sigmap 7.22.1 → 7.23.0

package/CHANGELOG.md

@@ -10,6 +10,24 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [7.23.0] — 2026-06-19
+
+Minor release — make the §9 LLM ablation produce a statistically stable number.
+
+### Added
+- **§9 ablation: `--runs N` averaging + 100-task corpus (#353):** the cleaned-guard §9 result is directionally clear (grounding cuts flagged codebase-fact errors ~13 → 3 per 100) but at N=40 with single-digit raw counts a single pass is noisy. `scripts/run-llm-ablation.mjs` gains `--runs N` (default 1) that runs the full task set N times with **fresh model calls per pass** and prints a mean ± [min–max] summary; `src/eval/llm-ablation.js` adds a pure, unit-tested `aggregateRuns(aggregates[])` (mean/min/max of without/with per-100 and delta). The committed corpus (`benchmarks/llm-ablation-tasks.json`) expands from 40 to **100** real-symbol tasks (`gen-ablation-corpus.mjs` default 40 → 100) for a tighter single-run estimate. The network touch stays confined to `scripts/`; the offline harness is unchanged. Run the robust headline with `npm run benchmark:llm-ablation -- --runs 5 --save`.
+
+---
+
+## [7.22.2] — 2026-06-19
+
+Patch release — clears the two remaining `verify-ai-output` false-positive classes surfaced by the §9 ablation.
+
+### Fixed
+- **`verify-ai-output` no longer flags camelCase placeholders or documentation-placeholder imports (#350):** continuing from #347, the Hallucination Guard now also skips camelCase/Pascal placeholder filenames (`myExample.js`, `exampleConfig.ts`) via a case-boundary rule that still flags ordinary words (`resample.js`), and the `fake-import` detector skips obvious documentation placeholders (`@scope/utils`, `some-module`, `./local-file`, `./path/to/…`) while still flagging genuine missing packages and unresolved relative imports. In the §9 re-run after #347, grounding genuinely fixed 6 mis-path flags but the guard re-flagged 4 illustrative tokens (net +2); suppressing those exposes the true grounding signal (on those outputs, with-grounding flags drop 10 → 6, delta +2 → +9). The bundled `src/verify/parsers` and `src/verify/hallucination-guard` factories were regenerated for standalone-binary parity.
+
+---
+
 ## [7.22.1] — 2026-06-18
 
 Patch release — hardens the `verify-ai-output` file-path extractor against the dominant false-positive class.

package/README.md

@@ -88,7 +88,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 ```
 Benchmark : sigmap-v7.0-main (21 repositories, including R language)
-Date      : 2026-06-18
+Date      : 2026-06-19
 
 Hit@5          : 75.6%   (baseline 13.6%  — 5.6× lift)
 Token reduction: 97.0%   (across 21 repos)

