Bump sem-core from 0.14.1 to 0.18.0

[dependabot]

Bumps sem-core from 0.14.1 to 0.18.0.

Release notes

Sourced from sem-core's releases.

v0.18.0

What's Changed

• feat(cli): impact --tests lexical fallback + IDF-weighted pack briefings by @​rs545837 in Ataraxy-Labs/sem#453
• feat(graph): unique-method-name call edges + Parent::child qualifiers by @​rs545837 in Ataraxy-Labs/sem#454
• release: v0.18.0 by @​rs545837 in Ataraxy-Labs/sem#456

Full Changelog: Ataraxy-Labs/sem@v0.17.0...v0.18.0

v0.17.0

No release notes provided.

v0.16.2

No release notes provided.

v0.16.1

No release notes provided.

v0.16.0

No release notes provided.

v0.15.1

No release notes provided.

v0.15.0

No release notes provided.

Changelog

Sourced from sem-core's changelog.

[0.18.0] - 2026-07-03

Fixed

• sem now works on repos using git's reftable ref storage (git init --ref-format=reftable, git 2.45+). Previously every command died with libgit2's cryptic unsupported extension name extensions.refstorage. libgit2 can't read reftable refs, but the object database and index are unchanged, so GitBridge now tolerates the extension and routes just the ref resolutions (HEAD, refspecs, revwalk starts) through the git CLI while libgit2 keeps doing everything else by OID. Verified end to end on a real reftable repo: working/staged/commit/range diffs, blame, and per-file history all produce identical results to a files-backend repo. One residual gap: the cache freshness oracle's direct git2::Repository::open is .ok()-guarded, so on reftable repos it just skips the acceleration (correctness unaffected). Requires git on PATH for the ref lookups. Thanks @​bengry for the report and clean repro (#451).

Added

• Unique-method-name call edges (dynamic languages). Attribute calls on receivers of unknown type (index.keep_levels(...)) previously produced no graph edge, hiding real dependents and blinding --tests. In Python/Ruby — where receiver types are statically unknowable — a method name with exactly one definition repo-wide now resolves to it: one candidate, one edge; any ambiguity, no edge. Static languages keep precision-first resolution (an unresolved receiver there is deliberate: shadowed import, instance property).

• Parent::child entity qualifiers. sem impact "Dataset::set_index" and friends now work everywhere Parent.child does (graph and cached lookups).

• sem impact --tests lexical fallback + fast-path fallthrough. Graph edges miss tests that call a target through a module namespace (xr.where(...) resolves to no entity), so --tests could answer "No tests found" for a function with dozens of tests. Now: an empty tests answer from the sidecar or disk cache is treated as non-authoritative and falls through to the full path, which backstops zero graph edges with lexical reachability — test entities naming the target as a whole word — clearly labeled as weaker evidence. Found live: an agent's graph-selected verify loop (run only the tests that reach your change) went from 0 selected tests to a 56-test net on xr.where, versus the 1,900+ tests of whole-file runs.

• Sharper --pack briefings. Term ranking is now IDF-weighted (a term appearing in half the repo is worth almost nothing), <details> environment dumps in issue text are stripped before extraction, attribute accesses glued to receivers ("d2.loc") also emit their .attr suffixes as terms, and one of the three briefing slots goes to the top name-echo orient hit — for bugs where the issue names a surface API the culprit's body never mentions.

• sem orient --pack <tokens>: turn-zero briefings from task text. Feed orient a whole issue or task description and it returns a packed briefing — the top matching functions' bodies plus their immediate callers/callees — sized to the token budget. Ranking is body-term convergence: code-ish terms are extracted from the task text (flags, dotted names, identifiers) and entities are ranked by how many distinct terms their bodies contain, since issue vocabulary lives in bodies, not names. Built for prompt-time injection (the agent-side analog of the prompt-submit prefetch hook): the code an agent would spend its first turns foraging for arrives at turn zero. Honest calibration: on three ground-truth issues it put the exact target function first on two; issues that quote the tool's own output can still poison term extraction.

• sem is published to the official MCP registry as io.github.Ataraxy-Labs/sem, so MCP clients that browse the registry (VS Code, Cursor, Claude Code, and others) can discover and install the server directly. The release workflow now publishes each release to the registry via mcp-publisher (authenticated with GitHub OIDC, no extra secrets), backed by a server.json manifest and an mcpName field in the npm wrapper.

