sourcecode 1.31.16__tar.gz → 1.31.17__tar.gz

sourcecode-1.31.17/.continue-here.md

@@ -0,0 +1,145 @@
+# Continue Here — atlas-cli sesión 20
+
+**Paused:** 2026-05-24
+**Repo:** `/Users/user/Documents/workspace/atlas-cli`
+**Branch:** master
+**Version audited:** sourcecode 1.31.16
+
+---
+
+## Objetivo de esta sesión
+
+Auditoría adversarial REAL y profunda de `sourcecode` v1.31.16 contra repos enterprise Java reales.
+Validar credibilidad post-fixes de sesiones anteriores. Encontrar nuevos bugs. Actualizar docs.
+
+---
+
+## Trabajo completado esta sesión (sin commitear)
+
+### `AUDIT_REAL_REPOS.md` — reescrito (22 secciones, auditoría completa)
+
+Repos auditados:
+- `~/Documents/workspace/keycloak` — 7,885 Java files, 18K+ commits, Quarkus/Jakarta EE
+- `~/Documents/workspace/BroadleafCommerce` — 2,985 Java files, 18K+ commits, Spring Boot
+
+Comandos probados: `--compact`, `--agent`, `--format yaml`, `endpoints`, `impact` (múltiples targets),
+`onboard`, `fix-bug`, `modernize`, `review-pr`, `repo-ir --summary-only`, `repo-ir --max-nodes/edges`,
+`prepare-context` vs aliases, cache cold/warm, error handling, flag consistency.
+
+### `README.md` — actualizado basado en evidencia real
+
+- Benchmarks reales (no inventados): cold/cached times, token sizes medidos
+- `repo-ir` size warning (nueva sección)
+- `impact` best practices expandidas (interface vs impl explicit)
+- `What sourcecode does NOT do` — honesto sobre filter security + impl classes + project_summary
+- `How to use` sección completamente reescrita con patrones correctos
+
+---
+
+## Bugs encontrados esta sesión (v1.31.16)
+
+### P0 — Críticos
+
+| # | Bug | Evidencia |
+|---|-----|-----------|
+| **P0-01** | `impact OrderServiceImpl` → `direct_callers:[], risk:low, confidence:HIGH` — WRONG | `OrderService` interface → 30 callers. Spring DI injects interface, not impl. Tool reports high-confidence garbage. |
+| **P0-02** | `repo-ir --max-nodes 200 --max-edges 500` → 3.85MB / 987K tokens | `reverse_graph` (3MB) not bounded by flags. Only `graph.nodes/edges` bounded. |
+
+### P1 — Altos
+
+| # | Bug | Fix direction |
+|---|-----|---------------|
+| P1-01 | Risk score inconsistente: `OrderServiceImpl`→low vs `OrderDaoImpl`→high (mismo 0 callers, distinta heurística) | Cuando `direct_callers=0` y clase es `@Service`/`@Repository` impl: bajar confidence, añadir gap |
+| P1-02 | `project_summary` = primera línea del README (license/marketing, no arquitectura) | Generar de código: "N-module Spring Boot — M classes, K endpoints, J txn boundaries" |
+| P1-03 | `fix-bug` devuelve 426 archivos para NPE genérico (14% de todo el repo, sin score field) | Cap en 20 archivos cuando symptom tiene baja especificidad. Añadir `score` field. |
+| P1-04 | `indirect_callers:0` para KeycloakSession con 1992 direct callers — BFS para en nivel 1 | BFS muestreado para targets muy grandes, o documentar el comportamiento |
+| P1-05 | fix-bug 23s cold en Keycloak — demasiado lento para CI | Profiling needed |
+
+### P2 — Medios
+
+- `bounded_contexts: ["dto","file"]` Broadleaf, `["keycloak"]` Keycloak — ambos WRONG. Fix: usar Maven module names.
+- `role: unknown` para todos los `high_coupling_nodes` en modernize — nunca clasifica annotation/interface/entity
+- `no_security_signal: 100%` en ambos repos — ambos usan filter-based security; métrica siempre vacía para el patrón enterprise más común
+- JAX-RS sub-resource paths no compuestos con parent `@Path` → paths incompletos
+- `hotspot_candidates: []` siempre — 18K commits ignorados; git churn no usado
+- `--format`/`--no-cache` ausentes en `impact`, `endpoints`, `fix-bug`, `onboard`, `modernize`, `review-pr`
+- Architecture confidence diferente entre `--compact` y `--agent` mismo repo
+- `entry_points.controllers.methods: 21` vs `endpoints` finding 130 — discrepancia inexplicada
+
+---
+
+## Estado actual archivos
+
+```
+M  README.md                    — benchmarks reales, limitaciones honestas
+?? AUDIT_REAL_REPOS.md          — auditoría 22 secciones (NUEVA, reemplaza anterior)
+?? docs/PRODUCT_TIERS.md        — de sesión anterior (sin tocar esta sesión)
+?? .sourcecode-cache/           — cache artifacts (ignorar)
+```
+
+**No hay cambios en código fuente esta sesión** — auditoría pura.