package/gen-context.js

@@ -32,6 +32,177 @@ function __require(key) {
 // ── ./src/conventions/report ──
 // ── ./src/conventions/ci ──
 // ── ./src/eval/llm-ablation ──
+__factories["./src/eval/llm-ablation"] = function(module, exports) {
+  
+  /**
+   * LLM A/B hallucination ablation (IMPL.md §9) — the honest measurement.
+   *
+   * Runs a model twice per task — (A) no SigMap context, (B) with SigMap
+   * grounding — pipes both outputs through the hallucination guard, and reports
+   * the measured delta in flagged codebase-fact errors. The model call is
+   * INJECTED (`complete(prompt) → text`), so the harness itself is pure and
+   * offline-testable; the live model adapter lives in `scripts/run-llm-ablation.mjs`.
+   * Zero-dependency, bundle-safe (no network here).
+   */
+
+  const { verify } = __require('./src/verify/hallucination-guard');
+
+  const path = require('path');
+
+  /** Strip a signature's trailing line anchor (` :12-20`) for prompt cleanliness. */
+  function _cleanSig(sig) {
+    return String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '').trim();
+  }
+
+  /**
+   * Build the SigMap grounding block for a repo — what we prepend to a task
+   * prompt in arm B. Conventions (the house style) + **exact signatures** grouped
+   * by file (what `get_callee_signatures` returns), so the model references the
+   * real surface instead of guessing — the actual product behavior, not a flat
+   * name dump.
+   * @param {string} cwd
+   * @param {object} [opts]
+   * @param {number} [opts.maxSignatures=150] cap on signature lines (bounds prompt size)
+   * @returns {string}
+   */
+  function buildGrounding(cwd, opts = {}) {
+    const maxSignatures = opts.maxSignatures != null ? opts.maxSignatures : 150;
+    const parts = [];
+
+    let index = null;
+    try {
+      const { buildSigIndex } = __require('./src/retrieval/ranker');
+      index = buildSigIndex(cwd);
+    } catch (_) {}
+
+    try {
+      const { extractConventions } = __require('./src/conventions/extract');
+      const { renderConventionsBlock } = __require('./src/conventions/inject');
+      const files = index ? [...index.keys()] : [];
+      parts.push(renderConventionsBlock(extractConventions(cwd, files)));
+    } catch (_) {}
+
+    if (index) {
+      const lines = ['## Exact signatures (use these — do not invent symbols or paths)'];
+      let count = 0;
+      for (const [file, sigs] of index) {
+        if (count >= maxSignatures) break;
+        const rel = path.relative(cwd, file).replace(/\\/g, '/');
+        const clean = (sigs || []).map(_cleanSig).filter(Boolean);
+        if (!clean.length) continue;
+        lines.push(`### ${rel}`);
+        for (const s of clean) {
+          if (count >= maxSignatures) break;
+          lines.push(s);
+          count++;
+        }
+      }
+      if (count > 0) parts.push(lines.join('\n'));
+    }
+
+    return parts.join('\n\n');
+  }
+
+  /**
+   * Score an answer: flagged codebase-fact errors + the issue list (the §9 metric).
+   * @param {string} answerText
+   * @param {string} cwd
+   * @returns {{ total: number, issues: object[] }}
+   */
+  function scoreAnswerDetail(answerText, cwd) {
+    try {
+      const { issues, summary } = verify(String(answerText || ''), cwd);
+      return { total: summary.total || 0, issues: issues || [] };
+    } catch (_) {
+      return { total: 0, issues: [] };
+    }
+  }
+
+  /** Count flagged codebase-fact errors in an answer (the §9 metric). */
+  function scoreAnswer(answerText, cwd) {
+    return scoreAnswerDetail(answerText, cwd).total;
+  }
+
+  /**
+   * Run the A/B ablation over a task corpus.
+   * @param {Array<{id:string, prompt:string}>} tasks
+   * @param {string} cwd
+   * @param {(prompt:string, meta:object)=>string} complete injected model call
+   * @param {object} [opts]
+   * @param {string} [opts.grounding] precomputed grounding (else built from cwd)
+   * @param {boolean} [opts.collectIssues] attach `aIssues`/`bIssues` per task
+   * @returns {{ tasks: object[], aggregate: object }}
+   */
+  function runAblation(tasks, cwd, complete, opts = {}) {
+    const grounding = opts.grounding != null ? opts.grounding : buildGrounding(cwd);
+    const rows = [];
+    let sumA = 0;
+    let sumB = 0;
+
+    for (const task of tasks || []) {
+      const basePrompt = task.prompt || '';
+      const groundedPrompt = grounding ? `${grounding}\n\n---\n\n${basePrompt}` : basePrompt;
+
+      const outA = String(complete(basePrompt, { id: task.id, grounded: false }) || '');
+      const outB = String(complete(groundedPrompt, { id: task.id, grounded: true }) || '');
+
+      const a = scoreAnswerDetail(outA, cwd);
+      const b = scoreAnswerDetail(outB, cwd);
+      sumA += a.total;
+      sumB += b.total;
+      const row = { id: task.id, aFlagged: a.total, bFlagged: b.total };
+      if (opts.collectIssues) { row.aIssues = a.issues; row.bIssues = b.issues; }
+      rows.push(row);
+    }
+
+    const n = rows.length;
+    const per100 = (sum) => (n > 0 ? (sum / n) * 100 : 0);
+    return {
+      tasks: rows,
+      aggregate: {
+        n,
+        withoutFlagged: sumA,
+        withFlagged: sumB,
+        delta: sumA - sumB,
+        withoutPer100: per100(sumA),
+        withPer100: per100(sumB),
+      },
+    };
+  }
+
+  /** mean/min/max of a number list (0s for an empty list). */
+  function _stats(nums) {
+    if (!nums.length) return { mean: 0, min: 0, max: 0 };
+    const sum = nums.reduce((a, b) => a + b, 0);
+    return { mean: sum / nums.length, min: Math.min(...nums), max: Math.max(...nums) };
+  }
+
+  /**
+   * Aggregate several `runAblation` passes into a stable estimate — mean ± range
+   * of the without/with per-100 flag rates and their delta. At N=40 with tiny raw
+   * counts a single pass is noisy; averaging repeated passes gives a publishable
+   * number with an honest spread.
+   * @param {object[]} aggregates the `.aggregate` object from each runAblation pass
+   * @returns {{ runs:number, n:number, withoutPer100:object, withPer100:object, deltaPer100:object }}
+   */
+  function aggregateRuns(aggregates) {
+    const runs = (aggregates || []).filter(Boolean);
+    const without = runs.map((a) => a.withoutPer100);
+    const withG = runs.map((a) => a.withPer100);
+    const delta = runs.map((a) => a.withoutPer100 - a.withPer100);
+    return {
+      runs: runs.length,
+      n: runs.length ? runs[0].n : 0,
+      withoutPer100: _stats(without),
+      withPer100: _stats(withG),
+      deltaPer100: _stats(delta),
+    };
+  }
+
+  module.exports = { buildGrounding, scoreAnswer, scoreAnswerDetail, runAblation, aggregateRuns };
+  
+};
+
 // ── ./src/conventions/fix ──
 // ── ./src/conventions/update ──
 // ── ./src/scaffold/persist ──
@@ -7931,7 +8102,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '7.22.1',
+    version: '7.23.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -12787,7 +12958,10 @@ __factories["./src/verify/parsers"] = function(module, exports) {
 
   // Illustrative placeholder names the model writes in prose, not repo claims:
   // e.g. example.js, minimal-example.js, sample.ts, demo.js, placeholder.js.
-  const PLACEHOLDER_RE = /(?:^|[-_.])(?:example|sample|demo|placeholder)(?:[-_.]|$)/i;
+  const PLACEHOLDER_RE = /(?:^|[-_.])(?:example|sample|demo|placeholder)(?:[-_.]|s?$)/i;
+  // camelCase / Pascal placeholders: myExample.js, exampleConfig.js, fooSample.ts.
+  // Requires a case boundary so ordinary words (resample.js) are NOT suppressed.
+  const PLACEHOLDER_CAMEL_RE = /(?:^|[a-z])(?:Example|Sample|Demo|Placeholder)|(?:^|[-_.])(?:example|sample|demo|placeholder)(?=[A-Z])/;
 
