Merge pull request #513 from manojmallick/develop

chore(release): v8.24.0 — Trust Quick Wins I

Author: manojmallick

CHANGELOG.md

@@ -10,6 +10,18 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.24.0] — 2026-07-28
+
+Minor release — **"Trust Quick Wins I" (v8.24, G3a)**: the secret-redaction engine that already protects signatures, `get_lines`, and evidence packs becomes a standalone command for arbitrary text.
+
+### Added
+- **`sigmap redact` (#511, PR #512):** new `src/security/redact.js` — `redactText()` masks only the matched secret substring (`[REDACTED:<pattern name>]`), preserving surrounding text (unlike the generation-time scanner's whole-line replacement, which is unchanged). Findings carry 1-based line numbers with per-pattern counts. CLI: `sigmap redact [file] [--json]` — file argument or stdin; redacted text on stdout (pipe-clean), summary on stderr. Reuses the existing 10-pattern bank verbatim; zero new dependencies; never throws. 6 new integration tests including an every-pattern mask sweep (130 test files).
+
+### Changed
+- Test fixtures for secret patterns are assembled at runtime (no secret-shaped literals in committed blobs) — GitHub Push Protection rejected the first push over the fake samples, which validated the detection class this command implements.
+
+---
+
 ## [8.23.0] — 2026-07-28
 
 Minor release — **"Agent Economy I" (v8.23, F1)**: SigMap's token savings become queryable *during* a session. A spend ledger over the existing gain log, an optional budget threshold, and context-freshness age — as a CLI command and the 21st MCP tool.

CONTRIBUTORS.md

@@ -35,6 +35,9 @@ To ensure proper attribution:
 
 We welcome contributions! See [Contributing](./docs/CONTRIBUTING.md) for guidelines.
 
+### Recent Contributors (v8.24.0)
+- **@manojmallick** — feat(security): `sigmap redact` — standalone substring-level secret masking over files/stdin (10-pattern bank, pipe-clean stdout, `--json`); every-pattern test sweep (#511, PR #512)
+
 ### Recent Contributors (v8.23.0)
 - **@manojmallick** — feat(tracking,mcp): `sigmap budget` session spend ledger (estimated SigMap-emitted tokens, optional budget, context-age TTL) + `get_budget` MCP tool (21st); `SIGMAP_SESSION` identity; opt-in `sessionBudgetTokens`/`contextTtlDays` (#508, PR #509)
 

README.md

@@ -122,7 +122,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.23-main (21 repositories, including R language)
+Benchmark : sigmap-v8.24-main (21 repositories, including R language)
 Date      : 2026-07-28
 
 Hit@5          : 82.2%   (grep-agent baseline 44.8%  — 1.59× lift)

benchmarks/latest.json

@@ -1,5 +1,5 @@
 {
-  "benchmark_id": "sigmap-v8.23-main",
+  "benchmark_id": "sigmap-v8.24-main",
   "benchmark_date": "2026-07-28",
   "source": "benchmarks/reports/{benchmark-matrix,task-benchmark,token-reduction,honest-baseline}.json",
   "repos_token": 21,

