sourcecode 1.31.31__py3-none-any.whl → 1.32.0__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.31.31"
+__version__ = "1.32.0"

sourcecode/cache.py

@@ -469,6 +469,7 @@ def _cas_load_blob(cache_d: Path, blob_hash: str) -> Optional[str]:
     try:
         return gzip.decompress(path.read_bytes()).decode("utf-8")
     except Exception:
+        _safe_unlink(path)  # evict corrupted blob so it doesn't block future reads
         return None
 
 

sourcecode/cli.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import threading
 import time
 from pathlib import Path
 from typing import Any, Optional, cast
@@ -140,7 +141,7 @@ def _check_pipeline_coherence(sm: "SourceMap") -> list[str]:  # type: ignore[nam
     return issues
 
 _HELP = """\
-Compressed AI-ready context for Java/Spring enterprise codebases.
+Deterministic codebase context for AI coding agents.
 
 [bold]Primary usage:[/bold]
   sourcecode --compact                  high-signal summary (~600-800 tokens)
@@ -176,9 +177,20 @@ _SUBCOMMANDS: frozenset[str] = frozenset(
     }
 )
 
-# Mutable container holding the path extracted by _preprocess_argv().
-# Default "." means "current directory" when no path is given.
-_detected_path: list[str] = ["."]
+# Thread-local storage for the path extracted by _preprocess_argv().
+# Using threading.local() prevents concurrent MCP tool calls from clobbering
+# each other's target path (the old module-level list was a shared mutable global).
+_tls = threading.local()
+
+
+def _get_detected_path() -> str:
+    """Return the thread-local detected path, defaulting to '.'."""
+    return _tls.__dict__.get("detected_path", ".")
+
+
+def _set_detected_path(value: str) -> None:
+    """Set the thread-local detected path."""
+    _tls.detected_path = value
 
 
 # Options that take a value token — their next arg must not be treated as a path.
@@ -214,6 +226,7 @@ def _preprocess_args(args: list[str]) -> list[str]:
     """
     result = list(args)
     skip_next = False
+    _path_index: int = -1
     for i, arg in enumerate(result):
         if skip_next:
             skip_next = False
@@ -227,9 +240,11 @@ def _preprocess_args(args: list[str]) -> list[str]:
         if arg in _SUBCOMMANDS:
             return result  # known subcommand — leave for Click to dispatch
         # First genuine positional: treat as repository path
-        _detected_path[0] = arg
-        result.pop(i)
-        return result
+        _set_detected_path(arg)
+        _path_index = i
+        break
+    if _path_index >= 0:
+        result.pop(_path_index)
     return result
 
 
@@ -334,7 +349,7 @@ def _get_command_with_preprocessing(typer_instance: Any) -> Any:
     def _cmd_main(args: Optional[list[str]] = None, **kwargs: Any) -> Any:
         if args is not None:
             # CliRunner / programmatic call: preprocess the explicit args list.
-            _detected_path[0] = "."
+            _set_detected_path(".")
             args = _preprocess_args(list(args))
         # args=None → Click reads sys.argv; _preprocess_argv() in main_entry handled it.
         return _orig_cmd_main(args=args, **kwargs)
@@ -363,7 +378,7 @@ app.add_typer(mcp_app, name="mcp")
 def _maybe_ask_consent() -> None:
     """Show first-run consent prompt once, on interactive TTYs only."""
     try:
-        from sourcecode.telemetry.config import has_been_asked, mark_asked, set_enabled
+        from sourcecode.telemetry.config import has_been_asked, set_enabled
         from sourcecode.telemetry.consent import ask_for_consent
         if not has_been_asked():
             enabled = ask_for_consent()
@@ -766,6 +781,11 @@ def main(
             err=True,
         )
 
+    # Pro gate for --full: removing truncation limits is enterprise-scale functionality.
+    if full:
+        from sourcecode.license import require_feature as _req_full
+        _req_full("--full")
+
     # P0-2 FIX: --compact and --full are mutually exclusive.
     # compact is designed to be a bounded summary; --full removes truncation limits,
     # which contradicts compact's purpose. Use --agent --full for expanded output.
@@ -833,7 +853,7 @@ def main(
     # Path was extracted from argv by _preprocess_argv() before Click ran.
     # FIX-P2-8: preserve original user input in error messages (Windows Git Bash
     # rewrites "/nonexistent" → "C:\Program Files\Git\nonexistent" via Path.resolve()).
-    _raw_path_input = _detected_path[0]
+    _raw_path_input = _get_detected_path()
     target = Path(_raw_path_input).resolve()
     if not target.exists():
         _emit_error_json(
@@ -852,6 +872,7 @@ def main(
 