   /**
    * Extract fenced code blocks.
@@ -12843,7 +13017,7 @@ __factories["./src/verify/parsers"] = function(module, exports) {
         if (!hasSlash && !KNOWN_CODE_EXT.has(ext)) continue;
         if (LIBRARY_TOKENS.has(p.toLowerCase())) continue;
         const base = p.split('/').pop();
-        if (PLACEHOLDER_RE.test(base)) continue;
+        if (PLACEHOLDER_RE.test(base) || PLACEHOLDER_CAMEL_RE.test(base)) continue;
         if (!seen.has(p)) seen.set(p, i + 1);
       }
     }
@@ -13293,317 +13467,326 @@ module.exports = { renderReportHtml, renderReportMarkdown, escapeHtml };
 
 // ── ./src/verify/hallucination-guard ──
 __factories["./src/verify/hallucination-guard"] = function(module, exports) {
-'use strict';
+  
+  /**
+   * Hallucination Guard — deterministic core (Reliable MVP, v6.15.0).
+   *
+   * Given the text of an AI answer, flag claims that do not match the repo:
+   *   - fake-file      : a referenced path is not on disk
+   *   - fake-test-file : a referenced *test* path is not on disk (sub-type)
+   *   - fake-import    : a relative import does not resolve; a bare import is
+   *                      absent from package.json deps (builtins allow-listed)
+   *   - fake-symbol    : a called function/class is absent from the symbol index
+   *   - fake-npm-script: `npm run X` where X is not a package.json script
+   *
+   * Each issue carries a `confidence` (detection certainty) and, where a near
+   * match exists, a heuristic `suggestion` ("Did you mean …?"). No network, no
+   * LLM. Reuses SigMap primitives (buildSigIndex) but every external dependency
+   * is injectable via `opts` so the core stays unit-testable.
+   */
 
-/**
- * Hallucination Guard — deterministic core (Reliable MVP, v6.15.0).
- *
- * Given the text of an AI answer, flag claims that do not match the repo:
- *   - fake-file      : a referenced path is not on disk
- *   - fake-test-file : a referenced *test* path is not on disk (sub-type)
- *   - fake-import    : a relative import does not resolve; a bare import is
- *                      absent from package.json deps (builtins allow-listed)
- *   - fake-symbol    : a called function/class is absent from the symbol index
- *   - fake-npm-script: `npm run X` where X is not a package.json script
- *
- * Each issue carries a `confidence` (detection certainty) and, where a near
- * match exists, a heuristic `suggestion` ("Did you mean …?"). No network, no
- * LLM. Reuses SigMap primitives (buildSigIndex) but every external dependency
- * is injectable via `opts` so the core stays unit-testable.
- */
+  const fs = require('fs');
+  const path = require('path');
+  const parsers = __require('./src/verify/parsers');
+  const { closestMatch, buildSymbolCandidates, formatSuggestion } = __require('./src/verify/closest-match');
+
+  // A path that looks like a test file (JS/TS spec/test, Python test_/_test, or
+  // a tests/__tests__ directory). Used to flag fake-test-file separately.
+  const TEST_PATH_RE = /(?:\.(?:test|spec)\.[mc]?[jt]sx?$)|(?:(?:^|\/)__tests__\/)|(?:(?:^|\/)test_[^/]+\.py$)|(?:_test\.py$)|(?:(?:^|\/)tests?\/)/i;
+  function isTestPath(p) { return TEST_PATH_RE.test(p); }
+
+  const NODE_BUILTINS = new Set([
+    'fs', 'path', 'os', 'util', 'events', 'stream', 'http', 'https', 'crypto',
+    'child_process', 'url', 'querystring', 'assert', 'zlib', 'readline', 'net',
+    'tls', 'dns', 'buffer', 'process', 'vm', 'module', 'console', 'timers',
+    'string_decoder', 'perf_hooks', 'worker_threads', 'cluster', 'dgram', 'v8',
+    'tty', 'repl', 'async_hooks', 'inspector', 'fs/promises', 'path/posix',
+  ]);
 
-const fs = require('fs');
-const path = require('path');
-const parsers = __require('./src/verify/parsers');
-const { closestMatch, buildSymbolCandidates, formatSuggestion } = __require('./src/verify/closest-match');
-
-// A path that looks like a test file (JS/TS spec/test, Python test_/_test, or
-// a tests/__tests__ directory). Used to flag fake-test-file separately.
-const TEST_PATH_RE = /(?:\.(?:test|spec)\.[mc]?[jt]sx?$)|(?:(?:^|\/)__tests__\/)|(?:(?:^|\/)test_[^/]+\.py$)|(?:_test\.py$)|(?:(?:^|\/)tests?\/)/i;
-function isTestPath(p) { return TEST_PATH_RE.test(p); }
-
-const NODE_BUILTINS = new Set([
-  'fs', 'path', 'os', 'util', 'events', 'stream', 'http', 'https', 'crypto',
-  'child_process', 'url', 'querystring', 'assert', 'zlib', 'readline', 'net',
-  'tls', 'dns', 'buffer', 'process', 'vm', 'module', 'console', 'timers',
-  'string_decoder', 'perf_hooks', 'worker_threads', 'cluster', 'dgram', 'v8',
-  'tty', 'repl', 'async_hooks', 'inspector', 'fs/promises', 'path/posix',
-]);
-
-const PY_BUILTINS = new Set([
-  'os', 'sys', 're', 'json', 'math', 'typing', 'collections', 'itertools',
-  'functools', 'datetime', 'pathlib', 'subprocess', 'abc', 'dataclasses',
-  'enum', 'io', 'time', 'random', 'logging', 'argparse', 'unittest', 'asyncio',
-  'copy', 'hashlib', 'threading', 'string', 'csv', 'glob', 'shutil', 'tempfile',
-]);
-
-const LANG_GLOBALS = new Set([
-  // JS
-  'console', 'require', 'module', 'exports', 'process', 'Object', 'Array',
-  'String', 'Number', 'Boolean', 'Math', 'JSON', 'Date', 'Promise', 'Map',
-  'Set', 'WeakMap', 'WeakSet', 'RegExp', 'Error', 'Symbol', 'parseInt',
-  'parseFloat', 'isNaN', 'setTimeout', 'setInterval', 'clearTimeout', 'fetch',
-  'Buffer', 'Function', 'eval', 'encodeURIComponent', 'decodeURIComponent',
-  // Python
-  'print', 'len', 'range', 'str', 'int', 'float', 'dict', 'list', 'tuple',
-  'set', 'bool', 'open', 'enumerate', 'zip', 'map', 'filter', 'sorted',
-  'sum', 'min', 'max', 'abs', 'isinstance', 'super', 'type', 'getattr',
-  'setattr', 'hasattr',
-]);
-
-const REL_EXTS = ['', '.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.json', '.py', '.r', '.R', '.vue'];
-const REL_INDEX = ['index.js', 'index.ts', 'index.tsx', 'index.jsx', '__init__.py'];
+  const PY_BUILTINS = new Set([
+    'os', 'sys', 're', 'json', 'math', 'typing', 'collections', 'itertools',
+    'functools', 'datetime', 'pathlib', 'subprocess', 'abc', 'dataclasses',
+    'enum', 'io', 'time', 'random', 'logging', 'argparse', 'unittest', 'asyncio',
+    'copy', 'hashlib', 'threading', 'string', 'csv', 'glob', 'shutil', 'tempfile',
+  ]);
 