benchmarks/reports/benchmark-matrix.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-07-28T19:29:15.129Z",
+  "generated": "2026-07-28T21:53:53.739Z",
   "success": true,
   "steps": [
     {
@@ -11,7 +11,7 @@
       ],
       "status": 0,
       "ok": true,
-      "durationMs": 31016,
+      "durationMs": 16146,
       "stdoutTail": "n 34s | 10.6s | **19min 23s** | 1min 57s | 1.1s | **1min 56s** |\n| **serilog** | 1min 38s | 3.6s | **1min 34s** | 9.8s | 0.4s | **9.4s** |\n| **riverpod** | 6min 14s | 10.7s | **6min 3s** | 37.4s | 1.1s | **36.3s** |\n| **okhttp** | 15.6s | 0.9s | **14.8s** | 1.6s | <0.1s | **1.5s** |\n| **laravel** | 13min 60s | 9.4s | **13min 50s** | 1min 24s | 0.9s | **1min 23s** |\n| **akka** | 6min 35s | 5.8s | **6min 30s** | 39.5s | 0.6s | **39.0s** |\n| **vapor** | 1min 26s | 1.6s | **1min 24s** | 8.6s | 0.2s | **8.4s** |\n| **vue-core** | 3min 34s | 5.3s | **3min 29s** | 21.4s | 0.5s | **20.9s** |\n| **svelte** | 3min 39s | 10.9s | **3min 28s** | 21.9s | 1.1s | **20.8s** |\n| **fastify** | 27.2s | 1.6s | **25.6s** | 2.7s | 0.2s | **2.6s** |\n| **fastapi** | 1min 29s | 1.9s | **1min 27s** | 8.9s | 0.2s | **8.7s** |\n| **ggplot2** | 3min 11s | 9.5s | **3min 1s** | 19.1s | 0.9s | **18.1s** |\n| **dplyr** | 1min 13s | 4.2s | **1min 8s** | 7.3s | 0.4s | **6.8s** |\n| **shiny** | 2min 12s | 4.4s | **2min 8s** | 13.2s | 0.4s | **12.8s** |\n\n*At 10 calls/day per repo: **1hr 50min** saved across all repos per round · **18hr 25min/day** · **6,720 hr/year***\n\nReport saved → benchmarks/reports/token-reduction.json\n",
       "stderrTail": ""
     },
@@ -23,7 +23,7 @@
       ],
       "status": 0,
       "ok": true,
-      "durationMs": 19434,
+      "durationMs": 14102,
       "stdoutTail": " 18     28%     100%   3.6×     5/5     0/5    0/5\nlaravel            1533  271      0%     100% 306.6×     4/5     1/5    0/5\nakka                211  108      2%     100%  42.2×     3/5     2/5    0/5\nvapor               131   58      4%       0%     0×     0/5     0/5    5/5\nvue-core            232  129      2%     100%  46.4×     4/5     1/5    0/5\nsvelte              370  141      1%      80%  59.2×     3/5     1/5    1/5\nfastify              31   28     16%      63%   3.9×     5/5     0/5    3/5\nfastapi              48   25     10%      80%   7.7×     3/5     1/5    1/5\n──────────────────────────────────────────────────────────────────────────────────────────\nAVERAGE                        16.0%    81.9%   5.1×  68/105  18/105 19/105\n──────────────────────────────────────────────────────────────────────────────────────────\n\nMethodology:\n  Random baseline = min(1, 5/fileCount) — probability of a random 5-file selection containing the target\n  Correct = target file is rank-1 result\n  Partial = target file in ranks 2–5\n  Wrong   = target file not in top-5\n  No LLM API used. All scores are retrieval rank math.\n\n[saved] /Users/manojmallick/sigmap/benchmarks/reports/retrieval.json\n",
