sourcecode 1.30.1__tar.gz → 1.30.3__tar.gz

sourcecode-1.30.3/.continue-here.md

@@ -0,0 +1,177 @@
+# Continue Here — atlas-cli session 7
+
+**Paused:** 2026-05-16 (sesión 7)
+**Repo:** `/Users/user/Downloads/atlas-cli`
+**Branch:** master
+**Último commit:** `7085e97` — (fix) corrigiendo prepare-context review-pr mejorando su representatividad y minimizando falsos positivos
+**Working tree:** LIMPIO
+
+---
+
+## Lo que se hizo esta sesión
+
+### BFS over-expansion fix — 3 fixes semánticos en `prepare_context.py`
+
+**Problema de partida** (heredado sesión 6): `review-pr` con 2 archivos cambiados (`User.java`, `ArticleFavorite.java`) devolvía 24 `relevant_files` incluyendo todos los controllers, toda la capa security, GraphQL completo.
+
+**Diagnóstico confirmado:**
+- `_classify_changed_file` es path-only, sin inspección de diff → worst-case siempre
+- BFS repo-wide sin constraint de módulo → todo lo que importa `User` incluido
+- Sin change severity classifier → getter renombrado = campo eliminado = mismo BFS
+
+---
+
+### Fix 1 — BFS module constraint
+
+Dentro del loop BFS (`_hop_dep_map`), antes de añadir a `_hop_bfs_staged`:
+
+```python
+_is_cross_module = bool(_dep_module) and _dep_module not in affected_modules_set
+if _is_cross_module:
+    _seed_expansion = _EXPANSION_TARGETS.get(_seed_atype, frozenset())
+    if _seed_severity == "security_change":
+        _seed_expansion = _seed_expansion | frozenset({"security", "spring_config", "config"})
+    if _hop_num >= 2 or _dep_atype not in _seed_expansion:
+        continue
+```
+
+Regla: cross-module solo en hop-1 si dep_atype ∈ `_EXPANSION_TARGETS[seed]`. Hop-2+: cross-module bloqueado siempre.
+
+### Fix 2 — Cross-module score penalty
+
+```python
+_cross_module_factor = 0.60 if _is_cross_module else 1.0
+_dep_score = round(_dep_score_base * (0.70 ** _hop_num) * _cross_module_factor, 2)
+```
+
+Same-module files ganan prioridad en el per-hop cap (8/6/4).
+
+### Fix 3 — `_classify_diff_severity` método nuevo
+
+Nuevo método que lee `git diff` y clasifica semánticamente:
+- `trivial` → no siembra BFS (solo comentarios/whitespace)
+- `field_change` → solo hop-1; deps excluidos del frontier hop-2+
+- `api_change` → BFS completo
+- `security_change` → BFS completo + security chain cross-module permitido
+- `unknown` → tratado como api_change (safe default)
+
+Integración en `_build_delta_impact`:
+- Step 1b: `diff_severities = {f: self._classify_diff_severity(f, since) for f in changed_files}`
+- Frontier gate: `trivial` files excluidos del BFS frontier
+- Loop gate: `field_change` seeds excluidos del hop-2+ frontier (`_hop_scored` no actualizado)
+- `_seed_severity` computado por seed para aplicar gates correctamente
+
+**Bug encontrado durante debug:** `_SECURITY` regex original incluía "password", "role", "permission" — field names comunes en domain models. `this.password = password` en `User.java` disparaba `security_change` falso positivo. Fix: removidos de la regex para Java/TS/Python. Mantenidos: `jwt|auth|token|credential|encrypt|decrypt|oauth|saml|ldap|principal|Security`.
+
+**Nota sobre instalación:** `sourcecode` CLI usa pipx venv separado. Para testear source editable:
+```bash
+/Users/user/.local/pipx/venvs/sourcecode/bin/python -m pip install -e .
+```
+
+---
+
+## Resultado smoke test (spring-boot-realworld-example-app)
+
+```
+changed_files: User.java, ArticleFavorite.java
+```
+
+| Métrica | Sesión 6 | Sesión 7 |
+|---------|----------|----------|
+| `relevant_files` total | 14 | **4** |
+| Controllers REST | 5 | **0** |
+| Security chain | 3 | **0** |
+| GraphQL | 0 | **0** |
+| Tests | 0 | **0** |
+| Same-module repos | 2 | 2 ✓ |
+
+Los 4 archivos resultantes:
+- `User.java` (changed)
+- `ArticleFavorite.java` (changed)
+- `UserRepository.java` (Step 3 same-module expansion)
+- `ArticleFavoriteRepository.java` (Step 3 same-module expansion)
+
+---
+
+## Estado de tests al pausar
+
+```
+771 passed, 3 skipped
+```
+
+Pre-existing failures (excluidos del run):
+- `test_block2_coverage.py::test_java_marked_unsupported` — DocRecord bug en doc_analyzer.py
+- `test_dependency_analyzer_node_python.py::test_python_requirements_without_lockfile_keeps_declared_versions` — typer version mismatch
+- `test_packaging.py::test_console_script_reports_version` — versión instalada vs source
+
+---
+
+## Decisiones técnicas de esta sesión
+
+- **`_EXPANSION_TARGETS` reutilizado en BFS gate**: misma tabla que Step 3, coherente con semántica del sistema
+- **hop-2+ cross-module siempre bloqueado**: excepto security_change que permite security chain
+- **"password" removido de `_SECURITY` en `_classify_diff_severity`**: distingue field name de auth logic real
+- **Cross-module penalty 0.60**: empírico, asegura que same-module gana el per-hop cap
+- **`_bfs_seen.add` antes del gate**: correcto — prevents double-processing aunque archivo sea filtrado
+
+---
+
+## Pendiente / próximos pasos
+
+1. **Smoke test `delta`** — verificar Fix 1-3 no afecta el comando `delta`:
+   ```bash
+   cd ~/Documents/workspace/spring-boot-realworld-example-app
+   sourcecode prepare-context delta . --since HEAD~1 2>/dev/null | python3 -c "
+   import json,sys; d=json.load(sys.stdin)
+   print('relevant_files:', len(d.get('relevant_files', [])))
+   "
+   ```
+
+2. **Smoke test `security_change` path** — verificar que cambio real en auth logic SÍ expande security chain:
+   - Modificar temporalmente `JwtService.java` (añadir línea con "jwt" o "auth")
+   - Correr `review-pr` → debería incluir AuthorizationService, JwtTokenFilter
+
+3. **Tests unitarios para `_classify_diff_severity`** — actualmente sin tests. Casos: trivial (solo comentarios), field_change (field declaration), api_change (import removal), security_change (jwt en diff), unknown (no diff).
+
+4. **`User.java` clasificado como `"source"` no `"domain_model"`** — "user" stem no está en `_ENTITY_KW` ni en `_FOLDER_TYPE_MAP`. Fix opcional: añadir "user", "profile", "account" a detección domain_model.
+
+5. **Smoke tests saint-server** (sesiones anteriores) — pendiente desde sesión 4/5.
+
+---
+
+## Para retomar
+
+```bash
+cd /Users/user/Downloads/atlas-cli
+git log --oneline -3
+# debe mostrar:
+# 7085e97 (fix) corrigiendo prepare-context review-pr mejorando su representatividad...
+# 772a01e (fix) corrigiendo bug que identificaba falsos positivos en review-pr
+# 5c06ef3 (feature) implementando mejoras significativas en prepare-context review-pr
+
+# Tests
+python3 -m pytest tests/ \
+  --ignore=tests/test_block2_coverage.py \
+  --ignore=tests/test_packaging.py \
+  --deselect=tests/test_dependency_analyzer_node_python.py::test_python_requirements_without_lockfile_keeps_declared_versions \
+  -q
+# Expected: 771 passed, 3 skipped
+
+# Reinstall en pipx venv para smoke tests
+/Users/user/.local/pipx/venvs/sourcecode/bin/python -m pip install -e . -q
+
+# Smoke test review-pr
+cd ~/Documents/workspace/spring-boot-realworld-example-app
+sourcecode prepare-context review-pr . 2>/dev/null | python3 -c "
+import json, sys
+d = json.load(sys.stdin)
+print('relevant_files:', len(d.get('relevant_files', [])))
+for f in d.get('relevant_files', []):
+    print(' ', f.get('score'), f.get('path').split('/')[-1])
+"
+# Expected: 4 files, no controllers, no security, no GraphQL
+```
+
+---
+
+*Pausado 2026-05-16 sesión 7 — gsd:pause-work*

