sigmap 8.2.0 → 8.3.0

package/CHANGELOG.md

@@ -10,6 +10,13 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.3.0] — 2026-07-05
+
+Minor release — **Python site-packages grounding: the moat now spans both major ecosystems.** v8.1/v8.2 built local-library grounding for JS/TS (`node_modules` `.d.ts`); this extends it to **Python**, so `verify-ai-output` and the `verify_suggestion` MCP tool ground AI-suggested Python code against the libraries actually installed in the project's venv — with pinned versions (D8). Zero-dependency, no Python runtime, deterministic.
+
+### Added
+- **Python site-packages grounding (#413, PR #414):** `buildLibraryIndex` (`src/verify/lib-index.js`) gains a Python pass alongside the JS/TS one. It reads direct deps from `requirements.txt` / `pyproject.toml` (PEP 621 `[project].dependencies` + Poetry), discovers the venv `site-packages` (`.venv|venv|env` → `lib/python*/site-packages`, or `Lib/site-packages` on Windows) **without spawning Python**, resolves each dep's installed module + version (`*.dist-info`, D8) with PEP 503 import-name normalization, and extracts exported names from the package's `__init__.py`/`.pyi` (`__all__`, top-level `def`/`class`, public assignments, and `from … import` re-exports). Both ecosystems merge into one symbol index — genuine installed-Python-library calls stop being false-flagged as `fake-symbol`. Byte-stable given a fixed installed tree; cached via `src/cache/sig-cache.js`; graceful on missing venv / unresolved deps.
+
 ## [8.2.0] — 2026-07-04
 
 Minor release — **`verify_suggestion` MCP tool: the grounding moat, made consumable by agents.** v8.1.0 built local-library grounding inside the `verify-ai-output` CLI; this exposes it as the **18th MCP tool**, so a coding agent can verify its own generated code against the repo **and the libraries actually installed** in `node_modules` — *before it writes* — and get back the flagged issues plus the pinned versions it verified against (D8).

package/README.md

@@ -98,7 +98,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.2-main (21 repositories, including R language)
+Benchmark : sigmap-v8.3-main (21 repositories, including R language)
 Date      : 2026-07-04
 
 Hit@5          : 86.7%   (baseline 13.6%  — 6.4× lift)

package/gen-context.js

@@ -13108,7 +13108,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.2.0',
+    version: '8.3.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -16805,12 +16805,17 @@ __factories["./src/verify/lib-index"] = function(module, exports) {
    * in `node_modules` and verify AI suggestions against repo + private +
    * installed-lib symbols. This module builds the installed-lib half.
    *
-   * For each **direct** dependency declared in `package.json`, it locates the
-   * package under `node_modules/<dep>`, reads its version (D8 version pinning),
-   * and extracts the exported symbol names from its TypeScript declaration entry
-   * (`types`/`typings`, else `index.d.ts`). Pure, zero-dependency, deterministic:
-   * byte-stable given a fixed installed tree. Bounded (per-file read cap + dep
-   * cap) and cached via `src/cache/sig-cache.js` so repeat builds are near-free.
+   * Two ecosystems, one index:
+   *   - **JS/TS** — each **direct** dependency in `package.json` resolved under
+   *     `node_modules/<dep>`; exports read from its TypeScript declaration entry
+   *     (`types`/`typings`, else `index.d.ts`).
+   *   - **Python** — each direct dependency in `requirements.txt`/`pyproject.toml`
+   *     resolved in the project's venv `site-packages`; exports read from the
+   *     package's `__init__.py`/`.pyi`. No Python runtime is spawned (North-Star #1).
+   *
+   * Pure, zero-dependency, deterministic: byte-stable given a fixed installed
+   * tree. Bounded (per-file read cap + dep cap) and cached via
+   * `src/cache/sig-cache.js` so repeat builds are near-free.
    */
 
   const fs = require('fs');
@@ -16820,6 +16825,7 @@ __factories["./src/verify/lib-index"] = function(module, exports) {
   const MAX_DTS_BYTES = 512 * 1024; // per-file read cap
   const MAX_DEPS = 1000;            // dep count cap
   const DEP_KEYS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+  const VENV_DIRS = ['.venv', 'venv', 'env', '.env'];
 
