sigmap 8.5.0 → 8.7.0

package/CHANGELOG.md

@@ -10,6 +10,25 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.7.0] — 2026-07-05
+
+Minor release — **method/caller-level call-graph (D4 v1): the graph goes from files to functions.** SigMap's dependency graph was file-level only (imports → `--impact`/`get_impact`). This adds **symbol-level** edges — *which function calls which function* — and the **method-level blast radius** of changing a single symbol. Deterministic, zero-dependency, JS/TS + Python. This is the plan's single hardest unbuilt gap and the biggest remaining lever on graph intelligence (v9.5 GR1).
+
+### Added
+- **Method/caller-level call-graph (#429, PR #430):** new `src/graph/call-graph.js` builds symbol edges keyed by `relPath#symbol` for **JS/TS + Python**. Definitions are extracted with real body ranges (brace-matching for JS, indentation for Python) over **comment- and string-masked** source, so braces/calls inside literals never create phantom edges. Each call site is resolved with **high precision** — a call binds to a definition of that name in the **same file** first, then in a **directly-imported file** (reusing the existing file-level import graph); names with no repo definition produce **no edge**, avoiding global name-collision noise. Public API: `buildCallGraph(cwd)` → `{ forward, reverse, defs }`, `methodImpact(symbol)` (transitive callers = method blast radius), `methodCallees(symbol)` (what it transitively calls), plus formatters mirroring `src/graph/impact.js`.
+- **`--callers` / `--callees` CLI (#429, PR #430):** `sigmap --callers <symbol>` prints the method-level blast radius (every function that transitively calls `<symbol>`); `sigmap --callees <symbol>` prints what it calls. Both accept a bare name or a `file#symbol` id, support `--json` and `--depth <n>` (0 = unlimited), and mirror the `--impact` command. Documented in `--help`.
+
+## [8.6.0] — 2026-07-05
+
+Minor release — **Phase 1 "bank the A": the grounding moat's supporting surface.** Three master-plan items land together: a self-contained, third-party-runnable benchmark harness (G1), installed dependency version pins in the generated context header (D8), and `verify` promoted to a documented flagship command (G2). All zero-dependency, deterministic, and in-boundary.
+
+### Added
+- **Public benchmark harness (#425, PR #426):** new `public-benchmarks/` — a self-contained, third-party-runnable retrieval harness. `repos.csv` (18 real repos pinned to exact commits), `queries.json` (90 natural-language query → expected-file tasks), `run.sh` (shallow-clones the pinned repos, then scores), `score.mjs` (maps each repo with `gen-context.js`, ranks with the **shipped** identifier-aware BM25 ranker `src/retrieval/bm25.js`, reports hit@1/hit@5/MRR), and a methodology `README.md`. Deterministic — pinned commits + a byte-stable map + rank-only math → the same numbers on any machine; no LLM, no API keys, no external deps. Dev-only (excluded from the npm package). Turns the published retrieval numbers from a claim into a third-party-verifiable fact (v9.0 G1).
+- **Version pins in the context header (#425, PR #426):** the generated header now carries a `## versions (installed direct deps)` block of sorted `name@version` pins for installed JS + Python direct dependencies, so agents reading `CLAUDE.md`/`AGENTS.md` ground against what is **actually installed here** (compounds with the G5/D5 verify moat). New `collectVersionPins(cwd)` in `src/verify/lib-index.js` (versions only — no symbol parsing, cheap enough to run per-build); gated by a new `versionPins` config key (default on). Byte-stable given a fixed installed tree (D8).
+
+### Changed
+- **`sigmap verify` — the grounding flagship (#425, PR #426):** `verify` is now a first-class alias of `verify-ai-output` (identical flags, output, and exit codes), with a dedicated flagship section near the top of the README and a `--help` entry. Positions the deterministic grounding guard — the one capability no agentic-grep loop or competitor offers — as the headline (v9.0 G2).
+
 ## [8.5.0] — 2026-07-05
 
 Minor release — **deterministic query expansion (a vocabulary-mismatch recall aid).** The BM25 ranker now bridges common code-domain synonyms/abbreviations so a query for `authentication` can still surface a file whose signatures only say `auth`. Zero-dependency, deterministic. **Honest framing:** measured on the retrieval benchmark, this is **benchmark-neutral** (hit@5 unchanged within the harness's 86.7–87.8% noise band at the shipped weight) — not a hit@5 improvement. The benefit is for real users whose query vocabulary differs from the code, a case the curated benchmark doesn't exercise.

package/README.md

@@ -52,15 +52,15 @@ That map is exactly what agentic grep is worst at: reproducible, auditable conte
 
 **Deterministic and verifiable — the two things an agentic-grep loop can't give you:**
 - **Deterministic** — no LLM calls, no agent loop; the same repo always produces a byte-identical map you can diff, cache, and gate in CI.
-- **Auditable & grounded** — every file and symbol traces to a real line anchor; `sigmap verify-ai-output` flags any AI claim that isn't.
+- **Auditable & grounded** — every file and symbol traces to a real line anchor; `sigmap verify` flags any AI claim that isn't.
 - **Zero dependencies** — `npx sigmap` on any machine; no embeddings, no vector DB, no hosted service, fully offline.
 
 **Proof it pays off** (full benchmark below):
 <!--SM:whyMetrics-->
-- **86.7% hit@5** — right file found in top 5 results (vs 13.6% baseline)
+- **87.8% hit@5** — right file found in top 5 results (vs 13.6% baseline)
 - **97.0% token reduction** — average across 21 real repos
-- **67.8% task success rate** — up from 10% without context
-- **1.46 prompts per task** — down from 2.84 (48.8% fewer retries)
+- **68.9% task success rate** — up from 10% without context
+- **1.43 prompts per task** — down from 2.84 (49.6% fewer retries)
 <!--/SM:whyMetrics-->
 - **<!--SM:languages-->33<!--/SM:languages--> languages supported** — TypeScript, Python, Go, Rust, Java, R, and more
 - **No vendor lock-in** — works with any AI assistant or local LLM
@@ -69,12 +69,34 @@ That map is exactly what agentic grep is worst at: reproducible, auditable conte
 
 ---
 
+## 🔒 `sigmap verify` — the grounding flagship
+
+The one thing no agentic-grep loop, and no competitor, gives you: **prove an AI answer is anchored to real signatures and line numbers before you trust it.** Deterministic, offline, no LLM — SigMap indexes your repo *plus the libraries actually installed here* and flags every fabricated file, import, symbol, test, or npm script.
+
+```bash
+sigmap verify answer.md                 # ✓ grounded, or a line-by-line list of fabrications
+sigmap verify answer.md --json          # machine-readable report; exits 1 if any issue (CI gate)
+sigmap verify answer.md --report        # standalone red/amber/green HTML report
+```
+
+```text
+[sigmap] ✗ answer.md — 2 issues found
+  fake-file: 1  fake-test-file: 0  fake-import: 0  fake-symbol: 1  fake-npm-script: 0
+
+  L12  [Fake file]    src/auth/session-store.js does not exist
+  L27  [Fake symbol]  authorize() — did you mean authenticate()?
+```
+
+`verify` is the flagship; `verify-ai-output` remains as the full command name. Pair it with `sigmap verify-plan` (check a plan before execution) and the `verify_suggestion` MCP tool (verify AI code against repo + private + installed-library symbols mid-session).
