sigmap 8.23.0 → 8.25.0

package/CHANGELOG.md

@@ -10,6 +10,30 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.25.0] — 2026-08-18
+
+Minor release — **"Agent Economy II" (v8.25, F2)**: the discovery stack becomes a config optimizer — one command that recommends (and can apply) the config a repo actually needs.
+
+### Added
+- **`sigmap tune` (#514, PR #515):** new `src/config/tune.js` — `buildTuneProposal(cwd)` packages the existing discovery stack (`resolveSourceRoots`, workspace markers, client-artifact probes) into a deterministic recommended-config diff with one evidence-naming reason per change. Five rules, explicit user choices never overridden: **srcDirs pin** (resolver roots, confidence-gated, never proposed against user-pinned dirs — pinned srcDirs are stable across runs and protected from token-budget drops), **monorepo** (fires when a workspace marker exists and the mode is off; reason names the marker — `pnpm-workspace.yaml`/`turbo.json`/`nx.json`/`lerna.json`/package.json `workspaces`), **adapters** (additive from client artifacts present: `CLAUDE.md`→claude, `.cursorrules`/`.cursor/`→cursor, `.windsurfrules`→windsurf, `AGENTS.md`→codex), **exclude** (curated vendored/generated dirs present at root — `third_party`, `external(s)`, `generated`, `testdata`, `tmp`, `.cache` … — appended with defaults preserved), **autoMaxTokens** (fires only when a pinned budget is below a labeled ~25-tokens/file heuristic estimate). `applyTuneProposal` merges into `gen-context.config.json` preserving every user key; re-proposal after apply is empty (idempotent). CLI: `sigmap tune` is read-only by default (`--dry-run` alias), `--apply` writes and points to `sigmap validate`, `--json` for agents. Zero new dependencies.
+
+### Changed
+- 10 new integration tests (131 test files); bundle rebuilt (148 modules).
+
+---
+
+## [8.24.0] — 2026-07-28
+
+Minor release — **"Trust Quick Wins I" (v8.24, G3a)**: the secret-redaction engine that already protects signatures, `get_lines`, and evidence packs becomes a standalone command for arbitrary text.
+
+### Added
+- **`sigmap redact` (#511, PR #512):** new `src/security/redact.js` — `redactText()` masks only the matched secret substring (`[REDACTED:<pattern name>]`), preserving surrounding text (unlike the generation-time scanner's whole-line replacement, which is unchanged). Findings carry 1-based line numbers with per-pattern counts. CLI: `sigmap redact [file] [--json]` — file argument or stdin; redacted text on stdout (pipe-clean), summary on stderr. Reuses the existing 10-pattern bank verbatim; zero new dependencies; never throws. 6 new integration tests including an every-pattern mask sweep (130 test files).
+
+### Changed
+- Test fixtures for secret patterns are assembled at runtime (no secret-shaped literals in committed blobs) — GitHub Push Protection rejected the first push over the fake samples, which validated the detection class this command implements.
+
+---
+
 ## [8.23.0] — 2026-07-28
 
 Minor release — **"Agent Economy I" (v8.23, F1)**: SigMap's token savings become queryable *during* a session. A spend ledger over the existing gain log, an optional budget threshold, and context-freshness age — as a CLI command and the 21st MCP tool.

package/README.md

@@ -59,7 +59,7 @@ That map is exactly what agentic grep is worst at: reproducible, auditable conte
 
 **Proof it pays off** (full benchmark below):
 <!--SM:whyMetrics-->
-- **82.2% hit@5** — right file in top 5 results (vs 44.8% single-shot grep baseline — 1.59× lift)
+- **82.2% hit@5** — right file in top 5 results (vs 44.0% single-shot grep baseline — 1.87× lift)
 - **96.8% token reduction** — average across 21 real repos
 - **64.8% task-success proxy** — modeled from retrieval tiers, not measured LLM sessions
 - **1.53 prompts per task** — down from 2.84 (46.1% fewer retries, modeled)
@@ -122,10 +122,10 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.23-main (21 repositories, including R language)
-Date      : 2026-07-28
+Benchmark : sigmap-v8.25-main (21 repositories, including R language)
+Date      : 2026-08-17
 
