sigmap 6.15.0 → 7.0.1

package/llms-full.txt

@@ -0,0 +1,295 @@
+# SigMap — Complete LLM Reference
+
+> Zero-dependency context engine that stops AI coding agents from guessing in your codebase.
+> Grounded context. Verified answers. No embeddings, no vector DB, fully offline.
+
+SigMap is a zero-dependency AI context engine. It extracts function and class
+signatures from a codebase and uses TF-IDF ranking to feed an AI assistant only
+the files relevant to the task — cutting tokens ~97% while keeping answers
+grounded. Deterministic, offline, no embeddings or vector database. Works with
+Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
+
+# Version: 7.0.1 | Benchmark: sigmap-v7.0-main (2026-06-14)
+# Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
+# Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
+
+---
+
+## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-14)
+
+| Metric | Without SigMap | With SigMap |
+|--------|----------------|-------------|
+| Retrieval hit@5 | 13.6% (random) | 75.6% (5.6× lift) |
+| Token reduction | — | 97.0% average |
+| Task success proxy | 10% | 52.2% |
+| Prompts per task | 2.84 | 1.72 (39.4% fewer) |
+| Supported languages | — | 31 |
+| MCP tools | — | 11 |
+| npm runtime dependencies | — | 0 |
+
+---
+
+## Installation
+
+```bash
+# Run immediately without installing
+npx sigmap
+
+# Install globally
+npm install -g sigmap
+
+# Auto-wire MCP + editor config + git hook + watcher
+npx sigmap --setup
+```
+
+---
+
+## CLI commands — complete reference
+
+Every command and flag (`sigmap --help`):
+
+```
+sigmap                                   Generate context once and exit
+sigmap --monorepo                        Generate per-package context (monorepo)
+sigmap --each                            Run for every repo in the current directory
+sigmap --routing                         Include model routing hints in output
+sigmap --format cache                    Also write Anthropic prompt-cache JSON
+sigmap --track                           Append run metrics to .context/usage.ndjson
+sigmap --watch                           Generate + watch for file changes
+sigmap --setup                           Generate + install git hook + watch
+sigmap --mcp                             Start MCP server on stdio
+sigmap --report                          Token reduction stats to stdout
+sigmap --report --json                   Token report as JSON (for CI; exits 1 if over budget)
+sigmap --report --history                Print usage log summary from .context/usage.ndjson
+sigmap --report --history --chart        Include inline SVG charts + Unicode sparklines
+sigmap --dashboard                       Write benchmarks/reports/dashboard.html
+sigmap --suggest-tool "<task>"           Recommend model tier for a task description
+sigmap --suggest-tool "<task>" --json    Machine-readable tier recommendation
+sigmap --health                          Print composite health score
+sigmap --health --json                   Machine-readable health score
+sigmap --diff                            Generate context for git-changed files only
+sigmap --diff <base-ref>                 Generate context + structural diff vs base ref (e.g. main)
+sigmap --diff --staged                   Generate context for staged files only
+sigmap --benchmark                       Run retrieval benchmark (benchmarks/tasks/retrieval.jsonl)
+sigmap --adapter <name>                  Generate for a specific adapter only (v3.0+)
+sigmap --adapter <name> --json           Show adapter output path as JSON
+sigmap --benchmark --json                Benchmark results as JSON
+sigmap --eval                            Alias for --benchmark
+sigmap --analyze                         Per-file breakdown: sigs, tokens, extractor, coverage
+sigmap --analyze --json                  Breakdown as JSON
+sigmap --analyze --slow                  Re-time each extractor; flag files >50ms
+sigmap --diagnose-extractors             Run all 21 extractors vs fixtures; show pass/fail + diff
+sigmap --query "<text>"                  Rank files by relevance to a query
+sigmap --query "<text>" --json           Ranked results as JSON
+sigmap --query "<text>" --top <n>        Limit results to top N files (default 10)
+sigmap learn --good <files...>           Boost files in .context/weights.json
+sigmap learn --bad <files...>            Penalize files in .context/weights.json