+
+---
+
+## Contexto de versión: qué estaba ya fixeado
+
+Los bugs de sesiones 18-19 (BUG-01 a BUG-07 del `.continue-here.md` anterior)
+fueron fixeados en commit `308f2f0` ("fix(impact,serializer,prepare_context): fix all 7 audit bugs").
+
+Los P0/P1/P2 listados arriba son **nuevos**, encontrados en v1.31.16 post-fix.
+
+---
+
+## Primera acción al retomar
+
+```bash
+cd /Users/user/Documents/workspace/atlas-cli
+
+# 1. Commitear docs de esta sesión
+git add README.md AUDIT_REAL_REPOS.md
+git commit -m "docs(audit,readme): P1.5 adversarial audit v1.31.16 — real benchmarks, P0/P1 bugs, honest limitations"
+
+# 2. Fix P0-01 — mayor ROI de credibilidad
+# En repository_ir.py → compute_blast_radius (o equivalente):
+# Cuando target es @Service/@Repository impl con 0 direct_callers:
+#   a) Detectar interfaces que implementa
+#   b) Run impact en las interfaces, merge resultados
+#   c) O mínimo: emitir warning en 'explanation' con nombre de interface y su caller count
+# Verificar con:
+sourcecode impact OrderServiceImpl ~/Documents/workspace/BroadleafCommerce
+# Esperado: warning o callers via OrderService interface
+
+# 3. Fix P0-02 — reverse_graph unbounded
+# repo-ir: cuando --max-nodes N dado, limitar reverse_graph a N hubs también
+# O añadir flag --max-reverse-hubs N
+# Verificar con:
+sourcecode repo-ir ~/Documents/workspace/BroadleafCommerce --max-nodes 200 --max-edges 500 | wc -c
+# Esperado: <500KB (no 4MB)
+```
+
+## Próximas acciones por ROI
+
+1. **P0-01** — impl → interface caller resolution (1-2h) → core claim becomes defensible
+2. **P0-02** — reverse_graph size control (30min) → LLM safety
+3. **P1-01** — risk score consistency for 0-caller impls (30min) → credibility
+4. **P1-02** — project_summary generation from code (1h) → first impression
+5. **P1-03** — fix-bug file cap + score field (30min) → LLM readiness
+6. **P2 batch** — bounded_contexts, security_model, role detection (2h)
+
+---
+
+## Archivos clave del codebase
+
+```
+src/sourcecode/
+  cli.py              — top-level commands + subcommands
+  repository_ir.py    — impact analysis + graph traversal (fix P0-01 aquí)
+  prepare_context.py  — fix-bug, onboard, review-pr output generation
+  serializer.py       — compact/agent output serialization
+tests/
+  test_enterprise_benchmarks.py
+```
+
+---
+
+*Pausado 2026-05-24 — gsd:pause-work (sesión 20)*

sourcecode-1.31.17/.sourcecode-cache/snapshot-bc358fa-06d2f793.json

@@ -0,0 +1,129 @@
+{
+  "schema_version": "1.0",
+  "mode": "contract",
+  "project": {
+    "type": "cli",
+    "stack": "python",
+    "frameworks": [
+      "Typer"
+    ],
+    "entry_points": [
+      "src/sourcecode/cli.py"
+    ],
+    "summary": "CLI: Deterministic codebase context for AI coding agents. Stack: Python (Typer)."
