sigmap 7.0.0 → 7.1.0

package/CHANGELOG.md

@@ -10,6 +10,35 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [7.1.0] — 2026-06-16
+
+Minor release — a token-savings dashboard in the terminal, plus domain and sponsorship docs.
+
+### Added
+- **Token-savings dashboard — `sigmap gain` (#260):** surfaces cumulative savings right in the terminal — total tokens saved, % efficiency, estimated $ saved, latency, and a by-operation breakdown, plus `gain --all` for daily / weekly / monthly trends. Savings are captured per operation (`ask`, `generate`) into a dedicated local log `.context/gain.ndjson` (counts only — no paths, source, or query text). Capture is **default-on** and privacy-safe; opt out via `--no-track`, `SIGMAP_NO_TRACK=1`, or `config.gainTracking:false`. The legacy `usage.ndjson` / `--track` health log is unchanged. New `src/tracking/{aggregate,pricing}.js` (zero-dep aggregation + model→$/Mtok pricing) and `src/format/gain-terminal.js` (ANSI renderer, `NO_COLOR`/non-TTY safe). Flags: `gain --all | --json | --since <7d|ISO> | --top <n> | --model <name> | --reset`. "Saved" is labeled everywhere as an estimate vs the whole-file baseline.
+
+### Fixed
+- **Docs served at the sigmap.io root (#258):** the docs site now builds with base `/` (dropped the `/sigmap/` path prefix) and the project domain points to sigmap.io.
+
+### Changed
+- **Sponsorship transparency (#257):** README gained a Sponsor section with a tier ladder and funding goal; detail moved into `SPONSOR.md`, with an "About the maintainer" note and a low-barrier welcome.
+
+---
+
+## [7.0.1] — 2026-06-14
+
+Patch release — supply-chain hardening and package hygiene, plus a wider star nudge.
+
+### Fixed
+- **Eliminated system-shell access (#252):** every `child_process.execSync` call (which runs via `/bin/sh -c`) was converted to shell-free `execFileSync` with an arguments array. Several commands had previously interpolated values into the command string (`git diff ${range}`, `HEAD~${n}`, `printf '%s' … | ${clipCmd}`, `node -e "…http.get…"`) — a real shell-injection surface. New `src/util/git.js` (`git()`/`tryGit()`) centralizes shell-free git; the `extends` config fetch passes the URL as an argv to node; `compare` spawns node by argv; clipboard copy writes via stdin. Net: zero `execSync`/`exec`/`shell:true` in the published surface, which clears Socket's "Shell access" capability alert.
+
+### Changed
+- **Star nudge now counts plain `sigmap` runs (#251):** the one-time GitHub-star nudge previously only counted `ask`/`squeeze`. Users who only run `sigmap` to generate the context file now also reach the 10-run threshold. Counted once per process at the end of generation (monorepo-safe, tracked at the repo root); interactive-only — silent under `--json`/`--report`/`--quiet`/non-TTY.
+- **`main` points at the importable core (#252):** `package.json` `main` changed from the CLI bundle (`gen-context.js`, which runs `main()` + exits on `require`) to `packages/core/index.js`, matching `exports["."]`. Bundlephobia and legacy resolvers now see the real zero-dep API.
+- **Removed unused device fingerprint (#252):** the star nudge no longer records `machineId = sha256(os.hostname())` in `.context/usage.json` — it was never read or transmitted. Dropped the now-unused `os`/`crypto` requires.
+
+---
+
 ## [7.0.0] — 2026-06-14
 
 Major release — **Squeeze** makes `ask` minimize pasted input by default, a behavioral change to the core command.

package/README.md

@@ -100,7 +100,7 @@ Repos tested   : 21 (JavaScript, Python, Go, Rust, Java, R, C++, C#, Dart, Swift
 Measured on 90 coding tasks across 18 real public repos. No LLM API — fully reproducible.
 