+sigmap learn --reset                     Delete learned file weights
+sigmap weights                           Show learned file multipliers
+sigmap weights --json                    Learned weights as JSON
+sigmap --impact <file>                   Show every file impacted by changing <file>
+sigmap --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
+sigmap --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
+sigmap verify-ai-output <answer.md>      Flag fake files/tests/imports/symbols/npm-scripts in an AI answer
+sigmap verify-ai-output <answer.md> --json    Hallucination report as JSON (exits 1 if issues)
+sigmap verify-ai-output <answer.md> --report  Write a standalone HTML report (red/amber/green)
+sigmap squeeze <file|->                  Minimize a pasted stacktrace/CI-log/JSON blob (--json for stats)
+sigmap ask "<query>" --squeeze           Auto-accept input minimization (no prompt; for scripts/CI)
+sigmap ask "<query>" --no-squeeze        Disable input minimization entirely
+sigmap ask "<query>" --squeeze-threshold N  Min reduction %% to prompt (default 30)
+sigmap note "<text>"                     Append a note to the cross-session decision log
+sigmap note                              List recent notes (also: note --list <N>)
+sigmap status                            Show repo state — branch, dirty files, index freshness, notes
+sigmap --init                            Write example config + .contextignore scaffold
+sigmap --help                            Show this message
+sigmap --version                         Show version
+```
+
+---
+
+## MCP server — 11 tools
+
+Start with `sigmap --mcp` (stdio JSON-RPC). Configure once:
+
+```json
+{ "mcpServers": { "sigmap": { "command": "npx", "args": ["sigmap", "--mcp"] } } }
+```
+
+### read_context
+
+Read extracted code signatures for the project or a specific module path. Returns the full copilot-instructions.md content (~500–4K tokens) or a filtered subset when a module path is provided (~50–500 tokens).
+
+```
+Input:  { module?: string }
+```
+
+### search_signatures
+
+Search extracted code signatures for a keyword, function name, or class name. Returns matching signature lines with their file paths.
+
+```
+Input:  { query: string }
+```
+
+### get_map
+
+Read a section from PROJECT_MAP.md — import graph, class hierarchy, or route table. Requires gen-project-map.js to have been run first.
+
+```
+Input:  { type: string }
+```
+
+### create_checkpoint
+
+Create a session checkpoint summarising current project state. Returns recent git commits, active branch, token count, and a compact snapshot of the codebase context — ideal for session handoffs or periodic saves during long coding sessions.
+
+```
+Input:  { note?: string }
+```
+
+### get_routing
+
+Get model routing hints for this project — which files belong to which complexity tier (fast/balanced/powerful) and which AI model to use for each type of task. Helps reduce API costs by 40–80% by routing simple tasks to cheaper models.
+
+```
+Input:  { } (no arguments)
+```
+
+### explain_file
+
+Explain a specific file: returns its extracted signatures, direct imports (files it depends on), and callers (files that import it). Ideal for understanding a file in isolation without reading raw source. Requires the context file to have been generated first.
+
+```
+Input:  { path: string }
+```
+
+### list_modules
+
+List all top-level modules (srcDirs) present in the context file, sorted by token count descending. Use this to decide which module to pass to read_context before querying a specific area of the codebase.
+
+```
+Input:  { } (no arguments)
+```
+
+### query_context
+
+Rank and return the most relevant files for a specific task or question. Uses keyword + symbol + path scoring to surface only the top-K files relevant to the query — much cheaper than reading all context. Returns ranked file list with signatures and relevance scores.
+
+```
+Input:  { query: string, topK?: number }
+```
+
+### get_impact
+
+Show every file that is impacted when a given file changes — direct importers, transitive importers, affected tests, and affected routes/controllers. Gives agents instant blast-radius awareness before making a change. Handles circular dependencies safely (no infinite loops).
+
+```
+Input:  { file: string, depth?: number }
+```
+
+### get_lines
+