+
+---
+
 ## Replace this with SigMap
 
 | Without SigMap | With SigMap |
 |---|---|
 | ❌ Non-reproducible agent guesses | ✅ Deterministic map — same input, same output, every time |
-| ❌ "Trust me" AI answers | ✅ Grounded — right file in context <!--SM:hitWhole-->87%<!--/SM:hitWhole--> of the time, every symbol on a real line anchor |
+| ❌ "Trust me" AI answers | ✅ Grounded — right file in context <!--SM:hitWhole-->88%<!--/SM:hitWhole--> of the time, every symbol on a real line anchor |
 | ❌ Embeddings / vector DB required | ✅ Zero deps, no infra, fully offline |
 
 ---
@@ -98,13 +120,13 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.5-main (21 repositories, including R language)
-Date      : 2026-07-04
+Benchmark : sigmap-v8.7-main (21 repositories, including R language)
+Date      : 2026-07-05
 
-Hit@5          : 86.7%   (baseline 13.6%  — 6.4× lift)
+Hit@5          : 87.8%   (baseline 13.6%  — 6.5× lift)
 Token reduction: 97.0%   (across 21 repos)
-Prompt reduction : 48.8% (2.84 → 1.46 prompts per task)
-Task success   : 67.8%   (baseline 10%)
+Prompt reduction : 49.6% (2.84 → 1.43 prompts per task)
+Task success   : 68.9%   (baseline 10%)
 Repos tested   : 21 (JavaScript, Python, Go, Rust, Java, R, C++, C#, Dart, Swift, Ruby, PHP, Scala, Kotlin, and more)
 ```
 <!--/SM:benchmarkBlock-->

package/gen-context.js

@@ -1498,6 +1498,9 @@ __factories["./src/config/defaults"] = function(module, exports) {
     // Include a compact import dependency map at top of output
     depMap: true,
 
+    // Include a compact `name@version` list of installed direct deps (D8)
+    versionPins: true,
+
     // Include TODO/FIXME/HACK/XXX comments as compact section
     todos: true,
 
@@ -10450,6 +10453,411 @@ __factories["./src/graph/builder"] = function(module, exports) {
   
 };
 
+// ── ./src/graph/call-graph ──
+__factories["./src/graph/call-graph"] = function(module, exports) {
+  
+  /**
+   * Method/caller-level call-graph (D4 v1).
+   *
+   * Builds symbol-level edges — which function calls which function — for JS/TS
+   * and Python. Deterministic, zero-dependency, regex + brace/indent matching.
+   * Call sites are resolved with high precision: a call resolves to a definition
+   * of that name in the *same file* first, then in a *directly-imported* file
+   * (via the existing file-level import graph). Names that resolve to no repo
+   * definition produce no edge — over-approximation noise is avoided.
+   *
+   * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
+   *
+   * @module src/graph/call-graph
+   */
+
+  const fs = require('fs');
+  const path = require('path');
+  const { build } = __require('./src/graph/builder');
+
+  const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+  const PY_EXTS = new Set(['.py', '.pyw']);
+
+  // Tokens that look like `name(` calls or definition headers but are language
+  // keywords, not user symbols — never treated as a call or a definition.
+  const NON_CALL = new Set([
+    'if', 'for', 'while', 'switch', 'catch', 'return', 'function', 'typeof',
+    'await', 'new', 'super', 'else', 'do', 'with', 'yield', 'void', 'delete',
+    'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
+    'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
+    'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
+  ]);
+
+  function normalizePath(p) { return path.normalize(p).toLowerCase(); }
+  function toRel(cwd, f) { return path.relative(cwd, f).replace(/\\/g, '/'); }
+  function symId(cwd, absFile, name) { return `${toRel(cwd, absFile)}#${name}`; }
+
+  // ── Length- and newline-preserving maskers ──────────────────────────────────
+  // Replace comment / string bodies with spaces so their braces, parens, and
+  // call-looking tokens never confuse structure detection. Offsets stay aligned.
+
+  function maskJs(src) {
+    const out = src.split('');
+    const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+    let i = 0; const n = src.length;
+    while (i < n) {
+      const c = src[i], d = src[i + 1];
+      if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+      if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
+      if (c === '"' || c === "'" || c === '`') {
+        let j = i + 1;
+        while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === c) break; if (c !== '`' && src[j] === '\n') break; j++; }
+        j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+      }
+      i++;
+    }
+    return out.join('');
+  }
+
+  function maskPy(src) {
+    const out = src.split('');
+    const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+    let i = 0; const n = src.length;
+    while (i < n) {
+      const c = src[i];
+      if (c === '#') { let j = i + 1; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+      if (c === '"' || c === "'") {
+        if (src.substr(i, 3) === c + c + c) {
+          let j = i + 3; while (j < n && src.substr(j, 3) !== c + c + c) j++; j = Math.min(n, j + 3); blank(i, j); i = j; continue;
+        }
+        let j = i + 1; while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === c || src[j] === '\n') break; j++; }
+        j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+      }
+      i++;
+    }
+    return out.join('');
+  }
+
+  // ── Balanced-delimiter matchers (operate on masked source) ───────────────────
+  function matchDelim(masked, openIdx, open, close) {
+    let depth = 0;
+    for (let i = openIdx; i < masked.length; i++) {
+      if (masked[i] === open) depth++;
+      else if (masked[i] === close) { depth--; if (depth === 0) return i; }
+    }
+    return masked.length - 1;
+  }
+
+  function lineAt(src, idx) {
+    let line = 1;
+    const end = Math.min(idx, src.length);
+    for (let i = 0; i < end; i++) if (src.charCodeAt(i) === 10) line++;
+    return line;
+  }
+
+  // ── Definition extraction ────────────────────────────────────────────────────
+  // Each def: { name, line, bodyStart, bodyEnd } with char offsets into `masked`.
+
+  function jsDefs(masked) {
+    const defs = [];
+    const seen = new Set();
+    const push = (name, headerIdx, bodyStart, bodyEnd) => {
+      const key = name + ':' + bodyStart;
+      if (NON_CALL.has(name) || seen.has(key)) return;
+      seen.add(key);
+      defs.push({ name, line: lineAt(masked, headerIdx), bodyStart, bodyEnd });
+    };
+
+    // Locate the `{` body (or `=>` expression) that follows a param list `)`.
