Map();           // symbolId → {file,name,line}
 
+  // JVM convention: a public type lives in a file of the same name. This is the
+  // deterministic type→file mapping receiver resolution needs, with no AST.
+  const fileByTypeName = new Map();   // 'UserService' → [absFile]
+  for (const f of files) {
+    const ext = path.extname(f).toLowerCase();
+    if (JAVA_EXTS.has(ext)) {
+      const base = path.basename(f, path.extname(f));
+      if (!fileByTypeName.has(base)) fileByTypeName.set(base, []);
+      fileByTypeName.get(base).push(f);
+    }
+  }
+
+  // interface/superclass name → implementing files, for the Spring hop below.
+  const implsByType = new Map();     // 'PaymentService' → [{ file, isBean, isPrimary }]
+  for (const f of files) {
+    if (!JAVA_EXTS.has(path.extname(f).toLowerCase())) continue;
+    let decl;
+    try { decl = javaTypeDecl(maskJs(fs.readFileSync(f, 'utf8'))); } catch (_) { continue; }
+    if (!decl) continue;
+    for (const sup of decl.supers) {
+      if (!implsByType.has(sup)) implsByType.set(sup, []);
+      implsByType.get(sup).push({ file: f, isBean: decl.isBean, isPrimary: decl.isPrimary });
+    }
+  }
+
+  /**
+   * The single implementing file for a type, or null when it is ambiguous.
+   * One implementation resolves outright; several resolve only via @Primary.
+   * Anything still ambiguous yields no edge — polymorphism is not guessed.
+   */
+  const soleImpl = (typeName) => {
+    const cands = implsByType.get(typeName) || [];
+    if (cands.length === 1) return cands[0].file;
+    const primary = cands.filter((c) => c.isPrimary);
+    if (primary.length === 1) return primary[0].file;
+    return null;
+  };
+
   for (const f of files) {
     normToAbs.set(normalizePath(path.resolve(f)), path.resolve(f));
     let src;
@@ -400,12 +552,20 @@ function buildCallGraph(cwd, opts = {}) {
 
   const forward = new Map();
   const reverse = new Map();
-  const addEdge = (from, to) => {
+  // Additive: `forward`/`reverse` keep their existing shape, so every current
+  // consumer is unaffected. Confidence is looked up by "from\u0000to".
+  const edgeConfidence = new Map();
+  const addEdge = (from, to, confidence) => {
     if (from === to) return;
     if (!forward.has(from)) forward.set(from, new Set());
     forward.get(from).add(to);
     if (!reverse.has(to)) reverse.set(to, new Set());
     reverse.get(to).add(from);
+    if (confidence) {
+      const k = from + '\u0000' + to;
+      // A 'high' resolution never loses to a later 'medium' one.
+      if (edgeConfidence.get(k) !== 'high') edgeConfidence.set(k, confidence);
+    }
   };
 
   for (const [f, fileDefs] of perFileDefs.entries()) {
@@ -423,16 +583,59 @@ function buildCallGraph(cwd, opts = {}) {
         .sort();
       importedAbs.push(...siblings);
     }
+    // Receiver types come from declarations anywhere in the file: fields are
+    // declared outside any method body, locals inside one.
+    const typeMap = JAVA_EXTS.has(ext) ? buildTypeMap(masked) : null;
+    // Types reachable from this file, by name — imports first, then same-package
+    // siblings, so an import always wins over a coincidental sibling name.
+    const scopeByTypeName = new Map();
+    if (typeMap) {
+      for (const imp of importedAbs) {
+        const base = path.basename(imp, path.extname(imp));
+        if (!scopeByTypeName.has(base)) scopeByTypeName.set(base, imp);
+      }
+    }
+
     for (const d of fileDefs) {
       const callerId = symId(cwd, f, d.name);
       if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
       const callees = callsInRange(masked, d.bodyStart, d.bodyEnd);
       for (const nm of callees) {
         const local = (defsByName.get(f) || new Map()).get(nm);
-        if (local && local.length) { for (const id of local) addEdge(callerId, id); continue; }
+        if (local && local.length) { for (const id of local) addEdge(callerId, id, 'high'); continue; }
         for (const imp of importedAbs) {
           const ids = (defsByName.get(imp) || new Map()).get(nm);
-          if (ids && ids.length) { for (const id of ids) addEdge(callerId, id); break; }
+          if (ids && ids.length) { for (const id of ids) addEdge(callerId, id, 'high'); break; }
+        }
+      }
+
+      // `receiver.method(` — resolve the receiver's declared type to a file.
+      if (!typeMap) continue;
+      for (const { receiver, method } of receiverCallsInRange(masked, d.bodyStart, d.bodyEnd)) {
+        // A receiver that is itself a type name is a static call: `Foo.bar()`.
+        const typeName = typeMap.get(receiver)
+          || (fileByTypeName.has(receiver) ? receiver : null);
+        if (!typeName) continue;                 // unknown receiver → no edge, never a guess
+
+        let target = scopeByTypeName.get(typeName);
+        let confidence = 'high';                 // typed receiver, resolved in scope
+        if (!target) {
+          const candidates = fileByTypeName.get(typeName) || [];
+          if (candidates.length !== 1) continue; // ambiguous or absent → no edge
+          target = candidates[0];
+          confidence = 'medium';                 // type known, but not in this file's scope
+        }
+        const ids = (defsByName.get(target) || new Map()).get(method);
+        if (ids && ids.length) for (const id of ids) addEdge(callerId, id, confidence);
+
+        // Spring: the call names the interface, but the code that runs — and
+        // that a reviewer changes — lives in the implementation. Both edges are
+        // true, so both are recorded; without the second, blast radius on an
+        // implementation is empty.
+        const implFile = soleImpl(typeName);
+        if (implFile && implFile !== target) {
+          const implIds = (defsByName.get(implFile) || new Map()).get(method);
+          if (implIds && implIds.length) for (const id of implIds) addEdge(callerId, id, confidence);
         }
       }
     }
@@ -443,7 +646,7 @@ function buildCallGraph(cwd, opts = {}) {
     for (const [k, set] of mapOfSets.entries()) out.set(k, [...set]);
     return out;
   };
-  return { forward: toArr(forward), reverse: toArr(reverse), defs };
+  return { forward: toArr(forward), reverse: toArr(reverse), defs, edgeConfidence };
 }
 
