sigmap 7.22.0 → 7.22.1

package/CHANGELOG.md

@@ -10,6 +10,15 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [7.22.1] — 2026-06-18
+
+Patch release — hardens the `verify-ai-output` file-path extractor against the dominant false-positive class.
+
+### Fixed
+- **`verify-ai-output` no longer flags runtime/library names or placeholder filenames (#347):** `extractFilePaths` now skips well-known `X.js` product names (`node.js`, `next.js`, `vue.js`, `express.js`, `three.js`, `d3.js`, …) and illustrative placeholder basenames (`example`/`sample`/`demo`/`placeholder`, including `minimal-example.js`). Genuine repo-shaped paths (`src/foo/bar.js`, `main.js`, `index.ts`) are still extracted, so real hallucinations are unaffected. This removes the dominant Hallucination Guard false-positive class — in the §9 ablation, 22 of ~34 flags were literally "Node.js" — turning the directional grounding delta into a clean signal. The bundled `src/verify/parsers` factory was regenerated for standalone-binary parity.
+
+---
+
 ## [7.22.0] — 2026-06-18
 
 Minor release — realistic §9 ablation (real-symbol corpus, exact-signature grounding, --verbose) + Gemini model fix.

package/README.md

@@ -88,7 +88,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 ```
 Benchmark : sigmap-v7.0-main (21 repositories, including R language)
-Date      : 2026-06-14
+Date      : 2026-06-18
 
 Hit@5          : 75.6%   (baseline 13.6%  — 5.6× lift)
 Token reduction: 97.0%   (across 21 repos)

package/gen-context.js

@@ -7931,7 +7931,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '7.22.0',
+    version: '7.22.1',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -12756,207 +12756,220 @@ module.exports = { checkStarNudge, readUsage, usagePath, showStarNudge, RUN_THRE
 
 // ── ./src/verify/parsers ──
 __factories["./src/verify/parsers"] = function(module, exports) {
-'use strict';
+  
+  /**
+   * Parsers for the Hallucination Guard (verify-ai-output).
+   *
+   * Extract the verifiable claims an AI answer makes about a codebase:
+   *   - file paths it references
+   *   - import / require statements it shows
+   *   - function / class symbols it calls
+   *   - fenced code blocks (so callers can scope checks to code vs prose)
+   *
+   * Everything here is deterministic and offline — pure string analysis.
+   */
 
-/**
- * Parsers for the Hallucination Guard (verify-ai-output).
- *
- * Extract the verifiable claims an AI answer makes about a codebase:
- *   - file paths it references
- *   - import / require statements it shows
- *   - function / class symbols it calls
- *   - fenced code blocks (so callers can scope checks to code vs prose)
- *
- * Everything here is deterministic and offline — pure string analysis.
- */
+  // Extensions we are confident name a source/code/config file (no slash required).
+  const KNOWN_CODE_EXT = new Set([
+    'js', 'jsx', 'mjs', 'cjs', 'ts', 'tsx', 'py', 'pyw', 'rb', 'go', 'rs',
+    'java', 'kt', 'swift', 'c', 'h', 'cpp', 'hpp', 'cs', 'php', 'r',
+    'vue', 'svelte', 'css', 'scss', 'less', 'html', 'json', 'yml', 'yaml',
+    'toml', 'xml', 'sql', 'graphql', 'gql', 'proto', 'tf', 'md', 'sh',
+    'gd', 'gdscript',
+  ]);
 
-// Extensions we are confident name a source/code/config file (no slash required).
-const KNOWN_CODE_EXT = new Set([
-  'js', 'jsx', 'mjs', 'cjs', 'ts', 'tsx', 'py', 'pyw', 'rb', 'go', 'rs',
-  'java', 'kt', 'swift', 'c', 'h', 'cpp', 'hpp', 'cs', 'php', 'r',
-  'vue', 'svelte', 'css', 'scss', 'less', 'html', 'json', 'yml', 'yaml',
-  'toml', 'xml', 'sql', 'graphql', 'gql', 'proto', 'tf', 'md', 'sh',
-  'gd', 'gdscript',
-]);
+  // Well-known "X.js" runtime/library product names — never repo files.
+  const LIBRARY_TOKENS = new Set([
+    'node.js', 'next.js', 'nuxt.js', 'vue.js', 'react.js', 'express.js', 'koa.js',
+    'nest.js', 'three.js', 'd3.js', 'chart.js', 'ember.js', 'backbone.js',
+    'angular.js', 'meteor.js', 'moment.js', 'anime.js', 'p5.js', 'next.config.js',
+  ]);
 