{sourcecode-1.30.1 → sourcecode-1.30.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.30.1
+Version: 1.30.3
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -221,7 +221,7 @@ Description-Content-Type: text/markdown
 
 **Compressed AI-ready context for Java/Spring enterprise codebases.**
 
-![Version](https://img.shields.io/badge/version-1.30.1-blue)
+![Version](https://img.shields.io/badge/version-1.30.3-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -255,7 +255,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.30.1
+# sourcecode 1.30.3
 ```
 
 ---

{sourcecode-1.30.1 → sourcecode-1.30.3}/README.md

@@ -2,7 +2,7 @@
 
 **Compressed AI-ready context for Java/Spring enterprise codebases.**
 
-![Version](https://img.shields.io/badge/version-1.30.1-blue)
+![Version](https://img.shields.io/badge/version-1.30.3-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -36,7 +36,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.30.1
+# sourcecode 1.30.3
 ```
 
 ---

{sourcecode-1.30.1 → sourcecode-1.30.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.30.1"
+version = "1.30.3"
 description = "Deterministic codebase context for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.30.1 → sourcecode-1.30.3}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.30.1"
+__version__ = "1.30.3"

{sourcecode-1.30.1 → sourcecode-1.30.3}/src/sourcecode/cli.py

@@ -1866,6 +1866,8 @@ def prepare_context_cmd(
             out["review_hotspots"] = output.review_hotspots
         if output.suggested_review_order:
             out["suggested_review_order"] = output.suggested_review_order
+        if output.execution_paths:
+            out["execution_paths"] = output.execution_paths
         if output.impact_summary:
             out["impact_summary"] = output.impact_summary
         if output.why_these_files:

