release: FixMap v0.8.7 (#448)

Publishes the vendored-bundle detection fix. It was merged to main before this
release, and for a short window the website changelog described it as shipped
while npm still served 0.8.6 without it — the #274 defect with its polarity
reversed, advertising a fix the released artifact lacked rather than an accuracy
figure it no longer achieved.

The website changelog loses its "Unreleased / In progress" section, and the
render branches that produced "Coming next" are removed rather than left unused.
An entry describing work that has only landed on main tells a reader a fix is
available when npm install will not give it to them; the type now documents that
every entry must be an installable version.

Versions move to 0.8.7 across root, core, cli, action, server.json and the
lockfile, with the README Action pin. apps/web keeps 0.0.0 — it is unpublished
and publish.yml validates only its core dependency. The lockfile was patched by
hand; regenerating on Windows drops the @emnapi entries Linux CI needs (9
present, verified).

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: aryamthecodebreaker

.gitignore

@@ -19,3 +19,5 @@ fixmap-report.md
 
 # Local design-QA scratch: references machine-specific temp paths.
 design-qa.md
+
+.vercel

CHANGELOG.md

@@ -6,6 +6,32 @@ Accuracy figures inside a released entry are the numbers measured **at that rele
 left as written. The current numbers live on the [evidence page](https://usefixmap.vercel.app/evidence),
 which is generated from the recorded results rather than transcribed by hand.
 
+## 0.8.7 - 2026-08-02
+
+### Fixed
+
+- A pretty-printed vendored dependency bundle could rank first at high confidence. It escaped content-based bundle detection — 96 characters per line against a 400-character threshold, and one bundler marker against a threshold of two — and it escaped generated-duplicate filtering, which by design only drops a generated path that has a maintained source twin. A vendored dependency has none, so it fell through both. Detection now accepts a single marker when the path is itself conventional generated output, such as a `compiled/` segment (#446).
+
+### Evidence
+
+- Added a pretty-printed vendored-bundle case to the adversarial suite, which was previously all minified fixtures. The suite is 9/9 with a false-confidence rate of 0.0.
+- Chalk's `source/vendor/supports-color/index.js` still ranks first for a colour-detection task. It is a vendored path whose content genuinely is the only implementation of the behavior, and it is the counterexample any path-based rule has to keep passing.
+- Held-out remains 7/12 Top-1, 8/12 Top-3, 9/12 Top-5; external remains 11/16, 16/16, 16/16.
+
+### Note on the gap after 0.8.6
+
+The fix above was merged to `main` before this release, and for a short window the published changelog described it as shipped while npm still served 0.8.6 without it. That is the #274 defect with its polarity reversed: the site advertising a fix the released artifact lacks, rather than an accuracy figure it no longer achieves. The website changelog no longer has an unreleased state — every entry on it is a version you can install.
+
+### Installation
+
+```bash
+npm install --global @aryam/fixmap@0.8.7
+fixmap doctor
+fixmap chalk/chalk#624
+```
+
+The npm packages, MCP Registry entry, GitHub tag/release, Action tag, and production site must all resolve to 0.8.7 before the release is considered complete.
+
 ## 0.8.6 - 2026-08-02
 
 ### Fixed

README.md

@@ -79,7 +79,7 @@ Doctor 0.8.4 and newer compares an exact npm-requested version when that newer D
 
 ```powershell
 $fixmapPrefix = Join-Path $env:TEMP "fixmap-cli-0.8.6"
-npm install --global --prefix $fixmapPrefix @aryam/fixmap@0.8.6
+npm install --global --prefix $fixmapPrefix @aryam/fixmap@0.8.7
 & "$fixmapPrefix\fixmap.cmd" --version
 ```
 
