sourcecode 1.31.20__tar.gz → 1.31.22__tar.gz

sourcecode-1.31.22/.continue-here.md

@@ -0,0 +1,88 @@
+# Handoff — sesión 23
+**Date:** 2026-05-25T11:30:00Z  
+**Branch:** master  
+**Last commit:** `de61d65 fix(mcp): isError + changed-only always-include`  
+**Suite:** 59 pass (mcp_tools + mcp_serve + mcp_runner + bug_fixes_v16)
+
+---
+
+## What was done this session
+
+Two critical blocking bugs fixed, tested, committed.
+
+### Bug 1 — MCP `isError` always false [FIXED]
+
+**Root cause:** FastMCP serializes any plain `dict` return with `isError=false` regardless of content. `_err()` returned a dict → MCP spec §tool-result violated.
+
+**Fix:**
+- `_err()` now returns `CallToolResult(isError=True, content=[TextContent(json_payload)])` — passes through FastMCP unmodified
+- `_execute()` also catches `success:false` in CLI JSON output → same `CallToolResult(isError=True)`
+- All validation errors (`INVALID_ARGUMENT`) also get `isError=True`
+
+**Files changed:**
+| File | What |
+|------|------|
+| `src/sourcecode/mcp/server.py` | `_err()` returns `CallToolResult`; `_execute()` checks `success:false`; added `json`, `CallToolResult`, `TextContent` imports |
+| `tests/test_mcp_tools.py` | `_assert_failure()` rewritten for `CallToolResult`; envelope tests updated; new test `test_get_impact_context_nonexistent_class_returns_is_error` |
+
+### Bug 2 — `--changed-only` drops security const files [FIXED]
+
+**Root cause:** `_resolve_java_constant()` needs const class files in `file_paths` to resolve `ClassName.FIELD_NAME` references in `@M3FiltroSeguridad` annotations. `--changed-only` filtered `sm.file_paths` to only git-changed files → const files absent → `resource_names_unresolved` 2→73.
+
+**Fix:** "always-include" function `_is_always_include_ref(p)` added in two places:
+- Criteria: name ends with `Const.java` / `Constants.java` OR path segment in `{security, seguridad, constantes}`
+- Always-include files have `is_changed=False` (read-only anchors, not diff output)
+
+**Files changed:**
+| File | What |
+|------|------|
+| `src/sourcecode/contract_pipeline.py` | `changed_only` filter uses `_is_always_include_ref()` |
+| `src/sourcecode/cli.py` | `sm.file_paths` filter in compact mode uses `_is_always_include_ref()` |
+| `tests/test_bug_fixes_v16.py` | New: `test_contract_pipeline_changed_only_always_includes_const_files` + `test_changed_only_resource_names_unresolved_le5` |
+
+---
+
+## Current state
+
+Working tree **clean** — 2 untracked files pending decision:
+- `AUDIT_REAL_REPOS.md` — full adversarial audit findings (Keycloak + Broadleaf)
+- `docs/PRODUCT_TIERS.md` — product tiers doc
+
+GSD state: milestone v1.0, 13 phases all complete (100%).
+
+---
+
+## P1 bugs remaining (from AUDIT_REAL_REPOS.md)
+
+- **BUG-P1-01** Risk score inconsistency: same 0-callers → different risk_level depending on heuristic
+- **BUG-P1-02** `project_summary` copies README blurb instead of generating from code structure
+- **BUG-P1-03** `fix-bug` returns 426 files for generic NPE — no score field, no cap
+- **BUG-P1-04** `indirect_callers: 0` for KeycloakSession (1992 direct callers) — BFS exhausts at depth 1
+
+## P2 bugs remaining
+
+- BUG-P2-01 `bounded_contexts` uses utility packages, not Maven modules
+- BUG-P2-02 `role: unknown` for all modernize `high_coupling_nodes`
+- BUG-P2-03 `no_security_signal` always 100% for filter-based security (JAX-RS/XML)
+- BUG-P2-04 JAX-RS sub-resource paths not composed with parent `@Path`
+- BUG-P2-05 Broadleaf admin paths mixed into REST endpoints
+- BUG-P2-06 Architecture confidence inconsistent `--compact` vs `--agent`
+- BUG-P2-07 `entry_points.controllers.methods: 21` vs endpoints 130
+- BUG-P2-08 `--format`/`--no-cache` inconsistently available across subcommands
+
+---
+
+## Next session: where to start
+
+**Recommended: BUG-P1-01** — risk score consistency (0 callers → uniform risk_level). Short fix, visible correctness.
+
+Then: BUG-P1-04 (BFS depth cap for large fan-in) or BUG-P1-02 (project_summary from code).
+
+---
+
+## Resume
+
+```
+cat .continue-here.md
+python3 -m pytest tests/ -q --tb=short 2>&1 | tail -5
+```