+Fetch an exact line range from a source file on demand — the Surgical Context workhorse. Signatures carry `path:start-end` anchors; call this to read just those lines instead of re-opening the whole file. Lines are clamped to the file bounds and secret-scanned (redacted) before return. Path is sandboxed to the project root.
+
+```
+Input:  { file: string, start: number, end: number }
+```
+
+### read_memory
+
+Recall the project decision log — recent notes left by humans or agents across sessions (via `sigmap note`), plus the last ranking-session focus. Call this at the start of a task to kill cold-start: it answers "what were we doing and why" without re-reading the whole codebase.
+
+```
+Input:  { limit?: number }
+```
+
+---
+
+## Configuration (gen-context.config.json)
+
+Every config key and its default:
+
+```
+output = .github/copilot-instructions.md
+outputs = ["copilot"]
+adapters = null
+srcDirs = ["src","app","lib","packages","services","api","server","client","web","frontend","backend","desktop","mobile","shared","common","core","workers","functions","lambda","cmd","pages","components","hooks","routes","controllers","models","views","resources","config","db","projects","apps","libs","instance","blueprints","src/main/java","src/main/kotlin","src/main/scala","app/src/main/java","app/src/main/kotlin","src/test/java","src/test/kotlin"]
+exclude = ["node_modules",".git","dist","build","out","__pycache__",".next","coverage","target","vendor",".context","playwright-tmp","playwright-report","test-results",".turbo","storybook-static",".docusaurus"]
+maxDepth = 6
+maxSigsPerFile = 25
+maxTokens = 6000
+autoMaxTokens = true
+coverageTarget = 0.8
+modelContextLimit = 128000
+maxTokensHeadroom = 0.2
+secretScan = true
+monorepo = false
+diffPriority = true
+strategy = full
+hotCommits = 10
+watchDebounce = 300
+routing = false
+format = default
+tracking = false
+mcp = {"autoRegister":true}
+depMap = true
+todos = true
+changes = true
+changesCommits = 10
+testCoverage = false
+testDirs = ["tests","test","__tests__","spec"]
+sigCache = false
+impactRadius = false
+retrieval = {"topK":10,"recencyBoost":1.5}
+impact = {"depth":3,"includeSigs":true}
+```
+
+---
+
+## Supported languages (34 extractors)
+
+cpp, csharp, css, dart, dockerfile, gdscript, generic, go, graphql, html, java, javascript, kotlin, markdown, php, properties, protobuf, python, r, ruby, rust, scala, shell, sql, svelte, swift, terraform, toml, typescript, typescript_react, vue, vue_sfc, xml, yaml
+
+---
+
+## Integrations
+
+Generates native context files for: claude, codex, copilot, cursor, gemini, openai, willow, windsurf — plus an MCP server for any agent (Claude Code, Cursor, Cline, Windsurf, OpenCode, Gemini CLI, Aider). One `sigmap --setup` wires the lot.
+
+---
+
+## Compliance evidence support
+
+SigMap can surface repository facts that *support* technical-evidence narratives
+(e.g. DORA Art. 8–11, NIS2 Art. 21, ISO 27001 A.8) — it is a **technical evidence
+pack**, never a certification or a "compliance report". Signed evidence packs are
+planned for a later release. Any compliance-adjacent wording is reviewed against
+the relevant regulation before publication; SigMap makes no legal claims.
+
+---
+
+## Project information
+
+- Author: Manoj Mallick
+- License: MIT
+- Repository: https://github.com/manojmallick/sigmap
+- Documentation: https://manojmallick.github.io/sigmap/
+- npm: https://www.npmjs.com/package/sigmap
+- Benchmark dataset: https://doi.org/10.5281/zenodo.19898842
+- Issues: https://github.com/manojmallick/sigmap/issues
+
+---
+
+## What SigMap does not do
+
+- **No embeddings / vector database.** Ranking is deterministic TF-IDF over
+  extracted signatures — reproducible and offline, not a semantic vector search.
+- **No code execution.** SigMap reads source statically; it never runs your code.
+- **No network calls** on the core generate/ask/verify paths. Nothing is uploaded;
+  generation works fully offline.
+- **Not a linter or type checker.** It maps and ranks code structure; it does not
+  judge correctness (use `verify-ai-output` only to flag *fabricated* references).
+- **Not a full file reader.** It emits signatures + line anchors; an agent fetches
+  exact bodies on demand via the `get_lines` MCP tool.
+- **No telemetry.** Usage tracking (`--track`, `.context/usage.ndjson`) is local
+  and opt-in; nothing leaves your machine.