+    const bodyAfterParams = (closeParen) => {
+      let k = closeParen + 1;
+      // skip a `=>`, return-type annotations, and whitespace up to `{` or a statement end
+      while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n') k++;
+      if (masked[k] === '{') { const end = matchDelim(masked, k, '{', '}'); return { bodyStart: k, bodyEnd: end }; }
+      return null; // no braced body (interface/abstract/overload signature) — skip
+    };
+
+    // 1) function declarations:  (async) function name(...) { ... }
+    const reFn = /\b(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)\s*\(/g;
+    let m;
+    while ((m = reFn.exec(masked)) !== null) {
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      const body = bodyAfterParams(close);
+      if (body) push(m[1], m.index, body.bodyStart, body.bodyEnd);
+    }
+
+    // 2) arrow / function expressions:  const name = (...) => { }  |  = function(...) { }
+    const reArrow = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?(?:function\b\s*\*?\s*[A-Za-z_$]*\s*)?\(/g;
+    while ((m = reArrow.exec(masked)) !== null) {
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      let k = close + 1;
+      while (k < masked.length && /\s/.test(masked[k])) k++;
+      if (masked[k] === '{') { push(m[1], m.index, k, matchDelim(masked, k, '{', '}')); continue; }
+      if (masked[k] === '=' && masked[k + 1] === '>') {
+        let j = k + 2; while (j < masked.length && /\s/.test(masked[j])) j++;
+        if (masked[j] === '{') push(m[1], m.index, j, matchDelim(masked, j, '{', '}'));
+        else { // single-expression arrow body → to end of statement
+          let e = j; let d = 0;
+          while (e < masked.length) { const ch = masked[e]; if (ch === '(' || ch === '[') d++; else if (ch === ')' || ch === ']') d--; else if ((ch === ';' || ch === '\n') && d <= 0) break; e++; }
+          push(m[1], m.index, j, e);
+        }
+      }
+    }
+
+    // 3) class methods:  class X { name(...) { } }
+    const reClass = /\bclass\s+[A-Za-z_$][\w$]*/g;
+    while ((m = reClass.exec(masked)) !== null) {
+      const brace = masked.indexOf('{', m.index);
+      if (brace === -1) continue;
+      const classEnd = matchDelim(masked, brace, '{', '}');
+      const reMethod = /(?:^|\n)\s*(?:public\s+|private\s+|protected\s+|static\s+|readonly\s+|abstract\s+|async\s+|get\s+|set\s+|\*\s*)*([A-Za-z_$][\w$]*)\s*\(/g;
+      reMethod.lastIndex = brace;
+      let mm;
+      while ((mm = reMethod.exec(masked)) !== null && mm.index < classEnd) {
+        const paren = masked.indexOf('(', mm.index + mm[0].length - 1);
+        const close = matchDelim(masked, paren, '(', ')');
+        const body = bodyAfterParams(close);
+        if (body && body.bodyEnd <= classEnd) push(mm[1], mm.index, body.bodyStart, body.bodyEnd);
+      }
+    }
+
+    return defs;
+  }
+
+  function pyDefs(masked) {
+    const defs = [];
+    const lines = masked.split('\n');
+    // precompute char offset of each line start
+    const offsets = [0];
+    for (let i = 0; i < lines.length; i++) offsets.push(offsets[i] + lines[i].length + 1);
+    for (let i = 0; i < lines.length; i++) {
+      const m = lines[i].match(/^([ \t]*)(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/);
+      if (!m) continue;
+      const indent = m[1].length;
+      let j = i + 1;
+      for (; j < lines.length; j++) {
+        const ln = lines[j];
+        if (!ln.trim()) continue;                       // blank
+        const ind = ln.match(/^[ \t]*/)[0].length;
+        if (ind <= indent) break;                        // dedent → block ends
+      }
+      defs.push({ name: m[2], line: i + 1, bodyStart: offsets[i], bodyEnd: offsets[j] || masked.length });
+    }
+    return defs;
+  }
+
+  function extractDefs(filePath, src) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (JS_EXTS.has(ext)) return jsDefs(maskJs(src));
+    if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
+    return null; // unsupported language
+  }
+
+  // Collect `name(` call tokens within [start,end) of masked source.
+  function callsInRange(masked, start, end) {
+    const slice = masked.slice(start, end);
+    const names = new Set();
+    const re = /([A-Za-z_$][\w$]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(slice)) !== null) {
+      // skip a `.name(` method access (can't resolve the receiver deterministically)
+      const before = slice[m.index - 1];
+      if (before === '.') continue;
+      if (!NON_CALL.has(m[1])) names.add(m[1]);
+    }
+    return names;
+  }
+
+  // ── Public API ───────────────────────────────────────────────────────────────
+
+  function _walk(dir, excludeSet, out, depth) {
+    if (depth > 8) return;
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
+    for (const e of entries) {
+      if (excludeSet.has(e.name) || e.name.startsWith('.')) continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
+      else if (e.isFile()) {
+        const ext = path.extname(e.name).toLowerCase();
+        if (JS_EXTS.has(ext) || PY_EXTS.has(ext)) out.push(full);
+      }
+    }
+  }
+
+  /**
+   * Build the method-level call-graph for a project.
+   *
+   * @param {string} cwd
+   * @param {object} [opts]
+   * @param {string[]} [opts.srcDirs=['src','app','lib']]
+   * @param {string[]} [opts.exclude]
+   * @param {string[]} [opts.files]  explicit absolute file list (skips the walk)
+   * @returns {{
+   *   forward: Map<string,string[]>,   // callerId → calleeIds
+   *   reverse: Map<string,string[]>,   // calleeId → callerIds
+   *   defs:    Map<string,{file:string,name:string,line:number}>
+   * }}
+   */
+  function buildCallGraph(cwd, opts = {}) {
+    const excludeSet = new Set(opts.exclude || ['node_modules', '.git', 'dist', 'build', 'coverage', 'vendor']);
+    let files = opts.files ? opts.files.map((f) => path.resolve(f)) : [];
+    if (!opts.files) {
+      for (const sd of (opts.srcDirs || ['src', 'app', 'lib'])) {
+        const abs = path.resolve(cwd, sd);
+        if (fs.existsSync(abs)) _walk(abs, excludeSet, files, 0);
+      }
+    }
+
+    // File-level import graph (for precise call-site resolution). Keys normalized.
+    let fileGraph;
+    try { fileGraph = build(files, cwd); } catch (_) { fileGraph = { forward: new Map() }; }
+
+    // Per-file definitions + name→file lookups.
+    const perFileDefs = new Map();   // absFile → def[]
+    const defsByName = new Map();     // absFile → Map<name, symbolId[]>
+    const normToAbs = new Map();      // normalized abs → abs
+    const defs = new Map();           // symbolId → {file,name,line}
+
+    for (const f of files) {
+      normToAbs.set(normalizePath(path.resolve(f)), path.resolve(f));
+      let src;
+      try { src = fs.readFileSync(f, 'utf8'); } catch (_) { continue; }
+      const fileDefs = extractDefs(f, src);
+      if (!fileDefs) continue;
+      perFileDefs.set(f, fileDefs);
+      const byName = new Map();
+      for (const d of fileDefs) {
+        const id = symId(cwd, f, d.name);
+        defs.set(id, { file: toRel(cwd, f), name: d.name, line: d.line });
+        if (!byName.has(d.name)) byName.set(d.name, []);
+        byName.get(d.name).push(id);
+      }
+      defsByName.set(f, byName);
+    }
+
+    const forward = new Map();
+    const reverse = new Map();
+    const addEdge = (from, to) => {
+      if (from === to) return;
+      if (!forward.has(from)) forward.set(from, new Set());
+      forward.get(from).add(to);
+      if (!reverse.has(to)) reverse.set(to, new Set());
+      reverse.get(to).add(from);
+    };
+
+    for (const [f, fileDefs] of perFileDefs.entries()) {
+      const masked = JS_EXTS.has(path.extname(f).toLowerCase()) ? maskJs(fs.readFileSync(f, 'utf8')) : maskPy(fs.readFileSync(f, 'utf8'));
+      // resolution scope: this file's defs, then directly-imported files' defs
+      const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
+        .map((nf) => normToAbs.get(nf)).filter(Boolean);
+      for (const d of fileDefs) {
+        const callerId = symId(cwd, f, d.name);
+        if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
+        const callees = callsInRange(masked, d.bodyStart, d.bodyEnd);
+        for (const nm of callees) {
+          const local = (defsByName.get(f) || new Map()).get(nm);
+          if (local && local.length) { for (const id of local) addEdge(callerId, id); continue; }
+          for (const imp of importedAbs) {
+            const ids = (defsByName.get(imp) || new Map()).get(nm);
+            if (ids && ids.length) { for (const id of ids) addEdge(callerId, id); break; }
+          }
+        }
+      }
+    }
+
+    const toArr = (mapOfSets) => {
+      const out = new Map();
+      for (const [k, set] of mapOfSets.entries()) out.set(k, [...set]);
+      return out;
+    };
+    return { forward: toArr(forward), reverse: toArr(reverse), defs };
+  }
+
+  // Resolve a user-supplied symbol (bare name or full `file#name` id) to ids.
