sigmap 8.10.0 → 8.11.0

package/CHANGELOG.md

@@ -10,6 +10,18 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.11.0] — 2026-07-11
+
+Minor release — the **terse signature encoder** (D7 from the master plan), shipped under its measure-first gate: the public reduction number comes from a benchmark run on this repo, never borrowed from another tool's prose-compression claims.
+
+### Added
+- **`--terse` — deterministic terse signature encoding (#462, PR #463):** opt-in compaction of the generated signature block (`function `→`fn `, tightened params/arrows/exports). Measured on this repo by `npm run benchmark:terse`: **10,232 → 8,580 sig tokens (−16.1%)** across 143 files / 780 signature lines. The `:start-end` line anchor and any trailing doc hint are preserved byte-exactly, so `get_lines`, evidence packs, `parseAnchor`, and symbol extraction keep working; the ranker parses terse context files (regression-tested). `terse: false` config default — default output is byte-identical when off. New `benchmark:terse` npm script (`scripts/run-terse-benchmark.mjs`) is the only legitimate source for this number.
+
+### Changed
+- **README:** replaced the flaky Star History embed with a reliable link (PR #461); added the 'Verified on MseeP' badge below the MseeP security badge (PR #460).
+
+---
+
 ## [8.10.0] — 2026-07-09
 
 Minor release — **honesty fixes** from a brutal code-review audit of the CLI surface: closing the gap between what each command *claims* and what it *does*. All changes are zero-dependency, deterministic, and the bundle stays reproducible from `src/`. ~40 new regression tests.

package/README.md

@@ -16,6 +16,7 @@
 [![Discover on ShyPD](https://img.shields.io/badge/ShyPD-Discover-7c6af7?logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxNiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAwIDE2IDE2Ij48Y2lyY2xlIGN4PSI4IiBjeT0iOCIgcj0iOCIgZmlsbD0id2hpdGUiLz48L3N2Zz4=&logoColor=7c6af7)](https://shypd.ai/tools/sigmap)
 
 [![MseeP.ai Security Assessment Badge](https://mseep.net/pr/manojmallick-sigmap-badge.png)](https://mseep.ai/app/manojmallick-sigmap)
+[![Verified on MseeP](https://mseep.ai/badge.svg)](https://mseep.ai/app/193cd37f-1ef3-43c3-80bc-86e23fd12924)
 
 </div>
 
@@ -121,8 +122,8 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.10-main (21 repositories, including R language)
-Date      : 2026-07-09
+Benchmark : sigmap-v8.11-main (21 repositories, including R language)
+Date      : 2026-07-11
 
 Hit@5          : 87.8%   (baseline 13.6%  — 6.5× lift)
 Token reduction: 97.0%   (across 21 repos)
@@ -339,9 +340,7 @@ If SigMap saves you context or API spend, a ⭐ on [GitHub](https://github.com/m
 
 🌍 See where SigMap's stargazers are around the world on the **[StarMapper star map →](https://starmapper.bruniaux.com/manojmallick/sigmap)**.
 
-<a href="https://star-history.com/#manojmallick/sigmap&Date">
-  <img src="https://api.star-history.com/svg?repos=manojmallick/sigmap&type=Date" alt="SigMap Star History Chart" width="600" />
-</a>
+📈 Watch SigMap's growth on the **[Star History chart →](https://star-history.com/#manojmallick/sigmap&Date)**.
 
 [Report an issue](https://github.com/manojmallick/sigmap/issues) · [Changelog](CHANGELOG.md)
 

package/gen-context.js

@@ -1501,6 +1501,9 @@ __factories["./src/config/defaults"] = function(module, exports) {
     // Include a compact `name@version` list of installed direct deps (D8)
     versionPins: true,
 
+    // Terse signature encoding — deterministic compaction of sig lines (D7, opt-in)
+    terse: false,
+
     // Include TODO/FIXME/HACK/XXX comments as compact section
     todos: true,
 
@@ -10011,6 +10014,96 @@ __factories["./src/format/llms-txt"] = function(module, exports) {
   
 };
 
