sigmap 4.0.0 → 4.0.2

package/AGENTS.md

@@ -12,35 +12,31 @@ Use this marker block for all appendable context files:
 ## Auto-generated signatures
 <!-- Updated by gen-context.js -->
 You are a coding assistant with full knowledge of this codebase.
-Below are the code signatures extracted by SigMap v4.0.0 on 2026-04-15T05:40:32.012Z.
+Below are the code signatures extracted by SigMap v4.0.2 on 2026-04-15T07:28:24.633Z.
 
 Use these signatures to answer questions about the code accurately.
 
 ## Code Signatures
 
-<!-- Generated by SigMap gen-context.js v4.0.0 -->
+<!-- Generated by SigMap gen-context.js v4.0.2 -->
 <!-- DO NOT EDIT below the marker line — run gen-context.js to regenerate -->
 
 # Code signatures
 
-## changes (last 5 commits — 6 hours ago)
+## changes (last 5 commits — 77 minutes ago)
 ```
-src/extractors/generic.js                     +extract
-src/format/llm-txt.js                         +outputPath  +format
-src/format/llms-txt.js                        +outputPath  +getShortCommit  +detectVersion  +format
-packages/adapters/llm-full.js                 +outputPath  +format  +write
+src/analysis/coverage-score.js                +coverageScore  +_walk
+src/eval/analyzer.js                          ~analyzeFiles
+packages/adapters/claude.js                   +_confidenceMeta  ~format
+packages/adapters/copilot.js                  +_confidenceMeta  ~format
+packages/adapters/cursor.js                   +_confidenceMeta  ~format
+packages/adapters/gemini.js                   +_confidenceMeta  ~format  ~write
+packages/adapters/openai.js                   +_confidenceMeta  ~format  ~outputPath
+packages/adapters/windsurf.js                 +_confidenceMeta  ~format
 ```
 
 ## packages
 
-### packages/adapters/llm-full.js
-```
-module.exports = { name: 'llm-full', format, outputPath, write }
-function outputPath(cwd)
-function format(context, opts)
-function write(context, cwd, opts)
-```
-
 ### packages/adapters/claude.js
 ```
 module.exports = { name, format, outputPath, write }
@@ -50,14 +46,6 @@ function outputPath(cwd) → string
 function write(context, cwd, opts = {})
 ```
 
-### packages/adapters/codex.js
-```
-module.exports = { name, format, outputPath, write }
-function format(context, opts = {}) → string
-function outputPath(cwd) → string
-function write(context, cwd, opts = {})
-```
-
 ### packages/adapters/copilot.js
 ```
 module.exports = { name, format, outputPath, write }
@@ -84,15 +72,6 @@ function write(context, cwd, opts = {})
 function _confidenceMeta(opts)
 ```
 
-### packages/adapters/index.js
-```
-module.exports = { getAdapter, listAdapters, adapt, outputsToAdapters }
-function getAdapter(name) → { name: string, format: F
-function listAdapters() → string[]
-function adapt(context, adapterName, opts = {}) → string
-function outputsToAdapters(outputs) → string[]
-```
-
 ### packages/adapters/openai.js
 ```
 module.exports = { name, format, outputPath }
@@ -109,6 +88,31 @@ function _confidenceMeta(opts)
 function outputPath(cwd) → string
 ```
 