{sourcecode-1.31.20 → sourcecode-1.31.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.31.20
+Version: 1.31.22
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -225,7 +225,7 @@ Description-Content-Type: text/markdown
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.20-blue)
+![Version](https://img.shields.io/badge/version-1.31.22-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -263,7 +263,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.20
+# sourcecode 1.31.22
 ```
 
 ---

{sourcecode-1.31.20 → sourcecode-1.31.22}/README.md

@@ -2,7 +2,7 @@
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.20-blue)
+![Version](https://img.shields.io/badge/version-1.31.22-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -40,7 +40,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.20
+# sourcecode 1.31.22
 ```
 
 ---

{sourcecode-1.31.20 → sourcecode-1.31.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.31.20"
+version = "1.31.22"
 description = "Deterministic codebase context for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.31.20 → sourcecode-1.31.22}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.31.20"
+__version__ = "1.31.22"

{sourcecode-1.31.20 → sourcecode-1.31.22}/src/sourcecode/ast_extractor.py

@@ -1131,6 +1131,23 @@ def _detect_role(path: str, contract: FileContract) -> str:
     if any(n.startswith("use") and len(n) > 3 and n[3:4].isupper() for n in export_names):
         return "hook"
 
+    # Angular-specific roles (.ts files): detect by stem suffix before generic checks.
+    # Must run before the "service" path-keyword check to prevent misclassification.
+    if ext == ".ts":
+        _ts_last = Path(path).stem.lower().rsplit(".", 1)[-1]
+        _NG_ROLE_MAP = {
+            "component":   "component",
+            "pipe":        "pipe",
+            "directive":   "directive",
+            "guard":       "guard",
+            "interceptor": "interceptor",
+            "resolver":    "resolver",
+            "module":      "module",
+            "service":     "service",
+        }
+        if _ts_last in _NG_ROLE_MAP:
+            return _NG_ROLE_MAP[_ts_last]
+
     # Route / page
     if any(x in path_lower for x in ["/routes/", "/route.", "/pages/", "/api/", "/handlers/"]):
         return "route"

{sourcecode-1.31.20 → sourcecode-1.31.22}/src/sourcecode/cli.py

@@ -238,6 +238,21 @@ def _preprocess_argv() -> None:
     _sys.argv = _sys.argv[:1] + modified
 
 
+def _emit_error_json(error: str, message: str, **context: object) -> None:
+    """Write a structured JSON error envelope to stderr.
+
+    Format: {"error": "<code>", "message": "<human text>", ...<context>}
+    All CLI validation and runtime errors must go through this helper so that
+    agents and tools can parse stderr reliably regardless of error type.
+    """
+    import json as _json
+    import sys as _sys
+    payload: dict[str, object] = {"error": error, "message": message}
+    payload.update(context)
+    _sys.stderr.write(_json.dumps(payload, ensure_ascii=False) + "\n")
+    _sys.stderr.flush()
+
+
 def _copy_to_clipboard(content: str) -> bool:
     """Copy text to system clipboard. Returns True on success, False otherwise (never raises)."""
     import subprocess
@@ -751,21 +766,30 @@ def main(
 