+// ── ./src/format/terse ──
+__factories["./src/format/terse"] = function(module, exports) {
+  
+  /**
+   * Terse signature encoder (D7).
+   *
+   * Deterministic compaction of signature lines for the generated context —
+   * opt-in via `--terse` / `terse: true`. Every transform is a fixed string
+   * rewrite (no heuristics, no LLM), so terse output stays byte-stable.
+   *
+   * The line anchor (`  :start-end`) and everything after it (Python/R doc
+   * hints) are preserved byte-exactly: `parseAnchor`, `get_lines`, and the
+   * evidence pack keep working on terse output. Symbol extraction is safe too —
+   * `extractName` in src/extractors/prdiff.js already recognizes `fn <name>`.
+   */
+
+  /** First `  :start[-end]` anchor token (two-space prefix, as emitted by line-anchor.js). */
+  const ANCHOR_RE = /\s{2}:\d+(?:-\d+)?(?=\s|$)/;
+
+  /**
+   * Split a signature into the compactable text and the byte-preserved suffix
+   * (anchor + any trailing doc hint).
+   * @param {string} sig
+   * @returns {{ text: string, suffix: string }}
+   */
+  function splitAnchor(sig) {
+    const s = String(sig);
+    const m = ANCHOR_RE.exec(s);
+    if (!m) return { text: s, suffix: '' };
+    return { text: s.slice(0, m.index), suffix: s.slice(m.index) };
+  }
+
+  /**
+   * Compact one signature line. Leading whitespace (member indentation) is kept.
+   * @param {string} sig
+   * @returns {string}
+   */
+  function encodeTerseSig(sig) {
+    const { text, suffix } = splitAnchor(sig);
+    let t = text
+      .replace(/\basync function\b/g, 'async fn')
+      .replace(/\bfunction\b/g, 'fn')
+      .replace(/\s+→\s+/g, '→')
+      .replace(/,\s+/g, ',')
+      .replace(/\s+=\s+/g, '=')
+      .replace(/\{\s+/g, '{')
+      .replace(/\s+\}/g, '}')
+      .replace(/(\S)\s{2,}(?=\S)/g, '$1 ')
+      .replace(/^module\.exports=/, 'exports=');
+    return t + suffix;
+  }
+
+  /**
+   * Compact an array of signature lines.
+   * @param {string[]} sigs
+   * @returns {string[]}
+   */
+  function encodeTerseSigs(sigs) {
+    return (sigs || []).map(encodeTerseSig);
+  }
+
+  /** Estimated tokens of joined signature lines (same chars/4 rule as elsewhere). */
+  function _tokens(sigs) {
+    return Math.ceil(sigs.join('\n').length / 4);
+  }
+
+  /**
+   * Measure the real reduction terse encoding buys over a set of signature
+   * lists — the D7 "measure first" gate. Never quote a number this didn't produce.
+   * @param {string[][]} sigsList one string[] per file
+   * @returns {{ beforeTokens: number, afterTokens: number, reductionPct: number }}
+   */
+  function measureTerse(sigsList) {
+    let beforeTokens = 0;
+    let afterTokens = 0;
+    for (const sigs of sigsList || []) {
+      if (!sigs || !sigs.length) continue;
+      beforeTokens += _tokens(sigs);
+      afterTokens += _tokens(encodeTerseSigs(sigs));
+    }
+    const reductionPct = beforeTokens > 0
+      ? Math.round(((beforeTokens - afterTokens) / beforeTokens) * 1000) / 10
+      : 0;
+    return { beforeTokens, afterTokens, reductionPct };
+  }
+
+  module.exports = { encodeTerseSig, encodeTerseSigs, measureTerse, splitAnchor };
+  
+};
+
 // ── ./src/format/usage-guidance ──
 __factories["./src/format/usage-guidance"] = function(module, exports) {
   
@@ -13950,7 +14043,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.10.0',
+    version: '8.11.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -18640,7 +18733,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.10.0';
+const VERSION = '8.11.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -19317,6 +19410,21 @@ function formatOutput(fileEntries, cwd, routingEnabled, config, extras) {
     groups[group].push({ rel, sigs: entry.sigs });
   }
 