+### packages/adapters/codex.js
+```
+module.exports = { name, format, outputPath, write }
+function format(context, opts = {}) → string
+function outputPath(cwd) → string
+function write(context, cwd, opts = {})
+```
+
+### packages/adapters/index.js
+```
+module.exports = { getAdapter, listAdapters, adapt, outputsToAdapters }
+function getAdapter(name) → { name: string, format: F
+function listAdapters() → string[]
+function adapt(context, adapterName, opts = {}) → string
+function outputsToAdapters(outputs) → string[]
+```
+
+### packages/adapters/llm-full.js
+```
+module.exports = { name: 'llm-full', format, outputPath, write }
+function outputPath(cwd)
+function format(context, opts)
+function write(context, cwd, opts)
+```
+
 ### packages/cli/index.js
 ```
 module.exports = { CLI_ENTRY, run }
@@ -149,33 +153,33 @@ function adapt(context, adapterName, opts = {}) → string
 
 ## src
 
-### src/extractors/generic.js
-```
-module.exports = { extract }
-function extract(src)
-```
-
-### src/format/llm-txt.js
+### src/analysis/coverage-score.js
 ```
-module.exports = { format, outputPath }
-function outputPath(cwd)
-function format(context, cwd, version)
+module.exports = { coverageScore }
+function coverageScore(cwd, fileEntries, config) → { * score: number, * grad
+function _walk(dir, excludeSet, out)
 ```
 
-### src/format/llms-txt.js
+### src/eval/analyzer.js
 ```
-module.exports = { format, outputPath }
-function outputPath(cwd)
-function getShortCommit(cwd)
-function detectVersion(cwd)
-function format(context, cwd, writtenFiles, sigmapVersion)
+module.exports = { analyzeFiles, formatAnalysisTable, formatAnalysisJSON }
+function isDockerfile(name)
+function getExtractorName(filePath)
+function tokenCount(sigs)
+function hasCoverage(filePath, cwd)
+function loadExtractor(name, cwd)
+function analyzeFiles(files, cwd, opts) → object[]
+function formatAnalysisTable(stats, showSlow) → string
+function formatAnalysisJSON(stats) → object
 ```
 
-### src/analysis/coverage-score.js
+### src/mcp/server.js
 ```
-module.exports = { coverageScore }
-function coverageScore(cwd, fileEntries, config) → { * score: number, * grad
-function _walk(dir, excludeSet, out)
+module.exports = { start }
+function respond(id, result)
+function respondError(id, code, message)
+function dispatch(msg, cwd)
+function start(cwd)
 ```
 
 ### src/config/defaults.js
@@ -191,19 +195,6 @@ function loadConfig(cwd) → object
 function deepClone(obj)
 ```
 
-### src/eval/analyzer.js
-```
-module.exports = { analyzeFiles, formatAnalysisTable, formatAnalysisJSON }
-function isDockerfile(name)
-function getExtractorName(filePath)
-function tokenCount(sigs)
-function hasCoverage(filePath, cwd)
-function loadExtractor(name, cwd)
-function analyzeFiles(files, cwd, opts) → object[]
-function formatAnalysisTable(stats, showSlow) → string
-function formatAnalysisJSON(stats) → object
-```
-
 ### src/eval/runner.js
 ```
 module.exports = { run, rank, loadTasks, buildSigIndex, formatTable, formatMetrics, tokenize }
@@ -287,6 +278,12 @@ module.exports = { extract }
 function extract(src) → string[]
 ```
 
+### src/extractors/generic.js
+```
+module.exports = { extract }
+function extract(src)
+```
+
 ### src/extractors/go.js
 ```
 module.exports = { extract }
@@ -546,6 +543,22 @@ function generateDashboardHtml(cwd, health)
 function renderHistoryCharts(cwd, health)
 ```
 
+### src/format/llm-txt.js
+```
+module.exports = { format, outputPath }
+function outputPath(cwd)
+function format(context, cwd, version)
+```
+
+### src/format/llms-txt.js
+```
+module.exports = { format, outputPath }
+function outputPath(cwd)
+function getShortCommit(cwd)
+function detectVersion(cwd)
+function format(context, cwd, writtenFiles, sigmapVersion)
+```
+
 ### src/graph/builder.js
 ```
 module.exports = { build, buildFromCwd, extractFileDeps }
@@ -609,15 +622,6 @@ function queryContext(args, cwd)
 function getImpact(args, cwd)
 ```
 