     # Normalize mode aliases
     _CONTRACT_MODES = frozenset({"contract", "minimal", "standard"})
+    _user_mode_explicit = mode not in ("contract",)  # track if user passed a non-default value
     if mode == "minimal":
         mode = "contract"   # minimal is a documented alias for contract
     elif mode not in _CONTRACT_MODES and mode != "raw":
@@ -872,6 +893,20 @@ def main(
         or docs or semantics or full_metrics or architecture
     )
     if mode in ("contract", "standard") and _legacy_flags_active:
+        if _user_mode_explicit:
+            _overriding_flags = [
+                f for f, v in [
+                    ("--compact", compact), ("--tree", tree),
+                    ("--trace-pipeline", trace_pipeline), ("--docs", docs),
+                    ("--semantics", semantics), ("--full-metrics", full_metrics),
+                    ("--architecture", architecture),
+                ] if v
+            ]
+            typer.echo(
+                f"[warning] --mode {mode} was overridden to raw because legacy flags "
+                f"({', '.join(_overriding_flags)}) require raw output mode.",
+                err=True,
+            )
         mode = "raw"
 
     # Map mode to contract_view depth
@@ -995,7 +1030,7 @@ def main(
                     f"cn={code_notes},mode={mode},"
                     f"ex={_excl_key},depth={effective_depth}"
                 )
-                _core_h = _hashlib.md5(_core_flags_str.encode()).hexdigest()[:8]
+                _core_h = _hashlib.sha256(_core_flags_str.encode()).hexdigest()[:8]
                 _core_key = f"{_git_sha}-{_core_h}"
 
                 # ── View flags: output presentation only (no re-analysis needed) ──
@@ -1007,7 +1042,7 @@ def main(
                     f"mn={max_nodes},ge={graph_edges},mi={max_importers},"
                     f"eg={emit_graph}"
                 )
-                _view_h = _hashlib.md5(_view_flags_str.encode()).hexdigest()[:8]
+                _view_h = _hashlib.sha256(_view_flags_str.encode()).hexdigest()[:8]
 
                 # ── Lookup ──────────────────────────────────────────────────────
                 # Step 1: try L1 to obtain the core_hash needed for L2 key
@@ -1961,7 +1996,7 @@ def main(
             if _written_core_hash:
                 if not _view_key:
                     # _view_key not set (L1 was also a miss); compute it now
-                    _wvh = _hashlib.md5(_view_flags_str.encode()).hexdigest()[:8]
+                    _wvh = _hashlib.sha256(_view_flags_str.encode()).hexdigest()[:8]
                     _view_key = f"{_written_core_hash}-{_wvh}"
                 _cache_mod.write_view(
                     target,
@@ -2642,6 +2677,32 @@ def prepare_context_cmd(
     _pc_budget = _pc_budgets.get(task, BUDGET_EXPLAIN)
     out = _pc_trim(out, _pc_budget, label=task)
 