-/**
- * Extract fenced code blocks.
- * @param {string} text
- * @returns {{ lang: string, content: string, line: number }[]}
- */
-function extractCodeBlocks(text) {
-  const blocks = [];
-  const lines = text.split('\n');
-  let inBlock = false;
-  let lang = '';
-  let buf = [];
-  let startLine = 0;
-  for (let i = 0; i < lines.length; i++) {
-    const m = lines[i].match(/^```(\w*)/);
-    if (m) {
-      if (!inBlock) {
-        inBlock = true;
-        lang = m[1] || '';
-        buf = [];
-        startLine = i + 2; // first content line (1-based)
-      } else {
-        blocks.push({ lang, content: buf.join('\n'), line: startLine });
-        inBlock = false;
+  // Illustrative placeholder names the model writes in prose, not repo claims:
+  // e.g. example.js, minimal-example.js, sample.ts, demo.js, placeholder.js.
+  const PLACEHOLDER_RE = /(?:^|[-_.])(?:example|sample|demo|placeholder)(?:[-_.]|$)/i;
+
+  /**
+   * Extract fenced code blocks.
+   * @param {string} text
+   * @returns {{ lang: string, content: string, line: number }[]}
+   */
+  function extractCodeBlocks(text) {
+    const blocks = [];
+    const lines = text.split('\n');
+    let inBlock = false;
+    let lang = '';
+    let buf = [];
+    let startLine = 0;
+    for (let i = 0; i < lines.length; i++) {
+      const m = lines[i].match(/^```(\w*)/);
+      if (m) {
+        if (!inBlock) {
+          inBlock = true;
+          lang = m[1] || '';
+          buf = [];
+          startLine = i + 2; // first content line (1-based)
+        } else {
+          blocks.push({ lang, content: buf.join('\n'), line: startLine });
+          inBlock = false;
+        }
+        continue;
       }
-      continue;
+      if (inBlock) buf.push(lines[i]);
     }
-    if (inBlock) buf.push(lines[i]);
+    return blocks;
   }
-  return blocks;
-}
 
-/**
- * Extract file-path references (deduped, first-seen line kept).
- * A token counts as a path when it has a `.<letter…>` extension AND
- * either contains a `/` or carries a known code/config extension.
- * @param {string} text
- * @returns {{ path: string, line: number }[]}
- */
-function extractFilePaths(text) {
-  const lines = text.split('\n');
-  const seen = new Map();
-  const re = /(?:^|[\s`"'(\[<])([A-Za-z0-9_][\w./-]*\.[A-Za-z][A-Za-z0-9]*)/g;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    let m;
-    re.lastIndex = 0;
-    while ((m = re.exec(line)) !== null) {
-      const p = m[1];
-      if (/^https?:/i.test(p)) continue;
-      const ext = (p.split('.').pop() || '').toLowerCase();
-      const hasSlash = p.includes('/');
-      if (!hasSlash && !KNOWN_CODE_EXT.has(ext)) continue;
-      if (!seen.has(p)) seen.set(p, i + 1);
+  /**
+   * Extract file-path references (deduped, first-seen line kept).
+   * A token counts as a path when it has a `.<letter…>` extension AND
+   * either contains a `/` or carries a known code/config extension.
+   * @param {string} text
+   * @returns {{ path: string, line: number }[]}
+   */
+  function extractFilePaths(text) {
+    const lines = text.split('\n');
+    const seen = new Map();
+    const re = /(?:^|[\s`"'(\[<])([A-Za-z0-9_][\w./-]*\.[A-Za-z][A-Za-z0-9]*)/g;
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      let m;
+      re.lastIndex = 0;
+      while ((m = re.exec(line)) !== null) {
+        const p = m[1];
+        if (/^https?:/i.test(p)) continue;
+        const ext = (p.split('.').pop() || '').toLowerCase();
+        const hasSlash = p.includes('/');
+        if (!hasSlash && !KNOWN_CODE_EXT.has(ext)) continue;
+        if (LIBRARY_TOKENS.has(p.toLowerCase())) continue;
+        const base = p.split('/').pop();
+        if (PLACEHOLDER_RE.test(base)) continue;
+        if (!seen.has(p)) seen.set(p, i + 1);
+      }
     }
+    return [...seen.entries()].map(([p, line]) => ({ path: p, line }));
   }
-  return [...seen.entries()].map(([p, line]) => ({ path: p, line }));
-}
 