+  },
+  "stacks": [
+    {
+      "stack": "python",
+      "detection_method": "manifest",
+      "confidence": "high",
+      "frameworks": [
+        {
+          "name": "Typer",
+          "source": "manifest",
+          "confidence": "high",
+          "detected_via": [
+            "manifest:manifest",
+            "import typer (src/sourcecode/cli.py)"
+          ],
+          "version": null
+        }
+      ],
+      "package_manager": "pip",
+      "manifests": [
+        "pyproject.toml"
+      ],
+      "primary": true,
+      "root": ".",
+      "workspace": null,
+      "signals": [
+        "manifest:pyproject.toml",
+        "framework:Typer",
+        "package_manager:pip",
+        "entry:src/sourcecode/cli.py",
+        "entry:run_cli.py",
+        "extensions:160"
+      ],
+      "produced_by": "python",
+      "language_version": null,
+      "packaging": null,
+      "app_server_hint": null,
+      "spring_profiles": [],
+      "transactional_classes": []
+    }
+  ],
+  "contracts": [
+    {
+      "path": "tests/fixtures/spring_boot_minimal/src/main/java/com/example/demo/service/HealthService.java",
+      "language": "java",
+      "exports": [
+        {
+          "kind": "class",
+          "name": "HealthService",
+          "annotations": [
+            "@Service",
+            "@Transactional"
+          ]
+        },
+        {
+          "kind": "method",
+          "name": "check",
+          "signature": "public String check("
+        }
+      ],
+      "imports": [
+        "org.springframework.stereotype.Service",
+        "org.springframework.transaction.annotation.Transactional"
+      ]
+    }
+  ],
+  "contracts_meta": {
+    "total": 1,
+    "shown": 1,
+    "truncated": false
+  },
+  "summary": {
+    "files": 1,
+    "total": 162,
+    "methods": {
+      "ast": 160,
+      "heuristic": 2
+    }
+  },
+  "symbol_query": {
+    "symbol": "HealthService",
+    "definers_found": 1,
+    "importers_found": 0,
+    "importers_returned": 0,
+    "references_found": 0,
+    "total_returned": 1,
+    "truncated": false
+  },
+  "confidence": {
+    "overall": "high",
+    "stack": "high",
+    "entry_points": "high"
+  },
+  "analysis_gaps": [
+    {
+      "area": "dependencies",
+      "reason": "Dependencies not analyzed — use the full analyze command with dependency flags for complete context",
+      "impact": "medium"
+    },
+    {
+      "area": "env",
+      "reason": "Environment variables not analyzed — run with --env-map for operational context",
+      "impact": "low"
+    },
+    {
+      "area": "documentation",
+      "reason": "No Architecture Decision Records (ADRs) detected — missing docs/ or adr/ directory",
+      "impact": "low"
+    },
+    {
+      "area": "api_contract",
+      "reason": "No OpenAPI/Swagger contract detected — agents cannot auto-discover API surface without it",
+      "impact": "medium"
+    }
+  ]
+}

sourcecode-1.31.17/.sourcecode-cache/snapshot-bc358fa-0bed428d.json

@@ -0,0 +1,406 @@
+{
+  "schema_version": "1.0",
+  "mode": "contract",
+  "project": {
+    "type": "cli",
+    "stack": "python",
+    "frameworks": [
+      "Typer"
+    ],
+    "entry_points": [
+      "src/sourcecode/cli.py"
+    ],
+    "summary": "CLI: Deterministic codebase context for AI coding agents. Stack: Python (Typer)."
+  },
+  "stacks": [
+    {
+      "stack": "python",
+      "detection_method": "manifest",
+      "confidence": "high",
+      "frameworks": [
+        {
+          "name": "Typer",
+          "source": "manifest",
+          "confidence": "high",
+          "detected_via": [
+            "manifest:manifest",
+            "import typer (src/sourcecode/cli.py)"
+          ],
+          "version": null
+        }
+      ],
+      "package_manager": "pip",
+      "manifests": [
+        "pyproject.toml"
+      ],
+      "primary": true,
+      "root": ".",
+      "workspace": null,
+      "signals": [
+        "manifest:pyproject.toml",
+        "framework:Typer",
+        "package_manager:pip",
+        "entry:src/sourcecode/cli.py",
+        "entry:run_cli.py",
+        "extensions:160"
+      ],
+      "produced_by": "python",
+      "language_version": null,
+      "packaging": null,
+      "app_server_hint": null,
+      "spring_profiles": [],
+      "transactional_classes": []
+    }
+  ],
+  "contracts": [
+    {
+      "path": "src/sourcecode/cli.py",
+      "role": "entrypoint",
+      "fn": [
+        "analyze_cmd(path: Path) -> None",
+        "config_cmd() -> None",
+        "endpoints_cmd(path: Path, output_path: Optional[Path], fo...",
+        "fix_bug_cmd(ctx: typer.Context, path: Path, symptom: Opti...",
+        "impact_cmd(target: str, path: Path, depth: int, output_pa..."