-/**
- * Build the set of known symbol identifiers from the SigMap signature index,
- * plus `{ name, file, line }` candidates (for closest-match suggestions).
- */
-function buildSymbolSet(cwd) {
-  const set = new Set();
-  let fileKeys = [];
-  let symbolCandidates = [];
-  try {
-    const { buildSigIndex } = __require('./src/retrieval/ranker');
-    const idx = buildSigIndex(cwd);
-    fileKeys = [...idx.keys()];
-    for (const sigs of idx.values()) {
-      for (const sig of sigs) {
-        const cleaned = String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '');
-        const ids = cleaned.match(/[A-Za-z_$][\w$]*/g) || [];
-        for (const id of ids) set.add(id);
-      }
-    }
-    symbolCandidates = buildSymbolCandidates(idx);
-  } catch (_) {}
-  return { set, fileKeys, symbolCandidates };
-}
+  const LANG_GLOBALS = new Set([
+    // JS
+    'console', 'require', 'module', 'exports', 'process', 'Object', 'Array',
+    'String', 'Number', 'Boolean', 'Math', 'JSON', 'Date', 'Promise', 'Map',
+    'Set', 'WeakMap', 'WeakSet', 'RegExp', 'Error', 'Symbol', 'parseInt',
+    'parseFloat', 'isNaN', 'setTimeout', 'setInterval', 'clearTimeout', 'fetch',
+    'Buffer', 'Function', 'eval', 'encodeURIComponent', 'decodeURIComponent',
+    // Python
+    'print', 'len', 'range', 'str', 'int', 'float', 'dict', 'list', 'tuple',
+    'set', 'bool', 'open', 'enumerate', 'zip', 'map', 'filter', 'sorted',
+    'sum', 'min', 'max', 'abs', 'isinstance', 'super', 'type', 'getattr',
+    'setattr', 'hasattr',
+  ]);
 
-/** Load declared dependency names from package.json. */
-function loadDeps(cwd) {
-  const deps = new Set();
-  let hasPkg = false;
-  try {
-    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
-    hasPkg = true;
-    for (const k of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
-      if (pkg[k] && typeof pkg[k] === 'object') {
-        for (const name of Object.keys(pkg[k])) deps.add(name);
-      }
-    }
-  } catch (_) {}
-  return { deps, hasPkg };
-}
+  const REL_EXTS = ['', '.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.json', '.py', '.r', '.R', '.vue'];
+  const REL_INDEX = ['index.js', 'index.ts', 'index.tsx', 'index.jsx', '__init__.py'];
 
-/** Load the set of npm script names declared in package.json. */
-function loadScripts(cwd) {
-  const scripts = new Set();
-  try {
-    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
-    if (pkg.scripts && typeof pkg.scripts === 'object') {
-      for (const name of Object.keys(pkg.scripts)) scripts.add(name);
-    }
-  } catch (_) {}
-  return scripts;
-}
+  // Obvious documentation-placeholder imports the model writes in illustrative
+  // snippets — not real dependency claims. e.g. @scope/utils, some-module, ./local-file.
+  const PLACEHOLDER_IMPORT_RE = new RegExp([
+    '^@(?:scope|org|your-org|my-org|company|example)(?:/|$)', // @scope/utils
+    '(?:^|/)(?:some|your|my)-(?:module|package|lib|component|file|dep)(?:$|/)', // some-module
+    '(?:^|/)(?:local-file|your-file|my-file|module-name|package-name|your-package|example-package)(?:$|/)',
+    '(?:^|/)path/to/', // ./path/to/x
+  ].join('|'), 'i');
 
-/** Default file-existence check: resolve a referenced path against cwd. */
-function defaultFileExists(cwd, ref) {
-  const clean = ref.replace(/^\.\//, '');
-  for (const c of [path.resolve(cwd, clean), path.resolve(cwd, ref)]) {
+  /**
+   * Build the set of known symbol identifiers from the SigMap signature index,
+   * plus `{ name, file, line }` candidates (for closest-match suggestions).
+   */
+  function buildSymbolSet(cwd) {
+    const set = new Set();
+    let fileKeys = [];
+    let symbolCandidates = [];
     try {
-      if (fs.existsSync(c)) return true;
+      const { buildSigIndex } = __require('./src/retrieval/ranker');
+      const idx = buildSigIndex(cwd);
+      fileKeys = [...idx.keys()];
+      for (const sigs of idx.values()) {
+        for (const sig of sigs) {
+          const cleaned = String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '');
+          const ids = cleaned.match(/[A-Za-z_$][\w$]*/g) || [];
+          for (const id of ids) set.add(id);
+        }
+      }
+      symbolCandidates = buildSymbolCandidates(idx);
     } catch (_) {}
+    return { set, fileKeys, symbolCandidates };
   }
-  return false;
-}
 