Performance

• Delta-fills: changed entities answer with a diff against the version your session saw. The attention ledger now stores fill contents, so when a session re-asks about an entity that changed since its last look, the answer is an entity-level delta (∆ alpha · changed since you read it … - x = 1 / + x = 42) instead of the whole packed body. Measured end to end: a post-edit re-ask that previously re-sent the body now costs 2 diff lines. Completes the ledger's answer set — new entity: full fill; unchanged: one line; changed: delta; SEM_FRESH=1 / fresh: true always forces the full re-pack. Deltas larger than 120 lines fall back to a full fill.

• Attention ledger covers the MCP path. sem_context (the tool agent sessions actually call) now runs through the same per-session fill ledger: an MCP server process serves exactly one session, so re-asks for unchanged entities collapse to one ≡ unchanged since you read it line automatically — no environment variable needed. New optional fresh: true param forces a full re-send (for when context compaction dropped the earlier fill).

• Attention ledger v1: repeated context fills collapse to one line. The resident server now keeps a per-session ledger of every context fill it has emitted (entity id + content fingerprint). When the same session re-asks for an unchanged entity, the answer is a single ≡ unchanged since you read it line instead of the full packed body — the body is already sitting in the asking model's context window, so re-sending it is pure token waste. Measured through the CLI socket path: 8,586 bytes first fill, 139 bytes on repeat (98.4% suppressed). Opt-in via SEM_SESSION=<id> in the environment; SEM_FRESH=1 bypasses; anonymous calls are never suppressed. Any change to the target entity misses the fingerprint and re-sends in full. This is the first piece of the attention architecture (docs/attention-architecture.md): space (graph), time (commit index), attention (ledger).

• sem entities --text: entity-addressed text search from the CLI (the MCP tool already had it) — one line per hit (file, innermost entity, line, matched text) instead of whole bodies, served from the resident server's warm graph in milliseconds with a local-graph fallback. This is the token-cheap way for an agent to verify a call site or find a string: a body-level sem context costs hundreds of tokens where a text hit costs ~15.

• Auto-resident server: every sem CLI query after the first answers in milliseconds, on any repo. A socket miss now spawns sem mcp --resident (hidden plumbing) detached in the background: a server that holds the repo's graph warm and serves ONLY the per-repo unix socket, exiting on its own when idle for 30 minutes or when it loses the bind race to a live session. sem context and sem orient gain sidecar fast paths (impact already had one), so the full structural read loop runs against the warm graph: measured on a 30K-LOC repo, first sem context 0.68s cold (spawning the resident), then context/orient/impact all under 10ms. In a controlled agent benchmark (6 verified code-understanding questions, classic grep/read agent vs sem agent, identical prompts and batching guidance), the sem agent answered in 13s vs 37s with equal 6/6 correctness — 65% faster. SEM_NO_AUTOWARM=1 disables the auto-spawn, SEM_NO_SIDECAR=1 the fast path.

• Token-efficient tool output: the same answers at a fraction of the tokens the consuming model has to read (and pay for). (1) The context packer stops enumerating noise: related test entities are folded into per-role counts instead of packed as one-line "#[test]" stubs (unless the target itself is a test, when its test neighborhood is the question), bare attribute/comment signatures are skipped, and transitive tiers are capped at 25 entries per role with the remainder counted. What was dropped is stated explicitly in one line ("not packed: +64 direct dependents (64 tests) · sem_impact lists them"), so the signal survives at a fraction of the cost. Measured: sem context on a hot sem-core entity 7,272 to 4,113 tokens (-43%, 119 to 48 entries); on a hot weave entity 5,216 to 3,498 (-33%, 146 to 27 entries, the 119 test stubs now one line). (2) The sem_entities MCP tool renders compact per-line trees (name · type · lines, children indented, files as group headers) instead of pretty-printed JSON: measured 3.7x fewer tokens on a 115-entity file (5,028 to 1,361). Applies to the MCP path and query modes; CLI --json output is unchanged for scripts.