+      ],
+      "exports": [
+        "main",
+        "main_entry",
+        "mcp_init",
+        "mcp_remove",
+        "mcp_serve",
+        "mcp_status",
+        "modernize_cmd",
+        "onboard_cmd",
+        "prepare_context_cmd",
+        "repo_ir_cmd",
+        "review_pr_cmd",
+        "telemetry_disable",
+        "telemetry_enable",
+        "telemetry_status",
+        "version_callback",
+        "version_cmd"
+      ],
+      "deps": [
+        "sourcecode",
+        "typer"
+      ]
+    },
+    {
+      "path": "src/sourcecode/mcp/server.py",
+      "role": "entrypoint",
+      "fn": [
+        "config() -> dict",
+        "explain_context(repo_path: str) -> dict",
+        "fix_bug_context(repo_path: str, symptom: str) -> dict",
+        "generate_tests_context(repo_path: str, include_all: bool)...",
+        "get_agent_context(repo_path: str, git_context: bool) -> dict"
+      ],
+      "exports": [
+        "get_compact_context",
+        "get_delta",
+        "get_endpoints",
+        "get_impact_context",
+        "get_ir_summary",
+        "get_module_context",
+        "onboard_context",
+        "refactor_context",
+        "review_pr_context",
+        "telemetry",
+        "version"
+      ],
+      "deps": [
+        "mcp",
+        "sourcecode"
+      ]
+    },
+    {
+      "path": "src/sourcecode/canonical_ir.py",
+      "role": "util",
+      "fn": [
+        "build_canonical_ir(file_paths: list[str], root: Path, sin...",
+        "ir_dict_to_canonical(ir: dict, file_paths: Optional[list[...",
+        "project_blast_radius(cir: CanonicalRepositoryIR, target: ...",
+        "project_endpoint_surface(cir: CanonicalRepositoryIR) -> dict",
+        "project_route_surface(cir: CanonicalRepositoryIR) -> list..."
+      ],
+      "exports": [
+        {
+          "name": "CanonicalEndpoint",
+          "k": "class"
+        },
+        {
+          "name": "CanonicalRepositoryIR",
+          "k": "class"
+        },
+        {
+          "name": "CanonicalSecurity",
+          "k": "class"
+        },
+        "validate_canonical_ir"
+      ],
+      "deps": [
+        "sourcecode"
+      ]
+    },
+    {
+      "path": "src/sourcecode/context_scorer.py",
+      "role": "util",
+      "exports": [
+        {
+          "k": "class",
+          "names": [
+            "ContextScorer",
+            "NodeScore"
+          ]
+        }
+      ]
+    },
+    {
+      "path": "src/sourcecode/contract_model.py",
+      "role": "model",
+      "exports": [
+        {
+          "k": "class",
+          "names": [
+            "ContractSummary",
+            "ExportRecord",
+            "FileContract",
+            "FunctionSignature",
+            "ImportRecord",
+            "TypeDefinition",
+            "TypeField"
+          ]
+        }
+      ]
+    },
+    {
+      "path": "src/sourcecode/contract_pipeline.py",
+      "role": "util",
+      "fn": [
+        "build_dependency_graph(contracts: list[FileContract]) -> ..."
+      ],
+      "exports": [
+        {
+          "k": "class",
+          "names": [
+            "ContractPipeline"
+          ]
+        }
+      ],
+      "deps": [
+        "sourcecode"
+      ]
+    },
+    {
+      "path": "src/sourcecode/detectors/base.py",
+      "role": "util",
+      "exports": [
+        {
+          "k": "class",
+          "names": [
+            "AbstractDetector",
+            "DetectionContext"
+          ]
+        }
+      ],
+      "deps": [
+        "sourcecode"
+      ]
+    },
+    {
+      "path": "src/sourcecode/detectors/csproj_parser.py",
+      "role": "util",
+      "fn": [
+        "infer_architecture_pattern(projects: list[CsprojProject])...",
+        "parse_csproj(absolute_path: Path, relative_path: str) -> ..."
+      ],
+      "exports": [
+        {
+          "k": "class",
+          "names": [
+            "CsprojProject"
+          ]
+        }
+      ]
+    },
+    {
+      "path": "src/sourcecode/detectors/hybrid.py",
+      "role": "util",
+      "fn": [
+        "merge_framework_detections(manifest_detections: list[Fram...",
+        "scan_for_frameworks(root: Path, file_tree: dict[str, Any]..."