+    # Free-tier limits: fix-bug (top-5 files) and review-pr (lightweight).
+    # Pro users get the full analysis; free users get enough to see the value.
+    if task in ("fix-bug", "review-pr"):
+        from sourcecode.license import can_use as _tier_can_use
+        if not _tier_can_use(task):
+            _FREE_FILE_LIMIT = 5
+            if task == "fix-bug":
+                _rf = out.get("relevant_files")
+                if isinstance(_rf, list) and len(_rf) > _FREE_FILE_LIMIT:
+                    out["relevant_files"] = _rf[:_FREE_FILE_LIMIT]
+                    out["tier"] = "free"
+                    out["tier_note"] = (
+                        f"Showing top {_FREE_FILE_LIMIT} files. "
+                        "Upgrade to Pro for complete risk-ranked analysis across all files."
+                    )
+            else:  # review-pr
+                for _cap_field in ("runtime_changes", "execution_paths", "review_hotspots", "suggested_review_order"):
+                    _fval = out.get(_cap_field)
+                    if isinstance(_fval, list) and len(_fval) > _FREE_FILE_LIMIT:
+                        out[_cap_field] = _fval[:_FREE_FILE_LIMIT]
+                out["tier"] = "free"
+                out["tier_note"] = (
+                    "Lightweight review. Upgrade to Pro for full blast-radius analysis, "
+                    "complete execution paths, and CI-grade risk scoring."
+                )
+
     if format == "github-comment" and task == "review-pr":
         from sourcecode.pr_comment_renderer import render_github_comment
         _pc_content = render_github_comment(out)
@@ -3343,13 +3404,11 @@ def modernize_cmd(
       sourcecode onboard .         — Architecture overview first
       sourcecode impact <target>   — Verify impact before touching a hotspot
     """
-    from sourcecode.license import require_pro as _require_pro
-    _require_pro("modernize")
-
     import json as _json
     import sys as _sys
     from sourcecode.repository_ir import build_repo_ir, find_java_files, apply_ir_size_limits
     from sourcecode.output_budget import trim_to_budget, BUDGET_ONBOARD
+    from sourcecode.license import can_use as _mod_can_use
 
     root = path.resolve()
     if not root.is_dir():
@@ -3451,52 +3510,73 @@ def modernize_cmd(
         key=lambda s: -len(s.get("members") or []),
     )[:10]
 
-    result = {
-        "workflow": "modernize",
-        "path": str(root),
-        "summary": {
-            "total_classes": len([n for n in graph_nodes if n.get("type") in ("class", "interface")]),
-            "total_subsystems": len(subsystems),
-            "high_coupling_nodes": len(coupling_nodes),
-            "dead_zone_candidates": len(dead_zones),
-        },
-        "hotspot_candidates": hotspots,
-        "high_coupling_nodes": [
-            {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
-            for n in coupling_nodes
-        ],
-        "dead_zone_candidates": [
-            {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
-            for n in dead_zones
-        ],
-        "subsystem_summary": [
-            {
-                "label": s.get("label") or s.get("name") or "",
-                "package_prefix": s.get("package_prefix") or s.get("pkg") or "",
-                "member_count": len(s.get("members") or []),
-            }
-            for s in subsystems[:15]
-        ],
-        "cross_module_tangles": [
-            {
-                "label": s.get("label") or s.get("name") or "",
-                "member_count": len(s.get("members") or []),
-            }
-            for s in tangle_modules
-        ],
-        # BUG-05 fix: don't recommend "Start with hotspot_candidates" when the list is empty.
-        # hotspots filters by role=service/repository/controller; annotation types and
-        # value objects end up in high_coupling_nodes instead.
-        "recommendation": (
-            (
-                "Start with hotspot_candidates (high fan-in = highest blast radius). "
-                if hotspots else
-                "high_coupling_nodes shows the most-referenced classes — start there. "
-            )
-            + "Dead zones are safe to remove or refactor. "
-            + "Cross-module tangles indicate coupling worth decomposing."
-        ),
+    _summary = {
+        "total_classes": len([n for n in graph_nodes if n.get("type") in ("class", "interface")]),
+        "total_subsystems": len(subsystems),
+        "high_coupling_nodes": len(coupling_nodes),
+        "dead_zone_candidates": len(dead_zones),
     }
+    _subsystem_summary = [
+        {
+            "label": s.get("label") or s.get("name") or "",
+            "package_prefix": s.get("package_prefix") or s.get("pkg") or "",
+            "member_count": len(s.get("members") or []),
+        }
+        for s in subsystems[:15]
+    ]
+
+    if not _mod_can_use("modernize"):
+        # Free tier: structural discovery only — no dead zones, tangles, or full refactor list.
+        result = {
+            "workflow": "modernize",
+            "path": str(root),
+            "tier": "free",
+            "tier_note": (
+                "Upgrade to Pro for full analysis: dead zones, dependency tangles, "
+                "refactor candidates ranked by git churn, and complete coupling graphs."
+            ),
+            "summary": _summary,
+            "subsystem_summary": _subsystem_summary,
+            "hotspot_candidates": hotspots[:3],
+            "high_coupling_nodes": [
+                {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
+                for n in coupling_nodes[:3]
+            ],
+        }
+    else:
+        # Pro tier: full analysis.
+        result = {
+            "workflow": "modernize",
+            "path": str(root),
+            "summary": _summary,
+            "hotspot_candidates": hotspots,
+            "high_coupling_nodes": [
+                {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
+                for n in coupling_nodes
+            ],
+            "dead_zone_candidates": [
+                {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
+                for n in dead_zones
+            ],
+            "subsystem_summary": _subsystem_summary,
+            "cross_module_tangles": [
+                {
+                    "label": s.get("label") or s.get("name") or "",
+                    "member_count": len(s.get("members") or []),
+                }
+                for s in tangle_modules
+            ],
+            # BUG-05 fix: don't recommend "Start with hotspot_candidates" when the list is empty.
+            "recommendation": (
+                (
+                    "Start with hotspot_candidates (high fan-in = highest blast radius). "
+                    if hotspots else
+                    "high_coupling_nodes shows the most-referenced classes — start there. "
+                )
+                + "Dead zones are safe to remove or refactor. "
+                + "Cross-module tangles indicate coupling worth decomposing."
+            ),
+        }
 
