sourcecode 1.31.26__tar.gz → 1.31.27__tar.gz

sourcecode-1.31.27/.continue-here.md

@@ -0,0 +1,73 @@
+# Handoff — Sesión 31 (2026-05-26)
+
+## Position
+
+**Project:** sourcecode (atlas-cli)  
+**Activity:** Post-audit bug fixing — AUDIT_v1.31.23.md / P0 blockers  
+**Branch:** master  
+**Last commit:** e0fab96 — fix(mcp,cli): three P0 blockers — exit codes, Windows paths, timeout  
+**Tests:** 1590 passed, 3 skipped ✅
+
+---
+
+## Work Done This Session
+
+### Session 31 (this session)
+**Three P0 blockers fixed:**
+
+**P0-1: Exit codes** (`cli.py`)
+- `--compact --full` now exits 1 (was 2); all controlled errors → exit 1
+- Updated `test_enterprise_benchmarks.py::test_compact_full_conflict_is_error` assertion 2→1
+
+**P0-2: MCP Windows paths** (`mcp/server.py`)
+- `_normalize_repo_path()`: MINGW `/c/Users/...` → `C:/Users/...`, backslash → forward slash
+- Applied to all 13 tools that accept `repo_path`
+- Each tool wrapped in `try/except Exception` → never exposes uncaught exception to stdio transport
+- Forward-slash note added to `mcp status` and `mcp init` output
+
+**P0-3: generate_tests_context timeout** (`mcp/server.py`)
+- Bounded by `SOURCECODE_TESTS_TIMEOUT_MS` env var (default: 15 000 ms)
+- Uses `concurrent.futures.wait([future], timeout=timeout_s)` for wall-clock limit
+- Returns `{truncated: true, truncated_reason: "timeout_15s", files_analyzed: 0, results: []}` on timeout
+- Normal repos complete well within limit (0.8s on atlas-cli itself)
+
+---
+
+## Remaining from AUDIT_v1.31.23.md
+
+### P2 unfixed (section 13, items 6–18)
+| # | Issue | File | Effort |
+|---|---|---|---|
+| P2-06 | `subsystem_summary.member_count` always 0 | cli.py modernize_cmd | Medium |
+| P2-07 | `no_security_signal` → detect filter-based security → `security_model: "filter_based"` | repository_ir.py | Medium |
+| P2-10 | `architecture.confidence` inconsistent between `--compact` and `--agent` | serializer.py | Low |
+| P2-13 | `--no-cache` flag inconsistent across subcommands | cli.py | Medium |
+| P2-14 | URLs in code_notes truncated (missing `https://bugs.` prefix) | code_notes_analyzer.py | Low (needs repro) |
+| P2-16 | `entry_points.controllers.methods` mismatches `endpoints` count | cli.py | Medium |
+| P2-17 | `--compact --help` token claim outdated | cli.py | Trivial |
+| P2-18 | `impact` via file path: resolve to FQN before IR lookup | repository_ir.py | Low |
+
+---
+
+## Key Files Modified (this session)
+
+```
+src/sourcecode/cli.py               — exit code 2→1 for --compact --full; forward-slash notes
+src/sourcecode/mcp/server.py        — _normalize_repo_path, try/except all tools, timeout P0-3
+tests/test_enterprise_benchmarks.py — assertion exit_code 2→1
+```
+
+---
+
+## Next Session
+
+**Recommended start:** Fix `subsystem_summary.member_count` (P2-06).
+
+Root cause: `_detect_subsystems()` in `repository_ir.py` builds subsystems without populating
+`members` list. `modernize_cmd` reads `len(s.get("members") or [])` → always 0.
+
+Then: `--no-cache` flag consistency audit (P2-13).
+
+**Resume command:** `/gsd:resume-work`
+
+**Test baseline:** `python3 -m pytest tests/ → 1590 passed, 3 skipped`