sourcecode-1.30.3/src/sourcecode/flow_analyzer.py

@@ -0,0 +1,310 @@
+"""flow_analyzer.py — Evidence-based execution path extraction for PR context.
+
+Builds Entry → Service → Repository → EndState ordered sequences using ONLY
+direct code evidence: field injection, constructor params, type annotations,
+method calls, explicit instantiation.
+
+V3: execution_paths with runtime_notes — conditional branches, optional execution,
+and async side-effects are surfaced when explicit code signals exist.
+No inference, no naming, no invented behavior.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Callable, Optional
+
+_ENTRY_ARTIFACT_TYPES = frozenset({"controller", "entrypoint"})
+_SERVICE_ARTIFACT_TYPES = frozenset({"service"})
+_REPO_ARTIFACT_TYPES = frozenset({"repository", "mapper"})
+
+_DB_KEYWORDS = frozenset({"repository", "dao", "mapper", "store", "jpa", "jdbc", "sql"})
+_EVENT_KEYWORDS = frozenset({"event", "publish", "emit", "kafka", "queue", "rabbit", "sns", "bus"})
+
+_HTTP_ENTRY_RE = re.compile(
+    r'@(?:Get|Post|Put|Delete|Patch|Request)Mapping[^)]*\)'
+    r'|@(?:Get|Post|Put|Delete|Patch)\([^)]*\)'
+    r'|@\w+\.(?:get|post|put|delete|patch)\([^)]*\)',
+    re.IGNORECASE,
+)
+_METHOD_NAME_RE = re.compile(
+    r'(?:public\s+|async\s+|def\s+|function\s+)*'
+    r'(?:[\w<>\[\]]+\s+)?'
+    r'(\w+)\s*\(',
+)
+
+# Runtime signal patterns: (compiled_regex, note_text)
+# Only signals with explicit code evidence — no inference.
+# Three categories: condition | branch | async
+_RUNTIME_SIGNALS: list[tuple[re.Pattern, str]] = [
+    # ── Conditional / auth guards ─────────────────────────────────────────────
+    (re.compile(r'@PreAuthorize|@Secured|@RolesAllowed', re.IGNORECASE),
+     "condition: authorization check present (@PreAuthorize / @Secured)"),
+    (re.compile(r'isAuthenticated\(\)|hasRole\(|hasAuthority\(|SecurityContextHolder', re.IGNORECASE),
+     "condition: reads authentication context"),
+    (re.compile(r'featureFlag|FeatureToggle|\.isEnabled\s*\(|\.isActive\s*\(', re.IGNORECASE),
+     "condition: feature flag gates execution"),
+    # Null/empty guard with early return — matches if (...null/empty...) return/throw on same line
+    (re.compile(r'if\s*\([^)]*(?:==\s*null|!=\s*null|isEmpty\s*\(\)|isBlank\s*\(\))[^)]*\)'
+                r'\s*(?:\{?\s*)?(?:return|throw)\b', re.IGNORECASE),
+     "condition: null/empty guard with early return"),
+
+    # ── Optional execution / branching ────────────────────────────────────────
+    (re.compile(r'@Cacheable|@CacheEvict|@CachePut', re.IGNORECASE),
+     "branch: Spring cache may short-circuit downstream call"),
+    (re.compile(r'\.getIfPresent\s*\(|cache\.get\s*\(|cacheManager\.', re.IGNORECASE),
+     "branch: manual cache lookup may short-circuit"),
+    (re.compile(r'Optional\s*<|\.orElseThrow\s*\(|\.orElseGet\s*\(|\.orElse\s*\(', re.IGNORECASE),
+     "branch: result may be absent (Optional)"),
+
+    # ── Async / side effects ──────────────────────────────────────────────────
+    (re.compile(r'@Async\b'),
+     "async: runs in separate thread (@Async)"),
+    (re.compile(r'CompletableFuture|\.supplyAsync\s*\(|\.runAsync\s*\('),
+     "async: non-blocking future-based execution"),
+    (re.compile(r'\basync\s+def\b|\bawait\b', re.IGNORECASE),
+     "async: non-blocking (async/await)"),
+    (re.compile(r'publishEvent\s*\(|applicationEventPublisher|eventPublisher\.', re.IGNORECASE),
+     "async: Spring application event emitted"),
+    (re.compile(r'kafkaTemplate\.|KafkaProducer|@KafkaListener', re.IGNORECASE),
+     "async: Kafka message produced"),
+    (re.compile(r'rabbitTemplate\.|amqpTemplate\.|@RabbitListener', re.IGNORECASE),
+     "async: RabbitMQ message sent"),
+]
+
+
+def _detect_lang(path: str) -> str:
+    return {
+        ".java": "java", ".kt": "kotlin",
+        ".py": "python",
+        ".ts": "typescript", ".tsx": "typescript",
+        ".js": "javascript", ".jsx": "javascript",
+        ".go": "go", ".cs": "csharp", ".rb": "ruby", ".php": "php",
+    }.get(Path(path).suffix.lower(), "unknown")
+
+
+def _strip_comments(content: str, lang: str) -> str:
+    content = re.sub(r"/\*.*?\*/", " ", content, flags=re.DOTALL)
+    content = re.sub(r"//[^\n]*", " ", content)
+    if lang in ("python", "ruby", "go"):
