sigmap 7.24.2 → 7.25.1

package/CHANGELOG.md

@@ -10,6 +10,31 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [7.25.1] — 2026-06-21
+
+Patch release — **Trust Hygiene (H4):** document the real CLI / MCP / adapter surface. Completes the v7.25.x milestone's documentation goals (only H2, the reproducible bundle build, remains).
+
+### Added
+- **Document the shipped surface (#366):** `sigmap --help` now lists the five wired-but-undocumented commands — `conventions`, `scaffold`, `verify-plan`, `review-pr`, and `create` (the grounded-creation pipeline). The README gains a "Grounded creation & guardrails" section, lists all 15 MCP tools, and adds the `willow` adapter to the integrations table. A new `surface-docs` test pins the documented surface to source (`--help` must list the commands, README's MCP count must equal `TOOLS.length`, every `listAdapters()` entry must appear in the README table), so the docs can never silently undersell the product again.
+
+### Fixed
+- **MCP tool undercount (#366):** the README advertised "10 on-demand tools" while the server ships **15** — corrected and now gated by the `surface-docs` test.
+
+---
+
+## [7.25.0] — 2026-06-21
+
+Minor release — **Trust Hygiene (H1 + H3):** one generated source of benchmark truth, gated in CI. First installment of the v7.25.x milestone.
+
+### Added
+- **Single source of benchmark truth (#363):** `benchmarks/latest.json` is now generated from the benchmark reports (`scripts/gen-benchmark-latest.mjs`), and `version.json` metrics, `README.md` (via `<!--SM:KEY-->` markers), and `llms.txt`/`llms-full.txt` all read from it (`scripts/sync-metrics.mjs`). Every hand-typed metric is removed — published numbers can no longer silently drift from the measured reports. New `npm run metrics:sync` regenerates the whole chain; `npm run check:metrics` gates it in `prepublishOnly` **and** CI.
+- **Truthful `version.json` (#363):** `languages`, `extractors`, `mcp_tools`, and `tests` are auto-derived from source via a shared `scripts/lib/source-meta.mjs` (the same derivation the llms generator uses, so the language count can never diverge). Added the `extractors` field.
+
+### Changed
+- **Every published number traces to one fresh, gated benchmark run (#363):** the long-standing drift (committed reports vs hand-typed README/`version.json`/`llms.txt`) is eliminated — all surfaces now derive from `benchmarks/latest.json`. This release regenerates that file from a **live** benchmark run (2026-06-21, `sigmap-v7.25-main`, 21 repos): hit@5 **75.6%** (13.6% baseline, 5.6× lift), token reduction **97%**, task success **52.2%**, prompts/task **1.72 → 2.84**, prompt reduction **39.4%**. `languages` corrected `31 → 33`; `extractors` (42) now reported.
+
+---
+
 ## [7.24.2] — 2026-06-19
 
 Patch release — surface the StarMapper stargazer map in the docs.

package/README.md

@@ -48,11 +48,13 @@ SigMap extracts function and class signatures from your codebase and feeds the r
 
 ## Why SigMap?
 
+<!--SM:whyMetrics-->
 - **75.6% hit@5** — right file found in top 5 results (vs 13.6% baseline)
 - **97.0% token reduction** — average across 21 real repos
 - **52.2% task success rate** — up from 10% without context
 - **1.72 prompts per task** — down from 2.84 (39.4% fewer retries)
-- **31 languages supported** — TypeScript, Python, Go, Rust, Java, R, and 25 others
+<!--/SM:whyMetrics-->
+- **<!--SM:languages-->33<!--/SM:languages--> languages supported** — TypeScript, Python, Go, Rust, Java, R, and more
 - **No vendor lock-in** — works with any AI assistant or local LLM
 - **No API costs** — use local models (Ollama, llama.cpp, vLLM) with zero token fees
 - **Full privacy** — keep your code and context on your machine
@@ -64,7 +66,7 @@ SigMap extracts function and class signatures from your codebase and feeds the r
 
 | Without SigMap | With SigMap |
 |---|---|
-| ❌ Guessing which files are relevant | ✅ Right file in context — 76% of the time |
+| ❌ Guessing which files are relevant | ✅ Right file in context — <!--SM:hitWhole-->76%<!--/SM:hitWhole--> of the time |
 | ❌ Sending the full repo to your AI | ✅ Minimal context — only what matters |
 | ❌ Embeddings / vector DB required | ✅ Grounded answers, no infra needed |
 