 **Resources:**
-- [Full methodology →](https://manojmallick.github.io/sigmap/guide/benchmark.html)
+- [Full methodology →](https://sigmap.io/guide/benchmark.html)
 - [Benchmark suite (GitHub)](https://github.com/manojmallick/sigmap-benchmark-suite) — scripts, tasks, and raw data
 - [Benchmark data (Zenodo)](https://zenodo.org/records/19898842) — archived results for reproducibility
 
@@ -172,8 +172,8 @@ sigmap --adapter claude    # works with Claude Code
 **Open-source agents & local LLMs:**
 
 Use SigMap with open-source tools and fully self-hosted setups:
-- **[Open-source agents guide →](https://manojmallick.github.io/sigmap/guide/agents)** — OpenCode, Aider, OpenHands, Cline
-- **[Local LLMs guide →](https://manojmallick.github.io/sigmap/guide/local-llms)** — Ollama, llama.cpp, vLLM (no API keys, full privacy)
+- **[Open-source agents guide →](https://sigmap.io/guide/agents)** — OpenCode, Aider, OpenHands, Cline
+- **[Local LLMs guide →](https://sigmap.io/guide/local-llms)** — Ollama, llama.cpp, vLLM (no API keys, full privacy)
 
 **IDE extensions:**
 
@@ -219,21 +219,21 @@ sigmap --health
 | 👶 **New** | [Quick start guide](docs/readmes/GETTING_STARTED.md) — setup in 60 seconds |
 | ⚡ **Daily** | `sigmap ask` / `sigmap validate` / `sigmap judge` |
 | 🧠 **Advanced** | [Context strategies](docs/readmes/CONTEXT_STRATEGIES.md) · [MCP setup](docs/readmes/MCP_SETUP.md) |
-| 🏢 **Teams** | [Config reference](https://manojmallick.github.io/sigmap/guide/config.html) · [CI setup](docs/readmes/ENTERPRISE_SETUP.md) |
+| 🏢 **Teams** | [Config reference](https://sigmap.io/guide/config.html) · [CI setup](docs/readmes/ENTERPRISE_SETUP.md) |
 
 ---
 
 ## Docs
 
-**[manojmallick.github.io/sigmap](https://manojmallick.github.io/sigmap)**
+**[sigmap.io](https://sigmap.io)**
 
 | Section | Link |
 |---|---|
-| CLI reference (32 commands) | [cli.html](https://manojmallick.github.io/sigmap/guide/cli.html) |
-| Benchmark methodology | [benchmark.html](https://manojmallick.github.io/sigmap/guide/benchmark.html) |
-| Config reference | [config.html](https://manojmallick.github.io/sigmap/guide/config.html) |
-| Roadmap | [roadmap.html](https://manojmallick.github.io/sigmap/guide/roadmap.html) |
-| 31 languages | [generalization.html](https://manojmallick.github.io/sigmap/guide/generalization.html) |
+| CLI reference (32 commands) | [cli.html](https://sigmap.io/guide/cli.html) |
+| Benchmark methodology | [benchmark.html](https://sigmap.io/guide/benchmark.html) |
+| Config reference | [config.html](https://sigmap.io/guide/config.html) |
+| Roadmap | [roadmap.html](https://sigmap.io/guide/roadmap.html) |
+| 31 languages | [generalization.html](https://sigmap.io/guide/generalization.html) |
 
 ---
 
@@ -245,6 +245,14 @@ If SigMap saves you context or API spend, a ⭐ on [GitHub](https://github.com/m
 
 ---
 
+## Sponsor
+
+SigMap is built and maintained by one developer, kept **zero-dependency**, offline, and free. If it saves your team context or API spend, sponsoring keeps it that way — and funds the benchmark CI, the `sigmap.io` domain, and ongoing supply-chain hardening.
+
+💜 **[Become a sponsor →](https://github.com/sponsors/manojmallick)** · see **[SPONSOR.md](SPONSOR.md)** for tiers and exactly where your support goes. Any amount helps — even $1/mo — and a ⭐ or a share counts too.
+
+---
+
 ## Contributing
 
 SigMap welcomes contributions! 
@@ -284,7 +292,7 @@ TypeScript · JavaScript · Python · Java · Kotlin · Go · Rust · C# · C/C+
 
 All implemented with zero external dependencies.
 