+        content = re.sub(r"#[^\n]*", " ", content)
+    return content
+
+
+def _read_safe(root: Path, rel_path: str) -> str:
+    try:
+        return (root / rel_path).read_text(encoding="utf-8", errors="ignore")
+    except (OSError, ValueError):
+        return ""
+
+
+def _collect_runtime_notes(content: str, lang: str) -> list[str]:
+    """Scan comment-stripped content for explicit runtime behavior signals.
+
+    Returns only notes backed by a direct code pattern match.
+    Returns [] when no signals are found.
+    """
+    clean = _strip_comments(content, lang)
+    notes: list[str] = []
+    seen: set[str] = set()
+    for pattern, note in _RUNTIME_SIGNALS:
+        if note not in seen and pattern.search(clean):
+            notes.append(note)
+            seen.add(note)
+    return notes
+
+
+def _find_entry_method(clean: str) -> Optional[str]:
+    m = _HTTP_ENTRY_RE.search(clean)
+    if not m:
+        return None
+    after = clean[m.end():]
+    mn = _METHOD_NAME_RE.match(after.lstrip())
+    if mn:
+        name = mn.group(1)
+        if name.lower() not in ("public", "async", "def", "function", "void", "override"):
+            return name
+    return None
+
+
+def _build_field_map(clean: str) -> dict[str, str]:
+    """Map field_name_lower → ClassName from injection patterns."""
+    fmap: dict[str, str] = {}
+    for m in re.finditer(r"private\s+(\w+)(?:<[^>]+>)?\s+(\w+)\s*[;=,)]", clean):
+        fmap[m.group(2).lower()] = m.group(1)
+    for m in re.finditer(r"(?:private|protected|readonly)\s+(\w+)\s*:\s*(\w+)", clean):
+        fmap[m.group(1).lower()] = m.group(2)
+    for m in re.finditer(r"self\.(\w+)\s*=\s*(\w+)\s*\(", clean):
+        fmap[m.group(1).lower()] = m.group(2)
+    return fmap
+
+
+def _find_called_method(clean: str, class_name: str, fmap: dict[str, str]) -> Optional[str]:
+    fields = [f for f, t in fmap.items() if t.lower() == class_name.lower()]
+    for field in fields:
+        pat = rf"\bthis\.{re.escape(field)}\.(\w+)\s*\(|\b{re.escape(field)}\.(\w+)\s*\("
+        for m in re.finditer(pat, clean, re.IGNORECASE):
+            name = m.group(1) or m.group(2)
+            if name and name.lower() not in ("class", "new", "super", "get", "set"):
+                return name
+    for m in re.finditer(rf"\b{re.escape(class_name)}\.(\w+)\s*\(", clean, re.IGNORECASE):
+        name = m.group(1)
+        if name.lower() not in ("class", "new", "super"):
+            return name
+    return None
+
+
+def _has_code_evidence(clean: str, class_name: str) -> bool:
+    """True only when class_name has direct code evidence in pre-stripped content."""
+    esc = re.escape(class_name)
+    if re.search(rf"\b(?:private|protected)\s+{esc}\b", clean, re.IGNORECASE):
+        return True
+    if re.search(rf"[,(]\s*{esc}\s+\w+", clean, re.IGNORECASE):
+        return True
+    if re.search(rf":\s*{esc}\b", clean, re.IGNORECASE):
+        return True
+    if re.search(rf"\bnew\s+{esc}\s*\(", clean, re.IGNORECASE):
+        return True
+    if re.search(rf"\b{esc}\s*\(", clean):
+        return True
+    if re.search(rf"\b{esc}\b", clean, re.IGNORECASE):
+        non_import = re.search(
+            rf"^(?!\s*(?:import|require|from|//|#|\*)\b).*\b{esc}\b",
+            clean, re.IGNORECASE | re.MULTILINE,
+        )
+        if non_import:
+            return True
+    return False
+
+
+def _find_evidenced_ordered(
+    root: Path,
+    source_path: str,
+    candidates: list[str],
+) -> list[tuple[str, Optional[str]]]:
+    """Return (class_name, method_or_None) for candidates with direct code evidence,
+    ordered by their first appearance position in the source file."""
+    content = _read_safe(root, source_path)
+    if not content:
+        return []
+    lang = _detect_lang(source_path)
+    clean = _strip_comments(content, lang)
+    fmap = _build_field_map(clean)
+
+    positioned: list[tuple[int, str, Optional[str]]] = []
+    for cand_path in candidates:
+        class_name = Path(cand_path).stem
+        if not _has_code_evidence(clean, class_name):
+            continue
+        method = _find_called_method(clean, class_name, fmap)
+        m = re.search(rf"\b{re.escape(class_name)}\b", clean, re.IGNORECASE)
+        pos = m.start() if m else len(clean)