-/** Default relative-import resolver: fs candidates + basename match in index. */
-function defaultRelativeResolvable(cwd, mod, fileBasenames) {
-  const base = path.resolve(cwd, mod);
-  for (const e of REL_EXTS) {
+  /** Load declared dependency names from package.json. */
+  function loadDeps(cwd) {
+    const deps = new Set();
+    let hasPkg = false;
     try {
-      if (fs.existsSync(base + e)) return true;
+      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+      hasPkg = true;
+      for (const k of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+        if (pkg[k] && typeof pkg[k] === 'object') {
+          for (const name of Object.keys(pkg[k])) deps.add(name);
+        }
+      }
     } catch (_) {}
+    return { deps, hasPkg };
   }
-  for (const idx of REL_INDEX) {
+
+  /** Load the set of npm script names declared in package.json. */
+  function loadScripts(cwd) {
+    const scripts = new Set();
     try {
-      if (fs.existsSync(path.join(base, idx))) return true;
+      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+      if (pkg.scripts && typeof pkg.scripts === 'object') {
+        for (const name of Object.keys(pkg.scripts)) scripts.add(name);
+      }
     } catch (_) {}
+    return scripts;
   }
-  // Fall back to basename match against the indexed file set (the answer's
-  // import is relative to a file we cannot know, so a name match is enough
-  // to avoid false positives).
-  const wantBase = path.basename(mod).replace(/\.[^.]+$/, '').toLowerCase();
-  return fileBasenames.has(wantBase);
-}
-
-/**
- * Verify an AI answer against the repository.
- *
- * Each issue has the shape:
- *   { type, value, line, location, message, confidence, suggestion }
- * where `confidence` is the *detection* certainty ('high' for path/dep/script
- * checks, 'medium' for symbol checks) and `suggestion` is a heuristic
- * closest-match hint (or null).
- *
- * @param {string} answerText
- * @param {string} cwd
- * @param {object} [opts]
- * @param {Set<string>} [opts.symbolSet]      override known symbols
- * @param {Array}       [opts.symbolCandidates] override { name, file, line } list
- * @param {Array<string>} [opts.fileCandidates]  override repo file paths (suggestions)
- * @param {Set<string>} [opts.deps]           override package deps
- * @param {Set<string>} [opts.scripts]        override package.json script names
- * @param {boolean}     [opts.hasPkg]         whether a package.json exists
- * @param {(ref: string) => boolean} [opts.fileExists]          override file check
- * @param {(mod: string) => boolean} [opts.relativeResolvable]  override rel-import check
- * @returns {{ issues: object[], summary: object }}
- */
-function verify(answerText, cwd, opts = {}) {
-  let symbolSet = opts.symbolSet;
-  let fileBasenames = opts.fileBasenames;
-  let symbolCandidates = opts.symbolCandidates || [];
-  let fileCandidates = opts.fileCandidates || [];
-  if (!symbolSet) {
-    const built = buildSymbolSet(cwd);
-    symbolSet = built.set;
-    fileBasenames = new Set(built.fileKeys.map(
-      (k) => path.basename(k).replace(/\.[^.]+$/, '').toLowerCase()
-    ));
-    symbolCandidates = built.symbolCandidates;
-    fileCandidates = built.fileKeys;
-  }
-  if (!fileBasenames) fileBasenames = new Set();
-
-  let deps = opts.deps;
-  let hasPkg = opts.hasPkg;
-  if (!deps) {
-    const loaded = loadDeps(cwd);
-    deps = loaded.deps;
-    if (hasPkg === undefined) hasPkg = loaded.hasPkg;
-  }
-  const scripts = opts.scripts || (hasPkg ? loadScripts(cwd) : new Set());
-
-  const fileExists = opts.fileExists || ((ref) => defaultFileExists(cwd, ref));
-  const relativeResolvable = opts.relativeResolvable
-    || ((mod) => defaultRelativeResolvable(cwd, mod, fileBasenames));
-
-  // Pre-derive basename candidates for file suggestions (compare on basename so
-  // a wrong directory still surfaces the right file).
-  const fileBasenameCandidates = fileCandidates.map((f) => ({ name: path.basename(f), file: f }));
-
-  const issues = [];
-  const dedupe = new Set();
-  const add = (issue) => {
-    const key = `${issue.type}::${issue.value}`;
-    if (dedupe.has(key)) return;
-    dedupe.add(key);
-    if (!('suggestion' in issue)) issue.suggestion = null;
-    issue.location = `L${issue.line}`;
-    issues.push(issue);
-  };
 
-  // 1. fake-file / fake-test-file
-  for (const { path: p, line } of parsers.extractFilePaths(answerText)) {
-    if (fileExists(p)) continue;
-    const isTest = isTestPath(p);
-    const match = closestMatch(path.basename(p), fileBasenameCandidates, { minLen: 4 });
-    add({
-      type: isTest ? 'fake-test-file' : 'fake-file',
-      value: p,
-      line,
-      message: `${isTest ? 'Test file' : 'File'} not found on disk: ${p}`,
-      confidence: 'high',
-      suggestion: match ? formatSuggestion(match, false) : null,
-    });
+  /** Default file-existence check: resolve a referenced path against cwd. */
+  function defaultFileExists(cwd, ref) {
+    const clean = ref.replace(/^\.\//, '');
+    for (const c of [path.resolve(cwd, clean), path.resolve(cwd, ref)]) {
+      try {
+        if (fs.existsSync(c)) return true;
+      } catch (_) {}
+    }
+    return false;
   }
 