+  function _resolveSymbol(symbol, defs) {
+    if (defs.has(symbol)) return [symbol];
+    const ids = [];
+    for (const id of defs.keys()) if (id.slice(id.indexOf('#') + 1) === symbol) ids.push(id);
+    return ids;
+  }
+
+  // BFS over a graph map from seed ids up to maxDepth (0 = unlimited).
+  function _bfs(seedIds, graph, maxDepth) {
+    const direct = new Set();
+    const transitive = new Set();
+    const visited = new Set(seedIds);
+    let frontier = [];
+    for (const s of seedIds) for (const nb of (graph.get(s) || [])) if (!visited.has(nb)) { direct.add(nb); visited.add(nb); frontier.push(nb); }
+    let depth = 1;
+    while (frontier.length && (maxDepth === 0 || depth < maxDepth)) {
+      const next = [];
+      for (const node of frontier) for (const nb of (graph.get(node) || [])) if (!visited.has(nb)) { transitive.add(nb); visited.add(nb); next.push(nb); }
+      frontier = next; depth++;
+    }
+    return { direct: [...direct], transitive: [...transitive] };
+  }
+
+  /**
+   * Method-level blast radius: everything that (transitively) calls `symbol`.
+   *
+   * @param {string} symbol  bare name or `file#name`
+   * @param {string} cwd
+   * @param {object} [opts]  { depth=0, ...buildCallGraph opts }
+   * @returns {{ symbol:string, resolved:string[], direct:string[], transitive:string[], total:number, unresolved:boolean }}
+   */
+  function methodImpact(symbol, cwd, opts = {}) {
+    const graph = opts.graph || buildCallGraph(cwd, opts);
+    const ids = _resolveSymbol(symbol, graph.defs);
+    if (ids.length === 0) return { symbol, resolved: [], direct: [], transitive: [], total: 0, unresolved: true };
+    const { direct, transitive } = _bfs(ids, graph.reverse, opts.depth || 0);
+    return { symbol, resolved: ids, direct, transitive, total: direct.length + transitive.length, unresolved: false };
+  }
+
+  /**
+   * What `symbol` (transitively) calls.
+   * @returns {{ symbol:string, resolved:string[], direct:string[], transitive:string[], total:number, unresolved:boolean }}
+   */
+  function methodCallees(symbol, cwd, opts = {}) {
+    const graph = opts.graph || buildCallGraph(cwd, opts);
+    const ids = _resolveSymbol(symbol, graph.defs);
+    if (ids.length === 0) return { symbol, resolved: [], direct: [], transitive: [], total: 0, unresolved: true };
+    const { direct, transitive } = _bfs(ids, graph.forward, opts.depth || 0);
+    return { symbol, resolved: ids, direct, transitive, total: direct.length + transitive.length, unresolved: false };
+  }
+
+  // ── Formatters ───────────────────────────────────────────────────────────────
+  function formatCallGraph(result, kind) {
+    const verb = kind === 'callees' ? 'calls' : 'callers of';
+    const lines = [`## ${kind === 'callees' ? 'Callees' : 'Callers'}: \`${result.symbol}\``, ''];
+    if (result.unresolved) { lines.push('_symbol not found in the call-graph._'); return lines.join('\n'); }
+    if (result.total === 0) {
+      lines.push(kind === 'callees' ? '_calls no repo-defined symbols._' : '_no repo symbol calls this — zero method blast radius._');
+      return lines.join('\n');
+    }
+    lines.push(`**Total ${verb}:** ${result.total}`, '');
+    if (result.direct.length) { lines.push(`### Direct`); for (const id of result.direct) lines.push(`- \`${id}\``); lines.push(''); }
+    if (result.transitive.length) { lines.push(`### Transitive`); for (const id of result.transitive) lines.push(`- \`${id}\``); lines.push(''); }
+    return lines.join('\n');
+  }
+
+  function formatCallGraphJSON(result, kind) {
+    return {
+      symbol: result.symbol,
+      kind: kind === 'callees' ? 'callees' : 'callers',
+      resolved: result.resolved,
+      direct: result.direct,
+      transitive: result.transitive,
+      total: result.total,
+      unresolved: result.unresolved,
+    };
+  }
+
+  module.exports = {
+    buildCallGraph, methodImpact, methodCallees,
+    formatCallGraph, formatCallGraphJSON,
+    extractDefs, maskJs, maskPy,
+  };
+  
+};
+
 // ── ./src/graph/impact ──
 __factories["./src/graph/impact"] = function(module, exports) {
   
@@ -13108,7 +13516,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.5.0',
+    version: '8.7.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -17311,8 +17719,37 @@ __factories["./src/verify/lib-index"] = function(module, exports) {
       .map((l) => `${l.name}@${l.version}`);
   }
 
+  /**
+   * D8: collect `name@version` pins for direct dependencies — versions only, no
+   * symbol extraction, no cache. Cheap enough to run on every context build so
+   * the generated header can ground against what is actually installed (JS +
+   * Python). Deterministic: sorted, then capped.
+   * @param {string} cwd
+   * @param {object} [opts]
+   * @param {number} [opts.limit=40] max pins returned (after sort)
+   * @returns {{ pins: string[], total: number }} pins capped to limit; total = all resolved
+   */
+  function collectVersionPins(cwd, opts = {}) {
+    const limit = Number.isInteger(opts.limit) && opts.limit >= 0 ? opts.limit : 40;
+    const pins = [];
+    for (const dep of directDeps(cwd).slice(0, MAX_DEPS)) {
+      const r = resolveEntry(cwd, dep);
+      if (r && r.version) pins.push(`${dep}@${r.version}`);
+    }
+    const sitePkgs = findSitePackages(cwd);
+    if (sitePkgs.length) {
+      for (const dep of pythonDirectDeps(cwd).slice(0, MAX_DEPS)) {
+        const r = resolvePyEntry(sitePkgs, dep);
+        if (r && r.version) pins.push(`${dep}@${r.version}`);
+      }
+    }
+    pins.sort();
+    return { pins: limit ? pins.slice(0, limit) : pins, total: pins.length };
+  }
+
   module.exports = {
     buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, formatVersionPins,
+    collectVersionPins,
     extractPyExports, pythonDirectDeps, findSitePackages, resolvePyEntry,
   };
   
@@ -17647,7 +18084,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.5.0';
+const VERSION = '8.7.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -18250,6 +18687,23 @@ function formatOutput(fileEntries, cwd, routingEnabled, config, extras) {
     lines.push('');
   }
 
+  // D8: installed direct-dependency version pins — grounds agents against what
+  // is actually installed here (byte-stable given a fixed installed tree).