     result = trim_to_budget(result, BUDGET_ONBOARD, label="modernize")
     output = _json.dumps(result, indent=2, ensure_ascii=False)
@@ -3589,9 +3669,6 @@ def mcp_serve() -> None:
         }
       }
     """
-    from sourcecode.license import require_pro as _require_pro
-    _require_pro("mcp serve")
-
     import logging
     import sys as _sys
 

sourcecode/env_analyzer.py

@@ -478,8 +478,13 @@ class EnvAnalyzer:
         example_files_found: list,
         limitations: list,
         profiles_scanned: list,
+        depth: int = 0,
+        max_depth: int = 12,
     ) -> int:
         """Walk the directory tree accumulating env var findings. Returns spring_candidates count."""
+        if depth >= max_depth:
+            return 0
+
         try:
             entries = sorted(current.iterdir())
         except PermissionError:
@@ -496,7 +501,7 @@ class EnvAnalyzer:
                     continue
                 total_spring_candidates += self._walk(
                     root, entry, findings, example_entries, example_files_found,
-                    limitations, profiles_scanned,
+                    limitations, profiles_scanned, depth + 1, max_depth,
                 )
             elif entry.is_file():
                 rel = entry.relative_to(root).as_posix()

sourcecode/git_analyzer.py

@@ -326,6 +326,9 @@ def _parse_uncommitted(output: str) -> "UncommittedChanges":
             continue
         x, y = line[0], line[1]
         filepath = line[3:].strip()
+        # Renamed files: git porcelain v1 produces "old -> new"; keep only the new path.
+        if x == "R" and " -> " in filepath:
+            filepath = filepath.split(" -> ", 1)[1]
         if x == "?" and y == "?":
             untracked.append(filepath)
         else:

sourcecode/license.py

@@ -3,12 +3,14 @@
 Flow:
   1. Module imported → _init() loads ~/.sourcecode/license.json (if present)
   2. is_pro set globally (True when plan == "pro")
-  3. Pro commands call require_pro(feature_name) at entry — exits 1 if not Pro
+  3. Pro commands call require_feature(feature_name) at entry — exits 1 if not Pro
   4. `sourcecode activate <key>` calls activate_license(key) — validates via
-     Supabase REST, writes ~/.sourcecode/license.json, exits 0 on success
+     Edge Function, writes ~/.sourcecode/license.json, exits 0 on success
+  5. Cached license is re-validated every 24 h (online); network errors keep
+     cached state (offline-first). Server-side invalidity clears cache.
 
-Supabase credentials:
-  SOURCECODE_SUPABASE_URL      — project REST endpoint
+Supabase credentials (baked in; override via env vars for testing):
+  SOURCECODE_SUPABASE_URL      — project Edge Function base URL
   SOURCECODE_SUPABASE_ANON_KEY — public anon key (not a secret)
 """
 from __future__ import annotations
@@ -21,19 +23,67 @@ from pathlib import Path
 from typing import Optional
 