-Hit@5          : 82.2%   (grep-agent baseline 44.8%  — 1.59× lift)
+Hit@5          : 82.2%   (grep-agent baseline 44.0%  — 1.87× lift)
 Token reduction: 96.8%   (across 21 repos)
 Prompt reduction : 46.1% (2.84 → 1.53 prompts per task, modeled)
 Task success   : 64.8%   (proxy — modeled from retrieval tiers)

package/gen-context.js

@@ -1877,6 +1877,220 @@ __factories["./src/config/loader"] = function(module, exports) {
   
 };
 
+// ── ./src/config/tune ──
+__factories["./src/config/tune"] = function(module, exports) {
+  
+  /**
+   * sigmap tune — deterministic config optimizer (F2, #514).
+   *
+   * Packages the existing discovery stack (source-root-resolver, monorepo
+   * markers, client-artifact probes) into a recommended config diff with a
+   * one-line reason per change. Read-only by default; `applyTuneProposal`
+   * merges accepted changes into gen-context.config.json, preserving every
+   * user key. Explicit user choices are never proposed against.
+   */
+
+  const fs = require('fs');
+  const path = require('path');
+  const { loadConfig } = __require('./src/config/loader');
+  const { resolveSourceRoots } = __require('./src/discovery/source-root-resolver');
+
+  // Workspace markers, in probe order (reason names the first one found).
+  const MONOREPO_MARKERS = ['pnpm-workspace.yaml', 'turbo.json', 'nx.json', 'lerna.json'];
+
+  // Client artifacts → adapter names (additive only).
+  const ADAPTER_MARKERS = [
+    { adapter: 'claude',   files: ['CLAUDE.md'] },
+    { adapter: 'cursor',   files: ['.cursorrules', '.cursor'] },
+    { adapter: 'windsurf', files: ['.windsurfrules', '.windsurf'] },
+    { adapter: 'codex',    files: ['AGENTS.md'] },
+  ];
+
+  // Root-level dirs that are typically vendored/generated when present.
+  const JUNK_DIRS = [
+    'third_party', 'thirdparty', 'external', 'externals',
+    'generated', 'testdata', 'snapshots', 'tmp', 'temp', '.cache',
+  ];
+
+  // Rough signature cost per source file (chars/4 world) for the budget check.
+  const TOKENS_PER_FILE = 25;
+
+  const SOURCE_EXTS = new Set([
+    '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '.py', '.rb', '.go', '.rs',
+    '.java', '.kt', '.cs', '.cpp', '.c', '.h', '.hpp', '.swift', '.dart',
+    '.scala', '.php', '.gd', '.r', '.R',
+  ]);
+
+  /** Raw user config file content, or null when absent/unparsable. */
+  function _readUserConfig(cwd) {
+    try {
+      return JSON.parse(fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8'));
+    } catch (_) {
+      return null;
+    }
+  }
+
+  /** Count source files under `roots` (relative to cwd), depth-capped, deterministic. */
+  function _countSourceFiles(cwd, roots, exclude, depth = 5) {
+    const excSet = new Set(exclude || []);
+    let count = 0;
+    const walk = (dir, d) => {
+      if (d <= 0 || count > 20000) return;
+      let entries;
+      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
+      for (const e of entries) {
+        if (excSet.has(e.name)) continue;
+        if (e.isDirectory()) walk(path.join(dir, e.name), d - 1);
+        else if (e.isFile() && SOURCE_EXTS.has(path.extname(e.name))) count++;
+      }
+    };
+    for (const r of roots) {
+      const full = path.join(cwd, r);
+      if (fs.existsSync(full)) walk(full, depth);
+    }
+    return count;
+  }
+
+  /** The workspace marker present at cwd, or null. */
+  function _monorepoMarker(cwd) {
+    for (const m of MONOREPO_MARKERS) {
+      if (fs.existsSync(path.join(cwd, m))) return m;
+    }
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+      if (pkg.workspaces) return 'package.json workspaces';
+    } catch (_) {}
+    return null;
+  }
+
+  /**
+   * Build the recommended config diff for a repo.
+   *
+   * @param {string} cwd
+   * @returns {{ changes: Array<{key:string, current:*, recommended:*, reason:string}>,
+   *             detection: { roots:string[], confidence:string, isMonorepo:boolean },
+   *             configExists: boolean }}
+   */
+  function buildTuneProposal(cwd) {
+    const userConfig = _readUserConfig(cwd);
+    const config = loadConfig(cwd);
+    const detection = resolveSourceRoots(cwd, { exclude: config.exclude });
+    const changes = [];
+
+    // 1. srcDirs — recommend pinning the detected roots when the user hasn't.
+    // Pinned srcDirs make generation explicit/stable and are protected from
+    // token-budget drops; user-pinned srcDirs are never proposed against.
+    const userPinnedSrcDirs = !!(userConfig && Array.isArray(userConfig.srcDirs));
+    if (!userPinnedSrcDirs && detection.roots.length > 0 && detection.confidence !== 'low') {
+      changes.push({
+        key: 'srcDirs',
+        current: null,
+        recommended: detection.roots,