       "stderrTail": "[run]  express ...\n[run]  flask ...\n[run]  gin ...\n[run]  spring-petclinic ...\n[run]  rails ...\n[run]  axios ...\n[run]  rust-analyzer ...\n[run]  abseil-cpp ...\n[run]  serilog ...\n[run]  riverpod ...\n[run]  okhttp ...\n[run]  laravel ...\n[run]  akka ...\n[run]  vapor ...\n[run]  vue-core ...\n[run]  svelte ...\n[run]  fastify ...\n[run]  fastapi ...\n[skip] ggplot2: no task file\n[skip] dplyr: no task file\n[skip] shiny: no task file\n"
     },
@@ -35,7 +35,7 @@
       ],
       "status": 0,
       "ok": true,
-      "durationMs": 23134,
+      "durationMs": 15118,
       "stdoutTail": "738 | **$22.15** |\n| **laravel** | $41.99 | $0.471 | $41.52 | **$1245.49** |\n| **akka** | $19.76 | $0.289 | $19.47 | **$584.25** |\n| **vapor** | $4.28 | $0.078 | $4.21 | **$126.19** |\n| **vue-core** | $10.69 | $0.263 | $10.43 | **$312.78** |\n| **svelte** | $10.95 | $0.547 | $10.41 | **$312.23** |\n| **fastify** | $1.36 | $0.081 | $1.28 | **$38.39** |\n| **fastapi** | $4.46 | $0.096 | $4.36 | **$130.90** |\n| **ggplot2** | $9.54 | $0.475 | $9.06 | **$271.85** |\n| **dplyr** | $3.63 | $0.210 | $3.42 | **$102.51** |\n| **shiny** | $6.62 | $0.219 | $6.40 | **$191.88** |\n\n*Total GPT-4o savings: ~$9941.94/month across 21 repos at 10 calls/day*\n\n### 5. API cost savings by model (10 calls/day)\n\n| Model | Input $/1M | Saved / day | Saved / month |\n|------|:----------:|:-----------:|:-------------:|\n| GPT-4o | $2.50 | $331.40 | **$9941.94** |\n| Claude Sonnet | $3.00 | $397.68 | **$11930.33** |\n| Claude Haiku | $1.00 | $132.56 | **$3976.78** |\n\n*Savings scale with each model's input rate — token reduction is model-agnostic; the dollar figure is not. Verified 2026-07 pricing: GPT-4o $2.50, Claude Sonnet $3.00, Claude Haiku $1.00 per 1M input tokens.*\n\nReport saved → benchmarks/reports/quality.json\n",
       "stderrTail": ""
     },
@@ -47,7 +47,7 @@
       ],
       "status": 0,
       "ok": true,
-      "durationMs": 159,
+      "durationMs": 128,
       "stdoutTail": "  flask                   26.3%      88%     3.3×\n  gin                      4.7%     100%    21.3×\n  spring-petclinic        38.5%     100%     2.6×\n  rails                    0.4%     100%   250.0×\n  axios                   20.0%      50%     2.5×\n  rust-analyzer            0.8%     100%   125.0×\n  abseil-cpp               0.7%     100%   142.9×\n  serilog                  5.1%      20%     3.9×\n  riverpod                 1.1%     100%    90.9×\n  okhttp                  27.8%     100%     3.6×\n  laravel                  0.3%     100%   333.3×\n  akka                     2.4%     100%    41.7×\n  vapor                    3.8%       0%     0.0×\n  vue-core                 2.2%     100%    45.5×\n  svelte                   1.4%      80%    57.1×\n  fastify                 16.1%      63%     3.9×\n  fastapi                 10.4%      80%     7.7×\n\n  Hallucination risk proxy (dark symbols)\n\n  Without SigMap: 85% of codebase symbols hidden from AI\n  With    SigMap: 15% of indexed symbols grounded in signatures\n  (10,216 grounded, 57,187 dark — across 21 repos)\n\n──────────────────────────────────────────────────────────────────────────\n\n  Report saved → benchmarks/reports/task-benchmark.json\n\n",
       "stderrTail": "[task-benchmark] saved → /Users/manojmallick/sigmap/benchmarks/reports/task-benchmark.json\n"
     }