+  // D7: terse signature encoding — anchors preserved byte-exactly
+  const terseOn = !!(config && config.terse);
+  let encodeTerseSigs = null;
+  if (terseOn) {
+    try {
+      const terseMod = requireSourceOrBundled('./src/format/terse');
+      encodeTerseSigs = terseMod.encodeTerseSigs;
+      const m = terseMod.measureTerse(fileEntries.map((e) => e.sigs));
+      console.warn(`[sigmap] terse: sig block ${m.beforeTokens} → ${m.afterTokens} tokens (-${m.reductionPct}%)`);
+    } catch (err) {
+      encodeTerseSigs = null;
+      console.warn(`[sigmap] terse encoding skipped: ${err.message}`);
+    }
+  }
+
   for (const [group, entries] of Object.entries(groups).sort()) {
     lines.push(`## ${group}`);
     lines.push('');
@@ -19326,7 +19434,7 @@ function formatOutput(fileEntries, cwd, routingEnabled, config, extras) {
       const usedByStr = usedBy && usedBy.length ? ` (used by: ${usedBy.join(', ')})` : '';
       lines.push(`### ${rel}${usedByStr}`);
       lines.push('```');
-      lines.push(...sigs);
+      lines.push(...(encodeTerseSigs ? encodeTerseSigs(sigs) : sigs));
       lines.push('```');
       lines.push('');
     }
@@ -20440,6 +20548,7 @@ Usage:
   ${cmd} --monorepo                        Generate per-package context (monorepo)
   ${cmd} --each                            Run for every repo in the current directory
   ${cmd} --routing                         Include model routing hints in output
+  ${cmd} --terse                           Compact signature encoding (deterministic; line anchors preserved)
   ${cmd} --format cache                    Also write Anthropic prompt-cache JSON
   ${cmd} --track                           Append run metrics to .context/usage.ndjson
   ${cmd} --watch                           Generate + watch for file changes
@@ -20826,6 +20935,11 @@ function main() {
     config.testCoverage = true;
   }
 
+  // --terse: compact signature encoding without editing config (D7)
+  if (args.includes('--terse')) {
+    config.terse = true;
+  }
+
   // ── --output <file> — parse early so every subsequent block can use it ─────
   // Resolves the custom output path and merges it into config.customOutput.
   // Also persists the resolved relative path to gen-context.config.json so

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.10.0 | Benchmark: sigmap-v8.10-main (2026-07-09)
+# Version: 8.11.0 | Benchmark: sigmap-v8.11-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.10-main, 2026-07-09)
+## Core metrics (benchmark: sigmap-v8.11-main, 2026-07-11)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -55,6 +55,7 @@ sigmap                                   Generate context once and exit
 sigmap --monorepo                        Generate per-package context (monorepo)
 sigmap --each                            Run for every repo in the current directory
 sigmap --routing                         Include model routing hints in output
+sigmap --terse                           Compact signature encoding (deterministic; line anchors preserved)
 sigmap --format cache                    Also write Anthropic prompt-cache JSON
 sigmap --track                           Append run metrics to .context/usage.ndjson
 sigmap --watch                           Generate + watch for file changes
@@ -325,6 +326,7 @@ tracking = false
 mcp = {"autoRegister":true}
 depMap = true
 versionPins = true
+terse = false
 todos = true
 changes = true
 changesCommits = 10

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.10.0 | Benchmark: sigmap-v8.10-main (2026-07-09)
+# Version: 8.11.0 | Benchmark: sigmap-v8.11-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.10-main, 2026-07-09)
+## Core metrics (benchmark: sigmap-v8.11-main, 2026-07-11)
 
 - hit@5 retrieval: 87.8% vs 13.6% random baseline (6.5× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.10.0",
+  "version": "8.11.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {
@@ -29,6 +29,7 @@
     "benchmark:verify": "node scripts/run-verify-benchmark.mjs",
     "benchmark:squeeze": "node scripts/run-squeeze-benchmark.mjs --save",
     "benchmark:test-discovery": "node scripts/run-test-discovery-benchmark.mjs --save",
+    "benchmark:terse": "node scripts/run-terse-benchmark.mjs --save",
     "validate:squeeze": "node scripts/run-squeeze-benchmark.mjs --gate",
     "health": "node gen-context.js --health",
     "map": "node gen-project-map.js",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.10.0",
+  "version": "8.11.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.10.0",
+  "version": "8.11.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/config/defaults.js