+        reason: `pin the ${detection.roots.length} detected source root(s) [confidence ${detection.confidence}] — explicit srcDirs are stable across runs and protected from budget drops`,
+      });
+    }
+
+    // 2. monorepo — a workspace marker exists but the mode is off.
+    const marker = _monorepoMarker(cwd);
+    if (marker && config.monorepo !== true) {
+      changes.push({
+        key: 'monorepo',
+        current: config.monorepo,
+        recommended: true,
+        reason: `workspace marker found: ${marker}`,
+      });
+    }
+
+    // 3. adapters — client artifacts present that the adapter list doesn't cover.
+    const currentAdapters = Array.isArray(config.adapters) ? config.adapters
+      : (Array.isArray(config.outputs) ? config.outputs : ['copilot']);
+    const found = [];
+    for (const { adapter, files } of ADAPTER_MARKERS) {
+      if (currentAdapters.includes(adapter)) continue;
+      const hit = files.find((f) => fs.existsSync(path.join(cwd, f)));
+      if (hit) found.push({ adapter, hit });
+    }
+    if (found.length > 0) {
+      changes.push({
+        key: 'adapters',
+        current: currentAdapters,
+        recommended: [...currentAdapters, ...found.map((f) => f.adapter)],
+        reason: `client files present: ${found.map((f) => f.hit).join(', ')}`,
+      });
+    }
+
+    // 4. exclude — root-level vendored/generated dirs not excluded yet.
+    const junkFound = JUNK_DIRS.filter((d) => {
+      if ((config.exclude || []).includes(d)) return false;
+      try { return fs.statSync(path.join(cwd, d)).isDirectory(); } catch (_) { return false; }
+    });
+    if (junkFound.length > 0) {
+      changes.push({
+        key: 'exclude',
+        current: userConfig && userConfig.exclude ? userConfig.exclude : null,
+        recommended: [...((userConfig && userConfig.exclude) || config.exclude), ...junkFound],
+        reason: `present at root and typically vendored/generated: ${junkFound.join(', ')}`,
+      });
+    }
+
+    // 5. autoMaxTokens — a pinned budget that the repo's size will overflow.
+    if (config.autoMaxTokens === false) {
+      const roots = detection.roots.length > 0 ? detection.roots : config.srcDirs;
+      const files = _countSourceFiles(cwd, roots, config.exclude);
+      const estTokens = files * TOKENS_PER_FILE;
+      if (estTokens > config.maxTokens) {
+        changes.push({
+          key: 'autoMaxTokens',
+          current: false,
+          recommended: true,
+          reason: `~${files} source files need ~${estTokens} tokens (heuristic) but maxTokens is pinned at ${config.maxTokens} — auto-scaling targets ${Math.round((config.coverageTarget || 0.8) * 100)}% coverage`,
+        });
+      }
+    }
+
+    return {
+      changes,
+      detection: { roots: detection.roots, confidence: detection.confidence, isMonorepo: detection.isMonorepo },
+      configExists: userConfig !== null,
+    };
+  }
+
+  /**
+   * Merge a proposal's changes into gen-context.config.json (create if absent).
+   * Preserves every existing user key; only the proposed keys are written.
+   *
+   * @returns {{ path: string, applied: string[] }}
+   */
+  function applyTuneProposal(cwd, proposal) {
+    const cfgPath = path.join(cwd, 'gen-context.config.json');
+    const existing = _readUserConfig(cwd) || {};
+    for (const c of proposal.changes) existing[c.key] = c.recommended;
+    fs.writeFileSync(cfgPath, JSON.stringify(existing, null, 2) + '\n');
+    return { path: cfgPath, applied: proposal.changes.map((c) => c.key) };
+  }
+
+  /** Human rendering of a proposal (one block per change, reason indented). */
+  function formatTuneProposal(proposal) {
+    const lines = [];
+    if (proposal.changes.length === 0) {
+      lines.push('[sigmap] tune: config already matches detection — no changes recommended');
+    } else {
+      lines.push(`[sigmap] tune: ${proposal.changes.length} recommended change(s)`);
+      for (const c of proposal.changes) {
+        lines.push(`  ${c.key.padEnd(14)} ${JSON.stringify(c.current)} → ${JSON.stringify(c.recommended)}`);
+        lines.push(`  ${''.padEnd(14)} reason: ${c.reason}`);
+      }
+      lines.push('');
+      lines.push('  apply with: sigmap tune --apply   (then: sigmap validate)');
+    }
+    lines.push(`  detection: roots [${proposal.detection.roots.join(', ')}] · confidence ${proposal.detection.confidence} · monorepo ${proposal.detection.isMonorepo ? 'yes' : 'no'}`);
+    return lines.join('\n');
+  }
+
+  module.exports = { buildTuneProposal, applyTuneProposal, formatTuneProposal, JUNK_DIRS, TOKENS_PER_FILE };
+  
+};
+
 // ── ./src/conventions/ci ──
 __factories["./src/conventions/ci"] = function(module, exports) {
   