+  if (!config || config.versionPins !== false) {
+    try {
+      const { collectVersionPins } = requireSourceOrBundled('./src/verify/lib-index');
+      const { pins, total } = collectVersionPins(cwd);
+      if (pins.length) {
+        lines.push('## versions (installed direct deps)');
+        lines.push('```');
+        lines.push(...pins);
+        if (total > pins.length) lines.push(`… +${total - pins.length} more`);
+        lines.push('```');
+        lines.push('');
+      }
+    } catch (_) { /* no/uninstalled deps → skip */ }
+  }
+
   const todoLines = buildTodoSection(fileEntries, cwd, config || {});
   if (todoLines.length) {
     lines.push('## todos');
@@ -19442,9 +19896,13 @@ Usage:
   ${cmd} --impact <file>                   Show every file impacted by changing <file>
   ${cmd} --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
   ${cmd} --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
-  ${cmd} verify-ai-output <answer.md>      Flag fake files/tests/imports/symbols/npm-scripts in an AI answer
-  ${cmd} verify-ai-output <answer.md> --json    Hallucination report as JSON (exits 1 if issues)
-  ${cmd} verify-ai-output <answer.md> --report  Write a standalone HTML report (red/amber/green)
+  ${cmd} --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS + Python)
+  ${cmd} --callees <symbol>                Every repo function that <symbol> (transitively) calls
+  ${cmd} --callers <symbol> --json --depth <n>   Call-graph edges as JSON (depth 0 = unlimited)
+  ${cmd} verify <answer.md>                Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)
+  ${cmd} verify <answer.md> --json         Grounding report as JSON (exits 1 if issues)
+  ${cmd} verify <answer.md> --report       Write a standalone HTML report (red/amber/green)
+  ${cmd} verify-ai-output <answer.md>      Full command name for ${cmd} verify
   ${cmd} conventions                       Extract repo file-naming/export/test conventions (--conflicts, --inject, --report, --fix)
   ${cmd} scaffold "<name>"                 Propose a convention-matched file/dir scaffold (--ext, --threshold, --force, --json)
   ${cmd} verify-plan <plan.md|->           Check a plan vs the live index — files/symbols exist, blast radius, scope (--json)
@@ -21304,7 +21762,10 @@ function main() {
     process.exit(s.ok ? 0 : 1);
   }
 
-  if (args[0] === 'verify-ai-output') {
+  // `sigmap verify` is the flagship alias for `verify-ai-output` — the grounding
+  // guard that proves an AI answer is anchored to real signatures + line anchors.
+  if (args[0] === 'verify-ai-output' || args[0] === 'verify') {
+    const cmdName = args[0];
     const target = args[1];
     const jsonOut = args.includes('--json');
     const reportIdx = args.indexOf('--report');
@@ -21312,7 +21773,7 @@ function main() {
       ? (args[reportIdx + 1] && !args[reportIdx + 1].startsWith('--') ? args[reportIdx + 1] : 'sigmap-verify-report.html')
       : null;
     if (!target || target.startsWith('--')) {
-      console.error('[sigmap] Usage: sigmap verify-ai-output <answer.md> [--json] [--report [out.html]]');
+      console.error(`[sigmap] Usage: sigmap ${cmdName} <answer.md> [--json] [--report [out.html]]`);
       process.exit(1);
     }
     const absTarget = path.resolve(cwd, target);
@@ -22014,6 +22475,37 @@ function main() {
     process.exit(0);
   }
 
+  // Method-level call-graph (D4): --callers <symbol> = method blast radius,
+  // --callees <symbol> = what it calls. JS/TS + Python, deterministic.
+  if (args.includes('--callers') || args.includes('--callees')) {
+    try {
+      const kind = args.includes('--callees') ? 'callees' : 'callers';
+      const flag = kind === 'callees' ? '--callees' : '--callers';
+      const symbol = (args[args.indexOf(flag) + 1] || '').trim();
+      if (!symbol || symbol.startsWith('--')) {
+        console.error(`[sigmap] ${flag} requires a symbol name (or file#symbol)`);
+        console.error(`  Example: node gen-context.js ${flag} extractFileDeps`);
+        process.exit(1);
+      }
+      const { methodImpact, methodCallees, formatCallGraph, formatCallGraphJSON } = requireSourceOrBundled('./src/graph/call-graph');
+      const depthIdx = args.indexOf('--depth');
+      const depth = depthIdx >= 0 ? Math.max(0, parseInt(args[depthIdx + 1], 10) || 0) : 0;
+      const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length) ? config.srcDirs : undefined;
+      const result = kind === 'callees'
+        ? methodCallees(symbol, cwd, { depth, srcDirs })
+        : methodImpact(symbol, cwd, { depth, srcDirs });
+      if (args.includes('--json')) {
+        process.stdout.write(JSON.stringify(formatCallGraphJSON(result, kind)) + '\n');
+      } else {
+        process.stdout.write(formatCallGraph(result, kind) + '\n');
+      }
+    } catch (err) {
+      console.error(`[sigmap] call-graph error: ${err.message}`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+
   if (args.includes('--report')) {
     if (args.includes('--history')) {
       try {

package/llms-full.txt

@@ -11,20 +11,20 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.5.0 | Benchmark: sigmap-v8.5-main (2026-07-04)
+# Version: 8.7.0 | Benchmark: sigmap-v8.7-main (2026-07-05)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.5-main, 2026-07-04)
+## Core metrics (benchmark: sigmap-v8.7-main, 2026-07-05)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
-| Retrieval hit@5 | 13.6% (random) | 86.7% (6.4× lift) |
+| Retrieval hit@5 | 13.6% (random) | 87.8% (6.5× lift) |
 | Token reduction | — | 97.0% average |
-| Task success proxy | 10% | 67.8% |
-| Prompts per task | 2.84 | 1.46 (48.8% fewer) |
+| Task success proxy | 10% | 68.9% |
+| Prompts per task | 2.84 | 1.43 (49.6% fewer) |
 | Supported languages | — | 33 |
 | MCP tools | — | 18 |
 | npm runtime dependencies | — | 0 |
@@ -99,9 +99,13 @@ sigmap weights --json                    Learned weights as JSON
 sigmap --impact <file>                   Show every file impacted by changing <file>
 sigmap --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
 sigmap --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
-sigmap verify-ai-output <answer.md>      Flag fake files/tests/imports/symbols/npm-scripts in an AI answer
-sigmap verify-ai-output <answer.md> --json    Hallucination report as JSON (exits 1 if issues)
-sigmap verify-ai-output <answer.md> --report  Write a standalone HTML report (red/amber/green)
+sigmap --callers <symbol>                Method-level blast radius — every function that (transitively) calls <symbol> (JS/TS + Python)
+sigmap --callees <symbol>                Every repo function that <symbol> (transitively) calls
+sigmap --callers <symbol> --json --depth <n>   Call-graph edges as JSON (depth 0 = unlimited)
+sigmap verify <answer.md>                Flagship grounding guard — flag fake files/tests/imports/symbols/npm-scripts in an AI answer (alias of verify-ai-output)
+sigmap verify <answer.md> --json         Grounding report as JSON (exits 1 if issues)
+sigmap verify <answer.md> --report       Write a standalone HTML report (red/amber/green)
+sigmap verify-ai-output <answer.md>      Full command name for gen-context verify
 sigmap conventions                       Extract repo file-naming/export/test conventions (--conflicts, --inject, --report, --fix)
 sigmap scaffold "<name>"                 Propose a convention-matched file/dir scaffold (--ext, --threshold, --force, --json)
 sigmap verify-plan <plan.md|->           Check a plan vs the live index — files/symbols exist, blast radius, scope (--json)
@@ -310,6 +314,7 @@ format = default
 tracking = false
 mcp = {"autoRegister":true}
 depMap = true
+versionPins = true
 todos = true
 changes = true
 changesCommits = 10

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.5.0 | Benchmark: sigmap-v8.5-main (2026-07-04)
+# Version: 8.7.0 | Benchmark: sigmap-v8.7-main (2026-07-05)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,12 +23,12 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.5-main, 2026-07-04)
+## Core metrics (benchmark: sigmap-v8.7-main, 2026-07-05)
 
-- hit@5 retrieval: 86.7% vs 13.6% random baseline (6.4× lift)
+- hit@5 retrieval: 87.8% vs 13.6% random baseline (6.5× lift)
 - Token reduction: 97.0% average across benchmark repos
-- Task success: 67.8% vs 10% without SigMap
-- Prompts per task: 1.46 vs 2.84 baseline (48.8% fewer)
+- Task success: 68.9% vs 10% without SigMap
+- Prompts per task: 1.43 vs 2.84 baseline (49.6% fewer)
 - Languages: 33 supported · MCP tools: 18
 - Dependencies: zero npm runtime dependencies · fully offline
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.5.0",
+  "version": "8.7.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.5.0",
+  "version": "8.7.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.5.0",
+  "version": "8.7.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/config/defaults.js

@@ -114,6 +114,9 @@ const DEFAULTS = {
   // Include a compact import dependency map at top of output
   depMap: true,
 
+  // Include a compact `name@version` list of installed direct deps (D8)
+  versionPins: true,
+
   // Include TODO/FIXME/HACK/XXX comments as compact section
   todos: true,
 

package/src/graph/call-graph.js

@@ -0,0 +1,401 @@
+'use strict';
+
+/**
+ * Method/caller-level call-graph (D4 v1).
