sigmap 7.10.0 → 7.12.0

package/llms-full.txt

@@ -9,7 +9,7 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.10.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
+# Version: 7.12.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
 # Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 

package/llms.txt

@@ -9,7 +9,7 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.10.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
+# Version: 7.12.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
 # Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "7.10.0",
+  "version": "7.12.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "7.10.0",
+  "version": "7.12.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "7.10.0",
+  "version": "7.12.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '7.10.0',
+  version: '7.12.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/plan/verify-plan.js

@@ -0,0 +1,108 @@
+'use strict';
+
+/**
+ * verify-plan (IMPL.md §6.1 — Gap 2, step 2 of the `create` pipeline).
+ *
+ * Checks a plan (markdown) against the LIVE index before execution: do the
+ * referenced files and symbols exist, is the blast radius acceptable, is the
+ * scope in bounds? Catches Cause 1+2 at plan time — cheaper than after the
+ * code is written. Reuses the verify primitives + the impact graph.
+ * Zero-dependency, bundle-safe.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { extractFilePaths, extractSymbols } = require('../verify/parsers');
+const { buildSymbolSet } = require('../verify/hallucination-guard');
+const { closestMatch } = require('../verify/closest-match');
+const { analyzeImpact } = require('../graph/impact');
+
+const DEFAULT_BLAST_THRESHOLD = 20; // transitive+direct dependents → "high blast radius"
+const DEFAULT_SCOPE_THRESHOLD = 10; // distinct referenced files → "broad scope"
+
+/** Resolve a referenced path against cwd (handles a leading "./"). */
+function _fileExists(cwd, ref) {
+  const clean = ref.replace(/^\.\//, '');
+  for (const c of [path.resolve(cwd, clean), path.resolve(cwd, ref)]) {
+    try { if (fs.existsSync(c)) return true; } catch (_) {}
+  }
+  return false;
+}
+
+/**
+ * Verify a plan against the live index.
+ * @param {string} planText the plan as markdown
+ * @param {string} cwd repo root
+ * @param {object} [opts]
+ * @param {number} [opts.blastThreshold=20]
+ * @param {number} [opts.scopeThreshold=10]
+ * @param {(ref:string)=>boolean} [opts.fileExists] override for testing
+ * @returns {{ issues: object[], blast: object[], scope: object, summary: object }}
+ */
+function verifyPlan(planText, cwd, opts = {}) {
+  const blastThreshold = opts.blastThreshold != null ? opts.blastThreshold : DEFAULT_BLAST_THRESHOLD;
+  const scopeThreshold = opts.scopeThreshold != null ? opts.scopeThreshold : DEFAULT_SCOPE_THRESHOLD;
+  const fileExists = opts.fileExists || ((ref) => _fileExists(cwd, ref));
+
+  const text = String(planText || '');
+  const filesRef = extractFilePaths(text);   // [{ path, line }]
+  const symbolsRef = extractSymbols(text);   // [{ name, line }]
+  const { set: symbolSet, symbolCandidates } = buildSymbolSet(cwd);
+
+  const issues = [];
+
+  // 1. Referenced files must exist.
+  const existingFiles = [];
+  for (const f of filesRef) {
+    if (fileExists(f.path)) existingFiles.push(f.path);
+    else issues.push({ type: 'missing-file', ref: f.path, line: f.line, severity: 'error' });
+  }
+
+  // 2. Referenced symbols must exist in the live index (suggest a near match).
+  for (const s of symbolsRef) {
+    if (symbolSet.has(s.name)) continue;
+    const match = closestMatch(s.name, symbolCandidates);
+    issues.push({
+      type: 'unknown-symbol', ref: s.name, line: s.line, severity: 'error',
+      suggestion: match ? match.name : null,
+    });
+  }
+
+  // 3. Blast radius for each existing referenced file (one graph build).
+  const blast = [];
+  if (existingFiles.length) {
+    let impacts = [];
+    try { impacts = analyzeImpact(existingFiles, cwd, {}); } catch (_) { impacts = []; }
+    for (const { file, impact } of impacts) {
+      const entry = { file, totalImpact: impact.totalImpact, tests: impact.tests.length };
+      blast.push(entry);
+      if (impact.totalImpact > blastThreshold) {
+        issues.push({ type: 'high-blast-radius', ref: file, count: impact.totalImpact, severity: 'warn' });
+      }
+    }
+    blast.sort((a, b) => b.totalImpact - a.totalImpact);
+  }
+
+  // 4. Scope.
+  const scope = { files: filesRef.length, symbols: symbolsRef.length, threshold: scopeThreshold };
+  if (filesRef.length > scopeThreshold) {
+    issues.push({ type: 'broad-scope', count: filesRef.length, threshold: scopeThreshold, severity: 'warn' });
+  }
+
+  const errors = issues.filter((i) => i.severity === 'error').length;
+  const warnings = issues.filter((i) => i.severity === 'warn').length;
+  return {
+    issues,
+    blast,
+    scope,
+    summary: {
+      filesReferenced: filesRef.length,
+      symbolsReferenced: symbolsRef.length,
+      errors,
+      warnings,
+      ok: errors === 0,
+    },
+  };
+}
+
+module.exports = { verifyPlan, DEFAULT_BLAST_THRESHOLD, DEFAULT_SCOPE_THRESHOLD };

