sigmap 8.34.0 → 8.35.0

package/src/extractors/xml.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
 /**
  * Lightweight XML config extractor.
  * Captures root tags, key config tags, and id/name/class attributes.
@@ -40,7 +42,7 @@ function extract(src) {
     if (cls) sigs.push(`${tag} -> ${cls[1]}`);
   }
 
-  return Array.from(new Set(sigs)).slice(0, 50);
+  return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
 }
 
 module.exports = { extract };

package/src/extractors/yaml.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from YAML configuration files.

package/src/mcp/server.js

@@ -7,8 +7,8 @@
  * One JSON object per line on both stdin and stdout.
  *
  * Supported methods:
- *   initialize        → serverInfo + capabilities
- *   tools/list        → 19 tool definitions
+ *   initialize        → serverInfo + capabilities + negotiated protocolVersion
+ *   tools/list        → 21 tool definitions
  *   tools/call        → dispatch to handler, return result
  */
 
@@ -18,10 +18,22 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.34.0',
+  version: '8.35.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 
+// Protocol revisions this server actually speaks. The tools-only surface —
+// initialize / tools/list / tools/call plus the initialized/cancelled
+// notifications — is identical across these revisions, and the
+// @hasmcp/mcp-spec-test suite passes every applicable 2025-11-25 case against
+// it. 2026-07-28 is deliberately absent: that revision requires
+// server/discover, which is not implemented. Newest first: a client offering
+// a version outside this list is downgraded to [0], never echoed back —
+// echoing an unspeakable version is itself a spec violation (#544), and it
+// made the conformance suite believe 2026-07-28 was supported, producing six
+// phantom server/discover failures on a revision never really offered (#545).
+const SUPPORTED_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
+
 // ---------------------------------------------------------------------------
 // JSON-RPC helpers
 // ---------------------------------------------------------------------------
@@ -46,9 +58,32 @@ function dispatch(msg, cwd) {
     return;
   }
 
+  // server/discover (spec 2026-07-28) — session-less discovery, answerable
+  // before any handshake, so a client can learn the honest version list
+  // instead of offering versions and hoping. The response is a
+  // CacheableResult: deterministic, so the TTL promise of stability holds.
+  // Note supportedVersions does NOT include 2026-07-28 — answering discover
+  // is forward-compatible plumbing, not a claim to serve that revision's
+  // whole surface (per-result envelopes, inline _meta negotiation).
+  if (method === 'server/discover') {
+    respond(id, {
+      resultType: 'complete',
+      cacheScope: 'public',
+      ttlMs: 3600000,
+      supportedVersions: SUPPORTED_PROTOCOL_VERSIONS,
+      capabilities: { tools: {} },
+      serverInfo: SERVER_INFO,
+      instructions: 'SigMap serves code signatures for the working directory. Call query_context or search_signatures to rank and fetch signature blocks instead of reading whole files.',
+    });
+    return;
+  }
+
   if (method === 'initialize') {
+    const offered = params && params.protocolVersion;
     respond(id, {
-      protocolVersion: (params && params.protocolVersion) || '2024-11-05',
+      protocolVersion: SUPPORTED_PROTOCOL_VERSIONS.includes(offered)
+        ? offered
+        : SUPPORTED_PROTOCOL_VERSIONS[0],
       serverInfo: SERVER_INFO,
       capabilities: { tools: {} },
     });
@@ -56,6 +91,13 @@ function dispatch(msg, cwd) {
   }
 
   if (method === 'tools/list') {
+    // No pagination: the full list fits one page, so any cursor a client
+    // presents is one this server never issued — reject it (-32602, per the
+    // spec's SHOULD) rather than silently restarting from page one.
+    if (params && params.cursor !== undefined) {
+      respondError(id, -32602, `Invalid cursor: ${String(params.cursor)}`);
+      return;
+    }
     respond(id, { tools: TOOLS });
     return;
   }

package/src/retrieval/ranker.js

@@ -376,9 +376,15 @@ function rank(query, sigIndex, opts) {
     const hop1Files = new Set(); // normalised keys that received a hop1 boost
     const hop1Seeds = [];        // original (un-normalised) paths, for hop-2 lookup
 
-    // Hop 1: direct neighbors of scored files
-    for (const entry of scored) {
-      if (entry.score <= 0) continue;
+    // Hop 1: direct neighbors of scored files. Seeds snapshotted BEFORE the
+    // loop (as the call-graph block below already does) so boosts never
+    // cascade: a file whose only score is a hop-1 boost must not become a seed
+    // itself mid-loop, or the effective seed set — and every boost total —
+    // depends on index insertion order, which git history changes via the
+    // recent-commits hoist. That made gate scores differ between a shallow CI
+    // checkout and a developer clone of the same commit (#596).
+    const hop1SeedEntries = scored.filter((e) => e.score > 0);
+    for (const entry of hop1SeedEntries) {
       const neighbors = _graphGet(graph.forward, path.resolve(cwd, entry.file)) || [];
       for (const neighborAbs of neighbors) {
         const nk = path.normalize(neighborAbs);
@@ -393,7 +399,10 @@ function rank(query, sigIndex, opts) {
       }
     }
 
-    // Hop 2: neighbors of hop1 files (only if they didn't get a direct score)
+    // Hop 2: neighbors of hop1 files (only if they didn't get a direct score).
+    // Eligibility frozen after hop-1 for the same reason: a file whose first
+    // score is a hop-2 boost must not become hop-2-eligible mid-loop (#596).
+    const hop2Eligible = scored.map((e) => e.score > 0);
     for (const hop1Key of hop1Seeds) {
       if (_graphGet(keyToIdx, hop1Key) === undefined) continue; // skip files not in index
       const neighbors = _graphGet(graph.forward, hop1Key) || [];
@@ -402,7 +411,7 @@ function rank(query, sigIndex, opts) {
         if (_isHub(nk) || hubs.has(nk) || hubs.has(nk.toLowerCase())) continue;
         if (hop1Files.has(nk)) continue; // skip already hop1-boosted
         const idx = _graphGet(keyToIdx, nk);
-        if (idx !== undefined && scored[idx].score > 0) {
+        if (idx !== undefined && hop2Eligible[idx]) {
           // Only boost files that have some baseline score (not noise)
           scored[idx].score += GRAPH_BOOST_AMOUNTS.hop2;
           scored[idx].signals.graphBoost = (scored[idx].signals.graphBoost || 0) + GRAPH_BOOST_AMOUNTS.hop2;