@@ -367,7 +367,7 @@ jobs:
         with:
           fetch-depth: 0
       - id: fixmap
-        uses: aryamthecodebreaker/FixMap@v0.8.6
+        uses: aryamthecodebreaker/FixMap@v0.8.7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -378,7 +378,7 @@ To close the plan→edit→verify loop without leaving GitHub, save the plan as
 
 ```yaml
       - id: plan
-        uses: aryamthecodebreaker/FixMap@v0.8.6
+        uses: aryamthecodebreaker/FixMap@v0.8.7
         with:
           format: json
       - run: echo '${{ steps.plan.outputs.report }}' > fixmap-plan.json
@@ -388,7 +388,7 @@ To close the plan→edit→verify loop without leaving GitHub, save the plan as
           path: fixmap-plan.json
 
       # In a later run, after the fix is pushed:
-      - uses: aryamthecodebreaker/FixMap@v0.8.6
+      - uses: aryamthecodebreaker/FixMap@v0.8.7
         with:
           mode: verify
           report-path: fixmap-plan.json

apps/web/app/changelog/page.tsx

@@ -21,7 +21,15 @@ type ChangeGroup = {
   items: string[];
 };
 
+/**
+ * Every entry here is a version that is published and installable. There is deliberately no
+ * "unreleased" or "coming next" state: an entry describing work that has only landed on main
+ * tells a reader a fix is available when `npm install` will not give it to them. That is the
+ * defect behind #274 pointed the other way — and it happened here once already, with the
+ * vendored-bundle fix listed as shipped while npm still served the version without it.
+ */
 type Release = {
+  /** A published semver version. Never "Unreleased". */
   version: string;
   date: string;
   label?: string;
@@ -31,10 +39,10 @@ type Release = {
 
 const releases: Release[] = [
   {
-    version: "Unreleased",
-    date: "Pending release",
-    label: "In progress",
-    summary: "Improvements that are tested and ready for the next package release.",
+    version: "0.8.7",
+    date: "August 2, 2026",
+    label: "Latest release",
+    summary: "Readable vendored dependency bundles stop posing as edit targets.",
     groups: [
       {
         label: "Fixed",
@@ -54,7 +62,6 @@ const releases: Release[] = [
   {
     version: "0.8.6",
     date: "August 2, 2026",
-    label: "Latest release",
     summary: "Cleaner implementation rankings without hiding legitimate UI or generated-artifact work.",
     groups: [
       {
@@ -214,7 +221,7 @@ export default function ChangelogPage() {
           <nav>
             {releases.map((release) => (
               <a key={release.version} href={`#${releaseId(release.version)}`}>
-                <span>{release.version === "Unreleased" ? "Next" : `v${release.version}`}</span>
+                <span>v{release.version}</span>
                 <small>{release.date}</small>
               </a>
             ))}
@@ -227,7 +234,7 @@ export default function ChangelogPage() {
               <header className="release-heading">
                 <div>
                   <p>{release.date}</p>
-                  <h2>{release.version === "Unreleased" ? "Coming next" : `FixMap v${release.version}`}</h2>
+                  <h2>FixMap v{release.version}</h2>
                 </div>
                 {release.label ? <span>{release.label}</span> : null}
               </header>

apps/web/package.json

@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@aryam/fixmap-core": "0.8.6",
+    "@aryam/fixmap-core": "0.8.7",
     "@phosphor-icons/react": "^2.1.10",
     "next": "16.2.11",
     "react": "19.2.7",

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "fixmap-workspace",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "Local-first repo context for coding agents: paste a GitHub issue URL to get ranked files, test routes, and risks.",
   "license": "MIT",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fixmap/action",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "GitHub Action wrapper for FixMap pull request reports.",
   "private": true,
   "license": "MIT",
@@ -11,6 +11,6 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@aryam/fixmap-core": "0.8.6"
+    "@aryam/fixmap-core": "0.8.7"
   }
 }

packages/action/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aryam/fixmap",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "mcpName": "io.github.aryamthecodebreaker/fixmap",
   "description": "Local-first CLI and MCP server mapping GitHub issue URLs, tasks, and diffs to ranked files, tests, and risks.",
   "license": "MIT",
@@ -46,7 +46,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@aryam/fixmap-core": "0.8.6",
+    "@aryam/fixmap-core": "0.8.7",
     "@modelcontextprotocol/sdk": "1.30.0"
   },
   "engines": {

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aryam/fixmap-core",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Deterministic local-first repository scanner, context ranker, and report renderer for coding agents.",
   "license": "MIT",
   "repository": {