-/**
- * Extract import / require statements.
- * @param {string} text
- * @returns {{ module: string, kind: 'js'|'py', relative: boolean, line: number, raw: string }[]}
- */
-function extractImports(text) {
-  const lines = text.split('\n');
-  const out = [];
-  const push = (module, kind, line, raw) => {
-    if (!module) return;
-    out.push({ module, kind, relative: /^[./]/.test(module), line, raw: raw.trim() });
-  };
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    let m;
-    // JS/TS: import ... from 'x'  |  export ... from 'x'
-    if ((m = line.match(/\b(?:import|export)\b[^'"]*\bfrom\s*['"]([^'"]+)['"]/))) {
-      push(m[1], 'js', i + 1, line);
-    } else if ((m = line.match(/\bimport\s*['"]([^'"]+)['"]/))) {
-      // side-effect import 'x'
-      push(m[1], 'js', i + 1, line);
-    }
-    // require('x') / dynamic import('x') — may co-occur, scan separately
-    const reqRe = /\b(?:require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-    let r;
-    while ((r = reqRe.exec(line)) !== null) push(r[1], 'js', i + 1, line);
-
-    // TS: import X = require('mod')
-    if ((m = line.match(/\bimport\s+[A-Za-z_$][\w$]*\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/))) {
-      push(m[1], 'js', i + 1, line);
-    }
-
-    // Python: from x import y  |  import x
-    if ((m = line.match(/^\s*from\s+([.\w]+)\s+import\b/))) {
-      push(m[1], 'py', i + 1, line);
-    } else if ((m = line.match(/^\s*import\s+([A-Za-z_][\w.]*)/))) {
-      push(m[1], 'py', i + 1, line);
-    }
-  }
-
-  // Multi-line JS/TS imports, e.g.
-  //   import {
-  //     A as B,
-  //   } from './mod';
-  // The per-line pass above misses these because `from '…'` sits on a later
-  // line. Trigger only when the opening line has no quote and no `from` yet,
-  // then gather forward until the source string appears.
-  for (let i = 0; i < lines.length; i++) {
-    const start = lines[i];
-    if (!/^\s*(?:import|export)\b/.test(start)) continue;
-    if (/['"]/.test(start) || /\bfrom\b/.test(start)) continue; // single-line, already handled
-    let joined = start;
-    for (let j = i + 1; j < Math.min(lines.length, i + 12); j++) {
-      joined += ' ' + lines[j];
-      const fm = joined.match(/\bfrom\s*['"]([^'"]+)['"]/);
-      if (fm) { push(fm[1], 'js', i + 1, start.trim()); break; }
-      if (/['"]/.test(lines[j]) && !/\bfrom\b/.test(joined)) break; // a string that isn't a source — bail
+  /**
+   * Extract import / require statements.
+   * @param {string} text
+   * @returns {{ module: string, kind: 'js'|'py', relative: boolean, line: number, raw: string }[]}
+   */
+  function extractImports(text) {
+    const lines = text.split('\n');
+    const out = [];
+    const push = (module, kind, line, raw) => {
+      if (!module) return;
+      out.push({ module, kind, relative: /^[./]/.test(module), line, raw: raw.trim() });
+    };
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      let m;
+      // JS/TS: import ... from 'x'  |  export ... from 'x'
+      if ((m = line.match(/\b(?:import|export)\b[^'"]*\bfrom\s*['"]([^'"]+)['"]/))) {
+        push(m[1], 'js', i + 1, line);
+      } else if ((m = line.match(/\bimport\s*['"]([^'"]+)['"]/))) {
+        // side-effect import 'x'
+        push(m[1], 'js', i + 1, line);
+      }
+      // require('x') / dynamic import('x') — may co-occur, scan separately
+      const reqRe = /\b(?:require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+      let r;
+      while ((r = reqRe.exec(line)) !== null) push(r[1], 'js', i + 1, line);
+
+      // TS: import X = require('mod')
+      if ((m = line.match(/\bimport\s+[A-Za-z_$][\w$]*\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/))) {
+        push(m[1], 'js', i + 1, line);
+      }
+
+      // Python: from x import y  |  import x
+      if ((m = line.match(/^\s*from\s+([.\w]+)\s+import\b/))) {
+        push(m[1], 'py', i + 1, line);
+      } else if ((m = line.match(/^\s*import\s+([A-Za-z_][\w.]*)/))) {
+        push(m[1], 'py', i + 1, line);
+      }
+    }
+
+    // Multi-line JS/TS imports, e.g.
+    //   import {
+    //     A as B,
+    //   } from './mod';
+    // The per-line pass above misses these because `from '…'` sits on a later
+    // line. Trigger only when the opening line has no quote and no `from` yet,
+    // then gather forward until the source string appears.
+    for (let i = 0; i < lines.length; i++) {
+      const start = lines[i];
+      if (!/^\s*(?:import|export)\b/.test(start)) continue;
+      if (/['"]/.test(start) || /\bfrom\b/.test(start)) continue; // single-line, already handled
+      let joined = start;
+      for (let j = i + 1; j < Math.min(lines.length, i + 12); j++) {
+        joined += ' ' + lines[j];
+        const fm = joined.match(/\bfrom\s*['"]([^'"]+)['"]/);
+        if (fm) { push(fm[1], 'js', i + 1, start.trim()); break; }
+        if (/['"]/.test(lines[j]) && !/\bfrom\b/.test(joined)) break; // a string that isn't a source — bail
+      }
     }
+    return out;
   }
-  return out;
-}
 