-  // 2. fake-import
-  for (const imp of parsers.extractImports(answerText)) {
-    if (imp.relative) {
-      if (!relativeResolvable(imp.module)) {
-        add({ type: 'fake-import', value: imp.module, line: imp.line, message: `Import does not resolve: ${imp.module}`, confidence: 'high' });
-      }
-      continue;
+  /** Default relative-import resolver: fs candidates + basename match in index. */
+  function defaultRelativeResolvable(cwd, mod, fileBasenames) {
+    const base = path.resolve(cwd, mod);
+    for (const e of REL_EXTS) {
+      try {
+        if (fs.existsSync(base + e)) return true;
+      } catch (_) {}
     }
-    // Bare module — only verifiable for JS when a package.json exists.
-    const top = imp.module.split('/')[0];
-    if (imp.kind === 'js') {
-      if (!hasPkg) continue;
-      if (NODE_BUILTINS.has(imp.module) || NODE_BUILTINS.has(top)) continue;
-      if (top.startsWith('@')) {
-        const scoped = imp.module.split('/').slice(0, 2).join('/');
-        if (deps.has(scoped) || deps.has(imp.module)) continue;
-      } else if (deps.has(top) || deps.has(imp.module)) {
-        continue;
-      }
-      const match = closestMatch(top, [...deps], { minLen: 3 });
-      add({
-        type: 'fake-import',
-        value: imp.module,
-        line: imp.line,
-        message: `Package not in dependencies: ${imp.module}`,
-        confidence: 'high',
-        suggestion: match ? formatSuggestion({ name: match.name }, false) : null,
-      });
+    for (const idx of REL_INDEX) {
+      try {
+        if (fs.existsSync(path.join(base, idx))) return true;
+      } catch (_) {}
     }
-    // Python bare imports: stdlib is unbounded offline — skip to keep precision.
+    // Fall back to basename match against the indexed file set (the answer's
+    // import is relative to a file we cannot know, so a name match is enough
+    // to avoid false positives).
+    const wantBase = path.basename(mod).replace(/\.[^.]+$/, '').toLowerCase();
+    return fileBasenames.has(wantBase);
   }
 
-  // 3. fake-symbol
-  if (symbolSet.size > 0) {
-    for (const { name, line } of parsers.extractSymbols(answerText)) {
-      if (symbolSet.has(name)) continue;
-      if (LANG_GLOBALS.has(name) || NODE_BUILTINS.has(name) || PY_BUILTINS.has(name)) continue;
-      const match = closestMatch(name, symbolCandidates, { minLen: 4 });
-      add({
-        type: 'fake-symbol',
-        value: name,
-        line,
-        message: `Symbol not found in repo index: ${name}()`,
-        confidence: 'medium',
-        suggestion: match ? formatSuggestion(match, true) : null,
-      });
+  /**
+   * Verify an AI answer against the repository.
+   *
+   * Each issue has the shape:
+   *   { type, value, line, location, message, confidence, suggestion }
+   * where `confidence` is the *detection* certainty ('high' for path/dep/script
+   * checks, 'medium' for symbol checks) and `suggestion` is a heuristic
+   * closest-match hint (or null).
+   *
+   * @param {string} answerText
+   * @param {string} cwd
+   * @param {object} [opts]
+   * @param {Set<string>} [opts.symbolSet]      override known symbols
+   * @param {Array}       [opts.symbolCandidates] override { name, file, line } list
+   * @param {Array<string>} [opts.fileCandidates]  override repo file paths (suggestions)
+   * @param {Set<string>} [opts.deps]           override package deps
+   * @param {Set<string>} [opts.scripts]        override package.json script names
+   * @param {boolean}     [opts.hasPkg]         whether a package.json exists
+   * @param {(ref: string) => boolean} [opts.fileExists]          override file check
+   * @param {(mod: string) => boolean} [opts.relativeResolvable]  override rel-import check
+   * @returns {{ issues: object[], summary: object }}
+   */
+  function verify(answerText, cwd, opts = {}) {
+    let symbolSet = opts.symbolSet;
+    let fileBasenames = opts.fileBasenames;
+    let symbolCandidates = opts.symbolCandidates || [];
+    let fileCandidates = opts.fileCandidates || [];
+    if (!symbolSet) {
+      const built = buildSymbolSet(cwd);
+      symbolSet = built.set;
+      fileBasenames = new Set(built.fileKeys.map(
+        (k) => path.basename(k).replace(/\.[^.]+$/, '').toLowerCase()
+      ));
+      symbolCandidates = built.symbolCandidates;
+      fileCandidates = built.fileKeys;
     }
-  }
+    if (!fileBasenames) fileBasenames = new Set();
+
+    let deps = opts.deps;
+    let hasPkg = opts.hasPkg;
+    if (!deps) {
+      const loaded = loadDeps(cwd);
+      deps = loaded.deps;
+      if (hasPkg === undefined) hasPkg = loaded.hasPkg;
+    }
+    const scripts = opts.scripts || (hasPkg ? loadScripts(cwd) : new Set());
+
+    const fileExists = opts.fileExists || ((ref) => defaultFileExists(cwd, ref));
+    const relativeResolvable = opts.relativeResolvable
+      || ((mod) => defaultRelativeResolvable(cwd, mod, fileBasenames));
 