@@ -14981,7 +15195,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.23.0',
+    version: '8.25.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -17528,6 +17742,66 @@ __factories["./src/security/patterns"] = function(module, exports) {
   
 };
 
+// ── ./src/security/redact ──
+__factories["./src/security/redact"] = function(module, exports) {
+  
+  /**
+   * Standalone text redaction (v8.24 G3a) — the same pattern bank the
+   * generation-time scanner uses (security/patterns.js), applied to arbitrary
+   * text. Unlike scanner.js (which replaces whole signature lines), this masks
+   * only the matched secret substring so surrounding text stays readable.
+   *
+   * Zero dependencies; never throws — on any error the original text is
+   * returned unredacted.
+   */
+
+  const { PATTERNS } = __require('./src/security/patterns');
+
+  // Global variants of the pattern regexes (needed for replace-all per line).
+  const GLOBAL_PATTERNS = PATTERNS.map((p) => ({
+    name: p.name,
+    regex: new RegExp(p.regex.source, p.regex.flags.includes('g') ? p.regex.flags : p.regex.flags + 'g'),
+  }));
+
+  /**
+   * Redact secrets in arbitrary text.
+   * @param {string} text
+   * @returns {{
+   *   text: string, redacted: boolean,
+   *   findings: Array<{ line: number, pattern: string }>,
+   *   counts: Object<string, number>
+   * }}
+   */
+  function redactText(text) {
+    if (typeof text !== 'string' || text.length === 0) {
+      return { text: typeof text === 'string' ? text : '', redacted: false, findings: [], counts: {} };
+    }
+    try {
+      const findings = [];
+      const counts = {};
+      const lines = text.split('\n');
+      const out = lines.map((line, i) => {
+        let masked = line;
+        for (const p of GLOBAL_PATTERNS) {
+          p.regex.lastIndex = 0;
+          if (!p.regex.test(masked)) continue;
+          p.regex.lastIndex = 0;
+          masked = masked.replace(p.regex, `[REDACTED:${p.name}]`);
+          findings.push({ line: i + 1, pattern: p.name });
+          counts[p.name] = (counts[p.name] || 0) + 1;
+        }
+        return masked;
+      });
+      return { text: out.join('\n'), redacted: findings.length > 0, findings, counts };
+    } catch (_) {
+      return { text, redacted: false, findings: [], counts: {} };
+    }
+  }
+
+  module.exports = { redactText };
+  
+};
+
 // ── ./src/security/scanner ──
 __factories["./src/security/scanner"] = function(module, exports) {
   
@@ -20347,7 +20621,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.23.0';
+const VERSION = '8.25.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -22234,6 +22508,9 @@ Usage:
   ${cmd} memory --clear <store>            Clear one store: session|notes|weights|evidence|all (--json supported)
   ${cmd} budget                            Session spend ledger — estimated SigMap-emitted tokens, budget, context age (--json)
   ${cmd} budget --budget <tokens>          One-off budget override (config: sessionBudgetTokens, contextTtlDays)
+  ${cmd} redact [file]                     Mask secrets in a file or stdin (10-pattern bank); redacted text to stdout (--json)
+  ${cmd} tune                              Recommend config from repo detection — srcDirs, monorepo, adapters, exclude, budget (--json)
+  ${cmd} tune --apply                      Write the recommendations into gen-context.config.json (merges; your keys preserved)
   ${cmd} note "<text>"                     Append a note to the cross-session decision log
   ${cmd} note                              List recent notes (also: note --list <N>)
   ${cmd} status                            Show repo state — branch, dirty files, index freshness, notes
@@ -23633,6 +23910,36 @@ function main() {
     process.exit(0);
   }
 