{sourcecode-1.31.26 → sourcecode-1.31.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.31.26
+Version: 1.31.27
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -225,7 +225,7 @@ Description-Content-Type: text/markdown
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.26-blue)
+![Version](https://img.shields.io/badge/version-1.31.27-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -263,7 +263,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.26
+# sourcecode 1.31.27
 ```
 
 ---

{sourcecode-1.31.26 → sourcecode-1.31.27}/README.md

@@ -2,7 +2,7 @@
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.26-blue)
+![Version](https://img.shields.io/badge/version-1.31.27-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -40,7 +40,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.26
+# sourcecode 1.31.27
 ```
 
 ---

{sourcecode-1.31.26 → sourcecode-1.31.27}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.31.26"
+version = "1.31.27"
 description = "Deterministic codebase context for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.31.26 → sourcecode-1.31.27}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.31.26"
+__version__ = "1.31.27"

{sourcecode-1.31.26 → sourcecode-1.31.27}/src/sourcecode/canonical_ir.py

@@ -332,6 +332,7 @@ def ir_dict_to_canonical(
         "spring_events": ir.get("spring_events") or {},
         "score_basis": (ir.get("impact") or {}).get("score_basis", "none"),
         "reverse_graph_size": len(ir.get("reverse_graph") or {}),
+        "security_model": ir.get("security_model", "unknown"),
     }
 
     cir_hash = _compute_cir_hash(
@@ -452,6 +453,7 @@ def project_endpoint_surface(cir: CanonicalRepositoryIR) -> dict:
         "endpoints": endpoints,
         "total": len(endpoints),
         "no_security_signal": no_security_signal,
+        "security_model": cir.metadata.get("security_model", "unknown"),
         # Legacy field alias — same count, kept for backward compat
         "undocumented": no_security_signal,
     }

{sourcecode-1.31.26 → sourcecode-1.31.27}/src/sourcecode/cli.py

@@ -1127,10 +1127,14 @@ def main(
 
     # --compact implicitly enables lightweight analysis passes so that
     # dependency_summary, env_summary and code_notes_summary are never null.
+    # architecture=True is also enabled so that architecture.confidence is
+    # consistent with --agent (which auto-enables architecture).  The
+    # ArchitectureAnalyzer is path-based and adds negligible latency.
     if compact:
         dependencies = True
         env_map = True
         code_notes = True
+        architecture = True
 
     dependency_analyzer = DependencyAnalyzer() if dependencies else None
     graph_analyzer = GraphAnalyzer() if graph_modules else None

{sourcecode-1.31.26 → sourcecode-1.31.27}/src/sourcecode/mcp/server.py

@@ -158,9 +158,12 @@ def get_endpoints(repo_path: str = ".") -> dict:
     Returns: endpoints list with method, path, controller, handler fields;
              security dict when authorization annotations are present
              (policy: roles_allowed|permit_all|deny_all|authenticated|...);
-             total (int) and no_security_signal (int) counts.
-             no_security_signal counts endpoints with no recognized auth annotation —
-             repos using framework-level auth (e.g. Keycloak) may show high counts.
+             total (int), no_security_signal (int), and security_model (str) fields.
+             no_security_signal counts endpoints with no recognized auth annotation.
+             security_model values: "filter_based" (centralized Spring Security config —
+             high no_security_signal is expected and does NOT mean endpoints are unprotected),
+             "annotation_based" (per-endpoint annotations only), "mixed" (both),
+             "unknown" (no security signals detected).
     Supports Spring MVC (@GetMapping etc.) and JAX-RS (@GET/@POST etc.).
     Security annotations detected: @RolesAllowed, @PermitAll, @DenyAll,
     @Authenticated, @PreAuthorize, @Secured, @SecurityRequirement, @M3FiltroSeguridad.