package/src/review/review-pr.js

@@ -0,0 +1,106 @@
+'use strict';
+
+/**
+ * review-pr (IMPL.md §6 step 4 — last guard stage of the `create` pipeline).
+ *
+ * Audits a diff for drift and side effects after a PR is opened: scope drift,
+ * edits to high-fan-in "god-node" files, source changes without matching tests,
+ * and changes to security-sensitive files. Pure (takes a changed-file list),
+ * zero-dependency, bundle-safe; reuses the impact graph for blast radius.
+ */
+
+const path = require('path');
+const { analyzeImpact } = require('../graph/impact');
+
+const SECURITY_PATTERNS = [
+  /(^|\/)\.env(\.|$)/i,
+  /(^|\/)(secrets?|credentials?)(\/|\.|$)/i,
+  /(^|\/)auth(\/|\.|-)/i,
+  /(^|\/)package(-lock)?\.json$/,
+  /(^|\/)(yarn\.lock|pnpm-lock\.yaml)$/,
+  /(^|\/)\.github\/workflows\//,
+  /(^|\/)Dockerfile/i,
+  /\.(pem|key|crt|p12)$/i,
+];
+
+const SRC_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.go', '.rs', '.java', '.rb', '.php']);
+const GOD_NODE_THRESHOLD = 15; // transitive dependents → high-fan-in "god node"
+const SCOPE_DIR_THRESHOLD = 5; // distinct top-level dirs → scope drift
+
+function isTestFile(p) {
+  return /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.(py|go)$|(^|\/)(tests?|__tests__|spec)\//.test(p);
+}
+function isSource(p) {
+  return SRC_EXTS.has(path.extname(p).toLowerCase()) && !isTestFile(p);
+}
+
+/**
+ * Audit a changed-file list.
+ * @param {Array<{path:string,status:string}>|string[]} changedFiles
+ * @param {string} cwd
+ * @param {object} [opts]
+ * @param {number} [opts.godNodeThreshold=15]
+ * @param {number} [opts.scopeThreshold=5]
+ * @returns {{ findings: object[], blast: object[], summary: object }}
+ */
+function reviewPr(changedFiles, cwd, opts = {}) {
+  const godThreshold = opts.godNodeThreshold != null ? opts.godNodeThreshold : GOD_NODE_THRESHOLD;
+  const scopeThreshold = opts.scopeThreshold != null ? opts.scopeThreshold : SCOPE_DIR_THRESHOLD;
+  const files = (changedFiles || []).map((f) => (typeof f === 'string' ? { path: f, status: 'M' } : f));
+
+  const findings = [];
+  const paths = files.map((f) => f.path);
+  const live = files.filter((f) => f.status !== 'D');
+  const srcChanged = live.filter((f) => isSource(f.path)).map((f) => f.path);
+  const testChanged = paths.filter(isTestFile);
+
+  // 1. Missing tests: a changed source file with no matching changed test file.
+  for (const s of srcChanged) {
+    const stem = path.basename(s).replace(/\.[^.]+$/, '');
+    const covered = testChanged.some((t) => path.basename(t).includes(stem));
+    if (!covered) findings.push({ type: 'missing-tests', file: s, severity: 'warn' });
+  }
+
+  // 2. Security-sensitive files.
+  for (const f of live) {
+    if (SECURITY_PATTERNS.some((re) => re.test(f.path))) {
+      findings.push({ type: 'security-file', file: f.path, severity: 'warn' });
+    }
+  }
+
+  // 3. God-node edits (high blast radius).
+  const blast = [];
+  if (srcChanged.length) {
+    let impacts = [];
+    try { impacts = analyzeImpact(srcChanged, cwd, {}); } catch (_) { impacts = []; }
+    for (const { file, impact } of impacts) {
+      blast.push({ file, totalImpact: impact.totalImpact });
+      if (impact.totalImpact > godThreshold) {
+        findings.push({ type: 'god-node', file, count: impact.totalImpact, severity: 'warn' });
+      }
+    }
+    blast.sort((a, b) => b.totalImpact - a.totalImpact);
+  }
+
+  // 4. Scope drift: distinct top-level directories touched.
+  const dirs = [...new Set(paths.map((p) => (p.includes('/') ? p.split('/')[0] : '.')))];
+  if (dirs.length > scopeThreshold) {
+    findings.push({ type: 'scope-drift', dirs, count: dirs.length, threshold: scopeThreshold, severity: 'warn' });
+  }
+
+  const byType = findings.reduce((a, f) => { a[f.type] = (a[f.type] || 0) + 1; return a; }, {});
+  return {
+    findings,
+    blast,
+    summary: {
+      filesChanged: files.length,
+      sourceChanged: srcChanged.length,
+      testsChanged: testChanged.length,
+      findings: findings.length,
+      byType,
+      ok: findings.length === 0,
+    },
+  };
+}
+
+module.exports = { reviewPr, SECURITY_PATTERNS, GOD_NODE_THRESHOLD, SCOPE_DIR_THRESHOLD };