   /**
    * Extract exported symbol names from a `.d.ts` declaration file. Deterministic,
@@ -16895,6 +16901,130 @@ __factories["./src/verify/lib-index"] = function(module, exports) {
     return { version, dtsPath: null }; // installed but untyped
   }
 
+  // ── Python ──────────────────────────────────────────────────────────────────
+
+  /**
+   * Extract exported symbol names from a Python module's `__init__.py`/`.pyi`.
+   * Deterministic, regex-based, top-level only: `__all__`, `def`/`class`, public
+   * module-level assignments, and `from … import …` re-exports (a package's
+   * public API is largely re-exports). Private names (leading `_`) are skipped
+   * unless listed in `__all__`.
+   * @param {string} src
+   * @returns {string[]} sorted unique exported names
+   */
+  function extractPyExports(src) {
+    const names = new Set();
+    if (!src) return [];
+
+    // __all__ = [ 'a', 'b', ... ]  (authoritative when present; keeps privates)
+    const allMatch = src.match(/^__all__\s*[:+]?=\s*[\[(]([\s\S]*?)[\])]/m);
+    if (allMatch) {
+      for (const m of allMatch[1].matchAll(/['"]([A-Za-z_]\w*)['"]/g)) names.add(m[1]);
+    }
+
+    // top-level def / class (column 0)
+    for (const m of src.matchAll(/^(?:async\s+)?def\s+([A-Za-z_]\w*)/gm)) if (!m[1].startsWith('_')) names.add(m[1]);
+    for (const m of src.matchAll(/^class\s+([A-Za-z_]\w*)/gm)) if (!m[1].startsWith('_')) names.add(m[1]);
+
+    // top-level public assignments: NAME = …  /  NAME: type = …  (not ==, +=, etc.)
+    for (const m of src.matchAll(/^([A-Za-z_]\w*)\s*(?::[^=\n]+)?=(?!=)/gm)) {
+      if (!m[1].startsWith('_')) names.add(m[1]);
+    }
+
+    // re-exports: from .mod import Name, Other as Alias
+    for (const m of src.matchAll(/^from\s+[^\n]+?\s+import\s+([^\n#]+)/gm)) {
+      for (const part of m[1].split(',')) {
+        const name = part.trim().replace(/[()]/g, '').split(/\s+as\s+/).pop().trim();
+        if (/^[A-Za-z_]\w*$/.test(name) && !name.startsWith('_')) names.add(name);
+      }
+    }
+
+    return [...names].sort();
+  }
+
+  /** Read direct Python dependency names from requirements.txt + pyproject.toml. */
+  function pythonDirectDeps(cwd) {
+    const names = new Set();
+    try {
+      const req = fs.readFileSync(path.join(cwd, 'requirements.txt'), 'utf8');
+      for (const line of req.split('\n')) {
+        const t = line.trim();
+        if (!t || t.startsWith('#') || t.startsWith('-')) continue;
+        const m = t.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
+        if (m) names.add(m[1]);
+      }
+    } catch (_) { /* none */ }
+    try {
+      const py = fs.readFileSync(path.join(cwd, 'pyproject.toml'), 'utf8');
+      // PEP 621: [project] dependencies = ["foo>=1", "bar"]
+      const projDeps = py.match(/^\s*dependencies\s*=\s*\[([\s\S]*?)\]/m);
+      if (projDeps) for (const m of projDeps[1].matchAll(/['"]([A-Za-z0-9][A-Za-z0-9._-]*)/g)) names.add(m[1]);
+      // Poetry: [tool.poetry.dependencies]\n foo = "^1"
+      const poetry = py.match(/\[tool\.poetry\.dependencies\]([\s\S]*?)(?:\n\[|$)/);