package/llms.txt

@@ -0,0 +1,56 @@
+# SigMap
+
+> Zero-dependency context engine that stops AI coding agents from guessing in your codebase.
+> Grounded context. Verified answers. No embeddings, no vector DB, fully offline.
+
+SigMap is a zero-dependency AI context engine. It extracts function and class
+signatures from a codebase and uses TF-IDF ranking to feed an AI assistant only
+the files relevant to the task — cutting tokens ~97% while keeping answers
+grounded. Deterministic, offline, no embeddings or vector database. Works with
+Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
+
+# Version: 7.0.1 | Benchmark: sigmap-v7.0-main (2026-06-14)
+# Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
+# Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
+
+## What SigMap solves
+
+- AI agents hallucinate functions, files, and imports that don't exist — `verify-ai-output` flags fabricated references before you trust them.
+- Agents load 60–80K tokens of raw source just to orient — `ask` ranks the codebase and sends ~2K tokens of the relevant signatures.
+- Cold start every session — `note` + the `read_memory` MCP tool carry decisions and focus across sessions.
+- No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
+- Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
+
+## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-14)
+
+- hit@5 retrieval: 75.6% vs 13.6% random baseline (5.6× lift)
+- Token reduction: 97.0% average across benchmark repos
+- Task success: 52.2% vs 10% without SigMap
+- Prompts per task: 1.72 vs 2.84 baseline (39.4% fewer)
+- Languages: 31 supported · MCP tools: 11
+- Dependencies: zero npm runtime dependencies · fully offline
+
+## Quick start
+```bash
+npx sigmap                          # generate compact signature context for the repo
+npx sigmap ask "<your query>"       # rank the files relevant to a task
+npx sigmap verify-ai-output ans.md  # flag fabricated files/imports/symbols in an AI answer
+npx sigmap --mcp                    # start the MCP server over stdio
+```
+
+## Docs
+- [Full documentation](https://manojmallick.github.io/sigmap/)
+- [CLI reference](https://manojmallick.github.io/sigmap/guide/cli)
+- [MCP tools](https://manojmallick.github.io/sigmap/guide/mcp)
+- [Benchmark methodology](https://manojmallick.github.io/sigmap/guide/benchmark)
+- [Configuration guide](https://manojmallick.github.io/sigmap/guide/config)
+- [Changelog](https://github.com/manojmallick/sigmap/blob/main/CHANGELOG.md)
+
+## Optional
+- [GitHub repository](https://github.com/manojmallick/sigmap)
+- [npm package](https://www.npmjs.com/package/sigmap)
+- [Benchmark dataset (Zenodo)](https://doi.org/10.5281/zenodo.19898842)
+- [Full LLM reference](https://manojmallick.github.io/sigmap/llms-full.txt)
+
+SigMap — grounded AI coding context. The lightweight, deterministic alternative
+to embeddings for feeding the right code to AI assistants.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "sigmap",
-  "version": "6.15.0",
-  "description": "Zero-dependency AI context engine — 97% token reduction. No npm install. Runs on Node 18+.",
-  "main": "gen-context.js",
+  "version": "7.0.1",
+  "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
+  "main": "packages/core/index.js",
