sigmap 8.28.0 → 8.28.1

package/CHANGELOG.md

@@ -10,6 +10,19 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.28.1] — 2026-08-22
+
+Patch release — two silent-failure bug fixes: a false "zero importers" in the Python import graph, and an empty index under the per-module strategy.
+
+### Fixed
+- **Python absolute imports resolve through any ancestor root (#532, PR #533)** — reported and precisely diagnosed by **@ruurdboeke**, thank you: `extractFileDeps` probed only the importing file's directory and one parent for `from package.module import`, so `src/`-layout projects (source root on `sys.path`) silently produced no graph edge whenever the importer sat two or more directories below the root — and `get_impact` then reported **zero importers**, exactly the signal that says a change is safe to make. Fix: an ancestor walk from the importing file up to the project root (nearest first, 16-level cap), probing `<module>.py` and `<module>/__init__.py` per level; nearest-first preserves the old first-match semantics for same-dir/one-parent cases. 4 new tests incl. the verbatim issue repro and `get_impact` end-to-end.
+- **Per-module strategy: `ask`/`query_context` find signatures again (#534, PR #535):** the per-module strategy writes one `context-<module>.md` per top-level srcDir and leaves the primary file as a thin overview — but the sig-index strategy enrichment merged only `context-cold.md` (hot-cold) plus the cache, so `sigmap ask` failed with "no context file found" and the `query_context` MCP tool returned an empty index on every per-module repo. Fix: enumerate `.github/context-*.md` (sorted, deterministic) and merge each — the cold-file merge generalized to every strategy split. 4 new tests on a real generated two-module fixture incl. the exact reported failure; hot-cold and full strategies verified unchanged.
+
+### Changed
+- 8 new integration tests (138 test files); bundle rebuilt; zero new dependencies.
+
+---
+
 ## [8.28.0] — 2026-08-18
 
 Minor release — **"Arity Guard" (v8.28, D1)**: verification now checks not just *does this function exist* but *is it being called with a plausible number of arguments* — the payoff of the v8.27 balanced scanner.