+        positioned.append((pos, class_name, method))
+
+    positioned.sort(key=lambda x: x[0])
+    return [(cls, meth) for _, cls, meth in positioned]
+
+
+def _detect_end_state(path: list[str]) -> str:
+    for step in path:
+        s = step.lower()
+        if any(kw in s for kw in _DB_KEYWORDS):
+            return "DB write"
+        if any(kw in s for kw in _EVENT_KEYWORDS):
+            return "event emitted"
+    return "HTTP response"
+
+
+def _step_label(class_name: str, method: Optional[str]) -> str:
+    return f"{class_name}.{method}" if method else class_name
+
+
+def _path_name(entry_class: str) -> str:
+    domain = re.sub(
+        r"(?:RestController|Controller|Resource|Handler|Api|Endpoint|Router|Servlet)$",
+        "", entry_class, flags=re.IGNORECASE,
+    )
+    return re.sub(r"(?<=[a-z])(?=[A-Z])", " ", domain).strip()
+
+
+def analyze_execution_paths(
+    changed_files: list[str],
+    all_paths: list[str],
+    root: Path,
+    classify_fn: Callable[[str], dict],
+    max_paths: int = 3,
+) -> list[dict]:
+    """Build ordered execution paths with runtime behavior signals.
+
+    Each path:
+    - One service per entry point (most evident, earliest-referenced)
+    - Each step requires direct code evidence
+    - runtime_notes populated from explicit code signals only (never inferred)
+    - Forward-only: Controller → Service → Repository
+
+    Returns list of: {name, entry_point, path, runtime_notes, end_state}
+    Returns [] when no verifiable path exists.
+    """
+    entry_files = [
+        f for f in changed_files
+        if classify_fn(f)["artifact_type"] in _ENTRY_ARTIFACT_TYPES
+    ]
+    if not entry_files:
+        return []
+
+    all_services = [p for p in all_paths if classify_fn(p)["artifact_type"] in _SERVICE_ARTIFACT_TYPES]
+    all_repos = [p for p in all_paths if classify_fn(p)["artifact_type"] in _REPO_ARTIFACT_TYPES]
+
+    result: list[dict] = []
+
+    for entry_path in entry_files[:max_paths]:
+        entry_class = Path(entry_path).stem
+        lang = _detect_lang(entry_path)
+
+        entry_content = _read_safe(root, entry_path)
+        entry_clean = _strip_comments(entry_content, lang) if entry_content else ""
+        entry_method = _find_entry_method(entry_clean) if entry_clean else None
+        entry_point_str = _step_label(entry_class, entry_method)
+
+        evidenced_svcs = _find_evidenced_ordered(root, entry_path, all_services)
+        if not evidenced_svcs:
+            continue
+
+        svc_class, svc_method = evidenced_svcs[0]
+        svc_label = _step_label(svc_class, svc_method)
+
+        svc_path = next((p for p in all_services if Path(p).stem == svc_class), None)
+        svc_content = _read_safe(root, svc_path) if svc_path else ""
+        svc_lang = _detect_lang(svc_path) if svc_path else "unknown"
+
+        # Service step — notes scoped to service file only
+        path_items: list[dict] = [
+            {"step": svc_label,
+             "notes": _collect_runtime_notes(svc_content, svc_lang) if svc_content else []},
+        ]
+
+        # Repository step — notes scoped to repo file only
+        if svc_path:
+            evidenced_repos = _find_evidenced_ordered(root, svc_path, all_repos)
+            if evidenced_repos:
+                repo_class, repo_method = evidenced_repos[0]
+                repo_label = _step_label(repo_class, repo_method)
+                repo_path = next((p for p in all_repos if Path(p).stem == repo_class), None)
+                repo_content = _read_safe(root, repo_path) if repo_path else ""
+                repo_lang = _detect_lang(repo_path) if repo_path else "unknown"
+                path_items.append(
+                    {"step": repo_label,
+                     "notes": _collect_runtime_notes(repo_content, repo_lang) if repo_content else []},
+                )
+
+        # Entry-point notes scoped to controller file
+        entry_notes = _collect_runtime_notes(entry_content, lang) if entry_content else []
+
+        result.append({
+            "name": _path_name(entry_class),
+            "entry_point": {"step": entry_point_str, "notes": entry_notes},
+            "path": path_items,
+            "end_state": _detect_end_state([item["step"] for item in path_items]),
+        })
+
+    return result