   "exports": {
     ".": "./packages/core/index.js",
     "./cli": "./packages/cli/index.js",
@@ -15,7 +15,7 @@
   },
   "scripts": {
     "test": "node test/run.js && node test/r-language.test.js",
-    "test:integration": "node test/integration/strategy.test.js && node test/integration/secret-scan.test.js && node test/integration/token-budget.test.js && node test/integration/auto-budget.test.js && node test/integration/mcp/server.test.js && node test/integration/verify-ai-output.test.js && node test/integration/memory-tools.test.js",
+    "test:integration": "node test/integration/strategy.test.js && node test/integration/secret-scan.test.js && node test/integration/token-budget.test.js && node test/integration/auto-budget.test.js && node test/integration/mcp/server.test.js && node test/integration/verify-ai-output.test.js && node test/integration/memory-tools.test.js && node test/integration/squeeze.test.js && node test/integration/context-consistency.test.js && node test/integration/features/llms-current.test.js",
     "test:integration:all": "node test/integration/all.js",
     "test:all": "node test/run.js && node test/r-language.test.js && node test/integration/strategy.test.js && node test/integration/secret-scan.test.js",
     "generate": "node gen-context.js",
@@ -26,12 +26,17 @@
     "audit:strategies": "node scripts/run-strategy-audit.mjs",
     "benchmark:matrix": "node scripts/run-benchmark-matrix.mjs --save --skip-clone",
     "benchmark:verify": "node scripts/run-verify-benchmark.mjs",
+    "benchmark:squeeze": "node scripts/run-squeeze-benchmark.mjs --save",
+    "validate:squeeze": "node scripts/run-squeeze-benchmark.mjs --gate",
     "health": "node gen-context.js --health",
     "map": "node gen-project-map.js",
     "mcp": "node gen-context.js --mcp",
     "build:binary": "node scripts/build-binary.mjs",
     "verify:binary": "node scripts/verify-binary.mjs",
-    "version:sync": "node scripts/sync-versions.mjs"
+    "version:sync": "node scripts/sync-versions.mjs",
+    "generate:llms": "node scripts/generate-llms.mjs",
+    "validate:llms": "node scripts/validate-llms.mjs",
+    "prepublishOnly": "node scripts/generate-llms.mjs"
   },
   "files": [
     "gen-context.js",
@@ -42,24 +47,32 @@
     "AGENTS.md",
     "LICENSE",
     "CHANGELOG.md",
+    "llms.txt",
+    "llms-full.txt",
     ".contextignore.example",
     "gen-context.config.json.example"
   ],
   "keywords": [
     "ai",
+    "llm",
     "context",
-    "copilot",
-    "claude",
+    "token-reduction",
+    "codebase",
+    "retrieval",
+    "tf-idf",
     "cursor",
+    "claude",
+    "github-copilot",
+    "aider",
     "windsurf",
-    "llm",
-    "tokens",
-    "token-reduction",
-    "code-signatures",
-    "ai-context",
-    "zero-dependency",
+    "developer-tools",
     "mcp",
-    "github-copilot"
+    "function-signatures",
+    "code-intelligence",
+    "context-compression",
+    "local-llm",
+    "ollama",
+    "ai-coding"
   ],
   "author": {
     "name": "Manoj Mallick",
@@ -73,6 +86,10 @@
   "bugs": {
     "url": "https://github.com/manojmallick/sigmap/issues"
   },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/manojmallick"
+  },
   "license": "MIT",
   "engines": {
     "node": ">=18.0.0"