+ *
+ * Builds symbol-level edges — which function calls which function — for JS/TS
+ * and Python. Deterministic, zero-dependency, regex + brace/indent matching.
+ * Call sites are resolved with high precision: a call resolves to a definition
+ * of that name in the *same file* first, then in a *directly-imported* file
+ * (via the existing file-level import graph). Names that resolve to no repo
+ * definition produce no edge — over-approximation noise is avoided.
+ *
+ * Symbol IDs are `relPath#symbolName` (forward-slashed, relative to cwd).
+ *
+ * @module src/graph/call-graph
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { build } = require('./builder');
+
+const JS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const PY_EXTS = new Set(['.py', '.pyw']);
+
+// Tokens that look like `name(` calls or definition headers but are language
+// keywords, not user symbols — never treated as a call or a definition.
+const NON_CALL = new Set([
+  'if', 'for', 'while', 'switch', 'catch', 'return', 'function', 'typeof',
+  'await', 'new', 'super', 'else', 'do', 'with', 'yield', 'void', 'delete',
+  'in', 'of', 'case', 'throw', 'print', 'and', 'or', 'not', 'assert',
+  'lambda', 'class', 'def', 'elif', 'except', 'finally', 'raise', 'import',
+  'from', 'global', 'nonlocal', 'del', 'pass', 'async', 'require', 'constructor',
+]);
+
+function normalizePath(p) { return path.normalize(p).toLowerCase(); }
+function toRel(cwd, f) { return path.relative(cwd, f).replace(/\\/g, '/'); }
+function symId(cwd, absFile, name) { return `${toRel(cwd, absFile)}#${name}`; }
+
+// ── Length- and newline-preserving maskers ──────────────────────────────────
+// Replace comment / string bodies with spaces so their braces, parens, and
+// call-looking tokens never confuse structure detection. Offsets stay aligned.
+
+function maskJs(src) {
+  const out = src.split('');
+  const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+  let i = 0; const n = src.length;
+  while (i < n) {
+    const c = src[i], d = src[i + 1];
+    if (c === '/' && d === '/') { let j = i + 2; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+    if (c === '/' && d === '*') { let j = i + 2; while (j < n && !(src[j] === '*' && src[j + 1] === '/')) j++; j = Math.min(n, j + 2); blank(i, j); i = j; continue; }
+    if (c === '"' || c === "'" || c === '`') {
+      let j = i + 1;
+      while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === c) break; if (c !== '`' && src[j] === '\n') break; j++; }
+      j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+    }
+    i++;
+  }
+  return out.join('');
+}
+
+function maskPy(src) {
+  const out = src.split('');
+  const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+  let i = 0; const n = src.length;
+  while (i < n) {
+    const c = src[i];
+    if (c === '#') { let j = i + 1; while (j < n && src[j] !== '\n') j++; blank(i, j); i = j; continue; }
+    if (c === '"' || c === "'") {
+      if (src.substr(i, 3) === c + c + c) {
+        let j = i + 3; while (j < n && src.substr(j, 3) !== c + c + c) j++; j = Math.min(n, j + 3); blank(i, j); i = j; continue;
+      }
+      let j = i + 1; while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === c || src[j] === '\n') break; j++; }
+      j = Math.min(n, j + 1); blank(i, j); i = j; continue;
+    }
+    i++;
+  }
+  return out.join('');
+}
+
+// ── Balanced-delimiter matchers (operate on masked source) ───────────────────
+function matchDelim(masked, openIdx, open, close) {
+  let depth = 0;
+  for (let i = openIdx; i < masked.length; i++) {
+    if (masked[i] === open) depth++;
+    else if (masked[i] === close) { depth--; if (depth === 0) return i; }
+  }
+  return masked.length - 1;
+}
+
+function lineAt(src, idx) {
+  let line = 1;
+  const end = Math.min(idx, src.length);
+  for (let i = 0; i < end; i++) if (src.charCodeAt(i) === 10) line++;
+  return line;
+}
+
+// ── Definition extraction ────────────────────────────────────────────────────
+// Each def: { name, line, bodyStart, bodyEnd } with char offsets into `masked`.
+
+function jsDefs(masked) {
+  const defs = [];
+  const seen = new Set();
+  const push = (name, headerIdx, bodyStart, bodyEnd) => {
+    const key = name + ':' + bodyStart;
+    if (NON_CALL.has(name) || seen.has(key)) return;
+    seen.add(key);
+    defs.push({ name, line: lineAt(masked, headerIdx), bodyStart, bodyEnd });
+  };
+
+  // Locate the `{` body (or `=>` expression) that follows a param list `)`.