benchmarks/reports/honest-baseline.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-07-28T19:29:52.966Z",
+  "generated": "2026-07-28T21:54:28.471Z",
   "methodology": {
     "corpus": "benchmarks/tasks/*.jsonl",
     "scorer": "src/eval/scorer.js hitAtK/reciprocalRank, k=5",

benchmarks/reports/quality.json

@@ -1,6 +1,6 @@
 {
-  "version": "8.23.0",
-  "timestamp": "2026-07-28T19:29:14.955Z",
+  "version": "8.24.0",
+  "timestamp": "2026-07-28T21:53:53.600Z",
   "assumptions": {
     "callsPerDay": 10,
     "models": [

benchmarks/reports/retrieval.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-07-28T19:28:51.814Z",
+  "generated": "2026-07-28T21:53:38.481Z",
   "repos": [
     {
       "repo": "express",

benchmarks/reports/task-benchmark.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-07-28T19:29:15.085Z",
+  "generated": "2026-07-28T21:53:53.711Z",
   "methodology": {
     "promptWeights": {
       "correct": 1,

benchmarks/reports/token-reduction.json

@@ -1,6 +1,6 @@
 {
-  "version": "8.23.0",
-  "timestamp": "2026-07-28T19:28:32.387Z",
+  "version": "8.24.0",
+  "timestamp": "2026-07-28T21:53:24.383Z",
   "assumptions": {
     "tokensPerSecUncached": 2000,
     "cacheSpeedup": 10,
@@ -16,7 +16,7 @@
       "reductionPct": 98.1,
       "fileCount": 38,
       "droppedCount": 0,
-      "timestamp": "2026-07-28T19:28:02.158Z",
+      "timestamp": "2026-07-28T21:53:08.892Z",
       "timings": {
         "rawColdSec": 35.29,
         "sigColdSec": 0.66,
@@ -36,7 +36,7 @@
       "reductionPct": 96.1,
       "fileCount": 51,
       "droppedCount": 18,
-      "timestamp": "2026-07-28T19:28:02.807Z",
+      "timestamp": "2026-07-28T21:53:09.459Z",
       "timings": {
         "rawColdSec": 69.73,
         "sigColdSec": 2.7,
@@ -56,7 +56,7 @@
       "reductionPct": 95.1,
       "fileCount": 118,
       "droppedCount": 40,
-      "timestamp": "2026-07-28T19:28:03.621Z",
+      "timestamp": "2026-07-28T21:53:10.036Z",
       "timings": {
         "rawColdSec": 110.62,
         "sigColdSec": 5.45,
@@ -76,7 +76,7 @@
       "reductionPct": 96.8,
       "fileCount": 52,
       "droppedCount": 13,
-      "timestamp": "2026-07-28T19:28:04.824Z",
+      "timestamp": "2026-07-28T21:53:10.387Z",
       "timings": {
         "rawColdSec": 47.05,
         "sigColdSec": 1.52,
@@ -96,7 +96,7 @@
       "reductionPct": 98.7,
       "fileCount": 1193,
       "droppedCount": 918,
-      "timestamp": "2026-07-28T19:28:06.490Z",
+      "timestamp": "2026-07-28T21:53:11.162Z",
       "timings": {
         "rawColdSec": 749.53,
         "sigColdSec": 9.6,
@@ -116,7 +116,7 @@
       "reductionPct": 95.4,
       "fileCount": 64,
       "droppedCount": 14,
-      "timestamp": "2026-07-28T19:28:08.332Z",
+      "timestamp": "2026-07-28T21:53:11.659Z",
       "timings": {
         "rawColdSec": 36.16,
         "sigColdSec": 1.65,
@@ -136,7 +136,7 @@
       "reductionPct": 99.4,
       "fileCount": 675,
       "droppedCount": 513,
-      "timestamp": "2026-07-28T19:28:17.424Z",
+      "timestamp": "2026-07-28T21:53:15.719Z",
       "timings": {
         "rawColdSec": 1765.57,
         "sigColdSec": 10.46,
@@ -156,7 +156,7 @@
       "reductionPct": 99.1,
       "fileCount": 703,
       "droppedCount": 556,
-      "timestamp": "2026-07-28T19:28:19.654Z",
+      "timestamp": "2026-07-28T21:53:16.680Z",
       "timings": {
         "rawColdSec": 1173.76,
         "sigColdSec": 10.61,
@@ -176,7 +176,7 @@
       "reductionPct": 96.4,
       "fileCount": 195,