{sourcecode-1.31.26 → sourcecode-1.31.27}/src/sourcecode/repository_ir.py

@@ -192,6 +192,15 @@ _SECURITY_MARKER_ANNOTATIONS: frozenset[str] = frozenset({
     "@PermitAll", "@DenyAll", "@Authenticated",
 })
 
+# Annotations on config classes that indicate a centralized security filter chain
+# (Spring Security / Spring Boot).  When present, per-endpoint no_security_signal
+# is expected and does NOT mean endpoints are unprotected.
+_FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
+    "@EnableWebSecurity",
+    "@EnableMethodSecurity",
+    "@EnableGlobalMethodSecurity",
+})
+
 _MODIFIER_WORDS: frozenset[str] = frozenset({
     "public", "private", "protected", "static", "final", "abstract",
     "synchronized", "native", "strictfp", "transient", "volatile", "default",
@@ -1711,6 +1720,7 @@ def _detect_subsystems(all_fqns: list[str], relations: list[RelationEdge]) -> li
             "label": label,
             "package_prefix": pkg_prefix,
             "member_count": len(members),
+            "members": members,
             "summary": summary,
         })
     return result
@@ -2132,17 +2142,47 @@ def _assemble(
         "change_set": change_set_out,
     }
 
-    _route_surface = _build_route_surface(sorted_syms, route_diffs, extends_map={
+    _extends_map = {
         e.from_symbol: e.to_symbol.split(".")[-1]
         for e in sorted_rels if e.type == "extends"
-    })
+    }
+    _route_surface = _build_route_surface(sorted_syms, route_diffs, extends_map=_extends_map)
     _analysis_gaps = _compute_analysis_gaps(sorted_syms, spring_summary, _route_surface, sorted_rels)
 
+    # Detect filter-based security model for the assembled IR.
+    # Stored here so CIR projections (project_endpoint_surface) can read it without
+    # re-parsing symbols.
+    _class_syms_asm = [s for s in sorted_syms if s.type in ("class", "interface")]
+    _filter_based_asm = (
+        any(
+            ann in _FILTER_SECURITY_ANNOTATIONS
+            for sym in _class_syms_asm
+            for ann in sym.annotations
+        )
+        or any(
+            _extends_map.get(sym.symbol, "") == "WebSecurityConfigurerAdapter"
+            for sym in _class_syms_asm
+        )
+    )
+    _has_ann_sec_asm = any(
+        r.get("security_annotations") for r in _route_surface
+        if isinstance(r, dict)
+    )
+    if _filter_based_asm and _has_ann_sec_asm:
+        _security_model_asm = "mixed"
+    elif _filter_based_asm:
+        _security_model_asm = "filter_based"
+    elif _has_ann_sec_asm:
+        _security_model_asm = "annotation_based"
+    else:
+        _security_model_asm = "unknown"
+
     return {
         **_base,
         "route_surface": _route_surface,
         "spring_events": _spring_events,
         "analysis_gaps": _analysis_gaps,
+        "security_model": _security_model_asm,
         "audit": {
             "dropped_fields": dropped_fields,
         },
@@ -2908,10 +2948,39 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
     # per-endpoint annotations — this count reflects annotation-based coverage only.
     no_security_signal = sum(1 for e in endpoints if "security" not in e)
+
+    # Detect filter-based security: centralized Spring Security config class.
+    # When present, high no_security_signal is expected — security is enforced by
+    # the filter chain, not per-endpoint annotations.
+    _class_syms = [s for s in all_symbols if s.type in ("class", "interface")]
+    _filter_based = (
+        # Config class annotated with EnableWebSecurity / EnableMethodSecurity
+        any(
+            ann in _FILTER_SECURITY_ANNOTATIONS
+            for sym in _class_syms
+            for ann in sym.annotations
+        )
+        # Class extends WebSecurityConfigurerAdapter (pre-Spring 5.7 style)
+        or any(
+            extends_map.get(sym.symbol, "") == "WebSecurityConfigurerAdapter"
+            for sym in _class_syms
+        )
+    )
+    _has_annotation_security = any("security" in e for e in endpoints)
+    if _filter_based and _has_annotation_security:
+        security_model = "mixed"
+    elif _filter_based:
+        security_model = "filter_based"
+    elif _has_annotation_security:
+        security_model = "annotation_based"
+    else:
+        security_model = "unknown"
+
     return {
         "endpoints": endpoints,
         "total": len(endpoints),
         "no_security_signal": no_security_signal,
+        "security_model": security_model,
         # Keep legacy field name for backward compat, now means same as no_security_signal
         "undocumented": no_security_signal,
     }