@@ -87,9 +89,10 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 ## Benchmark
 
+<!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v7.0-main (21 repositories, including R language)
-Date      : 2026-06-19
+Benchmark : sigmap-v7.25-main (21 repositories, including R language)
+Date      : 2026-06-21
 
 Hit@5          : 75.6%   (baseline 13.6%  — 5.6× lift)
 Token reduction: 97.0%   (across 21 repos)
@@ -97,6 +100,9 @@ Prompt reduction : 39.4% (2.84 → 1.72 prompts per task)
 Task success   : 52.2%   (baseline 10%)
 Repos tested   : 21 (JavaScript, Python, Go, Rust, Java, R, C++, C#, Dart, Swift, Ruby, PHP, Scala, Kotlin, and more)
 ```
+<!--/SM:benchmarkBlock-->
+
+<sub>All numbers above are generated from `benchmarks/latest.json` (`npm run metrics:sync`) — never hand-typed.</sub>
 
 Measured on 90 coding tasks across 18 real public repos. No LLM API — fully reproducible.
 
@@ -163,6 +169,7 @@ volta install sigmap
 | `openai` | `.github/openai-context.md` | OpenAI API, Aider, local Ollama/llama.cpp |
 | `gemini` | `.github/gemini-context.md` | Google Gemini |
 | `codex` | `AGENTS.md` | OpenAI Codex (legacy) |
+| `willow` | _Willow MCP store (HTTP POST — no file)_ | [Willow](https://github.com/rudi193-cmd/willow-1.9) knowledge store |
 
 ```bash
 sigmap --adapter copilot   # default — works with Copilot, OpenCode
@@ -184,12 +191,29 @@ Use SigMap with open-source tools and fully self-hosted setups:
 | **JetBrains** | [Marketplace](https://plugins.jetbrains.com/plugin/31109-sigmap--ai-context-engine/) | [github.com/manojmallick/sigmap-jetbrains](https://github.com/manojmallick/sigmap-jetbrains) | IntelliJ IDEA, WebStorm, PyCharm, GoLand — tool window + actions |
 | **Neovim** | lazy.nvim / packer / vim-plug | [github.com/manojmallick/sigmap.nvim](https://github.com/manojmallick/sigmap.nvim) | `:SigMap`, `:SigMapQuery` float window, statusline widget |
 
-**MCP server** — 10 on-demand tools for Claude Code and Cursor:
+**MCP server** — 15 on-demand tools for Claude Code and Cursor:
 
 ```bash
 sigmap --mcp
 ```
 
+Tools: `read_context`, `search_signatures`, `get_map`, `create_checkpoint`, `get_routing`, `explain_file`, `list_modules`, `query_context`, `get_impact`, `get_lines`, `read_memory`, `get_callee_signatures`, plus the live-index notifications `sigmap_notify_file_created`, `sigmap_notify_symbol_added`, and `sigmap_notify_file_deleted`. Full reference: [llms-full.txt](llms-full.txt).
+
+---
+
+## Grounded creation & guardrails
+
+Verify AI work against the live index instead of trusting it blind:
+
+```bash
+sigmap conventions                  # extract the repo's file-naming / export / test conventions
+sigmap scaffold "<name>"            # propose a convention-matched file/dir (refuses if conventions conflict)
+sigmap verify-plan <plan.md>        # check a plan: do the files/symbols exist? blast radius? scope?
+sigmap verify-ai-output <answer.md> # flag fabricated files/imports/symbols/tests in an AI answer
+sigmap review-pr                    # audit a diff: scope drift, god-node edits, missing tests, security files
+sigmap create "<task>"             # run the whole pipeline: scaffold → verify-plan → verify-ai-output → review-pr
+```
+
 ---
 