-### src/mcp/server.js
-```
-module.exports = { start }
-function respond(id, result)
-function respondError(id, code, message)
-function dispatch(msg, cwd)
-function start(cwd)
-```
-
 ### src/mcp/tools.js
 ```
 module.exports = { TOOLS }

package/CHANGELOG.md

@@ -10,6 +10,69 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [4.0.2] — 2026-04-15 — Bundle factory fix (re-release of 4.0.1)
+
+### Fixed
+- v4.0.1 was published to npm/GitHub Packages before the binary CI step ran, which meant the published package contained the incomplete bundle (missing `./src/analysis/coverage-score` factory). v4.0.2 is a clean re-release with all fixes from 4.0.1 and the correct bundle.
+
+---
+
+## [4.0.1] — 2026-04-15 — Config auto-detection fix
+
+### Fixed
+- **Bundled `loadConfig` lacked `detectAutoSrcDirs`**: the inline `__factories["./src/config/loader"]` copy inside `gen-context.js` was a stripped-down version that returned raw `DEFAULTS` without filesystem auto-detection. After `--init` wrote a config with 6 hardcoded `srcDirs`, auto-detection was bypassed and custom project directories were missed — causing coverage to drop for any project whose source lives outside those 6 dirs. The bundled loader is now fully in sync with `src/config/loader.js`.
+- **`--init` config hardcoded `srcDirs`**: `gen-context.config.json.example` had `"srcDirs": ["src","app","lib","packages","services","api"]` as a plain value. Any project that ran `--init` would lock into those 6 dirs and lose auto-detection. The example now omits `srcDirs` entirely and uses `_comment` keys to explain that auto-detection runs automatically. Users who need custom dirs can add `srcDirs` manually.
+- **`gen-context.config.json` (SigMap repo)**: restored explicit `"srcDirs": ["src","packages"]` so the repo's own context generation is not affected by auto-detection picking up `docs-vp/`, `scripts/`, `test/`, and `vscode-extension/`.
+- **Example `outputs` updated**: `gen-context.config.json.example` now lists all four standard adapters — `["copilot","codex","claude","gemini"]` — matching the recommended setup.
+
+### Benchmarks (v4.0.1)
+- Token reduction: **97.6% average** across 18 repos ✅
+- Retrieval hit@5: **84.4%** (up from 83.3% in v4.0.0)
+
+---
+
+## [4.0.0] — 2026-04-15 — Intelligence Layer
+
+### Added
+- **Coverage score** (`src/analysis/coverage-score.js`): measures what fraction of source files made it into context after token-budget application.
+  - Grade scale: A ≥ 90% · B ≥ 75% · C ≥ 50% · D < 50%
+  - Confidence indicator: HIGH / MEDIUM / LOW
+  - Per-module breakdown per srcDir via `perModule` Map
+- **Confidence indicators in all output writers**: every generated file now includes a metadata comment:
+  ```
+  <!-- sigmap: version=4.0.0 confidence=HIGH coverage=94% dropped=9 commit=abc1234 -->
+  ```
+  Applies to: `copilot`, `claude`, `cursor`, `windsurf`, `openai`, `gemini` adapters.
+- **`--report` module heatmap**: ASCII bar chart per srcDir showing coverage percentage:
+  ```
+  Module Coverage:
+    src                ████████████████ 100% (64/64 files)
+    packages           ██████████████░░  86% (12/14 files)
+  ```
+  `--report --json` gains a `coverage` object with `score`, `grade`, `confidence`, `totalFiles`, `includedFiles`, `droppedFiles`, and `perModule`.
+- **`--diff` risk score**: each changed file is now classified LOW / MEDIUM / HIGH based on reverse-dependency BFS, public API exports, route status, and config-file status:
+  ```
+  [sigmap] Risk: Changed files (3):
+    src/auth/service.ts         [HIGH]    — exports public API, 5 downstream dependents
+    src/config/database.ts      [MEDIUM]  — config file
+    src/utils/format.ts         [LOW]     — no dependents, internal utility
+  ```
+- **Coverage in post-run summary**: every normal run now prints a `Coverage` line:
+  ```
+   Coverage       : A (97%)  — 76 of 78 source files included
+  ```
+- **Coverage in `--health` and `--health --json`**: coverage grade, score, and file counts are included in both text and JSON health output. `--health --json` adds `coverage`, `coverageGrade`, `coverageConfidence`, `coverageTotalFiles`, `coverageIncludedFiles`.
+
+### Changed
+- **Token budget drop order step 5**: now uses `signalQuality = sigs / linesOfCode` (least-informative files dropped first) instead of the previous "fewest sigs" heuristic.
+- **`src/eval/analyzer.js` `analyzeFiles()` output**: each file stat now includes `linesOfCode` and `signalQuality` fields.
+
+### Benchmark (v4.0.0)
+- Token reduction: **97.6% average** across 18 repos (target ≥ 97.0%) ✅
+- Retrieval hit@5: 83.3% (retrieval improvement targeted in v4.5 with adaptive query)
+
+---
+
 ## [3.5.0] — 2026-04-14 — Phase C/D Intelligence Expansion
 
 ### Added

package/README.md

@@ -19,7 +19,7 @@
 npx sigmap   # 10 seconds. zero config. your AI never reads the wrong file again.
 ```
 
-> Latest: **v3.5.0** adds Phase C/D intelligence expansion with framework-specialized extractors and cross-module pattern detection.
+> Latest: **v4.0.0** — Intelligence Layer. Coverage score, confidence indicators in every output file, `--report` module heatmap, `--diff` risk scoring, and extractor quality-based drop order.
 