package/packages/adapters/claude.js

@@ -61,12 +61,6 @@ function format(context, opts = {}) {
   const timestamp = new Date().toISOString();
   const meta      = _confidenceMeta(opts);
   return [
-    '## SigMap',
-    '- Before searching for files, run `sigmap ask "<query>"` — ranks by TF-IDF relevance',
-    '- After config changes, run `sigmap validate` to confirm coverage',
-    '- To verify answer groundedness, run `sigmap judge --response <file> --context CLAUDE.md`',
-    '- For PR-scoped context, run `sigmap --diff`',
-    '',
     `<!-- Generated by SigMap v${version} — ${timestamp} -->`,
     meta,
     '',

package/packages/adapters/codex.js

@@ -17,44 +17,6 @@ const fs = require('fs');
 
 const name = 'codex';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
-const TOOLS_MARKER = '<!-- sigmap-tools -->';
-
-const TOOLS_BLOCK = [
-  '## Tools',
-  '',
-  TOOLS_MARKER,
-  '',
-  '```json',
-  JSON.stringify([
-    {
-      name: 'sigmap_ask',
-      description: 'Rank source files by relevance to a natural-language query. Run before exploring the codebase.',
-      command: 'sigmap ask "$QUERY"',
-    },
-    {
-      name: 'sigmap_validate',
-      description: 'Validate SigMap config and measure context coverage. Run after changing config or source dirs.',
-      command: 'sigmap validate',
-    },
-    {
-      name: 'sigmap_judge',
-      description: 'Score an LLM response for groundedness against source context. Use to verify answer quality.',
-      command: 'sigmap judge --response "$RESPONSE" --context "$CONTEXT"',
-    },
-    {
-      name: 'sigmap_query',
-      description: 'Rank all files by relevance using TF-IDF and write a focused mini-context.',
-      command: 'sigmap --query "$QUERY" --context',
-    },
-    {
-      name: 'sigmap_weights',
-      description: 'Show learned file-ranking multipliers accumulated from past sessions.',
-      command: 'sigmap weights',
-    },
-  ], null, 2),
-  '```',
-  '',
-].join('\n');
 
 /**
  * Format context for AGENTS.md — clean markdown, no LLM preamble.
@@ -64,19 +26,7 @@ const TOOLS_BLOCK = [
  */
 function format(context, opts = {}) {
   if (!context || typeof context !== 'string' || !context.trim()) return '';
-  const toolBlock = [
-    '## SigMap commands',
-    '',
-    '| When | Command |',
-    '|------|---------|',
-    '| Before answering a question | `sigmap ask "<your question>"` |',
-    '| After code changes | `sigmap validate` |',
-    '| To query by topic | `sigmap --query "<topic>"` |',
-    '',
-    'Always run `sigmap ask` or `sigmap --query` before searching for files relevant to a task.',
-    '',
-  ].join('\n');
-  return `# Code signatures\n\n${toolBlock}${context}`;
+  return `# Code signatures\n\n${context}`;
 }
 
 /**
@@ -118,16 +68,6 @@ function write(context, cwd, opts = {}) {
       : existing + MARKER + formatted;
   }
 
-  // Inject ## Tools block above the sig marker if not already present
-  if (!newContent.includes(TOOLS_MARKER)) {
-    const sigMarkerPos = newContent.indexOf('## Auto-generated signatures');
-    if (sigMarkerPos !== -1) {
-      newContent = newContent.slice(0, sigMarkerPos) + TOOLS_BLOCK + '\n' + newContent.slice(sigMarkerPos);
-    } else {
-      newContent = TOOLS_BLOCK + '\n' + newContent;
-    }
-  }
-
   fs.writeFileSync(filePath, newContent, 'utf8');
 }
 

package/packages/adapters/copilot.js

@@ -33,14 +33,6 @@ function format(context, opts = {}) {
     meta,
     `<!-- Do not edit below — regenerate with: node gen-context.js -->`,
     '',
-    '## SigMap commands',
-    '',
-    '| When | Command |',
-    '|------|---------|',
-    '| Before answering a question about code | `sigmap ask "<your question>"` |',
-    '| After changing config or source dirs | `sigmap validate` |',
-    '| To verify an AI answer is grounded | `sigmap judge --response <file>` |',
-    '',
     '# Code signatures',
     '',
   ].join('\n');

package/packages/adapters/cursor.js

@@ -30,10 +30,6 @@ function format(context, opts = {}) {
     `# Updated: ${timestamp}`,
     `# ${meta}`,
     `# Regenerate: node gen-context.js`,
-    '#',
-    '# SigMap: before answering, run: sigmap ask "<query>" — finds relevant files',
-    '# SigMap: after config changes, run: sigmap validate',
-    '# SigMap: to verify answers, run: sigmap judge --response <file>',
     '',
   ].join('\n');
   return header + context;