package/README.md

@@ -123,7 +123,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 <!--SM:benchmarkBlock-->
 ```
 Benchmark : sigmap-v8.28-main (21 repositories, including R language)
-Date      : 2026-08-18
+Date      : 2026-08-22
 
 Hit@5          : 81.1%   (grep-agent baseline 44.0%  — 1.73× lift)
 Token reduction: 96.8%   (across 21 repos)

package/gen-context.js

@@ -11573,23 +11573,31 @@ __factories["./src/graph/builder"] = function(module, exports) {
         }
       }
 
-      // Absolute imports: from package.module import ... (infer from project structure)
+      // Absolute imports: from package.module import ... (infer from project
+      // structure). The module is resolved against EVERY ancestor of the
+      // importing file up to the project root, nearest first — any of them can
+      // be the source root on sys.path (src/ layouts, pytest rootdir). The old
+      // dir + one-parent probe silently dropped edges for files nested two or
+      // more directories below the source root (#532), and a false "zero
+      // importers" from get_impact is exactly the signal that says a change is
+      // safe to make.
       const reAbs = /^[ \t]*from\s+([\w.]+)\s+import/gm;
       while ((m = reAbs.exec(content)) !== null) {
         const modulePath = m[1].replace(/\./g, '/');
-        const candidates = [
-          path.join(dir, modulePath + '.py'),
-          path.join(dir, modulePath, '__init__.py'),
-          path.resolve(dir, '..', modulePath + '.py'),
-          path.resolve(dir, '..', modulePath, '__init__.py'),
-        ];
-        for (const c of candidates) {
-          const normC = normalizePath(c);
-          if (fileSet.has(normC)) {
-            found.push(normC);
-            break;
+        const normCwd = normalizePath(path.resolve(cwd));
+        let base = dir;
+        let hit = null;
+        for (let depth = 0; depth < 16 && !hit; depth++) {
+          for (const c of [path.join(base, modulePath + '.py'), path.join(base, modulePath, '__init__.py')]) {
+            const normC = normalizePath(c);
+            if (fileSet.has(normC)) { hit = normC; break; }
           }
+          if (normalizePath(base) === normCwd) break;
+          const parent = path.dirname(base);
+          if (parent === base) break;
+          base = parent;
         }
+        if (hit) found.push(hit);
       }
     }
 
@@ -15385,7 +15393,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.28.0',
+    version: '8.28.1',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -16975,9 +16983,22 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
    * @returns {Map<string, string[]>}
    */
   function _enrichSigIndexFromStrategy(cwd, index) {
+    const fs = require('fs');
     const path = require('path');
-    const coldPath = path.join(cwd, '.github', 'context-cold.md');
-    _mergeSigIndex(index, _parseContextFile(coldPath));
+    // Merge every strategy split file: context-cold.md (hot-cold) AND each
+    // per-module context-<module>.md — the per-module strategy stores ALL
+    // signatures in these, leaving the primary file as a thin overview, so
+    // skipping them made ask/query_context see an empty index (#534).
+    // Sorted for deterministic merge order.
+    try {
+      const ghDir = path.join(cwd, '.github');
+      const splits = fs.readdirSync(ghDir)
+        .filter((f) => /^context-[\w.-]+\.md$/.test(f))
+        .sort();
+      for (const f of splits) {
+        _mergeSigIndex(index, _parseContextFile(path.join(ghDir, f)));
+      }
+    } catch (_) {}
     _mergeSigIndex(index, _buildSigIndexFromCache(cwd));
     return index;
   }
@@ -21214,7 +21235,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.28.0';
+const VERSION = '8.28.1';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.28.0 | Benchmark: sigmap-v8.28-main (2026-08-18)
+# Version: 8.28.1 | Benchmark: sigmap-v8.28-main (2026-08-22)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.28-main, 2026-08-18)
+## Core metrics (benchmark: sigmap-v8.28-main, 2026-08-22)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.28.0 | Benchmark: sigmap-v8.28-main (2026-08-18)
+# Version: 8.28.1 | Benchmark: sigmap-v8.28-main (2026-08-22)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.28-main, 2026-08-18)
+## Core metrics (benchmark: sigmap-v8.28-main, 2026-08-22)
 
 - hit@5 retrieval: 81.1% vs 44.0% single-shot grep baseline (1.73× lift)
 - Token reduction: 96.8% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.28.0",
+  "version": "8.28.1",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.28.0",
+  "version": "8.28.1",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.28.0",
+  "version": "8.28.1",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/graph/builder.js

@@ -240,23 +240,31 @@ function extractFileDeps(filePath, content, fileSet, cwd, ctx) {
       }
     }
 
-    // Absolute imports: from package.module import ... (infer from project structure)
+    // Absolute imports: from package.module import ... (infer from project
+    // structure). The module is resolved against EVERY ancestor of the
+    // importing file up to the project root, nearest first — any of them can
+    // be the source root on sys.path (src/ layouts, pytest rootdir). The old
+    // dir + one-parent probe silently dropped edges for files nested two or
+    // more directories below the source root (#532), and a false "zero
+    // importers" from get_impact is exactly the signal that says a change is
+    // safe to make.
     const reAbs = /^[ \t]*from\s+([\w.]+)\s+import/gm;
     while ((m = reAbs.exec(content)) !== null) {
       const modulePath = m[1].replace(/\./g, '/');
-      const candidates = [
-        path.join(dir, modulePath + '.py'),
-        path.join(dir, modulePath, '__init__.py'),
-        path.resolve(dir, '..', modulePath + '.py'),
-        path.resolve(dir, '..', modulePath, '__init__.py'),
-      ];
-      for (const c of candidates) {
-        const normC = normalizePath(c);
-        if (fileSet.has(normC)) {
-          found.push(normC);
-          break;
+      const normCwd = normalizePath(path.resolve(cwd));
+      let base = dir;
+      let hit = null;
+      for (let depth = 0; depth < 16 && !hit; depth++) {
+        for (const c of [path.join(base, modulePath + '.py'), path.join(base, modulePath, '__init__.py')]) {
+          const normC = normalizePath(c);
+          if (fileSet.has(normC)) { hit = normC; break; }
         }
+        if (normalizePath(base) === normCwd) break;
+        const parent = path.dirname(base);
+        if (parent === base) break;
+        base = parent;
       }
+      if (hit) found.push(hit);
     }
   }
 

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.28.0',
+  version: '8.28.1',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/retrieval/ranker.js

@@ -473,9 +473,22 @@ function _buildSigIndexFromCache(cwd) {
  * @returns {Map<string, string[]>}
  */
 function _enrichSigIndexFromStrategy(cwd, index) {
+  const fs = require('fs');
   const path = require('path');
-  const coldPath = path.join(cwd, '.github', 'context-cold.md');
-  _mergeSigIndex(index, _parseContextFile(coldPath));
+  // Merge every strategy split file: context-cold.md (hot-cold) AND each
+  // per-module context-<module>.md — the per-module strategy stores ALL
+  // signatures in these, leaving the primary file as a thin overview, so
+  // skipping them made ask/query_context see an empty index (#534).
+  // Sorted for deterministic merge order.
+  try {
+    const ghDir = path.join(cwd, '.github');
+    const splits = fs.readdirSync(ghDir)
+      .filter((f) => /^context-[\w.-]+\.md$/.test(f))
+      .sort();
+    for (const f of splits) {
+      _mergeSigIndex(index, _parseContextFile(path.join(ghDir, f)));
+    }
+  } catch (_) {}
   _mergeSigIndex(index, _buildSigIndexFromCache(cwd));
   return index;
 }