+      if (poetry) for (const m of poetry[1].matchAll(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/gm)) {
+        if (m[1] !== 'python') names.add(m[1]);
+      }
+    } catch (_) { /* none */ }
+    return [...names].sort();
+  }
+
+  /** Locate the project's venv `site-packages` directories (no Python runtime). */
+  function findSitePackages(cwd) {
+    const out = [];
+    for (const v of VENV_DIRS) {
+      const base = path.join(cwd, v);
+      const libDir = path.join(base, 'lib'); // POSIX: <venv>/lib/pythonX.Y/site-packages
+      let pyDirs = [];
+      try { pyDirs = fs.readdirSync(libDir).filter((d) => /^python\d/.test(d)).sort(); } catch (_) { /* none */ }
+      for (const py of pyDirs) {
+        const sp = path.join(libDir, py, 'site-packages');
+        try { if (fs.statSync(sp).isDirectory()) out.push(sp); } catch (_) { /* next */ }
+      }
+      const winSp = path.join(base, 'Lib', 'site-packages'); // Windows
+      try { if (fs.statSync(winSp).isDirectory()) out.push(winSp); } catch (_) { /* next */ }
+    }
+    return out;
+  }
+
+  /** PEP 503 name normalization (case-insensitive, `-`/`_`/`.` collapsed). */
+  function normalizePy(name) {
+    return String(name).toLowerCase().replace(/[-_.]+/g, '-');
+  }
+
+  /** Find an installed distribution's version from its `*.dist-info`/`*.egg-info`. */
+  function findPyVersion(sitePkgsDir, dep) {
+    const norm = normalizePy(dep);
+    let entries;
+    try { entries = fs.readdirSync(sitePkgsDir); } catch (_) { return null; }
+    for (const e of entries.sort()) {
+      const m = e.match(/^(.+?)-(\d[^-]*)\.(?:dist-info|egg-info)$/);
+      if (m && normalizePy(m[1]) === norm) return m[2];
+    }
+    return null;
+  }
+
+  /**
+   * Resolve a Python dependency to its installed module entry file + version.
+   * @returns {{ version: string|null, sourcePath: string|null }|null} null if not installed
+   */
+  function resolvePyEntry(sitePkgsDirs, dep) {
+    const candidates = [...new Set([dep, dep.replace(/-/g, '_'), dep.toLowerCase(), dep.toLowerCase().replace(/-/g, '_')])];
+    for (const sp of sitePkgsDirs) {
+      const version = findPyVersion(sp, dep);
+      for (const cand of candidates) {
+        for (const entry of ['__init__.pyi', '__init__.py']) { // package
+          const p = path.join(sp, cand, entry);
+          try { if (fs.statSync(p).isFile()) return { version, sourcePath: p }; } catch (_) { /* next */ }
+        }
+        for (const ext of ['.pyi', '.py']) { // single-module
+          const p = path.join(sp, cand + ext);
+          try { if (fs.statSync(p).isFile()) return { version, sourcePath: p }; } catch (_) { /* next */ }
+        }
+      }
+    }
+    return null;
+  }
+
   /**
    * Build the installed-library signature index for `cwd`.
    *
@@ -16907,17 +17037,24 @@ __factories["./src/verify/lib-index"] = function(module, exports) {
   function buildLibraryIndex(cwd, opts = {}) {
     const version = opts.version || '0';
     const useCache = opts.cache !== false;
-    const deps = directDeps(cwd).slice(0, MAX_DEPS);
 