+  // `sigmap tune [--apply|--dry-run] [--json]` — deterministic config optimizer:
+  // recommend srcDirs/monorepo/adapters/exclude/autoMaxTokens from the existing
+  // discovery stack, one reason per change. Read-only unless --apply.
+  if (args[0] === 'tune') {
+    const { buildTuneProposal, applyTuneProposal, formatTuneProposal } = requireSourceOrBundled('./src/config/tune');
+    let proposal;
+    try {
+      proposal = buildTuneProposal(cwd);
+    } catch (err) {
+      console.error(`[sigmap] tune failed: ${err.message}`);
+      process.exit(1);
+    }
+    if (args.includes('--apply') && proposal.changes.length > 0) {
+      const res = applyTuneProposal(cwd, proposal);
+      if (args.includes('--json')) {
+        process.stdout.write(JSON.stringify({ ...proposal, applied: res.applied, path: res.path }) + '\n');
+      } else {
+        console.log(formatTuneProposal(proposal));
+        console.log(`[sigmap] tune: wrote ${res.applied.join(', ')} → ${path.relative(cwd, res.path)} — run: sigmap validate`);
+      }
+      process.exit(0);
+    }
+    if (args.includes('--json')) {
+      process.stdout.write(JSON.stringify(proposal) + '\n');
+    } else {
+      console.log(formatTuneProposal(proposal));
+    }
+    process.exit(0);
+  }
+
   // `sigmap note "<text>"` — append to the cross-session decision log.
   // With no text, lists recent notes (also `note --list [N]`).
   // `sigmap memory` — one view over the cross-session stores in .context/.
@@ -23715,6 +24022,42 @@ function main() {
     process.exit(0);
   }
 
+  if (args[0] === 'redact') {
+    const jsonOut = args.includes('--json');
+    const { redactText } = requireSourceOrBundled('./src/security/redact');
+    const fileArg = args.slice(1).find((a) => !a.startsWith('--'));
+    let input;
+    if (fileArg) {
+      try {
+        input = fs.readFileSync(path.resolve(cwd, fileArg), 'utf8');
+      } catch (err) {
+        console.error(`[sigmap] redact: cannot read ${fileArg}: ${err.message}`);
+        process.exit(1);
+      }
+    } else if (!process.stdin.isTTY) {
+      try {
+        input = fs.readFileSync(0, 'utf8');
+      } catch (err) {
+        console.error(`[sigmap] redact: cannot read stdin: ${err.message}`);
+        process.exit(1);
+      }
+    } else {
+      console.error('[sigmap] usage: sigmap redact <file>   or   <cmd> | sigmap redact');
+      process.exit(1);
+    }
+    const r = redactText(input);
+    if (jsonOut) {
+      process.stdout.write(JSON.stringify(r) + '\n');
+      process.exit(0);
+    }
+    process.stdout.write(r.text);
+    const parts = Object.entries(r.counts).map(([k, v]) => `${k}×${v}`);
+    console.error(r.redacted
+      ? `[sigmap] redact: masked ${r.findings.length} secret(s) — ${parts.join(', ')}`
+      : '[sigmap] redact: no secrets found');
+    process.exit(0);
+  }
+
   if (args[0] === 'note') {
     const jsonOut = args.includes('--json');
     const { addNote, readNotes, formatNotes } = requireSourceOrBundled('./src/session/notes');