• Semantic commit index (storage engine layer 2): history is now stored as entity deltas. Each commit is semantic-diffed against its first parent exactly once and persisted as entity-change rows in the cache (commits + entity_changes tables, sha-keyed and branch-agnostic); every later history query is a SQLite lookup plus a diff of only the commits git gained since. Measured on the sem repo: sem log over 500 commits drops from 4.46s to 0.03s on the second query (~150x), with the first query as the one-time indexing pass and each new commit costing one incremental diff. Applies to sem log repo analytics (hotspots + co-change pairs) and the MCP sem_log tool; per-entity traces are unchanged. Aggregation is shared code between the live git walk and the store (aggregate_history_analytics), tested to produce identical hotspot/co-change output, so the two paths cannot drift. Merge-heavy history gets better semantics: each commit is attributed its own first-parent diff instead of a diff against its arbitrary revwalk neighbor, and merge commits contribute no changes of their own (their first-parent diff restates the merged-in commits, which index individually). File-filtered queries index full-repo diffs once and filter at aggregation, so the first filtered query costs more than the old pathspec-scoped walk but every later query on any filter is instant. Cache schema v9; existing caches rebuild automatically on first use.

• CLI sidecar fast path: sem impact now answers from the resident sem mcp server's warm graph via its unix socket before doing any local work — measured 4.5ms end-to-end on a 158K-LOC repo, versus 22.4ms for the local cold path and 7.7ms for a ripgrep scan of the same repo: the full blast radius (callers, dependencies, depth-bounded transitive impact, affected tests) is now cheaper than a raw text match. Output is byte-identical to the local path (the sidecar ships serialized EntityInfos that the CLI feeds to its existing printers; verified across all modes and --json). The fast path is an accelerator, never a requirement: bounded socket timeouts and silent fallback mean no resident server (or SEM_NO_SIDECAR=1, --no-cache, custom scopes, .semignore, --entity-id) just runs the normal local path. Server-side, the new sidecar impact op classifies affected tests only among the entities the impact BFS actually reached, instead of walking the whole corpus per call (6.8ms → 0.1ms on a 4.7K-entity graph).

Fixed

• Internal: rustfmt line-wrap missed in the #445 sidecar change; no behavior change.

• The context packer's token estimator was undercounting real tokens 2-3x on dense code (words x 1.3 vs the ~4 chars/token reality: a context reported as 661 tokens measured ~2,400 real tokens), silently overshooting every budget. It now takes the max of the word- and character-based estimates, so nominal budgets match what the consuming model actually pays.

• The context packer's "not packed" summary line pluralizes roles correctly ("transitive dependencies", not "dependencys").

• Workspace version bumped to 0.16.0: ContextResult gained the public omitted field (a breaking change for struct-literal constructors, flagged by cargo-semver-checks), and 0.x semantics put breaking changes in the minor version.

• The docs site deploys through workflow-based GitHub Pages (.github/workflows/docs-pages.yml: upload /docs verbatim, deploy) instead of the legacy branch-based Jekyll builder, which began failing repo-wide with zero-duration "Page build failed" errors on commits that didn't touch docs — including on direct build requests via the Pages API. The site is pure static HTML, so the legacy builder added nothing but a failure mode; deploys now also skip entirely on commits that don't change docs/.

Changed

... (truncated)

Commits

• 455170d release: v0.18.0
• 488c5e2 feat(graph): unique-method-name call edges + Parent::child qualifiers (#454)
• df44c68 feat(cli): impact --tests lexical fallback + IDF-weighted pack briefings (#453)
• c8a7b9b feat(git): support reftable repos via CLI ref resolution (#451) (#452)
• 6bcc36d feat(cli): sem orient --pack — turn-zero briefings from task text (#450)
• b8bd31a feat(mcp): delta-fills — changed entities answer as a diff vs the session's l...
• d5084be fix(release): match the MCP registry namespace casing (#448)
• 500548a style: rustfmt sidecar quick_context call (#447)
• 99ca7ab feat(mcp): publish sem to the official MCP registry (#446)
• d8e617a feat(mcp): attention ledger on the sem_context tool path (#445)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[inspect-review]

inspect review

Triage: 6 entities analyzed | 0 critical, 0 high, 6 medium, 0 low
Verdict: standard_review

Findings (0)

---

Reviewed by inspect | Entity-level triage found 0 high-risk changes