 <div align="center">
 <img src="demo.gif" alt="SigMap demo — reducing 80K tokens to 4K in under 10 seconds" width="760" />
@@ -145,7 +145,7 @@ Reproduced with `node scripts/run-benchmark.mjs` on public repos:
 | fastify | JavaScript | 54.4K | 2.6K | **95.3%** |
 | fastapi | Python | 178.4K | 5.2K | **97.1%** |
 
-**Average: 97.5% reduction across 18 repos (16 languages).** See [`benchmarks/reports/token-reduction.md`](benchmarks/reports/token-reduction.md) or reproduce with `node scripts/run-benchmark.mjs`.
+**Average: 97.6% reduction across 18 repos (16 languages).** See [`benchmarks/reports/token-reduction.md`](benchmarks/reports/token-reduction.md) or reproduce with `node scripts/run-benchmark.mjs`.
 
 ---
 
@@ -746,17 +746,89 @@ If `output` is omitted, the default `.github/copilot-instructions.md` is used.
 
 ## 📊 Observability
 
+### Coverage score (v4.0)
+
+Every run now prints a coverage line alongside token reduction:
+
+```
+───────────────────────────────────────────
+ SigMap v4.0.0
+ Files scanned  : 76
+ Symbols found  : 332
+ Token reduction: 94%  (65,227 → 4,103)
+ Coverage       : A (97%)  — 76 of 78 source files included
+ Output         : .github/copilot-instructions.md
+───────────────────────────────────────────
+```
+
+The **coverage score** answers _how much of your codebase is represented in context_ after the token budget is applied. Grade scale: A ≥ 90% · B ≥ 75% · C ≥ 50% · D < 50%.
+
+### Module heatmap in `--report`
+
 ```bash
-# Append run metrics to .context/usage.ndjson
-sigmap --track
+sigmap --report
+```
 
-# Structured JSON report for CI (exits 1 if over budget)
+```
+[sigmap] report:
+  version         : 4.0.0
+  files processed : 76
+  reduction       : 93.7%
+  coverage        : A (97%)  — 76 of 78 source files included
+  confidence      : HIGH
+
+  Module Coverage:
+    src                ████████████████ 100% (64/64 files)
+    packages           ██████████████░░  86% (12/14 files)
+```
+
+Machine-readable JSON (suitable for CI dashboards):
+
+```bash
 sigmap --report --json
-# { "version": "2.0.0", "finalTokens": 3200, "reductionPct": 92.4, "overBudget": false }
+# { "version": "4.0.0", "finalTokens": 4103, "reductionPct": 93.7,
+#   "coverage": { "score": 97, "grade": "A", "confidence": "HIGH", ... } }
+```
+
+### Composite health score
 
-# Composite health score
+```bash
 sigmap --health
-# score: 95/100 (grade A) | reduction: 91.2% | 1 day since regen | 47 runs
+```
+
+```
+[sigmap] health:
+  score    : 80/100 (grade B)
+  coverage : A (97%)  — 76 of 78 source files
+  strategy : full
+  ...
+```
+
+```bash
+sigmap --health --json
+# { "score": 80, "grade": "B", "coverage": 97, "coverageGrade": "A",
+#   "tokens": 4103, "reduction": 93.7, ... }
+```
+
+### Confidence indicators in generated files
+
+Every output file now carries a metadata line so you can inspect freshness at a glance:
+
+```
+<!-- sigmap: version=4.0.0 confidence=HIGH coverage=97% dropped=2 commit=8540612 -->
+```
+
+### Diff risk score
+
+```bash
+sigmap --diff HEAD~3
+```
+
+```
+[sigmap] Risk: Changed files (4):
+  src/auth/service.ts         [HIGH]    — exports public API, 5 downstream dependents
+  src/config/database.ts      [MEDIUM]  — config file
+  src/utils/format.ts         [LOW]     — no dependents, internal utility
 ```
 
 ### Self-healing CI

package/gen-context.config.json.example

@@ -1,11 +1,14 @@
 {
-  "_comment": "SigMap configuration — all keys are optional (defaults shown)",
+  "_comment": "SigMap configuration — all keys are optional (defaults shown). Copy to gen-context.config.json.",
 
   "output": ".github/copilot-instructions.md",
 
-  "outputs": ["copilot", "codex"],
+  "outputs": ["copilot", "codex", "claude", "gemini"],
 
-  "srcDirs": ["src", "app", "lib", "packages", "services", "api"],
+  "_srcDirs_comment": "Source directories to scan. OMIT this key to use auto-detection (recommended).",
+  "_srcDirs_comment2": "Auto-detection reads package.json/go.mod/Cargo.toml and scans top-level dirs automatically.",
+  "_srcDirs_comment3": "Only set this explicitly if auto-detection misses part of your project layout.",
+  "_srcDirs_example": ["src", "app", "lib", "packages", "services", "api"],
 
   "exclude": [
     "node_modules", ".git", "dist", "build", "out",

package/gen-context.js

@@ -116,14 +116,98 @@ __factories["./src/config/defaults"] = function(module, exports) {
 
 // ── ./src/config/loader ──
 __factories["./src/config/loader"] = function(module, exports) {
-  
+
   const fs = require('fs');
   const path = require('path');
   const { DEFAULTS } = __require('./src/config/defaults');
-  
+
   // Keys that are valid in gen-context.config.json
   const KNOWN_KEYS = new Set(Object.keys(DEFAULTS));
-  
+
+  // Common top-level folder names that reliably hold source code
+  const COMMON_CODE_DIRS = new Set([
+    'src', 'app', 'lib', 'packages', 'services', 'api', 'core', 'cmd',
+    'internal', 'pkg', 'handlers', 'controllers', 'models', 'views',
+    'components', 'pages', 'routes', 'middleware', 'utils', 'helpers',
+    'modules', 'plugins', 'extensions', 'adapters', 'drivers',
+    'hooks', 'composables', 'stores', 'features', 'domain', 'infra',
+    'infrastructure', 'application', 'data', 'Sources', 'Tests',
+  ]);
+
+  const SUPPORTED_CODE_EXTS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+    '.py', '.pyw', '.java', '.kt', '.kts', '.go', '.rs', '.cs',
+    '.cpp', '.c', '.h', '.hpp', '.cc', '.rb', '.rake', '.php',
+    '.swift', '.dart', '.scala', '.sc', '.vue', '.svelte',
+    '.html', '.htm', '.css', '.scss', '.sass', '.less',
+    '.yml', '.yaml', '.sh', '.bash', '.zsh', '.fish',
+    '.sql', '.graphql', '.gql', '.tf', '.tfvars', '.proto',
+    '.toml', '.properties', '.xml', '.md',
+  ]);
+
+  function detectAutoSrcDirs(cwd, excludeList) {
+    const excludeSet = new Set(excludeList || []);
+    const candidates = new Set(DEFAULTS.srcDirs);
+
+    // Manifest-based detection
+    const pkgPath = path.join(cwd, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies, ...pkg.peerDependencies };
+        if (allDeps.react || allDeps.next)
+          for (const d of ['src', 'app', 'pages', 'components', 'hooks', 'lib', 'utils']) candidates.add(d);
+        if (allDeps['@angular/core'])
+          for (const d of ['src', 'projects', 'apps', 'libs']) candidates.add(d);
+        if (allDeps['@nestjs/core'])
+          for (const d of ['src', 'libs', 'apps']) candidates.add(d);
+        if (allDeps.vue)
+          for (const d of ['src', 'components', 'views', 'stores', 'composables', 'plugins']) candidates.add(d);
+        if (allDeps.svelte || allDeps['@sveltejs/kit'])
+          for (const d of ['src', 'lib', 'routes']) candidates.add(d);
+        if (allDeps.nx || allDeps.turbo || allDeps.lerna || pkg.workspaces)
+          for (const d of ['packages', 'apps', 'libs', 'services']) candidates.add(d);
+      } catch (_) {}
+    }
+    if (fs.existsSync(path.join(cwd, 'pyproject.toml')) || fs.existsSync(path.join(cwd, 'requirements.txt')) || fs.existsSync(path.join(cwd, 'setup.py')))
+      for (const d of ['src', 'app', 'apps', 'tests', 'examples', 'instance', 'blueprints']) candidates.add(d);
+    if (fs.existsSync(path.join(cwd, 'Gemfile')))
+      for (const d of ['app', 'lib', 'config', 'db', 'spec', 'test']) candidates.add(d);
+    if (fs.existsSync(path.join(cwd, 'composer.json')))
+      for (const d of ['app', 'resources', 'routes', 'database', 'tests']) candidates.add(d);
+    if (fs.existsSync(path.join(cwd, 'go.mod')))
+      for (const d of ['cmd', 'internal', 'pkg', 'api', 'handler', 'handlers', 'middleware', 'service']) candidates.add(d);
+    if (fs.existsSync(path.join(cwd, 'Cargo.toml')))
+      for (const d of ['src', 'crates', 'examples', 'tests', 'benches']) candidates.add(d);
+    if (fs.existsSync(path.join(cwd, 'pubspec.yaml')))
+      for (const d of ['lib', 'test', 'integration_test', 'example', 'bin']) candidates.add(d);
+    if (fs.existsSync(path.join(cwd, 'Package.swift')))
+      for (const d of ['Sources', 'Tests']) candidates.add(d);
+
+    // Top-level directory scan
+    try {
+      const entries = fs.readdirSync(cwd, { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory() || entry.name.startsWith('.') || excludeSet.has(entry.name)) continue;
+        const lname = entry.name.toLowerCase();
+        if (COMMON_CODE_DIRS.has(entry.name) || COMMON_CODE_DIRS.has(lname)) { candidates.add(entry.name); continue; }
+        const dirPath = path.join(cwd, entry.name);
+        try {
+          const subs = fs.readdirSync(dirPath, { withFileTypes: true });
+          if (subs.some(s => s.isFile() && (SUPPORTED_CODE_EXTS.has(path.extname(s.name).toLowerCase()) || s.name === 'Dockerfile'))) {
+            candidates.add(entry.name); continue;
+          }
+          if (subs.some(s => s.isDirectory() && ['src', 'lib', 'main', 'java', 'kotlin', 'scala', 'python'].includes(s.name)))
+            candidates.add(entry.name);
+        } catch (_) {}
+      }
+    } catch (_) {}
+
+    return Array.from(candidates).filter(d => {
+      try { return fs.statSync(path.join(cwd, d)).isDirectory(); } catch (_) { return false; }
+    });
+  }
+
   /**
    * Load and merge configuration for a given working directory.
    *
@@ -133,18 +217,24 @@ __factories["./src/config/loader"] = function(module, exports) {
   function loadConfig(cwd) {
     const configPath = path.join(cwd, 'gen-context.config.json');
     if (!fs.existsSync(configPath)) {
-      return deepClone(DEFAULTS);
+      const cfg = deepClone(DEFAULTS);
+      const detected = detectAutoSrcDirs(cwd, cfg.exclude);
+      if (detected.length > 0) cfg.srcDirs = detected;
+      return cfg;
     }
-  
+
     let userConfig;
     try {
       const raw = fs.readFileSync(configPath, 'utf8');
       userConfig = JSON.parse(raw);
     } catch (err) {
       console.warn(`[sigmap] config parse error in ${configPath}: ${err.message}`);
-      return deepClone(DEFAULTS);
+      const cfg = deepClone(DEFAULTS);
+      const detected = detectAutoSrcDirs(cwd, cfg.exclude);
+      if (detected.length > 0) cfg.srcDirs = detected;
+      return cfg;
     }
-  
+
     // Warn on unknown keys (helps catch typos)
     for (const key of Object.keys(userConfig)) {
       if (key.startsWith('_')) continue; // allow _comment etc.
@@ -152,7 +242,7 @@ __factories["./src/config/loader"] = function(module, exports) {
         console.warn(`[sigmap] unknown config key: "${key}" (ignored)`);
       }
     }
-  
+
     // Deep merge: top-level known keys from user override defaults
     // For object values (e.g. mcp), merge one level deep
     const merged = deepClone(DEFAULTS);
@@ -167,6 +257,13 @@ __factories["./src/config/loader"] = function(module, exports) {
         merged[key] = val;
       }
     }
+
+    // If user didn't specify srcDirs, auto-detect; fall back to DEFAULTS if nothing found
+    if (!Array.isArray(userConfig.srcDirs)) {
+      const detected = detectAutoSrcDirs(cwd, merged.exclude);
+      merged.srcDirs = detected.length > 0 ? detected : deepClone(DEFAULTS.srcDirs);
+    }
+
     // Backward compat (v3.0+): if user specified 'adapters', use it as 'outputs' too.
     // If user specified only 'outputs' (old configs), mirror to 'adapters'.
     if (merged.adapters && !Array.isArray(merged.adapters)) merged.adapters = null;
@@ -177,13 +274,13 @@ __factories["./src/config/loader"] = function(module, exports) {
     }
     return merged;
   }
-  
+
   function deepClone(obj) {
     return JSON.parse(JSON.stringify(obj));
   }
-  
-  module.exports = { loadConfig };
-  
+
+  module.exports = { loadConfig, detectAutoSrcDirs };
+
 };
 
 // ── ./src/extractors/cpp ──
@@ -3184,6 +3281,72 @@ __factories["./src/format/cache"] = function(module, exports) {
   };
 
 // ── ./src/health/scorer ──
+// ── ./src/analysis/coverage-score ──
+__factories["./src/analysis/coverage-score"] = function(module, exports) {
+
+'use strict';
+
+function coverageScore(cwd, fileEntries, config) {
+  const fs   = require('fs');
+  const path = require('path');
+
+  const srcDirs = (config && Array.isArray(config.srcDirs) && config.srcDirs.length > 0)
+    ? config.srcDirs
+    : ['src', 'app', 'lib'];
+
+  const excludeSet = new Set([
+    'node_modules', '.git', 'dist', 'build', 'out', '__pycache__',
+    '.next', 'coverage', 'target', 'vendor', '.context',
+  ]);
+  if (config && Array.isArray(config.exclude)) {
+    for (const x of config.exclude) excludeSet.add(String(x));
+  }
+
+  const includedSet = new Set((fileEntries || []).map(f => f.filePath));
+
+  const allSource = [];
+  for (const relDir of srcDirs) {
+    const absDir = path.resolve(cwd, relDir);
+    if (fs.existsSync(absDir)) _walkCov(absDir, excludeSet, allSource);
+  }
+
+  const total    = allSource.length;
+  const included = allSource.filter(f => includedSet.has(f)).length;
+  const dropped  = total - included;
+  const pct      = total > 0 ? Math.round((included / total) * 100) : 100;
+
+  const grade      = pct >= 90 ? 'A' : pct >= 75 ? 'B' : pct >= 50 ? 'C' : 'D';
+  const confidence = pct >= 90 ? 'HIGH' : pct >= 70 ? 'MEDIUM' : 'LOW';
+
+  const perModule = new Map();
+  for (const relDir of srcDirs) {
+    const absDir   = path.resolve(cwd, relDir);
+    const modFiles = allSource.filter(f => f.startsWith(absDir + path.sep) || f === absDir);
+    const modIncl  = modFiles.filter(f => includedSet.has(f)).length;
+    const modPct   = modFiles.length > 0 ? Math.round((modIncl / modFiles.length) * 100) : 100;
+    perModule.set(relDir, { total: modFiles.length, included: modIncl, pct: modPct });
+  }
+
+  return { score: pct, grade, total, included, dropped, confidence, perModule };
+}
+
+function _walkCov(dir, excludeSet, out) {
+  const fs   = require('fs');
+  const path = require('path');
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
+  for (const e of entries) {
+    if (excludeSet.has(e.name)) continue;
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) { _walkCov(full, excludeSet, out); }
+    else if (e.isFile())  { out.push(full); }
+  }
+}
+
+module.exports = { coverageScore };
+
+};
+
 __factories["./src/health/scorer"] = function(module, exports) {
   
   /**
@@ -4478,7 +4641,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
   
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '4.0.0',
+    version: '4.0.2',
     description: 'SigMap MCP server — code signatures on demand',
   };
   
@@ -6040,7 +6203,7 @@ const path = require('path');
 const os = require('os');
 const { execSync } = require('child_process');
 
-const VERSION = '4.0.0';
+const VERSION = '4.0.2';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "Zero-dependency AI context engine — 97% token reduction. No npm install. Runs on Node 18+.",
   "main": "gen-context.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '4.0.0',
+  version: '4.0.2',
   description: 'SigMap MCP server — code signatures on demand',
 };