+  const bodyAfterParams = (closeParen) => {
+    let k = closeParen + 1;
+    // skip a `=>`, return-type annotations, and whitespace up to `{` or a statement end
+    while (k < masked.length && masked[k] !== '{' && masked[k] !== ';' && masked[k] !== '\n') k++;
+    if (masked[k] === '{') { const end = matchDelim(masked, k, '{', '}'); return { bodyStart: k, bodyEnd: end }; }
+    return null; // no braced body (interface/abstract/overload signature) — skip
+  };
+
+  // 1) function declarations:  (async) function name(...) { ... }
+  const reFn = /\b(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)\s*\(/g;
+  let m;
+  while ((m = reFn.exec(masked)) !== null) {
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    const body = bodyAfterParams(close);
+    if (body) push(m[1], m.index, body.bodyStart, body.bodyEnd);
+  }
+
+  // 2) arrow / function expressions:  const name = (...) => { }  |  = function(...) { }
+  const reArrow = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?(?:function\b\s*\*?\s*[A-Za-z_$]*\s*)?\(/g;
+  while ((m = reArrow.exec(masked)) !== null) {
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    let k = close + 1;
+    while (k < masked.length && /\s/.test(masked[k])) k++;
+    if (masked[k] === '{') { push(m[1], m.index, k, matchDelim(masked, k, '{', '}')); continue; }
+    if (masked[k] === '=' && masked[k + 1] === '>') {
+      let j = k + 2; while (j < masked.length && /\s/.test(masked[j])) j++;
+      if (masked[j] === '{') push(m[1], m.index, j, matchDelim(masked, j, '{', '}'));
+      else { // single-expression arrow body → to end of statement
+        let e = j; let d = 0;
+        while (e < masked.length) { const ch = masked[e]; if (ch === '(' || ch === '[') d++; else if (ch === ')' || ch === ']') d--; else if ((ch === ';' || ch === '\n') && d <= 0) break; e++; }
+        push(m[1], m.index, j, e);
+      }
+    }
+  }
+
+  // 3) class methods:  class X { name(...) { } }
+  const reClass = /\bclass\s+[A-Za-z_$][\w$]*/g;
+  while ((m = reClass.exec(masked)) !== null) {
+    const brace = masked.indexOf('{', m.index);
+    if (brace === -1) continue;
+    const classEnd = matchDelim(masked, brace, '{', '}');
+    const reMethod = /(?:^|\n)\s*(?:public\s+|private\s+|protected\s+|static\s+|readonly\s+|abstract\s+|async\s+|get\s+|set\s+|\*\s*)*([A-Za-z_$][\w$]*)\s*\(/g;
+    reMethod.lastIndex = brace;
+    let mm;
+    while ((mm = reMethod.exec(masked)) !== null && mm.index < classEnd) {
+      const paren = masked.indexOf('(', mm.index + mm[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      const body = bodyAfterParams(close);
+      if (body && body.bodyEnd <= classEnd) push(mm[1], mm.index, body.bodyStart, body.bodyEnd);
+    }
+  }
+
+  return defs;
+}
+
+function pyDefs(masked) {
+  const defs = [];
+  const lines = masked.split('\n');
+  // precompute char offset of each line start
+  const offsets = [0];
+  for (let i = 0; i < lines.length; i++) offsets.push(offsets[i] + lines[i].length + 1);
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^([ \t]*)(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/);
+    if (!m) continue;
+    const indent = m[1].length;
+    let j = i + 1;
+    for (; j < lines.length; j++) {
+      const ln = lines[j];
+      if (!ln.trim()) continue;                       // blank
+      const ind = ln.match(/^[ \t]*/)[0].length;
+      if (ind <= indent) break;                        // dedent → block ends
+    }
+    defs.push({ name: m[2], line: i + 1, bodyStart: offsets[i], bodyEnd: offsets[j] || masked.length });
+  }
+  return defs;
+}
+
+function extractDefs(filePath, src) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (JS_EXTS.has(ext)) return jsDefs(maskJs(src));
+  if (PY_EXTS.has(ext)) return pyDefs(maskPy(src));
+  return null; // unsupported language
+}
+
+// Collect `name(` call tokens within [start,end) of masked source.
+function callsInRange(masked, start, end) {
+  const slice = masked.slice(start, end);
+  const names = new Set();
+  const re = /([A-Za-z_$][\w$]*)\s*\(/g;
+  let m;
+  while ((m = re.exec(slice)) !== null) {
+    // skip a `.name(` method access (can't resolve the receiver deterministically)
+    const before = slice[m.index - 1];
+    if (before === '.') continue;
+    if (!NON_CALL.has(m[1])) names.add(m[1]);
+  }
+  return names;
+}
+
+// ── Public API ───────────────────────────────────────────────────────────────
+
+function _walk(dir, excludeSet, out, depth) {
+  if (depth > 8) return;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
+  for (const e of entries) {
+    if (excludeSet.has(e.name) || e.name.startsWith('.')) continue;
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1);
+    else if (e.isFile()) {
+      const ext = path.extname(e.name).toLowerCase();
+      if (JS_EXTS.has(ext) || PY_EXTS.has(ext)) out.push(full);
+    }
+  }
+}
+
+/**
+ * Build the method-level call-graph for a project.
+ *
+ * @param {string} cwd
+ * @param {object} [opts]
+ * @param {string[]} [opts.srcDirs=['src','app','lib']]
+ * @param {string[]} [opts.exclude]
+ * @param {string[]} [opts.files]  explicit absolute file list (skips the walk)
+ * @returns {{
+ *   forward: Map<string,string[]>,   // callerId → calleeIds
+ *   reverse: Map<string,string[]>,   // calleeId → callerIds
+ *   defs:    Map<string,{file:string,name:string,line:number}>
+ * }}
+ */
+function buildCallGraph(cwd, opts = {}) {
+  const excludeSet = new Set(opts.exclude || ['node_modules', '.git', 'dist', 'build', 'coverage', 'vendor']);
+  let files = opts.files ? opts.files.map((f) => path.resolve(f)) : [];
+  if (!opts.files) {
+    for (const sd of (opts.srcDirs || ['src', 'app', 'lib'])) {
+      const abs = path.resolve(cwd, sd);
+      if (fs.existsSync(abs)) _walk(abs, excludeSet, files, 0);
+    }
+  }
+
+  // File-level import graph (for precise call-site resolution). Keys normalized.
+  let fileGraph;
+  try { fileGraph = build(files, cwd); } catch (_) { fileGraph = { forward: new Map() }; }
+
+  // Per-file definitions + name→file lookups.
+  const perFileDefs = new Map();   // absFile → def[]
+  const defsByName = new Map();     // absFile → Map<name, symbolId[]>
+  const normToAbs = new Map();      // normalized abs → abs
+  const defs = new Map();           // symbolId → {file,name,line}
+
+  for (const f of files) {
+    normToAbs.set(normalizePath(path.resolve(f)), path.resolve(f));
+    let src;
+    try { src = fs.readFileSync(f, 'utf8'); } catch (_) { continue; }
+    const fileDefs = extractDefs(f, src);
+    if (!fileDefs) continue;
+    perFileDefs.set(f, fileDefs);
+    const byName = new Map();
+    for (const d of fileDefs) {
+      const id = symId(cwd, f, d.name);
+      defs.set(id, { file: toRel(cwd, f), name: d.name, line: d.line });
+      if (!byName.has(d.name)) byName.set(d.name, []);
+      byName.get(d.name).push(id);
+    }
+    defsByName.set(f, byName);
+  }
+
+  const forward = new Map();
+  const reverse = new Map();
+  const addEdge = (from, to) => {
+    if (from === to) return;
+    if (!forward.has(from)) forward.set(from, new Set());
+    forward.get(from).add(to);
+    if (!reverse.has(to)) reverse.set(to, new Set());
+    reverse.get(to).add(from);
+  };
+
+  for (const [f, fileDefs] of perFileDefs.entries()) {
+    const masked = JS_EXTS.has(path.extname(f).toLowerCase()) ? maskJs(fs.readFileSync(f, 'utf8')) : maskPy(fs.readFileSync(f, 'utf8'));
+    // resolution scope: this file's defs, then directly-imported files' defs
+    const importedAbs = (fileGraph.forward.get(normalizePath(path.resolve(f))) || [])
+      .map((nf) => normToAbs.get(nf)).filter(Boolean);
+    for (const d of fileDefs) {
+      const callerId = symId(cwd, f, d.name);
+      if (!forward.has(callerId)) forward.set(callerId, new Set()); // ensure node exists
+      const callees = callsInRange(masked, d.bodyStart, d.bodyEnd);
+      for (const nm of callees) {
+        const local = (defsByName.get(f) || new Map()).get(nm);
+        if (local && local.length) { for (const id of local) addEdge(callerId, id); continue; }
+        for (const imp of importedAbs) {
+          const ids = (defsByName.get(imp) || new Map()).get(nm);
+          if (ids && ids.length) { for (const id of ids) addEdge(callerId, id); break; }
+        }
+      }
+    }
+  }
+
+  const toArr = (mapOfSets) => {
+    const out = new Map();
+    for (const [k, set] of mapOfSets.entries()) out.set(k, [...set]);
+    return out;
+  };
+  return { forward: toArr(forward), reverse: toArr(reverse), defs };
+}
+
+// Resolve a user-supplied symbol (bare name or full `file#name` id) to ids.