     # Validate format choices
     if format not in FORMAT_CHOICES:
-        typer.echo(
-            f"Error: invalid value '{format}' for --format. Valid options: {', '.join(FORMAT_CHOICES)}",
-            err=True,
+        _emit_error_json(
+            "invalid_flag_value",
+            f"Invalid value '{format}' for --format. Valid values: {', '.join(FORMAT_CHOICES)}.",
+            flag="--format",
+            value=format,
+            valid_values=list(FORMAT_CHOICES),
         )
         raise typer.Exit(code=2)  # FIX-P2-7: arg validation → exit 2
     if graph_detail not in GRAPH_DETAIL_CHOICES:
-        typer.echo(
-            f"Error: invalid value '{graph_detail}' for --graph-detail. Valid options: {', '.join(GRAPH_DETAIL_CHOICES)}",
-            err=True,
+        _emit_error_json(
+            "invalid_flag_value",
+            f"Invalid value '{graph_detail}' for --graph-detail. Valid values: {', '.join(GRAPH_DETAIL_CHOICES)}.",
+            flag="--graph-detail",
+            value=graph_detail,
+            valid_values=list(GRAPH_DETAIL_CHOICES),
         )
         raise typer.Exit(code=2)  # FIX-P2-7: arg validation → exit 2
     if docs_depth not in DOCS_DEPTH_CHOICES:
-        typer.echo(
-            f"Error: invalid value '{docs_depth}' for --docs-depth. Valid options: {', '.join(DOCS_DEPTH_CHOICES)}",
-            err=True,
+        _emit_error_json(
+            "invalid_flag_value",
+            f"Invalid value '{docs_depth}' for --docs-depth. Valid values: {', '.join(DOCS_DEPTH_CHOICES)}.",
+            flag="--docs-depth",
+            value=docs_depth,
+            valid_values=list(DOCS_DEPTH_CHOICES),
         )
         raise typer.Exit(code=2)  # FIX-P2-7: arg validation → exit 2
 
@@ -775,10 +799,18 @@ def main(
     _raw_path_input = _detected_path[0]
     target = Path(_raw_path_input).resolve()
     if not target.exists():
-        typer.echo(f"Error: directory '{_raw_path_input}' does not exist.", err=True)
+        _emit_error_json(
+            "directory_not_found",
+            f"Directory '{_raw_path_input}' does not exist.",
+            path=_raw_path_input,
+        )
         raise typer.Exit(code=1)
     if not target.is_dir():
-        typer.echo(f"Error: '{_raw_path_input}' is not a directory.", err=True)
+        _emit_error_json(
+            "not_a_directory",
+            f"Path '{_raw_path_input}' is not a directory.",
+            path=_raw_path_input,
+        )
         raise typer.Exit(code=1)
 
     # Normalize mode aliases
@@ -1201,6 +1233,15 @@ def main(
         workspace_root = target / workspace.path
         if not workspace_root.exists() or not workspace_root.is_dir():
             continue
+        # BUG-2: skip workspaces explicitly excluded via --exclude.
+        # Without this guard, excluded frontend/backend modules still contribute
+        # their stacks and entry_points, causing architecture_summary to describe
+        # stacks that were intentionally filtered out.
+        if _extra_excludes:
+            _ws_norm = workspace.path.replace("\\", "/").strip("/")
+            _ws_parts = frozenset(_ws_norm.split("/"))
+            if _ws_parts & _extra_excludes:
+                continue
         _ws_topology = RepoClassifier().classify(workspace_root)
         workspace_scanner = AdaptiveScanner(workspace_root, topology=_ws_topology, base_depth=depth)
         workspace_tree = filter_sensitive_files(workspace_scanner.scan_tree())
@@ -1776,8 +1817,21 @@ def main(
         if changed_only and _allowed_changed_files:
             # GAP-5: preserve full entry_points for architecture context even in
             # --changed-only mode. Only filter file_paths and code_notes.
+            # ALWAYS-INCLUDE: security-const files must stay in file_paths even when
+            # not in the git diff — they resolve Java constant references used in
+            # @M3FiltroSeguridad annotations (read-only anchors, not diff output).
+            def _is_always_include_ref(p: str) -> bool:
+                name = p.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+                if name.endswith("Const.java") or name.endswith("Constants.java"):
+                    return True
+                parts = p.replace("\\", "/").lower().split("/")
+                return any(seg in ("security", "seguridad", "constantes") for seg in parts)
+
             sm = _replace(sm,
-                file_paths=[p for p in sm.file_paths if p in _allowed_changed_files],
+                file_paths=[
+                    p for p in sm.file_paths
+                    if p in _allowed_changed_files or _is_always_include_ref(p)
+                ],
                 code_notes=[n for n in sm.code_notes if n.path in _allowed_changed_files],
             )
         data = compact_view(sm, no_tree=no_tree, full=full)