 ## Try it
@@ -234,7 +258,7 @@ sigmap --health
 | Benchmark methodology | [benchmark.html](https://sigmap.io/guide/benchmark.html) |
 | Config reference | [config.html](https://sigmap.io/guide/config.html) |
 | Roadmap | [roadmap.html](https://sigmap.io/guide/roadmap.html) |
-| 31 languages | [generalization.html](https://sigmap.io/guide/generalization.html) |
+| <!--SM:languages-->33<!--/SM:languages--> languages | [generalization.html](https://sigmap.io/guide/generalization.html) |
 
 ---
 
@@ -289,7 +313,7 @@ See [.github/PULL_REQUEST_TEMPLATE.md](.github/PULL_REQUEST_TEMPLATE.md) for the
 
 ---
 
-## 31 languages
+## <!--SM:languages-->33<!--/SM:languages--> languages
 
 TypeScript · JavaScript · Python · Java · Kotlin · Go · Rust · C# · C/C++ · Ruby · PHP · Swift · Dart · Scala · Vue · Svelte · HTML · CSS/SCSS · YAML · Shell · SQL · GraphQL · Terraform · Protobuf · Dockerfile · TOML · XML · Properties · Markdown · R · GDScript
 

package/gen-context.js

@@ -8102,7 +8102,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '7.24.2',
+    version: '7.25.1',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -13805,7 +13805,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '7.24.2';
+const VERSION = '7.25.1';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -15603,6 +15603,11 @@ Usage:
   ${cmd} verify-ai-output <answer.md>      Flag fake files/tests/imports/symbols/npm-scripts in an AI answer
   ${cmd} verify-ai-output <answer.md> --json    Hallucination report as JSON (exits 1 if issues)
   ${cmd} verify-ai-output <answer.md> --report  Write a standalone HTML report (red/amber/green)
+  ${cmd} conventions                       Extract repo file-naming/export/test conventions (--conflicts, --inject, --report, --fix)
+  ${cmd} scaffold "<name>"                 Propose a convention-matched file/dir scaffold (--ext, --threshold, --force, --json)
+  ${cmd} verify-plan <plan.md|->           Check a plan vs the live index — files/symbols exist, blast radius, scope (--json)
+  ${cmd} review-pr                         Audit a diff — scope drift, god-node edits, missing tests, security files (--staged, --json)
+  ${cmd} create "<task>"                   Grounded-creation pipeline: scaffold → verify-plan → verify-ai-output → review-pr (--staged)
   ${cmd} squeeze <file|->                  Minimize a pasted stacktrace/CI-log/JSON blob (--json for stats)
   ${cmd} ask "<query>" --squeeze           Auto-accept input minimization (no prompt; for scripts/CI)
   ${cmd} ask "<query>" --no-squeeze        Disable input minimization entirely

package/llms-full.txt

@@ -9,13 +9,13 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.24.2 | Benchmark: sigmap-v7.0-main (2026-06-19)
-# Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
+# Version: 7.25.1 | Benchmark: sigmap-v7.25-main (2026-06-21)
+# Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-19)
+## Core metrics (benchmark: sigmap-v7.25-main, 2026-06-21)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -23,7 +23,7 @@ Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 | Token reduction | — | 97.0% average |
 | Task success proxy | 10% | 52.2% |
 | Prompts per task | 2.84 | 1.72 (39.4% fewer) |
-| Supported languages | — | 31 |
+| Supported languages | — | 33 |
 | MCP tools | — | 15 |
 | npm runtime dependencies | — | 0 |
 