 # ---------------------------------------------------------------------------
-# Supabase endpoint config — override via env vars
+# Supabase endpoint config — hardcoded for production; override via env for dev
 # ---------------------------------------------------------------------------
 _SUPABASE_URL: str = os.environ.get(
     "SOURCECODE_SUPABASE_URL",
-    "https://YOUR_PROJECT.supabase.co",
+    "https://qkndlmyekvujjdgthtmz.supabase.co",
 )
 _SUPABASE_ANON_KEY: str = os.environ.get(
     "SOURCECODE_SUPABASE_ANON_KEY",
-    "",
+    "",  # Set SOURCECODE_SUPABASE_ANON_KEY to your project anon key
 )
 
 _LICENSE_DIR: Path = Path.home() / ".sourcecode"
 _LICENSE_FILE: Path = _LICENSE_DIR / "license.json"
+_CACHE_TTL_SECONDS: int = 86400  # 24 hours
+
+# ---------------------------------------------------------------------------
+# Per-feature descriptions for upgrade UX
+# ---------------------------------------------------------------------------
+_FEATURE_INFO: dict[str, dict[str, str]] = {
+    "impact": {
+        "display": "impact",
+        "description": (
+            "Shows blast radius, callers, affected endpoints, and persistence paths in one call."
+        ),
+        "value": "Answers: what breaks if I touch this? The core risk signal before any change.",
+    },
+    "modernize": {
+        "display": "modernize (full)",
+        "description": (
+            "Full analysis: dead zones, refactor candidates, dependency tangles, and coupling ranked by git churn."
+        ),
+        "value": "Prioritizes where to refactor and what is safe to touch.",
+    },
+    "fix-bug": {
+        "display": "fix-bug (full)",
+        "description": "Complete risk-ranked file list with all annotation and structural signals.",
+        "value": "More results means less time scanning the codebase manually.",
+    },
+    "review-pr": {
+        "display": "review-pr (expanded)",
+        "description": "Full PR review: blast radius, all execution paths, security and transaction impact.",
+        "value": "CI-grade review — the complete picture before merging.",
+    },
+    "delta": {
+        "display": "prepare-context delta",
+        "description": "Incremental context: git-changed files with impact propagation.",
+        "value": "Designed for CI/CD pipelines — runs on every PR, flags risk automatically.",
+    },
+    "generate-tests": {
+        "display": "prepare-context generate-tests",
+        "description": "Test gap analysis: finds untested files with coverage recommendations.",
+        "value": "Reduces test debt systematically across the entire codebase.",
+    },
+    "--full": {
+        "display": "--full flag",
+        "description": (
+            "Removes truncation limits on transactional boundaries, DTO mappers, and large result sets."
+        ),
+        "value": "Essential for complete analysis of enterprise-scale codebases.",
+    },
+}
 
 # ---------------------------------------------------------------------------
 # Global license state — loaded once at import time
@@ -53,6 +103,84 @@ def _load_license_file() -> Optional[dict]:
     return None
 
 
+def _call_get_license(license_key: str) -> Optional[dict]:
+    """POST to /get-license edge function. Returns parsed dict or None on network error."""
+    import urllib.error
+    import urllib.request
+
+    if not _SUPABASE_ANON_KEY:
+        return None
+
+    url = f"{_SUPABASE_URL}/functions/v1/get-license"
+    body = json.dumps({"license_key": license_key}).encode("utf-8")
+    req = urllib.request.Request(url, data=body, method="POST")
+    req.add_header("apikey", _SUPABASE_ANON_KEY)
+    req.add_header("Authorization", f"Bearer {_SUPABASE_ANON_KEY}")
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Accept", "application/json")
+
+    try:
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return json.loads(resp.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        try:
+            return json.loads(exc.read().decode("utf-8", errors="replace"))
+        except Exception:
+            return {"valid": False, "error": f"HTTP {exc.code}"}
+    except Exception:
+        return None  # Network error — caller decides what to do
+
+
+def _maybe_revalidate() -> None:
+    """Re-validate cached license if stale. Mutates globals; never raises."""
+    global _license_data, is_pro
+
+    if not _license_data:
+        return
+
+    validated_at_str = _license_data.get("validated_at") or _license_data.get("activated_at")
+    if validated_at_str:
+        try:
+            validated_at = datetime.fromisoformat(validated_at_str)
+            if validated_at.tzinfo is None:
+                validated_at = validated_at.replace(tzinfo=timezone.utc)
+            age = (datetime.now(timezone.utc) - validated_at).total_seconds()
+            if age < _CACHE_TTL_SECONDS:
+                return
+        except Exception:
+            pass
+
+    key = _license_data.get("license_key")
+    if not key:
+        return
+
+    result = _call_get_license(key)
+    if result is None:
+        return  # Network error — keep cached data (offline-first)
+
+    if not result.get("valid"):
+        _license_data = None
+        is_pro = False
+        try:
+            if _LICENSE_FILE.exists():
+                _LICENSE_FILE.unlink()
+        except Exception:
+            pass
+        return
+
+    _license_data["plan"] = result.get("plan", "pro")
+    _license_data["features"] = result.get("features", [])
+    _license_data["validated_at"] = datetime.now(timezone.utc).isoformat()
+    is_pro = _license_data.get("plan") == "pro"
+    try:
+        _LICENSE_FILE.write_text(
+            json.dumps(_license_data, indent=2, ensure_ascii=False),
+            encoding="utf-8",
+        )
+    except Exception:
+        pass
+
+
 def _init() -> None:
     global _license_data, is_pro
     _license_data = _load_license_file()
@@ -66,27 +194,74 @@ _init()
 
