sigmap 8.23.0 → 8.24.0

package/CHANGELOG.md

@@ -10,6 +10,18 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.24.0] — 2026-07-28
+
+Minor release — **"Trust Quick Wins I" (v8.24, G3a)**: the secret-redaction engine that already protects signatures, `get_lines`, and evidence packs becomes a standalone command for arbitrary text.
+
+### Added
+- **`sigmap redact` (#511, PR #512):** new `src/security/redact.js` — `redactText()` masks only the matched secret substring (`[REDACTED:<pattern name>]`), preserving surrounding text (unlike the generation-time scanner's whole-line replacement, which is unchanged). Findings carry 1-based line numbers with per-pattern counts. CLI: `sigmap redact [file] [--json]` — file argument or stdin; redacted text on stdout (pipe-clean), summary on stderr. Reuses the existing 10-pattern bank verbatim; zero new dependencies; never throws. 6 new integration tests including an every-pattern mask sweep (130 test files).
+
+### Changed
+- Test fixtures for secret patterns are assembled at runtime (no secret-shaped literals in committed blobs) — GitHub Push Protection rejected the first push over the fake samples, which validated the detection class this command implements.
+
+---
+
 ## [8.23.0] — 2026-07-28
 
 Minor release — **"Agent Economy I" (v8.23, F1)**: SigMap's token savings become queryable *during* a session. A spend ledger over the existing gain log, an optional budget threshold, and context-freshness age — as a CLI command and the 21st MCP tool.

package/README.md

@@ -122,7 +122,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.23-main (21 repositories, including R language)
+Benchmark : sigmap-v8.24-main (21 repositories, including R language)
 Date      : 2026-07-28
 
 Hit@5          : 82.2%   (grep-agent baseline 44.8%  — 1.59× lift)

package/gen-context.js

@@ -14981,7 +14981,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.23.0',
+    version: '8.24.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -17528,6 +17528,66 @@ __factories["./src/security/patterns"] = function(module, exports) {
   
 };
 
+// ── ./src/security/redact ──
+__factories["./src/security/redact"] = function(module, exports) {
+  
+  /**
+   * Standalone text redaction (v8.24 G3a) — the same pattern bank the
+   * generation-time scanner uses (security/patterns.js), applied to arbitrary
+   * text. Unlike scanner.js (which replaces whole signature lines), this masks
+   * only the matched secret substring so surrounding text stays readable.
+   *
+   * Zero dependencies; never throws — on any error the original text is
+   * returned unredacted.
+   */
+
+  const { PATTERNS } = __require('./src/security/patterns');
+
+  // Global variants of the pattern regexes (needed for replace-all per line).
+  const GLOBAL_PATTERNS = PATTERNS.map((p) => ({
+    name: p.name,
+    regex: new RegExp(p.regex.source, p.regex.flags.includes('g') ? p.regex.flags : p.regex.flags + 'g'),
+  }));
+
+  /**
+   * Redact secrets in arbitrary text.
+   * @param {string} text
+   * @returns {{
+   *   text: string, redacted: boolean,
+   *   findings: Array<{ line: number, pattern: string }>,
+   *   counts: Object<string, number>
+   * }}
+   */
+  function redactText(text) {
+    if (typeof text !== 'string' || text.length === 0) {
+      return { text: typeof text === 'string' ? text : '', redacted: false, findings: [], counts: {} };
+    }
+    try {
+      const findings = [];
+      const counts = {};
+      const lines = text.split('\n');
+      const out = lines.map((line, i) => {
+        let masked = line;
+        for (const p of GLOBAL_PATTERNS) {
+          p.regex.lastIndex = 0;
+          if (!p.regex.test(masked)) continue;
+          p.regex.lastIndex = 0;
+          masked = masked.replace(p.regex, `[REDACTED:${p.name}]`);
+          findings.push({ line: i + 1, pattern: p.name });
+          counts[p.name] = (counts[p.name] || 0) + 1;
+        }
+        return masked;
+      });
+      return { text: out.join('\n'), redacted: findings.length > 0, findings, counts };
+    } catch (_) {
+      return { text, redacted: false, findings: [], counts: {} };
+    }
+  }
+
+  module.exports = { redactText };
+  
+};
+
 // ── ./src/security/scanner ──
 __factories["./src/security/scanner"] = function(module, exports) {
   
@@ -20347,7 +20407,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.23.0';
+const VERSION = '8.24.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -22234,6 +22294,7 @@ Usage:
   ${cmd} memory --clear <store>            Clear one store: session|notes|weights|evidence|all (--json supported)
   ${cmd} budget                            Session spend ledger — estimated SigMap-emitted tokens, budget, context age (--json)
   ${cmd} budget --budget <tokens>          One-off budget override (config: sessionBudgetTokens, contextTtlDays)
+  ${cmd} redact [file]                     Mask secrets in a file or stdin (10-pattern bank); redacted text to stdout (--json)
   ${cmd} note "<text>"                     Append a note to the cross-session decision log
   ${cmd} note                              List recent notes (also: note --list <N>)
   ${cmd} status                            Show repo state — branch, dirty files, index freshness, notes
@@ -23715,6 +23776,42 @@ function main() {
     process.exit(0);
   }
 