-[Full language table →](https://manojmallick.github.io/sigmap/guide/generalization.html)
+[Full language table →](https://sigmap.io/guide/generalization.html)
 
 ---
 
@@ -296,7 +304,7 @@ MIT © 2026 [Manoj Mallick](https://github.com/manojmallick) · Made in Amsterda
 
 <div align="center">
 
-**[Docs](https://manojmallick.github.io/sigmap) · [Changelog](CHANGELOG.md) · [Roadmap](https://manojmallick.github.io/sigmap/roadmap.html) · [npm](https://www.npmjs.com/package/sigmap)**
+**[Docs](https://sigmap.io) · [Changelog](CHANGELOG.md) · [Roadmap](https://sigmap.io/roadmap.html) · [npm](https://www.npmjs.com/package/sigmap)**
 
 ⭐ [Star on GitHub](https://github.com/manojmallick/sigmap) if SigMap saves you tokens.
 

package/gen-context.js

@@ -236,12 +236,11 @@ __factories["./src/config/loader"] = function(module, exports) {
         }
       }
       try {
-        const { execSync } = require('child_process');
-        const proto = extendsVal.startsWith('https') ? 'https' : 'http';
-        const out = execSync(
-          `node -e "const h=require('${proto}');let d='';h.get(${JSON.stringify(extendsVal)},r=>{r.on('data',c=>d+=c);r.on('end',()=>process.stdout.write(d))}).on('error',()=>process.exit(1))"`,
-          { timeout: 10000, encoding: 'utf8' }
-        );
+        // Shell-free: run the node binary directly with the URL passed as an argv
+        // value (never interpolated into a command string, never via /bin/sh).
+        const { execFileSync } = require('child_process');
+        const SYNC_FETCH = "const u=process.argv[1];const h=require(u.startsWith('https')?'https':'http');let d='';h.get(u,r=>{r.on('data',c=>d+=c);r.on('end',()=>process.stdout.write(d))}).on('error',()=>process.exit(1))";
+        const out = execFileSync(process.execPath, ['-e', SYNC_FETCH, extendsVal], { timeout: 10000, encoding: 'utf8' });
         const parsed = JSON.parse(out);
         if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
         fs.writeFileSync(cachePath, JSON.stringify(parsed), 'utf8');
@@ -5533,7 +5532,6 @@ __factories["./src/mcp/handlers"] = function(module, exports) {
 
 const fs   = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
 
 const CONTEXT_FILE = path.join('.github', 'copilot-instructions.md');
 const CONTEXT_COLD_FILE = path.join('.github', 'context-cold.md');
@@ -5680,19 +5678,14 @@ function createCheckpoint(args, cwd) {
   // ── Git info ────────────────────────────────────────────────────────────
   lines.push('## Git state');
   try {
-    const branch = execSync('git rev-parse --abbrev-ref HEAD', {
-      cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    const branch = __git(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }).trim();
     lines.push(`**Branch:** ${branch}`);
   } catch (_) {
     lines.push('**Branch:** (not a git repo)');
   }
 
   try {
-    const log = execSync(
-      'git log --oneline -5 --no-decorate 2>/dev/null',
-      { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
-    ).trim();
+    const log = __git(['log', '--oneline', '-5', '--no-decorate'], { cwd }).trim();
     if (log) {
       lines.push('');
       lines.push('**Recent commits:**');
@@ -6261,7 +6254,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '7.0.0',
+  version: '7.1.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 
@@ -7152,8 +7145,6 @@ __factories["./src/session/notes"] = function(module, exports) {
 
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
-
 const NOTES_FILE = path.join('.context', 'notes.ndjson');
 const MAX_TEXT = 2000;
 
@@ -7162,13 +7153,7 @@ function notesPath(cwd) {
 }
 
 function _currentBranch(cwd) {
-  try {
-    return execSync('git rev-parse --abbrev-ref HEAD', {
-      cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim() || null;
-  } catch (_) {
-    return null;
-  }
+  return __tryGit(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }) || null;
 }
 
 /**
@@ -8703,10 +8688,9 @@ __factories["./src/format/llms-txt"] = function(module, exports) {
   'use strict';
   const path = require('path');
   const fs   = require('fs');
-  const { execSync } = require('child_process');
   function outputPath(cwd) { return path.join(cwd, 'llms.txt'); }
   function getShortCommit(cwd) {
-    try { return execSync('git rev-parse --short HEAD', { cwd, timeout: 2000 }).toString().trim(); }
+    try { return __tryGit(['rev-parse', '--short', 'HEAD'], { cwd, timeout: 2000 }); }
     catch (_) { return ''; }
   }
   function detectVersion(cwd) {
@@ -8944,6 +8928,20 @@ __factories["./src/discovery/source-root-registry"] = function(module, exports)
   module.exports = { REGISTRY };
 };
 