-/**
- * Extract npm/pnpm/yarn script invocations (`npm run <name>`).
- * Only the explicit `run` form is matched, to avoid confusing package-manager
- * subcommands (`yarn add`, `pnpm install`) with script names.
- * @param {string} text
- * @returns {{ name: string, line: number }[]}
- */
-function extractNpmScripts(text) {
-  const lines = text.split('\n');
-  const out = [];
-  const seen = new Set();
-  const re = /\b(?:npm|pnpm|yarn)\s+run(?:-script)?\s+([A-Za-z0-9:_-]+)/g;
-  for (let i = 0; i < lines.length; i++) {
-    let m;
-    re.lastIndex = 0;
-    while ((m = re.exec(lines[i])) !== null) {
-      const name = m[1];
-      if (seen.has(name)) continue;
-      seen.add(name);
-      out.push({ name, line: i + 1 });
+  /**
+   * Extract npm/pnpm/yarn script invocations (`npm run <name>`).
+   * Only the explicit `run` form is matched, to avoid confusing package-manager
+   * subcommands (`yarn add`, `pnpm install`) with script names.
+   * @param {string} text
+   * @returns {{ name: string, line: number }[]}
+   */
+  function extractNpmScripts(text) {
+    const lines = text.split('\n');
+    const out = [];
+    const seen = new Set();
+    const re = /\b(?:npm|pnpm|yarn)\s+run(?:-script)?\s+([A-Za-z0-9:_-]+)/g;
+    for (let i = 0; i < lines.length; i++) {
+      let m;
+      re.lastIndex = 0;
+      while ((m = re.exec(lines[i])) !== null) {
+        const name = m[1];
+        if (seen.has(name)) continue;
+        seen.add(name);
+        out.push({ name, line: i + 1 });
+      }
     }
+    return out;
   }
-  return out;
-}
 