sourcecode-1.31.26/.continue-here.md

@@ -1,70 +0,0 @@
-# Handoff — Sesión 30 (2026-05-26)
-
-## Position
-
-**Project:** sourcecode (atlas-cli)  
-**Activity:** Post-audit bug fixing — AUDIT_v1.31.23.md  
-**Branch:** master  
-**Last commit:** f225ab2 — (fix) updating flags in order to copy the output in the clipboard  
-**Tests:** 1590 passed, 3 skipped ✅
-
----
-
-## Work Done This Session
-
-### Session 30 (this session)
-**`--copy/-c` flag parity across all output commands** (`cli.py`):
-- `impact_cmd`: added `--copy/-c` option + copy logic (fires only when no `--output`)
-- `repo_ir_cmd`: added `--copy/-c` option + copy logic (after stdout write, before UnicodeEncodeError path)
-- `endpoints_cmd`: added `--copy/-c` option + copy logic
-
-All three now consistent with existing commands (`main`, `prepare-context`, `onboard`, `review-pr`, `fix-bug`, `modernize`).
-
-Pattern: `if copy: if _copy_to_clipboard(output): typer.echo("✓ copied to clipboard", err=True)`
-
----
-
-## Remaining from AUDIT_v1.31.23.md
-
-### P2 unfixed (section 13, items 6–18)
-| # | Issue | File | Effort |
-|---|---|---|---|
-| P2-06 | `subsystem_summary.member_count` always 0 | cli.py modernize_cmd | Medium |
-| P2-07 | `no_security_signal` → detect filter-based security → `security_model: "filter_based"` | repository_ir.py | Medium |
-| P2-10 | `architecture.confidence` inconsistent between `--compact` and `--agent` | serializer.py | Low |
-| P2-13 | `--no-cache` flag inconsistent across subcommands (`--copy` now fixed) | cli.py | Medium |
-| P2-14 | URLs in code_notes truncated (missing `https://bugs.` prefix) | code_notes_analyzer.py | Low (needs repro) |
-| P2-16 | `entry_points.controllers.methods` mismatches `endpoints` count | cli.py | Medium |
-| P2-17 | `--compact --help` token claim outdated | cli.py | Trivial |
-| P2-18 | `impact` via file path: resolve to FQN before IR lookup | repository_ir.py | Low |
-
-### Score from Session 29
-| Dimension | v1.31.23 | After S29 | Fix applied |
-|---|---|---|---|
-| Correctness impl classes | 8/10 | 8.5/10 | BFS sampling |
-| Onboarding context quality | 7/10 | 8/10 | project_summary quantitative + bounded_contexts |
-| Modernize/dead code | 3/10 | 5.5/10 | hotspots with churn, roles classified |
-| Java/Spring depth | 8/10 | 8.5/10 | bounded_contexts Maven modules |
-| **TOTAL** | **6.5/10** | **~7.2/10** | |
-
----
-
-## Key Files Modified (this session)
-
-```
-src/sourcecode/cli.py    — --copy/-c added to impact_cmd, repo_ir_cmd, endpoints_cmd
-```
-
----
-
-## Next Session
-
-**Recommended start:** Fix `subsystem_summary.member_count` (P2-06).
-
-Root cause: `_detect_subsystems()` in `repository_ir.py` builds subsystems but doesn't populate the `members` list that `modernize_cmd` reads via `len(s.get("members") or [])`. Fix: ensure each subsystem dict includes the list of FQNs.
-
-Then: `--no-cache` flag consistency audit (P2-13 remainder).
-
-**Resume command:** `/gsd:resume-work`
-
-**Test baseline:** `python3 -m pytest tests/ → 1590 passed, 3 skipped`