+      ],
+      "deps": [
+        "sourcecode"
+      ]
+    },
+    {
+      "path": "src/sourcecode/detectors/parsers.py",
+      "role": "util",
+      "fn": [
+        "find_declared_dependencies(raw: Any) -> list[str]",
+        "load_json_file(path: Path) -> Optional[dict[str, Any]]",
+        "load_toml_file(path: Path) -> Optional[dict[str, Any]]",
+        "read_text_lines(path: Path) -> list[str]",
+        "unique_strings(values: Iterable[str]) -> list[str]"
+      ]
+    },
+    {
+      "path": "src/sourcecode/detectors/tooling.py",
+      "role": "util",
+      "fn": [
+        "collect_tooling_signals(file_tree: dict[str, object]) -> ...",
+        "infer_package_manager(stack: str, file_tree: dict[str, ob..."
+      ],
+      "deps": [
+        "sourcecode"
+      ]
+    },
+    {
+      "path": "src/sourcecode/entrypoint_classifier.py",
+      "role": "util",
+      "fn": [
+        "classify_entry_point(ep: EntryPoint) -> Classification",
+        "is_production_entry_point(ep: EntryPoint) -> bool",
+        "normalize_entry_point(ep: EntryPoint) -> EntryPoint",
+        "runtime_relevance(ep: EntryPoint, classification: Classif..."
+      ],
+      "deps": [
+        "sourcecode"
+      ]
+    },
+    {
+      "path": "src/sourcecode/file_classifier.py",
+      "role": "util",
+      "exports": [
+        {
+          "k": "class",
+          "names": [
+            "FileClassification",
+            "FileClassifier"
+          ]
+        }
+      ],
+      "deps": [
+        "sourcecode"
+      ]
+    },
+    {
+      "path": "src/sourcecode/flow_analyzer.py",
+      "role": "util",
+      "fn": [
+        "analyze_behavioral_impact(changed_files: list[str], all_p...",
+        "analyze_execution_paths(changed_files: list[str], all_pat..."
+      ]
+    },
+    {
+      "path": "src/sourcecode/mcp/onboarding/applier.py",
+      "role": "util",
+      "fn": [
+        "apply_entry(config: dict) -> dict",
+        "is_installed(config: dict) -> bool",
+        "read_config(path: Path) -> dict",
+        "remove_entry(config: dict) -> dict",
+        "validate(path: Path) -> bool"
+      ],
+      "exports": [
+        "write_config"
+      ]
+    }
+  ],
+  "contracts_meta": {
+    "total": 15,
+    "shown": 15,
+    "truncated": false
+  },
+  "dependency_summary": {
+    "requested": true,
+    "total_count": 13,
+    "direct_count": 13,
+    "transitive_count": 0,
+    "ecosystems": [
+      "python"
+    ],
+    "sources": [
+      "manifest"
+    ],
+    "limitations": []
+  },
+  "key_dependencies": [
+    {
+      "name": "mcp",
+      "ecosystem": "python",
+      "scope": "direct",
+      "declared_version": ">=1.0.0",
+      "source": "manifest",
+      "manifest_path": "pyproject.toml",
+      "role": "runtime"
+    },
+    {
+      "name": "typer",
+      "ecosystem": "python",
+      "scope": "direct",
+      "declared_version": ">=0.24",
+      "source": "manifest",
+      "manifest_path": "pyproject.toml",
+      "role": "runtime"
+    },
+    {
+      "name": "pathspec",
+      "ecosystem": "python",
+      "scope": "direct",
+      "declared_version": ">=1.0",
+      "source": "manifest",
+      "manifest_path": "pyproject.toml",
+      "role": "parsing"
+    },
+    {
+      "name": "ruamel.yaml",
+      "ecosystem": "python",
+      "scope": "direct",
+      "declared_version": ">=0.18",
+      "source": "manifest",
+      "manifest_path": "pyproject.toml",
+      "role": "serialization"
+    },
+    {
+      "name": "tomli",
+      "ecosystem": "python",
+      "scope": "direct",
+      "declared_version": ">=2.0",
+      "source": "manifest",
+      "manifest_path": "pyproject.toml",
+      "role": "serialization"
+    }
+  ],
+  "summary": {
+    "files": 15,
+    "total": 78,
+    "methods": {
+      "ast": 78
+    }
+  },
+  "confidence": {
+    "overall": "high",
+    "stack": "high",
+    "entry_points": "high"
+  },
+  "analysis_gaps": [
+    {
+      "area": "env",
+      "reason": "Environment variables not analyzed — run with --env-map for operational context",
+      "impact": "low"
+    },
+    {
+      "area": "documentation",
+      "reason": "No Architecture Decision Records (ADRs) detected — missing docs/ or adr/ directory",
+      "impact": "low"
+    },
+    {
+      "area": "api_contract",
+      "reason": "No OpenAPI/Swagger contract detected — agents cannot auto-discover API surface without it",
+      "impact": "medium"
+    }
+  ]
+}