+// ── ./src/util/git ──
+__factories["./src/util/git"] = function(module, exports) {
+  'use strict';
+  const { execFileSync } = require('child_process');
+  function git(args, opts = {}) {
+    return execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], ...opts });
+  }
+  function tryGit(args, opts = {}) {
+    try { return git(args, opts).toString().trim(); }
+    catch (_) { return ''; }
+  }
+  module.exports = { git, tryGit };
+};
+
 // ── ./src/discovery/sigmapignore ──
 __factories["./src/discovery/sigmapignore"] = function(module, exports) {
   'use strict';
@@ -9031,14 +9029,13 @@ __factories["./src/discovery/source-root-scorer"] = function(module, exports) {
   'use strict';
   const fs   = require('fs');
   const path = require('path');
-  const { execSync } = require('child_process');
   const CODE_EXTS = new Set(['.js','.mjs','.cjs','.ts','.tsx','.jsx','.py','.rb','.go','.rs','.java','.kt','.cs','.cpp','.c','.h','.swift','.dart','.scala','.php']);
   const AUTO_SKIP = new Set(['node_modules','dist','build','.git','.next','.nuxt','vendor','DerivedData','Pods','target','coverage','__pycache__','.venv','venv','.build','Carthage','storybook-static','.gradle','bin','obj','.vs']);
   const PENALTY_DIRS = new Set(['test','tests','spec','__tests__','e2e','docs','doc','docs-vp','examples','example','fixtures','mocks','__mocks__','demo','samples','migrations','benchmarks','scripts']);
   const ROOT_ENTRYPOINTS = { go: ['main.go'], python: ['app.py','main.py','wsgi.py','asgi.py'], javascript: ['index.js','server.js','app.js'], typescript: ['index.ts','main.ts'], rust: [], php: ['index.php'] };
   function getRecentlyChangedDirs(cwd) {
     try {
-      const out = execSync('git log --name-only --format="" HEAD~10 2>/dev/null', { cwd, timeout: 3000 }).toString();
+      const out = __git(['log', '--name-only', '--format=', 'HEAD~10'], { cwd, timeout: 3000 }).toString();
       return new Set(out.split('\n').filter(Boolean).map(f => f.split('/')[0]));
     } catch { return new Set(); }
   }
@@ -10027,8 +10024,6 @@ __factories["./src/nudge"] = function(module, exports) {
 
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
-const crypto = require('crypto');
 
 const RUN_THRESHOLD = 10;
 const SUCCESS_THRESHOLD = 8;
@@ -10038,7 +10033,7 @@ function usagePath(cwd) { return path.join(cwd, '.context', 'usage.json'); }
 function defaultUsage() {
   return {
     totalRuns: 0, successfulRuns: 0, squeezeOffered: 0, squeezeAccepted: 0,
-    starNudgeShown: false, machineId: '', firstRunDate: null, lastRunDate: null,
+    starNudgeShown: false, firstRunDate: null, lastRunDate: null,
   };
 }
 
@@ -10091,9 +10086,6 @@ function checkStarNudge(cwd, runSuccess, opts = {}) {
   const today = opts.today || new Date().toISOString().slice(0, 10);
   if (!usage.firstRunDate) usage.firstRunDate = today;
   usage.lastRunDate = today;
-  if (!usage.machineId) {
-    try { usage.machineId = 'sha256-' + crypto.createHash('sha256').update(os.hostname()).digest('hex').slice(0, 16); } catch (_) {}
-  }
 
   let nudged = false;
   if (!usage.starNudgeShown && usage.totalRuns >= RUN_THRESHOLD && usage.successfulRuns >= SUCCESS_THRESHOLD) {
@@ -10956,9 +10948,20 @@ module.exports = { verify, buildSymbolSet, loadDeps, loadScripts, isTestPath };
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { execSync } = require('child_process');
 
-const VERSION = '7.0.0';
+// Shell-free subprocess helpers. execFileSync runs the binary directly (never
+// /bin/sh), so there is no shell-injection surface and no "Shell access"
+// capability for supply-chain scanners. stderr is discarded by default.
+function __git(args, opts = {}) {
+  const { execFileSync } = require('child_process');
+  return execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], ...opts });
+}
+function __tryGit(args, opts = {}) {
+  try { return __git(args, opts).toString().trim(); }
+  catch (_) { return ''; }
+}
+
+const VERSION = '7.1.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -11340,9 +11343,7 @@ function applyTokenBudget(fileEntries, maxTokens) {
 function getRecentlyCommittedFiles(cwd, count) {
   const n = count || 10;
   try {
-    const out = execSync(`git log --name-only --format="" -n ${n}`, {
-      cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-    });
+    const out = __git(['log', '--name-only', '--format=', '-n', String(n)], { cwd });
     return new Set(out.split('\n').map((f) => f.trim()).filter(Boolean).map((f) => path.resolve(cwd, f)));
   } catch (_) {
     return new Set();
@@ -11354,8 +11355,8 @@ function getRecentlyCommittedFiles(cwd, count) {
 // ---------------------------------------------------------------------------
 function getDiffFiles(cwd, stagedOnly) {
   try {
-    const cmd = stagedOnly ? 'git diff --cached --name-only' : 'git diff HEAD --name-only';
-    const out = execSync(cmd, { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    const gitArgs = stagedOnly ? ['diff', '--cached', '--name-only'] : ['diff', 'HEAD', '--name-only'];
+    const out = __git(gitArgs, { cwd });
     return new Set(
       out.split('\n').map((f) => f.trim()).filter(Boolean).map((f) => path.resolve(cwd, f))
     );
@@ -11453,17 +11454,13 @@ function buildChangesSection(cwd, config, fileEntries) {
   try {
     let range = `HEAD~${n}..HEAD`;
     try {
-      execSync(`git rev-parse --verify HEAD~${n} 2>/dev/null`, {
-        cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-      });
+      __git(['rev-parse', '--verify', `HEAD~${n}`], { cwd });
     } catch (_) {
       // HEAD~n doesn't exist (shallow repo) — clamp to deepest valid ancestor
       let best = 1;
       for (let k = n - 1; k >= 2; k--) {
         try {
-          execSync(`git rev-parse --verify HEAD~${k} 2>/dev/null`, {
-            cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-          });
+          __git(['rev-parse', '--verify', `HEAD~${k}`], { cwd });
           best = k;
           break;
         } catch (_) {}
@@ -11471,15 +11468,11 @@ function buildChangesSection(cwd, config, fileEntries) {
       range = `HEAD~${best}..HEAD`;
     }
 
-    const namesOnly = execSync(`git diff ${range} --name-only 2>/dev/null`, {
-      cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-    });
+    const namesOnly = __git(['diff', range, '--name-only'], { cwd });
     const changed = new Set(namesOnly.split('\n').map((l) => l.trim()).filter(Boolean).map((f) => path.resolve(cwd, f)));
     if (changed.size === 0) return [];
 
-    const timeAgo = execSync('git log -1 --format="%cr" 2>/dev/null', {
-      cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    const timeAgo = __git(['log', '-1', '--format=%cr'], { cwd }).trim();
 
     const lines = [`## changes (last ${n} commits — ${timeAgo})`, '```'];
     let hasDelta = false;
@@ -11488,9 +11481,7 @@ function buildChangesSection(cwd, config, fileEntries) {
       const rel = path.relative(cwd, entry.filePath);
       let diff = '';
       try {
-        diff = execSync(`git diff ${range} -- "${rel}" 2>/dev/null`, {
-          cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        diff = __git(['diff', range, '--', rel], { cwd });
       } catch (_) {
         continue;
       }
@@ -12203,6 +12194,7 @@ function runDiff(cwd, config, stagedOnly, baseRef) {
 // Core generate pipeline
 // ---------------------------------------------------------------------------
 function runGenerate(cwd, config, reportMode, reportJson = false) {
+  const __genT0 = Date.now();
   const ignorePatterns = loadIgnorePatterns(cwd);
   let allFiles = buildFileList(cwd, config);
 