-    const entries = [];
-    for (const dep of deps) {
+    // Collect entries from both ecosystems; each carries its extractor kind.
+    const entries = []; // { name, version, sourcePath, kind: 'dts'|'py' }
+    for (const dep of directDeps(cwd).slice(0, MAX_DEPS)) {
       const r = resolveEntry(cwd, dep);
-      if (r) entries.push({ dep, version: r.version, dtsPath: r.dtsPath });
+      if (r) entries.push({ name: dep, version: r.version, sourcePath: r.dtsPath, kind: 'dts' });
+    }
+    const sitePkgs = findSitePackages(cwd);
+    if (sitePkgs.length) {
+      for (const dep of pythonDirectDeps(cwd).slice(0, MAX_DEPS)) {
+        const r = resolvePyEntry(sitePkgs, dep);
+        if (r) entries.push({ name: dep, version: r.version, sourcePath: r.sourcePath, kind: 'py' });
+      }
     }
 
     const cache = useCache ? loadCache(cwd, version) : new Map();
-    const dtsFiles = entries.filter((e) => e.dtsPath).map((e) => e.dtsPath);
-    const { unchanged } = getChangedFiles(dtsFiles, cache);
+    const files = entries.filter((e) => e.sourcePath).map((e) => e.sourcePath);
+    const { unchanged } = getChangedFiles(files, cache);
     const unchangedSet = new Set(unchanged);
 
     const symbols = new Set();
@@ -16926,20 +17063,20 @@ __factories["./src/verify/lib-index"] = function(module, exports) {
 
     for (const e of entries) {
       let names;
-      if (!e.dtsPath) {
+      if (!e.sourcePath) {
         names = [];
-      } else if (unchangedSet.has(e.dtsPath) && cache.get(e.dtsPath)) {
-        names = cache.get(e.dtsPath).sigs || [];
+      } else if (unchangedSet.has(e.sourcePath) && cache.get(e.sourcePath)) {
+        names = cache.get(e.sourcePath).sigs || [];
       } else {
         let src = '';
         try {
-          if (fs.statSync(e.dtsPath).size <= MAX_DTS_BYTES) src = fs.readFileSync(e.dtsPath, 'utf8');
+          if (fs.statSync(e.sourcePath).size <= MAX_DTS_BYTES) src = fs.readFileSync(e.sourcePath, 'utf8');
         } catch (_) { /* unreadable → empty */ }
-        names = extractDtsExports(src);
-        fresh.push({ file: e.dtsPath, sigs: names });
+        names = e.kind === 'py' ? extractPyExports(src) : extractDtsExports(src);
+        fresh.push({ file: e.sourcePath, sigs: names });
       }
       for (const n of names) symbols.add(n);
-      libraries.push({ name: e.dep, version: e.version, symbols: names.length, typed: !!e.dtsPath });
+      libraries.push({ name: e.name, version: e.version, symbols: names.length, typed: !!e.sourcePath });
     }
 
     if (useCache && fresh.length) {
@@ -16958,7 +17095,10 @@ __factories["./src/verify/lib-index"] = function(module, exports) {
       .map((l) => `${l.name}@${l.version}`);
   }
 
-  module.exports = { buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, formatVersionPins };
+  module.exports = {
+    buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, formatVersionPins,
+    extractPyExports, pythonDirectDeps, findSitePackages, resolvePyEntry,
+  };
   
 };
 
@@ -17291,7 +17431,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.2.0';
+const VERSION = '8.3.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.2.0 | Benchmark: sigmap-v8.2-main (2026-07-04)
+# Version: 8.3.0 | Benchmark: sigmap-v8.3-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.2-main, 2026-07-04)
+## Core metrics (benchmark: sigmap-v8.3-main, 2026-07-04)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.2.0 | Benchmark: sigmap-v8.2-main (2026-07-04)
+# Version: 8.3.0 | Benchmark: sigmap-v8.3-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.2-main, 2026-07-04)
+## Core metrics (benchmark: sigmap-v8.3-main, 2026-07-04)
 
 - hit@5 retrieval: 86.7% vs 13.6% random baseline (6.4× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.2.0",
+  "version": "8.3.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.2.0",
+  "version": "8.3.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.2.0",
+  "version": "8.3.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.2.0',
+  version: '8.3.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/verify/lib-index.js