       "droppedCount": 117,
-      "timestamp": "2026-07-28T19:28:21.254Z",
+      "timestamp": "2026-07-28T21:53:17.200Z",
       "timings": {
         "rawColdSec": 97.76,
         "sigColdSec": 3.56,
@@ -196,7 +196,7 @@
       "reductionPct": 97.1,
       "fileCount": 465,
       "droppedCount": 350,
-      "timestamp": "2026-07-28T19:28:23.017Z",
+      "timestamp": "2026-07-28T21:53:17.978Z",
       "timings": {
         "rawColdSec": 373.61,
         "sigColdSec": 10.65,
@@ -216,7 +216,7 @@
       "reductionPct": 94.4,
       "fileCount": 18,
       "droppedCount": 0,
-      "timestamp": "2026-07-28T19:28:23.953Z",
+      "timestamp": "2026-07-28T21:53:18.352Z",
       "timings": {
         "rawColdSec": 15.64,
         "sigColdSec": 0.87,
@@ -236,7 +236,7 @@
       "reductionPct": 98.9,
       "fileCount": 1536,
       "droppedCount": 1265,
-      "timestamp": "2026-07-28T19:28:25.785Z",
+      "timestamp": "2026-07-28T21:53:19.260Z",
       "timings": {
         "rawColdSec": 839.75,
         "sigColdSec": 9.42,
@@ -256,7 +256,7 @@
       "reductionPct": 98.5,
       "fileCount": 211,
       "droppedCount": 103,
-      "timestamp": "2026-07-28T19:28:26.651Z",
+      "timestamp": "2026-07-28T21:53:19.948Z",
       "timings": {
         "rawColdSec": 395.27,
         "sigColdSec": 5.78,
@@ -276,7 +276,7 @@
       "reductionPct": 98.2,
       "fileCount": 134,
       "droppedCount": 76,
-      "timestamp": "2026-07-28T19:28:27.412Z",
+      "timestamp": "2026-07-28T21:53:20.400Z",
       "timings": {
         "rawColdSec": 85.68,
         "sigColdSec": 1.56,
@@ -296,7 +296,7 @@
       "reductionPct": 97.5,
       "fileCount": 249,
       "droppedCount": 120,
-      "timestamp": "2026-07-28T19:28:28.148Z",
+      "timestamp": "2026-07-28T21:53:21.020Z",
       "timings": {
         "rawColdSec": 213.77,
         "sigColdSec": 5.25,
@@ -316,7 +316,7 @@
       "reductionPct": 95,
       "fileCount": 370,
       "droppedCount": 229,
-      "timestamp": "2026-07-28T19:28:29.396Z",
+      "timestamp": "2026-07-28T21:53:22.099Z",
       "timings": {
         "rawColdSec": 219.09,
         "sigColdSec": 10.94,
@@ -336,7 +336,7 @@
       "reductionPct": 94.1,
       "fileCount": 28,
       "droppedCount": 0,
-      "timestamp": "2026-07-28T19:28:29.846Z",
+      "timestamp": "2026-07-28T21:53:22.500Z",
       "timings": {
         "rawColdSec": 27.21,
         "sigColdSec": 1.62,
@@ -356,7 +356,7 @@
       "reductionPct": 97.8,
       "fileCount": 32,
       "droppedCount": 7,
-      "timestamp": "2026-07-28T19:28:30.534Z",
+      "timestamp": "2026-07-28T21:53:22.959Z",
       "timings": {
         "rawColdSec": 89.19,
         "sigColdSec": 1.93,
@@ -376,7 +376,7 @@
       "reductionPct": 95,
       "fileCount": 189,
       "droppedCount": 75,
-      "timestamp": "2026-07-28T19:28:31.229Z",
+      "timestamp": "2026-07-28T21:53:23.486Z",
       "timings": {
         "rawColdSec": 190.73,
         "sigColdSec": 9.5,
@@ -396,7 +396,7 @@
       "reductionPct": 94.2,
       "fileCount": 97,
       "droppedCount": 38,
-      "timestamp": "2026-07-28T19:28:31.701Z",
+      "timestamp": "2026-07-28T21:53:23.909Z",
       "timings": {
         "rawColdSec": 72.54,
         "sigColdSec": 4.2,
@@ -416,7 +416,7 @@
       "reductionPct": 96.7,
       "fileCount": 93,
       "droppedCount": 39,
-      "timestamp": "2026-07-28T19:28:32.343Z",
+      "timestamp": "2026-07-28T21:53:24.348Z",
       "timings": {
         "rawColdSec": 132.3,
         "sigColdSec": 4.38,