@@ -12402,7 +12394,7 @@ function runGenerate(cwd, config, reportMode, reportJson = false) {
     printReport(result.inputTokenTotal, result.finalTokens, result.fileCount, result.droppedCount, reportJson, effectiveMaxTokens, result.coverageResult, config.autoMaxTokens !== false && effectiveMaxTokens !== config.maxTokens, config.maxTokens);
   }
 
-  // Usage tracking (v0.9) — optional append-only NDJSON log
+  // Usage tracking (v0.9) — legacy health log, opt-in via config.tracking / --track.
   const trackingEnabled = !!(config.tracking || process.argv.includes('--track'));
   if (trackingEnabled && !reportMode) {
     try {
@@ -12422,6 +12414,22 @@ function runGenerate(cwd, config, reportMode, reportJson = false) {
     }
   }
 
+  // gain: capture generate savings (separate gain.ndjson; default ON, opt-out).
+  if (!reportMode) {
+    try {
+      const { recordUsage, isTrackingEnabled } = requireSourceOrBundled('./src/tracking/logger');
+      if (isTrackingEnabled(config, process.argv)) {
+        recordUsage({
+          version: VERSION,
+          op: 'generate',
+          baselineTokens: result.inputTokenTotal,
+          actualTokens: result.finalTokens,
+          durationMs: Date.now() - __genT0,
+        }, cwd);
+      }
+    } catch (_) { /* gain capture is best-effort */ }
+  }
+
   // Feature 8: post-run summary — 6-line stdout after every normal run
   if (!reportMode
     && !process.argv.includes('--json')
@@ -12470,6 +12478,23 @@ function runGenerate(cwd, config, reportMode, reportJson = false) {
     }
   }
 
+  // v7.0.1: count a plain context-generation run for the one-time star nudge.
+  // Most users only ever run `sigmap` to build the context file — count that too,
+  // not just ask/squeeze. Guard so a monorepo (many runGenerate calls per process)
+  // counts as a single run. Interactive only — silent under --json/--report or non-TTY.
+  if (!global.__sigmapGenCounted) {
+    global.__sigmapGenCounted = true;
+    try {
+      const { checkStarNudge } = requireSourceOrBundled('./src/nudge');
+      const showNudge = !!process.stderr.isTTY
+        && !reportJson
+        && !process.argv.includes('--json')
+        && !process.argv.includes('--report')
+        && !process.argv.includes('--quiet');
+      checkStarNudge(global.__sigmapRootCwd || cwd, true, { silent: !showNudge });
+    } catch (_) {}
+  }
+
   return result;
 }
 
@@ -12651,11 +12676,7 @@ function suggestTool(description) {
 
 function resolveProjectRoot(startDir) {
   try {
-    const gitRoot = execSync('git rev-parse --show-toplevel', {
-      cwd: startDir,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
+    const gitRoot = __git(['rev-parse', '--show-toplevel'], { cwd: startDir }).trim();
     if (gitRoot) return gitRoot;
   } catch (_) {}
   return startDir;
@@ -12705,6 +12726,13 @@ Usage:
   ${cmd} --suggest-tool "<task>" --json    Machine-readable tier recommendation
   ${cmd} --health                          Print composite health score
   ${cmd} --health --json                   Machine-readable health score
+  ${cmd} gain                              Token-savings dashboard (totals + by-operation)
+  ${cmd} gain --all                        Add daily / weekly / monthly trend tables
+  ${cmd} gain --json                       Aggregate savings as JSON
+  ${cmd} gain --since 7d                    Window filter (7d, 30d, 12h, or ISO date)
+  ${cmd} gain --top <n> | --model <name>   Limit rows / set $ pricing model
+  ${cmd} gain --reset                      Clear the local savings log (.context/gain.ndjson)
+  ${cmd} ... --no-track                    Disable gain savings capture for this run
   ${cmd} --diff                            Generate context for git-changed files only
   ${cmd} --diff <base-ref>                 Generate context + structural diff vs base ref (e.g. main)
   ${cmd} --diff --staged                   Generate context for staged files only
@@ -12926,8 +12954,7 @@ function buildIndexContext(ranked, cwd) {
 