@@ -8,12 +8,17 @@
  * in `node_modules` and verify AI suggestions against repo + private +
  * installed-lib symbols. This module builds the installed-lib half.
  *
- * For each **direct** dependency declared in `package.json`, it locates the
- * package under `node_modules/<dep>`, reads its version (D8 version pinning),
- * and extracts the exported symbol names from its TypeScript declaration entry
- * (`types`/`typings`, else `index.d.ts`). Pure, zero-dependency, deterministic:
- * byte-stable given a fixed installed tree. Bounded (per-file read cap + dep
- * cap) and cached via `src/cache/sig-cache.js` so repeat builds are near-free.
+ * Two ecosystems, one index:
+ *   - **JS/TS** — each **direct** dependency in `package.json` resolved under
+ *     `node_modules/<dep>`; exports read from its TypeScript declaration entry
+ *     (`types`/`typings`, else `index.d.ts`).
+ *   - **Python** — each direct dependency in `requirements.txt`/`pyproject.toml`
+ *     resolved in the project's venv `site-packages`; exports read from the
+ *     package's `__init__.py`/`.pyi`. No Python runtime is spawned (North-Star #1).
+ *
+ * Pure, zero-dependency, deterministic: byte-stable given a fixed installed
+ * tree. Bounded (per-file read cap + dep cap) and cached via
+ * `src/cache/sig-cache.js` so repeat builds are near-free.
  */
 
 const fs = require('fs');
@@ -23,6 +28,7 @@ const { loadCache, saveCache, getChangedFiles, updateCacheEntries } = require('.
 const MAX_DTS_BYTES = 512 * 1024; // per-file read cap
 const MAX_DEPS = 1000;            // dep count cap
 const DEP_KEYS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+const VENV_DIRS = ['.venv', 'venv', 'env', '.env'];
 
 /**
  * Extract exported symbol names from a `.d.ts` declaration file. Deterministic,
@@ -98,6 +104,130 @@ function resolveEntry(cwd, dep) {
   return { version, dtsPath: null }; // installed but untyped
 }
 