-  // 4. fake-npm-script
-  if (hasPkg && scripts.size > 0) {
-    for (const { name, line } of parsers.extractNpmScripts(answerText)) {
-      if (scripts.has(name)) continue;
-      const match = closestMatch(name, [...scripts], { minLen: 2 });
+    // Pre-derive basename candidates for file suggestions (compare on basename so
+    // a wrong directory still surfaces the right file).
+    const fileBasenameCandidates = fileCandidates.map((f) => ({ name: path.basename(f), file: f }));
+
+    const issues = [];
+    const dedupe = new Set();
+    const add = (issue) => {
+      const key = `${issue.type}::${issue.value}`;
+      if (dedupe.has(key)) return;
+      dedupe.add(key);
+      if (!('suggestion' in issue)) issue.suggestion = null;
+      issue.location = `L${issue.line}`;
+      issues.push(issue);
+    };
+
+    // 1. fake-file / fake-test-file
+    for (const { path: p, line } of parsers.extractFilePaths(answerText)) {
+      if (fileExists(p)) continue;
+      const isTest = isTestPath(p);
+      const match = closestMatch(path.basename(p), fileBasenameCandidates, { minLen: 4 });
       add({
-        type: 'fake-npm-script',
-        value: name,
+        type: isTest ? 'fake-test-file' : 'fake-file',
+        value: p,
         line,
-        message: `npm script not in package.json: ${name}`,
+        message: `${isTest ? 'Test file' : 'File'} not found on disk: ${p}`,
         confidence: 'high',
-        suggestion: match ? formatSuggestion({ name: match.name }, false) : null,
+        suggestion: match ? formatSuggestion(match, false) : null,
       });
     }
-  }
 
-  issues.sort((a, b) => a.line - b.line);
+    // 2. fake-import
+    for (const imp of parsers.extractImports(answerText)) {
+      if (PLACEHOLDER_IMPORT_RE.test(imp.module)) continue;
+      if (imp.relative) {
+        if (!relativeResolvable(imp.module)) {
+          add({ type: 'fake-import', value: imp.module, line: imp.line, message: `Import does not resolve: ${imp.module}`, confidence: 'high' });
+        }
+        continue;
+      }
+      // Bare module — only verifiable for JS when a package.json exists.
+      const top = imp.module.split('/')[0];
+      if (imp.kind === 'js') {
+        if (!hasPkg) continue;
+        if (NODE_BUILTINS.has(imp.module) || NODE_BUILTINS.has(top)) continue;
+        if (top.startsWith('@')) {
+          const scoped = imp.module.split('/').slice(0, 2).join('/');
+          if (deps.has(scoped) || deps.has(imp.module)) continue;
+        } else if (deps.has(top) || deps.has(imp.module)) {
+          continue;
+        }
+        const match = closestMatch(top, [...deps], { minLen: 3 });
+        add({
+          type: 'fake-import',
+          value: imp.module,
+          line: imp.line,
+          message: `Package not in dependencies: ${imp.module}`,
+          confidence: 'high',
+          suggestion: match ? formatSuggestion({ name: match.name }, false) : null,
+        });
+      }
+      // Python bare imports: stdlib is unbounded offline — skip to keep precision.
+    }
+
+    // 3. fake-symbol
+    if (symbolSet.size > 0) {
+      for (const { name, line } of parsers.extractSymbols(answerText)) {
+        if (symbolSet.has(name)) continue;
+        if (LANG_GLOBALS.has(name) || NODE_BUILTINS.has(name) || PY_BUILTINS.has(name)) continue;
+        const match = closestMatch(name, symbolCandidates, { minLen: 4 });
+        add({
+          type: 'fake-symbol',
+          value: name,
+          line,
+          message: `Symbol not found in repo index: ${name}()`,
+          confidence: 'medium',
+          suggestion: match ? formatSuggestion(match, true) : null,
+        });
+      }
+    }
+
+    // 4. fake-npm-script
+    if (hasPkg && scripts.size > 0) {
+      for (const { name, line } of parsers.extractNpmScripts(answerText)) {
+        if (scripts.has(name)) continue;
+        const match = closestMatch(name, [...scripts], { minLen: 2 });
+        add({
+          type: 'fake-npm-script',
+          value: name,
+          line,
+          message: `npm script not in package.json: ${name}`,
+          confidence: 'high',
+          suggestion: match ? formatSuggestion({ name: match.name }, false) : null,
+        });
+      }
+    }
 
-  const byType = {
-    'fake-file': 0, 'fake-test-file': 0, 'fake-import': 0,
-    'fake-symbol': 0, 'fake-npm-script': 0,
-  };
-  for (const i of issues) byType[i.type] = (byType[i.type] || 0) + 1;
-
-  const summary = {
-    total: issues.length,
-    byType,
-    clean: issues.length === 0,
-    symbolsIndexed: symbolSet.size,
-    withSuggestion: issues.filter((i) => i.suggestion).length,
-  };
+    issues.sort((a, b) => a.line - b.line);
 
-  return { issues, summary };
-}
+    const byType = {
+      'fake-file': 0, 'fake-test-file': 0, 'fake-import': 0,
+      'fake-symbol': 0, 'fake-npm-script': 0,
+    };
+    for (const i of issues) byType[i.type] = (byType[i.type] || 0) + 1;
+
+    const summary = {
+      total: issues.length,
+      byType,
+      clean: issues.length === 0,
+      symbolsIndexed: symbolSet.size,
+      withSuggestion: issues.filter((i) => i.suggestion).length,
+    };
 
-module.exports = { verify, buildSymbolSet, loadDeps, loadScripts, isTestPath };
+    return { issues, summary };
+  }
 