{sourcecode-1.31.20 → sourcecode-1.31.22}/src/sourcecode/contract_pipeline.py

@@ -242,7 +242,27 @@ class ContractPipeline:
         ]
 
         if changed_only:
-            src_paths = [p for p in src_paths if p in changed_files]
+            def _is_always_include_ref(p: str) -> bool:
+                """Always include security-const files regardless of diff status.
+
+                These are read-only reference anchors: they resolve Java constant
+                references (e.g. SeguridadRecursosConst.REC_X) used in security
+                annotations.  They do NOT appear in diff output because
+                contract.is_changed is set from ``changed_files`` only (line below).
+                Criteria per bug-spec:
+                  - name ends with Const.java or Constants.java
+                  - any path segment is: security | seguridad | constantes
+                """
+                name = p.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+                if name.endswith("Const.java") or name.endswith("Constants.java"):
+                    return True
+                parts = p.replace("\\", "/").lower().split("/")
+                return any(seg in ("security", "seguridad", "constantes") for seg in parts)
+
+            src_paths = [
+                p for p in src_paths
+                if p in changed_files or _is_always_include_ref(p)
+            ]
 
         # Apply max_files cap — bypass when symbol search to ensure defining files are found.
         # A symbol query over a large repo needs all files; result set is small after filtering.

{sourcecode-1.31.20 → sourcecode-1.31.22}/src/sourcecode/mcp/server.py

@@ -10,10 +10,12 @@ data is the parsed JSON object from the CLI output, not a shell string.
 """
 from __future__ import annotations
 
+import json
 import os
 from typing import Any
 
 from mcp.server.fastmcp import FastMCP
+from mcp.types import CallToolResult, TextContent
 
 from sourcecode import __version__ as _sourcecode_version
 from sourcecode.mcp.runner import run_command
@@ -30,15 +32,35 @@ def _ok(data: Any) -> dict:
     return {"success": True, "data": data, "error": None}
 
 
-def _err(message: str, code: str = "EXECUTION_FAILED") -> dict:
-    return {"success": False, "data": None, "error": {"code": code, "message": message}}
+def _err(message: str, code: str = "EXECUTION_FAILED") -> CallToolResult:
+    """Return an MCP tool-error result with isError=True per MCP spec §tool-result."""
+    payload = {"success": False, "data": None, "error": {"code": code, "message": message}}
+    return CallToolResult(
+        content=[TextContent(type="text", text=json.dumps(payload))],
+        isError=True,
+    )
 
 
-def _execute(args: list[str]) -> dict:
+def _execute(args: list[str]) -> dict | CallToolResult:
     try:
-        return _ok(run_command(args))
+        result = run_command(args)
     except RuntimeError as exc:
         return _err(str(exc))
+    # If CLI output itself signals failure via success:false, propagate as isError=True
+    if isinstance(result, dict) and result.get("success") is False:
+        payload = {
+            "success": False,
+            "data": None,
+            "error": result.get("error") or {
+                "code": "EXECUTION_FAILED",
+                "message": "Command returned success=false",
+            },
+        }
+        return CallToolResult(
+            content=[TextContent(type="text", text=json.dumps(payload))],
+            isError=True,
+        )
+    return _ok(result)
 
 
 @mcp.tool()

{sourcecode-1.31.20 → sourcecode-1.31.22}/src/sourcecode/prepare_context.py

@@ -589,6 +589,15 @@ _ARTIFACT_CHANGE_EFFECT: dict[str, str] = {
     "documentation":  "documentation file (no runtime impact)",
     "ide_noise":      "IDE/tooling artifact (no application impact)",
     "source":         "application source file (role could not be confirmed from code signals)",
+    # Angular-specific artifact types (detected before Java/Spring heuristics)
+    "ng_component":   "UI presentation layer (Angular @Component)",
+    "ng_pipe":        "data transformation layer (Angular @Pipe)",
+    "ng_directive":   "DOM behavior layer (Angular @Directive)",
+    "ng_guard":       "navigation guard (Angular CanActivate / CanActivateFn)",
+    "ng_interceptor": "HTTP middleware layer (Angular HttpInterceptor)",
+    "ng_resolver":    "data pre-fetch layer (Angular Resolve)",
+    "ng_service":     "Angular injectable service (@Injectable)",
+    "ng_module":      "Angular feature module (@NgModule)",
 }
 