+// ── Python ──────────────────────────────────────────────────────────────────
+
+/**
+ * Extract exported symbol names from a Python module's `__init__.py`/`.pyi`.
+ * Deterministic, regex-based, top-level only: `__all__`, `def`/`class`, public
+ * module-level assignments, and `from … import …` re-exports (a package's
+ * public API is largely re-exports). Private names (leading `_`) are skipped
+ * unless listed in `__all__`.
+ * @param {string} src
+ * @returns {string[]} sorted unique exported names
+ */
+function extractPyExports(src) {
+  const names = new Set();
+  if (!src) return [];
+
+  // __all__ = [ 'a', 'b', ... ]  (authoritative when present; keeps privates)
+  const allMatch = src.match(/^__all__\s*[:+]?=\s*[\[(]([\s\S]*?)[\])]/m);
+  if (allMatch) {
+    for (const m of allMatch[1].matchAll(/['"]([A-Za-z_]\w*)['"]/g)) names.add(m[1]);
+  }
+
+  // top-level def / class (column 0)
+  for (const m of src.matchAll(/^(?:async\s+)?def\s+([A-Za-z_]\w*)/gm)) if (!m[1].startsWith('_')) names.add(m[1]);
+  for (const m of src.matchAll(/^class\s+([A-Za-z_]\w*)/gm)) if (!m[1].startsWith('_')) names.add(m[1]);
+
+  // top-level public assignments: NAME = …  /  NAME: type = …  (not ==, +=, etc.)
+  for (const m of src.matchAll(/^([A-Za-z_]\w*)\s*(?::[^=\n]+)?=(?!=)/gm)) {
+    if (!m[1].startsWith('_')) names.add(m[1]);
+  }
+
+  // re-exports: from .mod import Name, Other as Alias
+  for (const m of src.matchAll(/^from\s+[^\n]+?\s+import\s+([^\n#]+)/gm)) {
+    for (const part of m[1].split(',')) {
+      const name = part.trim().replace(/[()]/g, '').split(/\s+as\s+/).pop().trim();
+      if (/^[A-Za-z_]\w*$/.test(name) && !name.startsWith('_')) names.add(name);
+    }
+  }
+
+  return [...names].sort();
+}
+
+/** Read direct Python dependency names from requirements.txt + pyproject.toml. */
+function pythonDirectDeps(cwd) {
+  const names = new Set();
+  try {
+    const req = fs.readFileSync(path.join(cwd, 'requirements.txt'), 'utf8');
+    for (const line of req.split('\n')) {
+      const t = line.trim();
+      if (!t || t.startsWith('#') || t.startsWith('-')) continue;
+      const m = t.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
+      if (m) names.add(m[1]);
+    }
+  } catch (_) { /* none */ }
+  try {
+    const py = fs.readFileSync(path.join(cwd, 'pyproject.toml'), 'utf8');
+    // PEP 621: [project] dependencies = ["foo>=1", "bar"]
+    const projDeps = py.match(/^\s*dependencies\s*=\s*\[([\s\S]*?)\]/m);
+    if (projDeps) for (const m of projDeps[1].matchAll(/['"]([A-Za-z0-9][A-Za-z0-9._-]*)/g)) names.add(m[1]);
+    // Poetry: [tool.poetry.dependencies]\n foo = "^1"
+    const poetry = py.match(/\[tool\.poetry\.dependencies\]([\s\S]*?)(?:\n\[|$)/);
+    if (poetry) for (const m of poetry[1].matchAll(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/gm)) {
+      if (m[1] !== 'python') names.add(m[1]);
+    }
+  } catch (_) { /* none */ }
+  return [...names].sort();
+}
+
+/** Locate the project's venv `site-packages` directories (no Python runtime). */
+function findSitePackages(cwd) {
+  const out = [];
+  for (const v of VENV_DIRS) {
+    const base = path.join(cwd, v);
+    const libDir = path.join(base, 'lib'); // POSIX: <venv>/lib/pythonX.Y/site-packages
+    let pyDirs = [];
+    try { pyDirs = fs.readdirSync(libDir).filter((d) => /^python\d/.test(d)).sort(); } catch (_) { /* none */ }
+    for (const py of pyDirs) {
+      const sp = path.join(libDir, py, 'site-packages');
+      try { if (fs.statSync(sp).isDirectory()) out.push(sp); } catch (_) { /* next */ }
+    }
+    const winSp = path.join(base, 'Lib', 'site-packages'); // Windows
+    try { if (fs.statSync(winSp).isDirectory()) out.push(winSp); } catch (_) { /* next */ }
+  }
+  return out;
+}
+
+/** PEP 503 name normalization (case-insensitive, `-`/`_`/`.` collapsed). */
+function normalizePy(name) {
+  return String(name).toLowerCase().replace(/[-_.]+/g, '-');
+}
+
+/** Find an installed distribution's version from its `*.dist-info`/`*.egg-info`. */
+function findPyVersion(sitePkgsDir, dep) {
+  const norm = normalizePy(dep);
+  let entries;
+  try { entries = fs.readdirSync(sitePkgsDir); } catch (_) { return null; }
+  for (const e of entries.sort()) {
+    const m = e.match(/^(.+?)-(\d[^-]*)\.(?:dist-info|egg-info)$/);
+    if (m && normalizePy(m[1]) === norm) return m[2];
+  }
+  return null;
+}
+
+/**
+ * Resolve a Python dependency to its installed module entry file + version.
+ * @returns {{ version: string|null, sourcePath: string|null }|null} null if not installed
+ */
+function resolvePyEntry(sitePkgsDirs, dep) {
+  const candidates = [...new Set([dep, dep.replace(/-/g, '_'), dep.toLowerCase(), dep.toLowerCase().replace(/-/g, '_')])];
+  for (const sp of sitePkgsDirs) {
+    const version = findPyVersion(sp, dep);
+    for (const cand of candidates) {
+      for (const entry of ['__init__.pyi', '__init__.py']) { // package
+        const p = path.join(sp, cand, entry);
+        try { if (fs.statSync(p).isFile()) return { version, sourcePath: p }; } catch (_) { /* next */ }
+      }
+      for (const ext of ['.pyi', '.py']) { // single-module
+        const p = path.join(sp, cand + ext);
+        try { if (fs.statSync(p).isFile()) return { version, sourcePath: p }; } catch (_) { /* next */ }
+      }
+    }
+  }
+  return null;
+}
+
 /**
  * Build the installed-library signature index for `cwd`.
  *
@@ -110,17 +240,24 @@ function resolveEntry(cwd, dep) {
 function buildLibraryIndex(cwd, opts = {}) {
   const version = opts.version || '0';
   const useCache = opts.cache !== false;
-  const deps = directDeps(cwd).slice(0, MAX_DEPS);
 