+  module.exports = { verify, buildSymbolSet, loadDeps, loadScripts, isTestPath };
+  
 };
 
 const fs = require('fs');
@@ -13622,7 +13805,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '7.22.1';
+const VERSION = '7.23.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {

package/llms-full.txt

@@ -9,13 +9,13 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.22.1 | Benchmark: sigmap-v7.0-main (2026-06-18)
+# Version: 7.23.0 | Benchmark: sigmap-v7.0-main (2026-06-19)
 # Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-18)
+## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-19)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|

package/llms.txt

@@ -9,7 +9,7 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.22.1 | Benchmark: sigmap-v7.0-main (2026-06-18)
+# Version: 7.23.0 | Benchmark: sigmap-v7.0-main (2026-06-19)
 # Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -21,7 +21,7 @@ Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-18)
+## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-19)
 
 - hit@5 retrieval: 75.6% vs 13.6% random baseline (5.6× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "7.22.1",
+  "version": "7.23.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "7.22.1",
+  "version": "7.23.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "7.22.1",
+  "version": "7.23.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/eval/llm-ablation.js

@@ -136,4 +136,33 @@ function runAblation(tasks, cwd, complete, opts = {}) {
   };
 }
 
-module.exports = { buildGrounding, scoreAnswer, scoreAnswerDetail, runAblation };
+/** mean/min/max of a number list (0s for an empty list). */
+function _stats(nums) {
+  if (!nums.length) return { mean: 0, min: 0, max: 0 };
+  const sum = nums.reduce((a, b) => a + b, 0);
+  return { mean: sum / nums.length, min: Math.min(...nums), max: Math.max(...nums) };
+}
+
+/**
+ * Aggregate several `runAblation` passes into a stable estimate — mean ± range
+ * of the without/with per-100 flag rates and their delta. At N=40 with tiny raw
+ * counts a single pass is noisy; averaging repeated passes gives a publishable
+ * number with an honest spread.
+ * @param {object[]} aggregates the `.aggregate` object from each runAblation pass
+ * @returns {{ runs:number, n:number, withoutPer100:object, withPer100:object, deltaPer100:object }}
+ */
+function aggregateRuns(aggregates) {
+  const runs = (aggregates || []).filter(Boolean);
+  const without = runs.map((a) => a.withoutPer100);
+  const withG = runs.map((a) => a.withPer100);
+  const delta = runs.map((a) => a.withoutPer100 - a.withPer100);
+  return {
+    runs: runs.length,
+    n: runs.length ? runs[0].n : 0,
+    withoutPer100: _stats(without),
+    withPer100: _stats(withG),
+    deltaPer100: _stats(delta),
+  };
+}
+
+module.exports = { buildGrounding, scoreAnswer, scoreAnswerDetail, runAblation, aggregateRuns };

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '7.22.1',
+  version: '7.23.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/verify/hallucination-guard.js

@@ -59,6 +59,15 @@ const LANG_GLOBALS = new Set([
 const REL_EXTS = ['', '.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.json', '.py', '.r', '.R', '.vue'];
 const REL_INDEX = ['index.js', 'index.ts', 'index.tsx', 'index.jsx', '__init__.py'];
 
+// Obvious documentation-placeholder imports the model writes in illustrative
+// snippets — not real dependency claims. e.g. @scope/utils, some-module, ./local-file.
+const PLACEHOLDER_IMPORT_RE = new RegExp([
+  '^@(?:scope|org|your-org|my-org|company|example)(?:/|$)', // @scope/utils
+  '(?:^|/)(?:some|your|my)-(?:module|package|lib|component|file|dep)(?:$|/)', // some-module
+  '(?:^|/)(?:local-file|your-file|my-file|module-name|package-name|your-package|example-package)(?:$|/)',
+  '(?:^|/)path/to/', // ./path/to/x
+].join('|'), 'i');
+
 /**
  * Build the set of known symbol identifiers from the SigMap signature index,
  * plus `{ name, file, line }` candidates (for closest-match suggestions).
@@ -225,6 +234,7 @@ function verify(answerText, cwd, opts = {}) {
 
   // 2. fake-import
   for (const imp of parsers.extractImports(answerText)) {
+    if (PLACEHOLDER_IMPORT_RE.test(imp.module)) continue;
     if (imp.relative) {
       if (!relativeResolvable(imp.module)) {
         add({ type: 'fake-import', value: imp.module, line: imp.line, message: `Import does not resolve: ${imp.module}`, confidence: 'high' });

package/src/verify/parsers.js

@@ -30,7 +30,10 @@ const LIBRARY_TOKENS = new Set([
 
 // Illustrative placeholder names the model writes in prose, not repo claims:
 // e.g. example.js, minimal-example.js, sample.ts, demo.js, placeholder.js.
-const PLACEHOLDER_RE = /(?:^|[-_.])(?:example|sample|demo|placeholder)(?:[-_.]|$)/i;
+const PLACEHOLDER_RE = /(?:^|[-_.])(?:example|sample|demo|placeholder)(?:[-_.]|s?$)/i;
+// camelCase / Pascal placeholders: myExample.js, exampleConfig.js, fooSample.ts.
+// Requires a case boundary so ordinary words (resample.js) are NOT suppressed.
+const PLACEHOLDER_CAMEL_RE = /(?:^|[a-z])(?:Example|Sample|Demo|Placeholder)|(?:^|[-_.])(?:example|sample|demo|placeholder)(?=[A-Z])/;
 
 /**
  * Extract fenced code blocks.
@@ -86,7 +89,7 @@ function extractFilePaths(text) {
       if (!hasSlash && !KNOWN_CODE_EXT.has(ext)) continue;
       if (LIBRARY_TOKENS.has(p.toLowerCase())) continue;
       const base = p.split('/').pop();
-      if (PLACEHOLDER_RE.test(base)) continue;
+      if (PLACEHOLDER_RE.test(base) || PLACEHOLDER_CAMEL_RE.test(base)) continue;
       if (!seen.has(p)) seen.set(p, i + 1);
     }
   }