 /**
@@ -565,7 +768,7 @@ function formatCallGraphJSON(result, kind) {
 }
 
 module.exports = {
-  buildCallGraph, buildCallFileGraph, methodImpact, methodCallees,
+  buildCallGraph, buildTypeMap, receiverCallsInRange, javaTypeDecl, DEFAULT_WALK_DEPTH, buildCallFileGraph, methodImpact, methodCallees,
   formatCallGraph, formatCallGraphJSON,
   extractDefs, maskJs, maskPy, maskRust,
 };

package/src/mcp/install.js

@@ -17,6 +17,7 @@ const os   = require('os');
 
 // Config shapes the supported clients use.
 //  - 'json'  → { mcpServers: { sigmap: { command, args } } }
+//  - 'vscode'→ { servers: { sigmap: { type: 'stdio', command, args } } }
 //  - 'zed'   → { context_servers: { sigmap: { command: { path, args } } } }
 //  - 'yaml'  → Codex CLI ~/.codex/config.yaml (mcpServers block, appended)
 const CLIENTS = {
@@ -25,7 +26,7 @@ const CLIENTS = {
   windsurf: { label: 'Windsurf',     format: 'json', scope: 'both',
               project: ['.windsurf', 'mcp.json'],
               global:  ['.codeium', 'windsurf', 'mcp_config.json'] },
-  vscode:   { label: 'VS Code',      format: 'json', scope: 'project', project: ['.vscode', 'mcp.json'] },
+  vscode:   { label: 'VS Code',      format: 'vscode', scope: 'project', project: ['.vscode', 'mcp.json'] },
   opencode: { label: 'OpenCode',     format: 'json', scope: 'both',
               project: ['opencode.json'],
               global:  ['.config', 'opencode', 'config.json'] },
@@ -80,6 +81,31 @@ function _installJson(filePath, scriptPath) {
   return 'installed';
 }
 
+/**
+ * Install into VS Code's `.vscode/mcp.json`, which keys servers under `servers`
+ * (not `mcpServers`) and expects an explicit transport `type`. A config written
+ * by an older SigMap under `mcpServers` is migrated rather than left in place,
+ * so re-running repairs it instead of leaving two entries VS Code cannot read.
+ */
+function _installVscode(filePath, scriptPath) {
+  let settings = {};
+  if (fs.existsSync(filePath)) {
+    try { settings = JSON.parse(fs.readFileSync(filePath, 'utf8')) || {}; }
+    catch (_) { settings = {}; }
+  }
+  const stale = settings.mcpServers && settings.mcpServers.sigmap;
+  if (stale) {
+    delete settings.mcpServers.sigmap;
+    if (Object.keys(settings.mcpServers).length === 0) delete settings.mcpServers;
+  }
+  if (!settings.servers) settings.servers = {};
+  if (settings.servers.sigmap && !stale) return 'already';
+  settings.servers.sigmap = { type: 'stdio', command: 'node', args: serverArgs(scriptPath) };
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + '\n');
+  return stale ? 'updated' : 'installed';
+}
+
 /** Install into Zed's `context_servers` config (create file/dir if absent). */
 function _installZed(filePath, scriptPath) {
   let settings = {};
@@ -132,7 +158,8 @@ function installClient(client, opts = {}) {
   const filePath   = resolveTarget(spec, cwd, home, opts.global);
 
   let status;
-  if (spec.format === 'zed')       status = _installZed(filePath, scriptPath);
+  if (spec.format === 'vscode')    status = _installVscode(filePath, scriptPath);
+  else if (spec.format === 'zed')  status = _installZed(filePath, scriptPath);
   else if (spec.format === 'yaml') status = _installYaml(filePath, scriptPath);
   else                             status = _installJson(filePath, scriptPath);
 

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.29.0',
+  version: '8.31.0',
   description: 'SigMap MCP server — code signatures on demand',
 };