 # Maps frontend symptom keywords → backend terms likely to contain the root cause.
@@ -2710,6 +2719,29 @@ class TaskContextBuilder:
         ):
             return {"artifact_type": "entrypoint", "risk_areas": ["api", "config"], "impact_level": "critical", "is_noise": False, "module": module, "confidence": "high"}
 
+        # Angular-specific artifact detection (.ts files only).
+        # Must run BEFORE the Java/Spring heuristics so that *.component.ts,
+        # *.pipe.ts, etc. are never misclassified as "service" or "security".
+        # Detection is pure-path/stem — no file reads, fully deterministic.
+        if suffix == ".ts":
+            # Stem may be multi-part: "causa-denegacion-form.component" → last part is the Angular type
+            _ts_last = stem_lower.rsplit(".", 1)[-1]  # "component", "pipe", etc.
+            _NG_SUFFIX_MAP = {
+                "component":   ("ng_component",   ["ui"],               "medium"),
+                "pipe":        ("ng_pipe",         ["ui"],               "low"),
+                "directive":   ("ng_directive",    ["ui"],               "medium"),
+                "guard":       ("ng_guard",        ["security", "auth"], "high"),
+                "interceptor": ("ng_interceptor",  ["api"],              "medium"),
+                "resolver":    ("ng_resolver",     ["api"],              "low"),
+                "module":      ("ng_module",       ["config"],           "medium"),
+            }
+            if _ts_last in _NG_SUFFIX_MAP:
+                _ng_atype, _ng_risks, _ng_impact = _NG_SUFFIX_MAP[_ts_last]
+                return {"artifact_type": _ng_atype, "risk_areas": _ng_risks, "impact_level": _ng_impact, "is_noise": False, "module": module, "confidence": "high"}
+            # Angular service: stem ends with ".service" or equals "service"
+            if _ts_last == "service":
+                return {"artifact_type": "ng_service", "risk_areas": ["business_logic"], "impact_level": "medium", "is_noise": False, "module": module, "confidence": "high"}
+
         # Security surface (extended: interceptor, filter, cors, acl)
         _SECURITY_KW = ("security", "auth", "jwt", "token", "permission", "role",
                          "credential", "encrypt", "decrypt", "oauth", "saml", "ldap",
@@ -2724,9 +2756,11 @@ class TaskContextBuilder:
         if suffix in _CODE_EXTS and any(kw in stem_lower for kw in _API_KW):
             return {"artifact_type": "controller", "risk_areas": ["api"], "impact_level": "high", "is_noise": False, "module": module, "confidence": "high"}
 
-        # Business logic / services (extended: facade, usecase, aspect, listener, component)
+        # Business logic / services (extended: facade, usecase, aspect, listener)
+        # NOTE: "component" intentionally removed — Angular *.component.ts files
+        # are caught above by the Angular-specific block before reaching here.
         _SERVICE_KW = ("service", "serviceimpl", "servicefacade", "facade", "usecase",
-                       "interactor", "aspect", "listener", "subscriber", "eventhandler", "component")
+                       "interactor", "aspect", "listener", "subscriber", "eventhandler")
         if suffix in _CODE_EXTS and any(kw in stem_lower for kw in _SERVICE_KW):
             return {"artifact_type": "service", "risk_areas": ["transactions", "business_logic"], "impact_level": "high", "is_noise": False, "module": module, "confidence": "high"}
 

{sourcecode-1.31.20 → sourcecode-1.31.22}/tests/test_audit_fixes.py

@@ -814,12 +814,19 @@ class TestTelemetrySchema:
             )
 
     def test_telemetry_invalid_action_returns_error_with_valid_list(self):
+        import json
+        from mcp.types import CallToolResult
         from sourcecode.mcp.server import telemetry
         result = telemetry("unknown_action")
-        assert result["success"] is False
-        assert result["error"] is not None
+        assert isinstance(result, CallToolResult), (
+            f"expected CallToolResult, got {type(result).__name__}"
+        )
+        assert result.isError is True, "isError must be True for tool failures"
+        payload = json.loads(result.content[0].text)
+        assert payload["success"] is False
+        assert payload["error"] is not None
         # Error message must enumerate valid actions
-        msg = result["error"]["message"]
+        msg = payload["error"]["message"]
         for action in ("status", "enable", "disable"):
             assert action in msg, (
                 f"telemetry error message must list valid action '{action}': {msg!r}"