@@ -117,6 +117,9 @@ const DEFAULTS = {
   // Include a compact `name@version` list of installed direct deps (D8)
   versionPins: true,
 
+  // Terse signature encoding — deterministic compaction of sig lines (D7, opt-in)
+  terse: false,
+
   // Include TODO/FIXME/HACK/XXX comments as compact section
   todos: true,
 

package/src/format/terse.js

@@ -0,0 +1,86 @@
+'use strict';
+
+/**
+ * Terse signature encoder (D7).
+ *
+ * Deterministic compaction of signature lines for the generated context —
+ * opt-in via `--terse` / `terse: true`. Every transform is a fixed string
+ * rewrite (no heuristics, no LLM), so terse output stays byte-stable.
+ *
+ * The line anchor (`  :start-end`) and everything after it (Python/R doc
+ * hints) are preserved byte-exactly: `parseAnchor`, `get_lines`, and the
+ * evidence pack keep working on terse output. Symbol extraction is safe too —
+ * `extractName` in src/extractors/prdiff.js already recognizes `fn <name>`.
+ */
+
+/** First `  :start[-end]` anchor token (two-space prefix, as emitted by line-anchor.js). */
+const ANCHOR_RE = /\s{2}:\d+(?:-\d+)?(?=\s|$)/;
+
+/**
+ * Split a signature into the compactable text and the byte-preserved suffix
+ * (anchor + any trailing doc hint).
+ * @param {string} sig
+ * @returns {{ text: string, suffix: string }}
+ */
+function splitAnchor(sig) {
+  const s = String(sig);
+  const m = ANCHOR_RE.exec(s);
+  if (!m) return { text: s, suffix: '' };
+  return { text: s.slice(0, m.index), suffix: s.slice(m.index) };
+}
+
+/**
+ * Compact one signature line. Leading whitespace (member indentation) is kept.
+ * @param {string} sig
+ * @returns {string}
+ */
+function encodeTerseSig(sig) {
+  const { text, suffix } = splitAnchor(sig);
+  let t = text
+    .replace(/\basync function\b/g, 'async fn')
+    .replace(/\bfunction\b/g, 'fn')
+    .replace(/\s+→\s+/g, '→')
+    .replace(/,\s+/g, ',')
+    .replace(/\s+=\s+/g, '=')
+    .replace(/\{\s+/g, '{')
+    .replace(/\s+\}/g, '}')
+    .replace(/(\S)\s{2,}(?=\S)/g, '$1 ')
+    .replace(/^module\.exports=/, 'exports=');
+  return t + suffix;
+}
+
+/**
+ * Compact an array of signature lines.
+ * @param {string[]} sigs
+ * @returns {string[]}
+ */
+function encodeTerseSigs(sigs) {
+  return (sigs || []).map(encodeTerseSig);
+}
+
+/** Estimated tokens of joined signature lines (same chars/4 rule as elsewhere). */
+function _tokens(sigs) {
+  return Math.ceil(sigs.join('\n').length / 4);
+}
+
+/**
+ * Measure the real reduction terse encoding buys over a set of signature
+ * lists — the D7 "measure first" gate. Never quote a number this didn't produce.
+ * @param {string[][]} sigsList one string[] per file
+ * @returns {{ beforeTokens: number, afterTokens: number, reductionPct: number }}
+ */
+function measureTerse(sigsList) {
+  let beforeTokens = 0;
+  let afterTokens = 0;
+  for (const sigs of sigsList || []) {
+    if (!sigs || !sigs.length) continue;
+    beforeTokens += _tokens(sigs);
+    afterTokens += _tokens(encodeTerseSigs(sigs));
+  }
+  const reductionPct = beforeTokens > 0
+    ? Math.round(((beforeTokens - afterTokens) / beforeTokens) * 1000) / 10
+    : 0;
+  return { beforeTokens, afterTokens, reductionPct };
+}
+
+module.exports = { encodeTerseSig, encodeTerseSigs, measureTerse, splitAnchor };

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.10.0',
+  version: '8.11.0',
   description: 'SigMap MCP server — code signatures on demand',
 };