-/**
- * Extract function/class symbol references that look like calls.
- * Restricted to backtick-wrapped calls (`foo(...)`) for high precision.
- * @param {string} text
- * @returns {{ name: string, line: number }[]}
- */
-function extractSymbols(text) {
-  const lines = text.split('\n');
-  const out = [];
-  const seen = new Set();
-  const re = /`([A-Za-z_$][\w$]*)\s*\([^`]*\)`/g;
-  for (let i = 0; i < lines.length; i++) {
-    let m;
-    re.lastIndex = 0;
-    while ((m = re.exec(lines[i])) !== null) {
-      const name = m[1];
-      const key = name + '@' + (i + 1);
-      if (seen.has(key)) continue;
-      seen.add(key);
-      out.push({ name, line: i + 1 });
+  /**
+   * Extract function/class symbol references that look like calls.
+   * Restricted to backtick-wrapped calls (`foo(...)`) for high precision.
+   * @param {string} text
+   * @returns {{ name: string, line: number }[]}
+   */
+  function extractSymbols(text) {
+    const lines = text.split('\n');
+    const out = [];
+    const seen = new Set();
+    const re = /`([A-Za-z_$][\w$]*)\s*\([^`]*\)`/g;
+    for (let i = 0; i < lines.length; i++) {
+      let m;
+      re.lastIndex = 0;
+      while ((m = re.exec(lines[i])) !== null) {
+        const name = m[1];
+        const key = name + '@' + (i + 1);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ name, line: i + 1 });
+      }
     }
+    return out;
   }
-  return out;
-}
-
-module.exports = {
-  extractCodeBlocks,
-  extractFilePaths,
-  extractImports,
-  extractSymbols,
-  extractNpmScripts,
-};
 
+  module.exports = {
+    extractCodeBlocks,
+    extractFilePaths,
+    extractImports,
+    extractSymbols,
+    extractNpmScripts,
+  };
+  
 };
 
 // ── ./src/verify/closest-match ──
@@ -13609,7 +13622,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '7.22.0';
+const VERSION = '7.22.1';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {

package/llms-full.txt

@@ -9,13 +9,13 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.22.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
+# Version: 7.22.1 | Benchmark: sigmap-v7.0-main (2026-06-18)
 # Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-14)
+## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-18)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|

package/llms.txt

@@ -9,7 +9,7 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.22.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
+# Version: 7.22.1 | Benchmark: sigmap-v7.0-main (2026-06-18)
 # Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -21,7 +21,7 @@ Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-14)
+## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-18)
 
 - hit@5 retrieval: 75.6% vs 13.6% random baseline (5.6× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "7.22.0",
+  "version": "7.22.1",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "7.22.0",
+  "version": "7.22.1",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "7.22.0",
+  "version": "7.22.1",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '7.22.0',
+  version: '7.22.1',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/verify/parsers.js

@@ -21,6 +21,17 @@ const KNOWN_CODE_EXT = new Set([
   'gd', 'gdscript',
 ]);
 
+// Well-known "X.js" runtime/library product names — never repo files.
+const LIBRARY_TOKENS = new Set([
+  'node.js', 'next.js', 'nuxt.js', 'vue.js', 'react.js', 'express.js', 'koa.js',
+  'nest.js', 'three.js', 'd3.js', 'chart.js', 'ember.js', 'backbone.js',
+  'angular.js', 'meteor.js', 'moment.js', 'anime.js', 'p5.js', 'next.config.js',
+]);
+
+// Illustrative placeholder names the model writes in prose, not repo claims:
+// e.g. example.js, minimal-example.js, sample.ts, demo.js, placeholder.js.
+const PLACEHOLDER_RE = /(?:^|[-_.])(?:example|sample|demo|placeholder)(?:[-_.]|$)/i;
+
 /**
  * Extract fenced code blocks.
  * @param {string} text
@@ -73,6 +84,9 @@ function extractFilePaths(text) {
       const ext = (p.split('.').pop() || '').toLowerCase();
       const hasSlash = p.includes('/');
       if (!hasSlash && !KNOWN_CODE_EXT.has(ext)) continue;
+      if (LIBRARY_TOKENS.has(p.toLowerCase())) continue;
+      const base = p.split('/').pop();
+      if (PLACEHOLDER_RE.test(base)) continue;
       if (!seen.has(p)) seen.set(p, i + 1);
     }
   }