-  const entries = [];
-  for (const dep of deps) {
+  // Collect entries from both ecosystems; each carries its extractor kind.
+  const entries = []; // { name, version, sourcePath, kind: 'dts'|'py' }
+  for (const dep of directDeps(cwd).slice(0, MAX_DEPS)) {
     const r = resolveEntry(cwd, dep);
-    if (r) entries.push({ dep, version: r.version, dtsPath: r.dtsPath });
+    if (r) entries.push({ name: dep, version: r.version, sourcePath: r.dtsPath, kind: 'dts' });
+  }
+  const sitePkgs = findSitePackages(cwd);
+  if (sitePkgs.length) {
+    for (const dep of pythonDirectDeps(cwd).slice(0, MAX_DEPS)) {
+      const r = resolvePyEntry(sitePkgs, dep);
+      if (r) entries.push({ name: dep, version: r.version, sourcePath: r.sourcePath, kind: 'py' });
+    }
   }
 
   const cache = useCache ? loadCache(cwd, version) : new Map();
-  const dtsFiles = entries.filter((e) => e.dtsPath).map((e) => e.dtsPath);
-  const { unchanged } = getChangedFiles(dtsFiles, cache);
+  const files = entries.filter((e) => e.sourcePath).map((e) => e.sourcePath);
+  const { unchanged } = getChangedFiles(files, cache);
   const unchangedSet = new Set(unchanged);
 
   const symbols = new Set();
@@ -129,20 +266,20 @@ function buildLibraryIndex(cwd, opts = {}) {
 
   for (const e of entries) {
     let names;
-    if (!e.dtsPath) {
+    if (!e.sourcePath) {
       names = [];
-    } else if (unchangedSet.has(e.dtsPath) && cache.get(e.dtsPath)) {
-      names = cache.get(e.dtsPath).sigs || [];
+    } else if (unchangedSet.has(e.sourcePath) && cache.get(e.sourcePath)) {
+      names = cache.get(e.sourcePath).sigs || [];
     } else {
       let src = '';
       try {
-        if (fs.statSync(e.dtsPath).size <= MAX_DTS_BYTES) src = fs.readFileSync(e.dtsPath, 'utf8');
+        if (fs.statSync(e.sourcePath).size <= MAX_DTS_BYTES) src = fs.readFileSync(e.sourcePath, 'utf8');
       } catch (_) { /* unreadable → empty */ }
-      names = extractDtsExports(src);
-      fresh.push({ file: e.dtsPath, sigs: names });
+      names = e.kind === 'py' ? extractPyExports(src) : extractDtsExports(src);
+      fresh.push({ file: e.sourcePath, sigs: names });
     }
     for (const n of names) symbols.add(n);
-    libraries.push({ name: e.dep, version: e.version, symbols: names.length, typed: !!e.dtsPath });
+    libraries.push({ name: e.name, version: e.version, symbols: names.length, typed: !!e.sourcePath });
   }
 
   if (useCache && fresh.length) {
@@ -161,4 +298,7 @@ function formatVersionPins(libraries) {
     .map((l) => `${l.name}@${l.version}`);
 }
 
-module.exports = { buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, formatVersionPins };
+module.exports = {
+  buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, formatVersionPins,
+  extractPyExports, pythonDirectDeps, findSitePackages, resolvePyEntry,
+};