+function _resolveSymbol(symbol, defs) {
+  if (defs.has(symbol)) return [symbol];
+  const ids = [];
+  for (const id of defs.keys()) if (id.slice(id.indexOf('#') + 1) === symbol) ids.push(id);
+  return ids;
+}
+
+// BFS over a graph map from seed ids up to maxDepth (0 = unlimited).
+function _bfs(seedIds, graph, maxDepth) {
+  const direct = new Set();
+  const transitive = new Set();
+  const visited = new Set(seedIds);
+  let frontier = [];
+  for (const s of seedIds) for (const nb of (graph.get(s) || [])) if (!visited.has(nb)) { direct.add(nb); visited.add(nb); frontier.push(nb); }
+  let depth = 1;
+  while (frontier.length && (maxDepth === 0 || depth < maxDepth)) {
+    const next = [];
+    for (const node of frontier) for (const nb of (graph.get(node) || [])) if (!visited.has(nb)) { transitive.add(nb); visited.add(nb); next.push(nb); }
+    frontier = next; depth++;
+  }
+  return { direct: [...direct], transitive: [...transitive] };
+}
+
+/**
+ * Method-level blast radius: everything that (transitively) calls `symbol`.
+ *
+ * @param {string} symbol  bare name or `file#name`
+ * @param {string} cwd
+ * @param {object} [opts]  { depth=0, ...buildCallGraph opts }
+ * @returns {{ symbol:string, resolved:string[], direct:string[], transitive:string[], total:number, unresolved:boolean }}
+ */
+function methodImpact(symbol, cwd, opts = {}) {
+  const graph = opts.graph || buildCallGraph(cwd, opts);
+  const ids = _resolveSymbol(symbol, graph.defs);
+  if (ids.length === 0) return { symbol, resolved: [], direct: [], transitive: [], total: 0, unresolved: true };
+  const { direct, transitive } = _bfs(ids, graph.reverse, opts.depth || 0);
+  return { symbol, resolved: ids, direct, transitive, total: direct.length + transitive.length, unresolved: false };
+}
+
+/**
+ * What `symbol` (transitively) calls.
+ * @returns {{ symbol:string, resolved:string[], direct:string[], transitive:string[], total:number, unresolved:boolean }}
+ */
+function methodCallees(symbol, cwd, opts = {}) {
+  const graph = opts.graph || buildCallGraph(cwd, opts);
+  const ids = _resolveSymbol(symbol, graph.defs);
+  if (ids.length === 0) return { symbol, resolved: [], direct: [], transitive: [], total: 0, unresolved: true };
+  const { direct, transitive } = _bfs(ids, graph.forward, opts.depth || 0);
+  return { symbol, resolved: ids, direct, transitive, total: direct.length + transitive.length, unresolved: false };
+}
+
+// ── Formatters ───────────────────────────────────────────────────────────────
+function formatCallGraph(result, kind) {
+  const verb = kind === 'callees' ? 'calls' : 'callers of';
+  const lines = [`## ${kind === 'callees' ? 'Callees' : 'Callers'}: \`${result.symbol}\``, ''];
+  if (result.unresolved) { lines.push('_symbol not found in the call-graph._'); return lines.join('\n'); }
+  if (result.total === 0) {
+    lines.push(kind === 'callees' ? '_calls no repo-defined symbols._' : '_no repo symbol calls this — zero method blast radius._');
+    return lines.join('\n');
+  }
+  lines.push(`**Total ${verb}:** ${result.total}`, '');
+  if (result.direct.length) { lines.push(`### Direct`); for (const id of result.direct) lines.push(`- \`${id}\``); lines.push(''); }
+  if (result.transitive.length) { lines.push(`### Transitive`); for (const id of result.transitive) lines.push(`- \`${id}\``); lines.push(''); }
+  return lines.join('\n');
+}
+
+function formatCallGraphJSON(result, kind) {
+  return {
+    symbol: result.symbol,
+    kind: kind === 'callees' ? 'callees' : 'callers',
+    resolved: result.resolved,
+    direct: result.direct,
+    transitive: result.transitive,
+    total: result.total,
+    unresolved: result.unresolved,
+  };
+}
+
+module.exports = {
+  buildCallGraph, methodImpact, methodCallees,
+  formatCallGraph, formatCallGraphJSON,
+  extractDefs, maskJs, maskPy,
+};

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.5.0',
+  version: '8.7.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/verify/lib-index.js

@@ -298,7 +298,36 @@ function formatVersionPins(libraries) {
     .map((l) => `${l.name}@${l.version}`);
 }
 
+/**
+ * D8: collect `name@version` pins for direct dependencies — versions only, no
+ * symbol extraction, no cache. Cheap enough to run on every context build so
+ * the generated header can ground against what is actually installed (JS +
+ * Python). Deterministic: sorted, then capped.
+ * @param {string} cwd
+ * @param {object} [opts]
+ * @param {number} [opts.limit=40] max pins returned (after sort)
+ * @returns {{ pins: string[], total: number }} pins capped to limit; total = all resolved
+ */
+function collectVersionPins(cwd, opts = {}) {
+  const limit = Number.isInteger(opts.limit) && opts.limit >= 0 ? opts.limit : 40;
+  const pins = [];
+  for (const dep of directDeps(cwd).slice(0, MAX_DEPS)) {
+    const r = resolveEntry(cwd, dep);
+    if (r && r.version) pins.push(`${dep}@${r.version}`);
+  }
+  const sitePkgs = findSitePackages(cwd);
+  if (sitePkgs.length) {
+    for (const dep of pythonDirectDeps(cwd).slice(0, MAX_DEPS)) {
+      const r = resolvePyEntry(sitePkgs, dep);
+      if (r && r.version) pins.push(`${dep}@${r.version}`);
+    }
+  }
+  pins.sort();
+  return { pins: limit ? pins.slice(0, limit) : pins, total: pins.length };
+}
+
 module.exports = {
   buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, formatVersionPins,
+  collectVersionPins,
   extractPyExports, pythonDirectDeps, findSitePackages, resolvePyEntry,
 };