 function computeCurrentRisk(cwd) {
   try {
-    const { execSync } = require('child_process');
-    const out = execSync('git diff --name-only HEAD', { cwd, timeout: 3000, encoding: 'utf8' });
+    const out = __git(['diff', '--name-only', 'HEAD'], { cwd, timeout: 3000 });
     const count = out.trim().split('\n').filter(Boolean).length;
     if (count === 0) return 'NONE';
     if (count <= 3)  return 'LOW';
@@ -13011,6 +13038,9 @@ function main() {
   const cwd = cwdFlag
     ? path.resolve(invokedFrom, cwdFlag)
     : resolveProjectRoot(invokedFrom);
+  // v7.0.1: remember the invocation root so the generation star-nudge always tracks
+  // usage at the repo root, even when runGenerate is called per-package (monorepo).
+  global.__sigmapRootCwd = cwd;
   const scriptPath = process.argv[1] || path.join(invokedFrom, 'gen-context.js');
 
   if (cwdFlag) {
@@ -13102,6 +13132,7 @@ function main() {
 
   // v4.2: `sigmap ask "<query>"` — unified pipeline
   if (args[0] === 'ask') {
+    const __askT0 = Date.now();
     // v6.8: Handle --followup flag which may appear before or after query
     let query = args[1];
     if (query === '--followup' && args[2]) {
@@ -13269,6 +13300,21 @@ function main() {
         bar,
       ].join('\n'));
     }
+    // gain: capture this query's savings for the `sigmap gain` dashboard.
+    try {
+      const { recordUsage, isTrackingEnabled } = requireSourceOrBundled('./src/tracking/logger');
+      if (isTrackingEnabled(config, args)) {
+        recordUsage({
+          version: VERSION,
+          op: 'ask',
+          baselineTokens: rawTok,
+          actualTokens: ctxTok,
+          durationMs: Date.now() - __askT0,
+          model,
+        }, cwd);
+      }
+    } catch (_) { /* gain capture is best-effort */ }
+
     // v7.0.0: record the run and show the one-time star nudge (interactive only).
     try {
       const { checkStarNudge } = requireSourceOrBundled('./src/nudge');
@@ -13281,14 +13327,51 @@ function main() {
     process.exit(0);
   }
 
+  // `sigmap gain` — token-savings dashboard (totals, by-operation, trends).
+  if (args[0] === 'gain') {
+    const valOf = (f, d) => { const i = args.indexOf(f); return i >= 0 && args[i + 1] ? args[i + 1] : d; };
+    if (args.includes('--reset')) {
+      try {
+        const { GAIN_FILE } = requireSourceOrBundled('./src/tracking/logger');
+        const p = path.join(cwd, GAIN_FILE);
+        if (fs.existsSync(p)) fs.unlinkSync(p);
+        console.log('[sigmap] gain: usage log cleared.');
+      } catch (e) { console.error(`[sigmap] gain: ${e.message}`); }
+      process.exit(0);
+    }
+    try {
+      const { readGainLog } = requireSourceOrBundled('./src/tracking/logger');
+      const { aggregate } = requireSourceOrBundled('./src/tracking/aggregate');
+      const { renderSummary, renderBreakdown } = requireSourceOrBundled('./src/format/gain-terminal');
+      const records = readGainLog(cwd);
+      const agg = aggregate(records, {
+        model: valOf('--model', 'claude-sonnet'),
+        since: valOf('--since', null),
+        top: parseInt(valOf('--top', args.includes('--all') ? '0' : '10'), 10),
+      });
+      if (args.includes('--json')) {
+        process.stdout.write(JSON.stringify(agg, null, 2) + '\n');
+      } else {
+        const out = args.includes('--all')
+          ? renderSummary(agg, { version: VERSION }) + '\n' + renderBreakdown(agg)
+          : renderSummary(agg, { version: VERSION });
+        process.stdout.write(out + '\n');
+      }
+    } catch (e) {
+      console.error(`[sigmap] gain: ${e.message}`);
+      console.error('  (gain modules require src/ — for single-file installs, regenerate the bundle)');
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+
   // v4.2: `sigmap suggest-profile` — auto-detect task type from git state
   if (args[0] === 'suggest-profile') {
     const short = args.includes('--short');
     let msg = '', diff = '';
     try {
-      const { execSync } = require('child_process');
-      msg  = execSync('git log -1 --format=%s',        { cwd, timeout: 3000, encoding: 'utf8' }).trim();
-      diff = execSync('git diff --cached --name-only',  { cwd, timeout: 3000, encoding: 'utf8' });
+      msg  = __git(['log', '-1', '--format=%s'],        { cwd, timeout: 3000 }).trim();
+      diff = __git(['diff', '--cached', '--name-only'], { cwd, timeout: 3000 });
     } catch (_) {}
 