package/llms-full.txt

@@ -11,17 +11,17 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.23.0 | Benchmark: sigmap-v8.23-main (2026-07-28)
+# Version: 8.25.0 | Benchmark: sigmap-v8.25-main (2026-08-17)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.23-main, 2026-07-28)
+## Core metrics (benchmark: sigmap-v8.25-main, 2026-08-17)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
-| Retrieval hit@5 | 44.8% (single-shot grep) | 82.2% (1.59× lift) |
+| Retrieval hit@5 | 44.0% (single-shot grep) | 82.2% (1.87× lift) |
 | Token reduction | — | 96.8% average |
 | Task-success proxy (modeled) | — | 64.8% |
 | Prompts per task | 2.84 | 1.53 (46.1% fewer) |
@@ -127,6 +127,9 @@ sigmap memory                            List cross-session stores (.context/)
 sigmap memory --clear <store>            Clear one store: session|notes|weights|evidence|all (--json supported)
 sigmap budget                            Session spend ledger — estimated SigMap-emitted tokens, budget, context age (--json)
 sigmap budget --budget <tokens>          One-off budget override (config: sessionBudgetTokens, contextTtlDays)
+sigmap redact [file]                     Mask secrets in a file or stdin (10-pattern bank); redacted text to stdout (--json)
+sigmap tune                              Recommend config from repo detection — srcDirs, monorepo, adapters, exclude, budget (--json)
+sigmap tune --apply                      Write the recommendations into gen-context.config.json (merges; your keys preserved)
 sigmap note "<text>"                     Append a note to the cross-session decision log
 sigmap note                              List recent notes (also: note --list <N>)
 sigmap status                            Show repo state — branch, dirty files, index freshness, notes

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.23.0 | Benchmark: sigmap-v8.23-main (2026-07-28)
+# Version: 8.25.0 | Benchmark: sigmap-v8.25-main (2026-08-17)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,9 +23,9 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.23-main, 2026-07-28)
+## Core metrics (benchmark: sigmap-v8.25-main, 2026-08-17)
 
-- hit@5 retrieval: 82.2% vs 44.8% single-shot grep baseline (1.59× lift)
+- hit@5 retrieval: 82.2% vs 44.0% single-shot grep baseline (1.87× lift)
 - Token reduction: 96.8% average across benchmark repos
 - Task-success proxy: 64.8% (modeled from retrieval tiers, not measured LLM sessions)
 - Prompts per task: 1.53 vs 2.84 baseline (46.1% fewer, modeled)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.23.0",
+  "version": "8.25.0",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.23.0",
+  "version": "8.25.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.23.0",
+  "version": "8.25.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/config/tune.js