{sourcecode-1.30.1 → sourcecode-1.30.3}/src/sourcecode/prepare_context.py

@@ -351,6 +351,7 @@ class TaskOutput:
     test_coverage_risk: dict = field(default_factory=dict)
     review_hotspots: list[str] = field(default_factory=list)
     suggested_review_order: list[str] = field(default_factory=list)
+    execution_paths: list[dict] = field(default_factory=list)
 
 
 # ─────────────────────────────────────────────────────────────────────────────
@@ -874,6 +875,17 @@ class TaskContextBuilder:
                     _pr_suggested_review_order.append(_f)
                     _seen_order.add(_f)
 
+        # ── 6d. review-pr: execution paths ──────────────────────────────────
+        _execution_paths: list[dict] = []
+        if task_name == "review-pr" and _delta_files:
+            from sourcecode.flow_analyzer import analyze_execution_paths
+            _execution_paths = analyze_execution_paths(
+                changed_files=sorted(_delta_files),
+                all_paths=all_paths,
+                root=self.root,
+                classify_fn=self._classify_changed_file,
+            )
+
         # ── 6c. Symptom keyword boost + related notes (fix-bug + --symptom) ──
         symptom_keywords: list[str] = []
         related_notes: list[dict] = []
@@ -1104,6 +1116,7 @@ class TaskContextBuilder:
             test_coverage_risk=_pr_test_coverage_risk,
             review_hotspots=_pr_review_hotspots,
             suggested_review_order=_pr_suggested_review_order,
+            execution_paths=_execution_paths,
         )
 
     def render_prompt(self, output: TaskOutput) -> str: