sigmap 6.15.0 → 7.0.1

package/CHANGELOG.md

@@ -10,6 +10,42 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [7.0.1] — 2026-06-14
+
+Patch release — supply-chain hardening and package hygiene, plus a wider star nudge.
+
+### Fixed
+- **Eliminated system-shell access (#252):** every `child_process.execSync` call (which runs via `/bin/sh -c`) was converted to shell-free `execFileSync` with an arguments array. Several commands had previously interpolated values into the command string (`git diff ${range}`, `HEAD~${n}`, `printf '%s' … | ${clipCmd}`, `node -e "…http.get…"`) — a real shell-injection surface. New `src/util/git.js` (`git()`/`tryGit()`) centralizes shell-free git; the `extends` config fetch passes the URL as an argv to node; `compare` spawns node by argv; clipboard copy writes via stdin. Net: zero `execSync`/`exec`/`shell:true` in the published surface, which clears Socket's "Shell access" capability alert.
+
+### Changed
+- **Star nudge now counts plain `sigmap` runs (#251):** the one-time GitHub-star nudge previously only counted `ask`/`squeeze`. Users who only run `sigmap` to generate the context file now also reach the 10-run threshold. Counted once per process at the end of generation (monorepo-safe, tracked at the repo root); interactive-only — silent under `--json`/`--report`/`--quiet`/non-TTY.
+- **`main` points at the importable core (#252):** `package.json` `main` changed from the CLI bundle (`gen-context.js`, which runs `main()` + exits on `require`) to `packages/core/index.js`, matching `exports["."]`. Bundlephobia and legacy resolvers now see the real zero-dep API.
+- **Removed unused device fingerprint (#252):** the star nudge no longer records `machineId = sha256(os.hostname())` in `.context/usage.json` — it was never read or transmitted. Dropped the now-unused `os`/`crypto` requires.
+
+---
+
+## [7.0.0] — 2026-06-14
+
+Major release — **Squeeze** makes `ask` minimize pasted input by default, a behavioral change to the core command.
+
+### Added
+- **Squeeze — input minimization (#238):** `sigmap ask` now classifies a pasted blob (stack trace / CI log / JSON) and minimizes it before ranking — deduping frames, stripping vendor noise, collapsing repeated array items — and **enriches the top stack frame** with its real signature from the symbol index. New `sigmap squeeze <file|->` command and `--squeeze` (auto-accept), `--no-squeeze`, `--squeeze-threshold N` flags. New `src/squeeze/{classify,cilog,stacktrace,jsonpayload,index}.js`; zero-dep, deterministic, offline.
+- **Star Nudge (#238):** a one-time, race-safe GitHub-star prompt after ≥10 runs / ≥8 successes (`.context/usage.json`).
+- **`llms.txt` + `llms-full.txt` generator (#243):** SigMap's own LLM reference is generated from source of truth (MCP tools, config keys, languages, `version.json` metrics, CLI help), validated in CI so it can never go stale, and published to the docs site + repo root. `npm run generate:llms` / `validate:llms`; `prepublishOnly` regenerates before publish.
+- **npm discoverability + GitHub Sponsors (#241):** benefit-driven description, 20 keywords, `funding` field + `.github/FUNDING.yml`.
+
+### Changed
+- **BREAKING: `sigmap ask` now classifies its input and may prompt** to minimize large pasted stack traces / logs / JSON before ranking. Interactive only — piped/CI usage is unaffected (no prompt), and `--no-squeeze` fully disables it.
+- **Token budget keeps full signatures (#240):** when context exceeds `maxTokens`, low-priority files are dropped (and only marginal overflow collapses to anchors) — signatures keep their parameters/return types instead of being gutted to bare line anchors. The repo's own context config raises `maxTokens` (auto-scaling off) so it fits all files with full signatures.
+- **One consistent usage block (#240):** every generated context file (CLAUDE.md / AGENTS.md / copilot-instructions.md / …) now carries a single canonical `## SigMap commands` block emitted from `formatOutput`; the redundant `## Tools` JSON in AGENTS.md was removed.
+- **Benchmark repos pinned to fixed commits (#236):** retrieval/token benchmarks now clone pinned SHAs, so metrics move only when SigMap changes — not when upstream repos do.
+
+### Fixed
+- **Signatures no longer gutted under budget (#240):** the headline regression in the generated context files is resolved (see Changed).
+- **prdiff symbol-name extraction (#247):** the changes block no longer emits phantom 2-char fragments (e.g. `+is`/`~is`); `extractName` now handles `export class`, `const x = () =>`, async/visibility modifiers, and returns nothing for re-export lines.
+
+---
+
 ## [6.15.0] — 2026-06-09
 
 ### Added

package/README.md

@@ -48,9 +48,9 @@ SigMap extracts function and class signatures from your codebase and feeds the r
 ## Why SigMap?
 
 - **75.6% hit@5** — right file found in top 5 results (vs 13.6% baseline)
-- **97.1% token reduction** — average across 21 real repos
-- **51.1% task success rate** — up from 10% without context
-- **1.73 prompts per task** — down from 2.84 (39.0% fewer retries)
+- **97.0% token reduction** — average across 21 real repos
+- **52.2% task success rate** — up from 10% without context
+- **1.72 prompts per task** — down from 2.84 (39.4% fewer retries)
 - **31 languages supported** — TypeScript, Python, Go, Rust, Java, R, and 25 others
 - **No vendor lock-in** — works with any AI assistant or local LLM
 - **No API costs** — use local models (Ollama, llama.cpp, vLLM) with zero token fees
@@ -87,13 +87,13 @@ Ask → Rank → Context → Validate → Judge → Learn
 ## Benchmark
 
 ```
-Benchmark : sigmap-v6.15-main (21 repositories, including R language)
-Date      : 2026-06-09
+Benchmark : sigmap-v7.0-main (21 repositories, including R language)
+Date      : 2026-06-14
 
 Hit@5          : 75.6%   (baseline 13.6%  — 5.6× lift)
-Token reduction: 97.1%   (across 21 repos)
-Prompt reduction : 39.0% (2.84 → 1.73 prompts per task)
-Task success   : 51.1%   (baseline 10%)
+Token reduction: 97.0%   (across 21 repos)
+Prompt reduction : 39.4% (2.84 → 1.72 prompts per task)
+Task success   : 52.2%   (baseline 10%)
 Repos tested   : 21 (JavaScript, Python, Go, Rust, Java, R, C++, C#, Dart, Swift, Ruby, PHP, Scala, Kotlin, and more)
 ```