+  if (args[0] === 'redact') {
+    const jsonOut = args.includes('--json');
+    const { redactText } = requireSourceOrBundled('./src/security/redact');
+    const fileArg = args.slice(1).find((a) => !a.startsWith('--'));
+    let input;
+    if (fileArg) {
+      try {
+        input = fs.readFileSync(path.resolve(cwd, fileArg), 'utf8');
+      } catch (err) {
+        console.error(`[sigmap] redact: cannot read ${fileArg}: ${err.message}`);
+        process.exit(1);
+      }
+    } else if (!process.stdin.isTTY) {
+      try {
+        input = fs.readFileSync(0, 'utf8');
+      } catch (err) {
+        console.error(`[sigmap] redact: cannot read stdin: ${err.message}`);
+        process.exit(1);
+      }
+    } else {
+      console.error('[sigmap] usage: sigmap redact <file>   or   <cmd> | sigmap redact');
+      process.exit(1);
+    }
+    const r = redactText(input);
+    if (jsonOut) {
+      process.stdout.write(JSON.stringify(r) + '\n');
+      process.exit(0);
+    }
+    process.stdout.write(r.text);
+    const parts = Object.entries(r.counts).map(([k, v]) => `${k}×${v}`);
+    console.error(r.redacted
+      ? `[sigmap] redact: masked ${r.findings.length} secret(s) — ${parts.join(', ')}`
+      : '[sigmap] redact: no secrets found');
+    process.exit(0);
+  }
+
   if (args[0] === 'note') {
     const jsonOut = args.includes('--json');
     const { addNote, readNotes, formatNotes } = requireSourceOrBundled('./src/session/notes');

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.23.0 | Benchmark: sigmap-v8.23-main (2026-07-28)
+# Version: 8.24.0 | Benchmark: sigmap-v8.24-main (2026-07-28)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.23-main, 2026-07-28)
+## Core metrics (benchmark: sigmap-v8.24-main, 2026-07-28)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -127,6 +127,7 @@ sigmap memory                            List cross-session stores (.context/)
 sigmap memory --clear <store>            Clear one store: session|notes|weights|evidence|all (--json supported)
 sigmap budget                            Session spend ledger — estimated SigMap-emitted tokens, budget, context age (--json)
 sigmap budget --budget <tokens>          One-off budget override (config: sessionBudgetTokens, contextTtlDays)
+sigmap redact [file]                     Mask secrets in a file or stdin (10-pattern bank); redacted text to stdout (--json)
 sigmap note "<text>"                     Append a note to the cross-session decision log
 sigmap note                              List recent notes (also: note --list <N>)
 sigmap status                            Show repo state — branch, dirty files, index freshness, notes

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.23.0 | Benchmark: sigmap-v8.23-main (2026-07-28)
+# Version: 8.24.0 | Benchmark: sigmap-v8.24-main (2026-07-28)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.23-main, 2026-07-28)
+## Core metrics (benchmark: sigmap-v8.24-main, 2026-07-28)
 
 - hit@5 retrieval: 82.2% vs 44.8% single-shot grep baseline (1.59× lift)
 - Token reduction: 96.8% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.23.0",
+  "version": "8.24.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.23.0",
+  "version": "8.24.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.23.0",
+  "version": "8.24.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.23.0',
+  version: '8.24.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/security/redact.js

@@ -0,0 +1,56 @@
+'use strict';
+
+/**
+ * Standalone text redaction (v8.24 G3a) — the same pattern bank the
+ * generation-time scanner uses (security/patterns.js), applied to arbitrary
+ * text. Unlike scanner.js (which replaces whole signature lines), this masks
+ * only the matched secret substring so surrounding text stays readable.
+ *
+ * Zero dependencies; never throws — on any error the original text is
+ * returned unredacted.
+ */
+
+const { PATTERNS } = require('./patterns');
+
+// Global variants of the pattern regexes (needed for replace-all per line).
+const GLOBAL_PATTERNS = PATTERNS.map((p) => ({
+  name: p.name,
+  regex: new RegExp(p.regex.source, p.regex.flags.includes('g') ? p.regex.flags : p.regex.flags + 'g'),
+}));
+
+/**
+ * Redact secrets in arbitrary text.
+ * @param {string} text
+ * @returns {{
+ *   text: string, redacted: boolean,
+ *   findings: Array<{ line: number, pattern: string }>,
+ *   counts: Object<string, number>
+ * }}
+ */
+function redactText(text) {
+  if (typeof text !== 'string' || text.length === 0) {
+    return { text: typeof text === 'string' ? text : '', redacted: false, findings: [], counts: {} };
+  }
+  try {
+    const findings = [];
+    const counts = {};
+    const lines = text.split('\n');
+    const out = lines.map((line, i) => {
+      let masked = line;
+      for (const p of GLOBAL_PATTERNS) {
+        p.regex.lastIndex = 0;
+        if (!p.regex.test(masked)) continue;
+        p.regex.lastIndex = 0;
+        masked = masked.replace(p.regex, `[REDACTED:${p.name}]`);
+        findings.push({ line: i + 1, pattern: p.name });
+        counts[p.name] = (counts[p.name] || 0) + 1;
+      }
+      return masked;
+    });
+    return { text: out.join('\n'), redacted: findings.length > 0, findings, counts };
+  } catch (_) {
+    return { text, redacted: false, findings: [], counts: {} };
+  }
+}
+
+module.exports = { redactText };