@@ -0,0 +1,210 @@
+'use strict';
+
+/**
+ * sigmap tune — deterministic config optimizer (F2, #514).
+ *
+ * Packages the existing discovery stack (source-root-resolver, monorepo
+ * markers, client-artifact probes) into a recommended config diff with a
+ * one-line reason per change. Read-only by default; `applyTuneProposal`
+ * merges accepted changes into gen-context.config.json, preserving every
+ * user key. Explicit user choices are never proposed against.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { loadConfig } = require('./loader');
+const { resolveSourceRoots } = require('../discovery/source-root-resolver');
+
+// Workspace markers, in probe order (reason names the first one found).
+const MONOREPO_MARKERS = ['pnpm-workspace.yaml', 'turbo.json', 'nx.json', 'lerna.json'];
+
+// Client artifacts → adapter names (additive only).
+const ADAPTER_MARKERS = [
+  { adapter: 'claude',   files: ['CLAUDE.md'] },
+  { adapter: 'cursor',   files: ['.cursorrules', '.cursor'] },
+  { adapter: 'windsurf', files: ['.windsurfrules', '.windsurf'] },
+  { adapter: 'codex',    files: ['AGENTS.md'] },
+];
+
+// Root-level dirs that are typically vendored/generated when present.
+const JUNK_DIRS = [
+  'third_party', 'thirdparty', 'external', 'externals',
+  'generated', 'testdata', 'snapshots', 'tmp', 'temp', '.cache',
+];
+
+// Rough signature cost per source file (chars/4 world) for the budget check.
+const TOKENS_PER_FILE = 25;
+
+const SOURCE_EXTS = new Set([
+  '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '.py', '.rb', '.go', '.rs',
+  '.java', '.kt', '.cs', '.cpp', '.c', '.h', '.hpp', '.swift', '.dart',
+  '.scala', '.php', '.gd', '.r', '.R',
+]);
+
+/** Raw user config file content, or null when absent/unparsable. */
+function _readUserConfig(cwd) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(cwd, 'gen-context.config.json'), 'utf8'));
+  } catch (_) {
+    return null;
+  }
+}
+
+/** Count source files under `roots` (relative to cwd), depth-capped, deterministic. */
+function _countSourceFiles(cwd, roots, exclude, depth = 5) {
+  const excSet = new Set(exclude || []);
+  let count = 0;
+  const walk = (dir, d) => {
+    if (d <= 0 || count > 20000) return;
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
+    for (const e of entries) {
+      if (excSet.has(e.name)) continue;
+      if (e.isDirectory()) walk(path.join(dir, e.name), d - 1);
+      else if (e.isFile() && SOURCE_EXTS.has(path.extname(e.name))) count++;
+    }
+  };
+  for (const r of roots) {
+    const full = path.join(cwd, r);
+    if (fs.existsSync(full)) walk(full, depth);
+  }
+  return count;
+}
+
+/** The workspace marker present at cwd, or null. */
+function _monorepoMarker(cwd) {
+  for (const m of MONOREPO_MARKERS) {
+    if (fs.existsSync(path.join(cwd, m))) return m;
+  }
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+    if (pkg.workspaces) return 'package.json workspaces';
+  } catch (_) {}
+  return null;
+}
+
+/**
+ * Build the recommended config diff for a repo.
+ *
+ * @param {string} cwd
+ * @returns {{ changes: Array<{key:string, current:*, recommended:*, reason:string}>,
+ *             detection: { roots:string[], confidence:string, isMonorepo:boolean },
+ *             configExists: boolean }}
+ */
+function buildTuneProposal(cwd) {
+  const userConfig = _readUserConfig(cwd);
+  const config = loadConfig(cwd);
+  const detection = resolveSourceRoots(cwd, { exclude: config.exclude });
+  const changes = [];
+
+  // 1. srcDirs — recommend pinning the detected roots when the user hasn't.
+  // Pinned srcDirs make generation explicit/stable and are protected from
+  // token-budget drops; user-pinned srcDirs are never proposed against.
+  const userPinnedSrcDirs = !!(userConfig && Array.isArray(userConfig.srcDirs));
+  if (!userPinnedSrcDirs && detection.roots.length > 0 && detection.confidence !== 'low') {
+    changes.push({
+      key: 'srcDirs',
+      current: null,
+      recommended: detection.roots,
+      reason: `pin the ${detection.roots.length} detected source root(s) [confidence ${detection.confidence}] — explicit srcDirs are stable across runs and protected from budget drops`,
+    });
+  }
+
+  // 2. monorepo — a workspace marker exists but the mode is off.
+  const marker = _monorepoMarker(cwd);
+  if (marker && config.monorepo !== true) {
+    changes.push({
+      key: 'monorepo',
+      current: config.monorepo,
+      recommended: true,
+      reason: `workspace marker found: ${marker}`,
+    });
+  }
+
+  // 3. adapters — client artifacts present that the adapter list doesn't cover.
+  const currentAdapters = Array.isArray(config.adapters) ? config.adapters
+    : (Array.isArray(config.outputs) ? config.outputs : ['copilot']);
+  const found = [];
+  for (const { adapter, files } of ADAPTER_MARKERS) {
+    if (currentAdapters.includes(adapter)) continue;
+    const hit = files.find((f) => fs.existsSync(path.join(cwd, f)));
+    if (hit) found.push({ adapter, hit });
+  }
+  if (found.length > 0) {
+    changes.push({
+      key: 'adapters',
+      current: currentAdapters,
+      recommended: [...currentAdapters, ...found.map((f) => f.adapter)],
+      reason: `client files present: ${found.map((f) => f.hit).join(', ')}`,
+    });
+  }
+
+  // 4. exclude — root-level vendored/generated dirs not excluded yet.
+  const junkFound = JUNK_DIRS.filter((d) => {
+    if ((config.exclude || []).includes(d)) return false;
+    try { return fs.statSync(path.join(cwd, d)).isDirectory(); } catch (_) { return false; }
+  });
+  if (junkFound.length > 0) {
+    changes.push({
+      key: 'exclude',
+      current: userConfig && userConfig.exclude ? userConfig.exclude : null,
+      recommended: [...((userConfig && userConfig.exclude) || config.exclude), ...junkFound],
+      reason: `present at root and typically vendored/generated: ${junkFound.join(', ')}`,
+    });
+  }
+
+  // 5. autoMaxTokens — a pinned budget that the repo's size will overflow.
+  if (config.autoMaxTokens === false) {
+    const roots = detection.roots.length > 0 ? detection.roots : config.srcDirs;
+    const files = _countSourceFiles(cwd, roots, config.exclude);
+    const estTokens = files * TOKENS_PER_FILE;
+    if (estTokens > config.maxTokens) {
+      changes.push({
+        key: 'autoMaxTokens',
+        current: false,
+        recommended: true,
+        reason: `~${files} source files need ~${estTokens} tokens (heuristic) but maxTokens is pinned at ${config.maxTokens} — auto-scaling targets ${Math.round((config.coverageTarget || 0.8) * 100)}% coverage`,
+      });
+    }
+  }
+
+  return {
+    changes,
+    detection: { roots: detection.roots, confidence: detection.confidence, isMonorepo: detection.isMonorepo },
+    configExists: userConfig !== null,
+  };
+}
+
+/**
+ * Merge a proposal's changes into gen-context.config.json (create if absent).
+ * Preserves every existing user key; only the proposed keys are written.
+ *
+ * @returns {{ path: string, applied: string[] }}
+ */
+function applyTuneProposal(cwd, proposal) {
+  const cfgPath = path.join(cwd, 'gen-context.config.json');
+  const existing = _readUserConfig(cwd) || {};
+  for (const c of proposal.changes) existing[c.key] = c.recommended;
+  fs.writeFileSync(cfgPath, JSON.stringify(existing, null, 2) + '\n');
+  return { path: cfgPath, applied: proposal.changes.map((c) => c.key) };
+}
+
+/** Human rendering of a proposal (one block per change, reason indented). */
+function formatTuneProposal(proposal) {
+  const lines = [];
+  if (proposal.changes.length === 0) {
+    lines.push('[sigmap] tune: config already matches detection — no changes recommended');
+  } else {
+    lines.push(`[sigmap] tune: ${proposal.changes.length} recommended change(s)`);
+    for (const c of proposal.changes) {
+      lines.push(`  ${c.key.padEnd(14)} ${JSON.stringify(c.current)} → ${JSON.stringify(c.recommended)}`);
+      lines.push(`  ${''.padEnd(14)} reason: ${c.reason}`);
+    }
+    lines.push('');
+    lines.push('  apply with: sigmap tune --apply   (then: sigmap validate)');
+  }
+  lines.push(`  detection: roots [${proposal.detection.roots.join(', ')}] · confidence ${proposal.detection.confidence} · monorepo ${proposal.detection.isMonorepo ? 'yes' : 'no'}`);
+  return lines.join('\n');
+}
+
+module.exports = { buildTuneProposal, applyTuneProposal, formatTuneProposal, JUNK_DIRS, TOKENS_PER_FILE };