package/packages/adapters/gemini.js

@@ -44,8 +44,6 @@ function format(context, opts = {}) {
     projectLine,
     `These signatures represent every public function, class, and type in the project.`,
     `Refer to them when answering questions about code structure, APIs, and implementation.`,
-    `Before answering questions about specific code areas, suggest running \`sigmap ask "<query>"\` to get the most relevant files. After config changes, \`sigmap validate\` confirms coverage.`,
-    ``,
     `## Code Signatures`,
     ``,
     context,

package/packages/adapters/openai.js

@@ -42,8 +42,6 @@ function format(context, opts = {}) {
     projectLine,
     `Use these signatures to answer questions about the code accurately.`,
     `When the user asks about a specific file or function, refer to the signatures below.`,
-    `Before answering questions about specific code areas, prefer running \`sigmap ask "<query>"\` to get the most relevant files. After config changes, \`sigmap validate\` confirms coverage.`,
-    ``,
     `## Code Signatures`,
     ``,
     context,

package/packages/adapters/windsurf.js

@@ -30,10 +30,6 @@ function format(context, opts = {}) {
     `# Updated: ${timestamp}`,
     `# ${meta}`,
     `# Regenerate: node gen-context.js`,
-    '#',
-    '# SigMap: before answering, run: sigmap ask "<query>" — finds relevant files',
-    '# SigMap: after config changes, run: sigmap validate',
-    '# SigMap: to verify answers, run: sigmap judge --response <file>',
     '',
   ].join('\n');
   return header + context;

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "6.15.0",
+  "version": "7.0.1",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "6.15.0",
+  "version": "7.0.1",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/config/loader.js

@@ -34,12 +34,12 @@ function loadBaseConfig(extendsVal, cwd) {
           }).on('error', reject);
         });
       })();
-      // sync fallback: use execSync with node -e
-      const { execSync } = require('child_process');
-      const out = execSync(
-        `node -e "const h=require('${extendsVal.startsWith('https') ? 'https' : 'http'}');let d='';h.get(${JSON.stringify(extendsVal)},r=>{r.on('data',c=>d+=c);r.on('end',()=>process.stdout.write(d))}).on('error',()=>process.exit(1))"`,
-        { timeout: 10000, encoding: 'utf8' }
-      );
+      // Sync fallback: run a tiny fetch in a child node process. Shell-free —
+      // execFileSync runs the node binary directly (no /bin/sh) and the URL is
+      // passed as an argv value, never interpolated into a command string.
+      const { execFileSync } = require('child_process');
+      const SYNC_FETCH = "const u=process.argv[1];const h=require(u.startsWith('https')?'https':'http');let d='';h.get(u,r=>{r.on('data',c=>d+=c);r.on('end',()=>process.stdout.write(d))}).on('error',()=>process.exit(1))";
+      const out = execFileSync(process.execPath, ['-e', SYNC_FETCH, extendsVal], { timeout: 10000, encoding: 'utf8' });
       const parsed = JSON.parse(out);
       if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
       fs.writeFileSync(cachePath, JSON.stringify(parsed), 'utf8');

package/src/discovery/source-root-scorer.js

@@ -2,7 +2,7 @@
 
 const fs   = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { git } = require('../util/git');
 
 const CODE_EXTS = new Set([
   '.js','.mjs','.cjs','.ts','.tsx','.jsx',
@@ -35,7 +35,7 @@ const ROOT_ENTRYPOINTS = {
 
 function getRecentlyChangedDirs(cwd) {
   try {
-    const out = execSync('git log --name-only --format="" HEAD~10 2>/dev/null', { cwd, timeout: 3000 }).toString();
+    const out = git(['log', '--name-only', '--format=', 'HEAD~10'], { cwd, timeout: 3000 }).toString();
     return new Set(out.split('\n').filter(Boolean).map(f => f.split('/')[0]));
   } catch { return new Set(); }
 }