feat: add graph-backed cross-file review context

Author: haasonsaas

eval/fixtures/repo_regressions/cross_file_sql_helper.yml

@@ -0,0 +1,27 @@
+name: repo regression - cross file sql helper usage
+repo_path: graph_call_chain_repo
+diff: |
+  diff --git a/routes.py b/routes.py
+  index 1111111..2222222 100644
+  --- a/routes.py
+  +++ b/routes.py
+  @@ -2,4 +2,5 @@ from auth import lookup_user
+   
+   
+   def get_profile(request, db):
+  -    return {"ok": True}
+  +    user = lookup_user(request.args["name"], db)
+  +    return {"user": user}
+expect:
+  must_find:
+    - file: routes.py
+      contains_any:
+        - sql injection
+        - unsafe sql
+        - interpolates user-controlled
+      tags_any:
+        - sql-injection
+  must_not_find:
+    - contains: style
+  min_total: 1
+  max_total: 12

eval/fixtures/repo_regressions/graph_call_chain_repo/auth.py

@@ -0,0 +1,3 @@
+def lookup_user(name, db):
+    query = f"SELECT * FROM users WHERE name = '{name}'"
+    return db.execute(query).fetchone()

eval/fixtures/repo_regressions/graph_call_chain_repo/routes.py

@@ -0,0 +1,5 @@
+from auth import lookup_user
+
+
+def get_profile(request, db):
+    return {"ok": True}

src/core/context.rs

@@ -13,6 +13,8 @@ pub struct LLMContextChunk {
     pub content: String,
     pub context_type: ContextType,
     pub line_range: Option<(usize, usize)>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub provenance: Option<String>,
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
@@ -74,6 +76,7 @@ impl ContextFetcher {
                         content: chunk_content,
                         context_type: ContextType::FileContent,
                         line_range: Some((expanded_start, expanded_end)),
+                        provenance: None,
                     });
                 }
             }
@@ -137,6 +140,7 @@ impl ContextFetcher {
                 content: snippet,
                 context_type: ContextType::Reference,
                 line_range: None,
+                provenance: None,
             });
         }
 
@@ -185,6 +189,7 @@ impl ContextFetcher {
                                 content: definition_content,
                                 context_type: ContextType::Definition,
                                 line_range: Some((start_line + 1, end_line)),
+                                provenance: None,
                             });
                         }
                     }
@@ -222,11 +227,32 @@ impl ContextFetcher {
                         content: snippet,
                         context_type: ContextType::Definition,
                         line_range: Some(location.line_range),
+                        provenance: location.provenance.clone(),
                     });
                 }
             }
         }
 
+        for location in index.graph_related_locations(
+            file_path,
+            symbols,
+            graph_hops,
+            max_locations,
+            graph_max_files,
+        ) {
+            if &location.file_path == file_path {
+                continue;
+            }
+            let snippet = truncate_with_notice(location.snippet, MAX_CONTEXT_CHARS);
+            chunks.push(LLMContextChunk {
+                file_path: location.file_path,
+                content: snippet,
+                context_type: ContextType::Definition,
+                line_range: Some(location.line_range),
+                provenance: location.provenance,
+            });
+        }
+
         for location in index.multi_hop_locations(
             file_path,
             symbols,
@@ -243,6 +269,7 @@ impl ContextFetcher {
                 content: snippet,
                 context_type: ContextType::Reference,
                 line_range: Some(location.line_range),
+                provenance: location.provenance,
             });
         }
 
@@ -373,4 +400,55 @@ mod tests {
         let chunk = &chunks[0];
         assert!(chunk.content.contains("pub fn process"));
     }
+
+    #[tokio::test]
+    async fn test_fetch_related_definitions_with_index_uses_symbol_graph_neighbors() {
+        let dir = tempfile::tempdir().unwrap();
+        let src_dir = dir.path().join("src");
+        std::fs::create_dir_all(&src_dir).unwrap();
+
+        std::fs::write(
+            src_dir.join("auth.rs"),
+            "pub fn validate_token(token: &str) -> bool {\n    token.len() > 10\n}\n",
+        )
+        .unwrap();
+        std::fs::write(
+            src_dir.join("handler.rs"),
+            "use crate::auth::validate_token;\n\npub fn handle_request(token: &str) -> bool {\n    validate_token(token)\n}\n",
+        )
+        .unwrap();
+
+        let index = SymbolIndex::build(dir.path(), 20, 200_000, 10, |_| false).unwrap();
+        let fetcher = ContextFetcher::new(dir.path().to_path_buf());
+
+        let chunks = fetcher
+            .fetch_related_definitions_with_index(
+                &PathBuf::from("src/handler.rs"),
+                &["handle_request".to_string()],
+                &index,
+                10,
+                2,
+                5,
+            )
+            .await
+            .unwrap();
+
+        let graph_chunk = chunks
+            .iter()
+            .find(|chunk| chunk.file_path == std::path::Path::new("src/auth.rs"))
+            .expect("expected graph-related auth context");
+
+        assert_eq!(graph_chunk.context_type, ContextType::Definition);
+        assert!(graph_chunk.content.contains("validate_token"));
+        assert!(graph_chunk
+            .provenance
+            .as_deref()
+            .unwrap_or_default()
+            .contains("symbol graph"));
+        assert!(graph_chunk
+            .provenance
+            .as_deref()
+            .unwrap_or_default()
+            .contains("calls"));
+    }
 }

src/core/prompt.rs

@@ -441,13 +441,18 @@ impl PromptBuilder {
 
         for chunk in chunks {
             let block = format!(
-                "\n[{:?} - {}{}]\n{}\n",
+                "\n[{:?} - {}{}{}]\n{}\n",
                 chunk.context_type,
                 chunk.file_path.display(),
                 chunk
                     .line_range
                     .map(|(s, e)| format!(":{}-{}", s, e))
                     .unwrap_or_default(),
+                chunk
+                    .provenance
+                    .as_ref()
+                    .map(|value| format!(" | {}", value))
+                    .unwrap_or_default(),
                 chunk.content
             );
             if self.config.max_context_chars > 0

src/core/semantic.rs

@@ -452,6 +452,10 @@ pub async fn semantic_context_for_diff(
             content,
             context_type: ContextType::Reference,
             line_range: Some(semantic_match.chunk.line_range),
+            provenance: Some(format!(
+                "semantic retrieval (similarity={:.2}, symbol={})",
+                semantic_match.similarity, semantic_match.chunk.symbol_name
+            )),
         });
         if chunks.len() >= limit {
             break;

src/core/smart_review_prompt.rs

@@ -116,8 +116,16 @@ TAGS: [comma-separated relevant tags]
             prompt.push_str("## Context Information\n\n");
             for chunk in context_chunks {
                 let (start_line, end_line) = chunk.line_range.unwrap_or((1, 1));
-                let description =
-                    format!("{} - {:?}", chunk.file_path.display(), chunk.context_type);
+                let description = format!(
+                    "{} - {:?}{}",
+                    chunk.file_path.display(),
+                    chunk.context_type,
+                    chunk
+                        .provenance
+                        .as_ref()
+                        .map(|value| format!(" | {}", value))
+                        .unwrap_or_default()
+                );
                 let block = format!(
                     "**{}** (lines {}-{}):\n```\n{}\n```\n\n",
                     description,