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.23.0',
+  version: '8.25.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/security/redact.js

@@ -0,0 +1,56 @@
+'use strict';
+
+/**
+ * Standalone text redaction (v8.24 G3a) — the same pattern bank the
+ * generation-time scanner uses (security/patterns.js), applied to arbitrary
+ * text. Unlike scanner.js (which replaces whole signature lines), this masks
+ * only the matched secret substring so surrounding text stays readable.
+ *
+ * Zero dependencies; never throws — on any error the original text is
+ * returned unredacted.
+ */
+
+const { PATTERNS } = require('./patterns');
+
+// Global variants of the pattern regexes (needed for replace-all per line).
+const GLOBAL_PATTERNS = PATTERNS.map((p) => ({
+  name: p.name,
+  regex: new RegExp(p.regex.source, p.regex.flags.includes('g') ? p.regex.flags : p.regex.flags + 'g'),
+}));
+
+/**
+ * Redact secrets in arbitrary text.
+ * @param {string} text
+ * @returns {{
+ *   text: string, redacted: boolean,
+ *   findings: Array<{ line: number, pattern: string }>,
+ *   counts: Object<string, number>
+ * }}
+ */
+function redactText(text) {
+  if (typeof text !== 'string' || text.length === 0) {
+    return { text: typeof text === 'string' ? text : '', redacted: false, findings: [], counts: {} };
+  }
+  try {
+    const findings = [];
+    const counts = {};
+    const lines = text.split('\n');
+    const out = lines.map((line, i) => {
+      let masked = line;
+      for (const p of GLOBAL_PATTERNS) {
+        p.regex.lastIndex = 0;
+        if (!p.regex.test(masked)) continue;
+        p.regex.lastIndex = 0;
+        masked = masked.replace(p.regex, `[REDACTED:${p.name}]`);
+        findings.push({ line: i + 1, pattern: p.name });
+        counts[p.name] = (counts[p.name] || 0) + 1;
+      }
+      return masked;
+    });
+    return { text: out.join('\n'), redacted: findings.length > 0, findings, counts };
+  } catch (_) {
+    return { text, redacted: false, findings: [], counts: {} };
+  }
+}
+
+module.exports = { redactText };