@@ -100,6 +100,11 @@ sigmap --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited
 sigmap verify-ai-output <answer.md>      Flag fake files/tests/imports/symbols/npm-scripts in an AI answer
 sigmap verify-ai-output <answer.md> --json    Hallucination report as JSON (exits 1 if issues)
 sigmap verify-ai-output <answer.md> --report  Write a standalone HTML report (red/amber/green)
+sigmap conventions                       Extract repo file-naming/export/test conventions (--conflicts, --inject, --report, --fix)
+sigmap scaffold "<name>"                 Propose a convention-matched file/dir scaffold (--ext, --threshold, --force, --json)
+sigmap verify-plan <plan.md|->           Check a plan vs the live index — files/symbols exist, blast radius, scope (--json)
+sigmap review-pr                         Audit a diff — scope drift, god-node edits, missing tests, security files (--staged, --json)
+sigmap create "<task>"                   Grounded-creation pipeline: scaffold → verify-plan → verify-ai-output → review-pr (--staged)
 sigmap squeeze <file|->                  Minimize a pasted stacktrace/CI-log/JSON blob (--json for stats)
 sigmap ask "<query>" --squeeze           Auto-accept input minimization (no prompt; for scripts/CI)
 sigmap ask "<query>" --no-squeeze        Disable input minimization entirely
@@ -285,9 +290,9 @@ impact = {"depth":3,"includeSigs":true}
 
 ---
 
-## Supported languages (35 extractors)
+## Supported languages (33 extractors)
 
-cpp, csharp, css, dart, dispatch, dockerfile, gdscript, generic, go, graphql, html, java, javascript, kotlin, markdown, php, properties, protobuf, python, r, ruby, rust, scala, shell, sql, svelte, swift, terraform, toml, typescript, typescript_react, vue, vue_sfc, xml, yaml
+cpp, csharp, css, dart, dockerfile, gdscript, go, graphql, html, java, javascript, kotlin, markdown, php, properties, protobuf, python, r, ruby, rust, scala, shell, sql, svelte, swift, terraform, toml, typescript, typescript_react, vue, vue_sfc, xml, yaml
 
 ---
 

package/llms.txt

@@ -9,8 +9,8 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.24.2 | Benchmark: sigmap-v7.0-main (2026-06-19)
-# Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
+# Version: 7.25.1 | Benchmark: sigmap-v7.25-main (2026-06-21)
+# Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ## What SigMap solves
@@ -21,13 +21,13 @@ Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v7.0-main, 2026-06-19)
+## Core metrics (benchmark: sigmap-v7.25-main, 2026-06-21)
 
 - hit@5 retrieval: 75.6% vs 13.6% random baseline (5.6× lift)
 - Token reduction: 97.0% average across benchmark repos
 - Task success: 52.2% vs 10% without SigMap
 - Prompts per task: 1.72 vs 2.84 baseline (39.4% fewer)
-- Languages: 31 supported · MCP tools: 15
+- Languages: 33 supported · MCP tools: 15
 - Dependencies: zero npm runtime dependencies · fully offline
 
 ## Quick start

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "7.24.2",
+  "version": "7.25.1",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {
@@ -38,7 +38,10 @@
     "version:sync": "node scripts/sync-versions.mjs",
     "generate:llms": "node scripts/generate-llms.mjs",
     "validate:llms": "node scripts/validate-llms.mjs",
-    "prepublishOnly": "node scripts/check-bundle.mjs && node scripts/check-version-meta.mjs && node scripts/generate-llms.mjs",
+    "metrics:latest": "node scripts/gen-benchmark-latest.mjs",
+    "metrics:sync": "node scripts/gen-benchmark-latest.mjs && node scripts/check-version-meta.mjs --fix && node scripts/sync-metrics.mjs && node scripts/generate-llms.mjs",
+    "check:metrics": "node scripts/gen-benchmark-latest.mjs --check && node scripts/check-version-meta.mjs && node scripts/sync-metrics.mjs --check",
+    "prepublishOnly": "node scripts/check-bundle.mjs && node scripts/gen-benchmark-latest.mjs --check && node scripts/check-version-meta.mjs && node scripts/sync-metrics.mjs --check && node scripts/generate-llms.mjs",
     "benchmark:grounding": "node scripts/run-hallucination-benchmark.mjs",
     "benchmark:llm-ablation": "node scripts/run-llm-ablation.mjs"
   },

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "7.24.2",
+  "version": "7.25.1",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "7.24.2",
+  "version": "7.25.1",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '7.24.2',
+  version: '7.25.1',
   description: 'SigMap MCP server — code signatures on demand',
 };