     let profile = 'default';
@@ -13309,13 +13392,15 @@ function main() {
 
   // v4.2: `sigmap compare` — human-readable benchmark CLI
   if (args[0] === 'compare') {
-    const { execSync } = require('child_process');
+    const { execFileSync } = require('child_process');
     console.log('[sigmap] Running comparison benchmark (this may take ~30s)...\n');
 
     let raw = '';
     try {
-      raw = execSync(
-        `node ${JSON.stringify(path.join(__dirname, 'scripts', 'run-retrieval-benchmark.mjs'))} --compare`,
+      // Shell-free: run the node binary directly with the script path as an argv.
+      raw = execFileSync(
+        process.execPath,
+        [path.join(__dirname, 'scripts', 'run-retrieval-benchmark.mjs'), '--compare'],
         { cwd, timeout: 90_000, encoding: 'utf8' }
       );
     } catch (e) { raw = (e && e.stdout) ? e.stdout : ''; }
@@ -13366,15 +13451,19 @@ function main() {
     const shareText = [
       'Generated with SigMap — zero-dependency AI context engine',
       `${reduction}% fewer tokens · ${hitAt5}% retrieval accuracy · 6× better results`,
-      'https://sigmap.dev',
+      'https://sigmap.io',
     ].join('\n');
 
     console.log(shareText);
 
     try {
-      const { execSync } = require('child_process');
-      const clipCmd = process.platform === 'darwin' ? 'pbcopy' : 'xclip -selection clipboard';
-      execSync(`printf '%s' ${JSON.stringify(shareText)} | ${clipCmd}`, { timeout: 2000 });
+      // Shell-free: spawn the clipboard binary directly and write the text to its
+      // stdin — no shell, no pipe, no string-built command.
+      const { execFileSync } = require('child_process');
+      const [clipBin, clipArgs] = process.platform === 'darwin'
+        ? ['pbcopy', []]
+        : ['xclip', ['-selection', 'clipboard']];
+      execFileSync(clipBin, clipArgs, { input: shareText, timeout: 2000 });
       console.log('\n[sigmap] Copied to clipboard.');
     } catch (_) {}
 
@@ -13955,16 +14044,16 @@ function main() {
   // `sigmap status` — environment / repo state at a glance.
   if (args[0] === 'status') {
     const jsonOut = args.includes('--json');
-    const gitOpts = { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] };
+    const gitOpts = { cwd };
     const st = { branch: null, dirty: 0, lastIndex: null, indexVersion: null, indexFiles: null, changedSinceIndex: null, notes: 0, lastNote: null };
 
-    try { st.branch = execSync('git rev-parse --abbrev-ref HEAD', gitOpts).trim() || null; } catch (_) {}
+    st.branch = __tryGit(['rev-parse', '--abbrev-ref', 'HEAD'], gitOpts) || null;
     // Fallback for an unborn branch (fresh repo, no commits yet).
     if (!st.branch || st.branch === 'HEAD') {
-      try { st.branch = execSync('git symbolic-ref --short HEAD', gitOpts).trim() || st.branch; } catch (_) {}
+      st.branch = __tryGit(['symbolic-ref', '--short', 'HEAD'], gitOpts) || st.branch;
     }
     try {
-      const porcelain = execSync('git status --porcelain', gitOpts).trim();
+      const porcelain = __git(['status', '--porcelain'], gitOpts).trim();
       st.dirty = porcelain ? porcelain.split('\n').filter(Boolean).length : 0;
     } catch (_) {}
 
@@ -13983,7 +14072,7 @@ function main() {
     if (st.lastIndex) {
       try {
         const since = Date.parse(st.lastIndex);
-        const tracked = execSync('git ls-files', gitOpts).split('\n').filter(Boolean);
+        const tracked = __git(['ls-files'], gitOpts).split('\n').filter(Boolean);
         let changed = 0;
         for (const f of tracked.slice(0, 5000)) {
           try { if (fs.statSync(path.join(cwd, f)).mtimeMs > since) changed++; } catch (_) {}