 
 # ---------------------------------------------------------------------------
-# Enforcement
+# Entitlement helpers
 # ---------------------------------------------------------------------------
 
-def require_pro(feature_name: str) -> None:
-    """Exit with structured JSON error when not Pro.
+def can_use(feature_name: str) -> bool:
+    """Return True if the current plan has access to feature_name.
+
+    Does not trigger revalidation — use require_feature() at command entry
+    points where you want revalidation + gating in one call.
+    """
+    return is_pro
 
-    Call at the very top of every Pro-gated command, before any work.
+
+def require_feature(feature_name: str) -> None:
+    """Exit with a clean upgrade prompt when feature_name requires Pro.
+
+    Re-validates stale cached license before gating (once per 24 h, online).
+
+    Writes human-readable context to stderr (terminal UX) and a JSON error
+    to stdout (backward-compatible machine-readable format).
+
+    Example:
+        from sourcecode.license import require_feature
+        require_feature("impact")
+    """
+    _maybe_revalidate()
+
+    if is_pro:
+        return
+
+    info = _FEATURE_INFO.get(feature_name, {})
+    display = info.get("display", feature_name)
+    description = info.get("description", "")
+    value = info.get("value", "")
+
+    # Human-readable upgrade prompt on stderr
+    lines = [f"\n  '{display}' is a Pro feature."]
+    if description:
+        lines.append(f"  {description}")
+    if value:
+        lines.append(f"  {value}")
+    lines.append("")
+    lines.append("  Upgrade:  sourcecode activate <license_key>")
+    lines.append("")
+    sys.stderr.write("\n".join(lines) + "\n")
+    sys.stderr.flush()
+
+    # JSON on stdout — backward-compatible for CI / MCP consumers
+    payload = {
+        "error": "pro_required",
+        "feature": feature_name,
+        "message": (
+            f"'{display}' requires a Pro license. "
+            "Run: sourcecode activate <license_key>"
+        ),
+    }
+    sys.stdout.write(json.dumps(payload, ensure_ascii=False) + "\n")
+    sys.stdout.flush()
+    sys.exit(1)
+
+
+def require_pro(feature_name: str) -> None:
+    """Backward-compatible alias for require_feature.
 
     Example:
         from sourcecode.license import require_pro
         require_pro("impact")
     """
-    if not is_pro:
-        payload = {
-            "error": "pro_required",
-            "feature": feature_name,
-            "message": "Run sourcecode activate <license_key>",
-        }
-        sys.stdout.write(json.dumps(payload, ensure_ascii=False) + "\n")
-        sys.stdout.flush()
-        sys.exit(1)
+    require_feature(feature_name)
 
 
 # ---------------------------------------------------------------------------
@@ -94,63 +269,42 @@ def require_pro(feature_name: str) -> None:
 # ---------------------------------------------------------------------------
 
 def activate_license(license_key: str) -> None:
-    """Validate license_key via Supabase, write ~/.sourcecode/license.json.
+    """Validate license_key via Edge Function, write ~/.sourcecode/license.json.
 
     Outputs JSON to stdout; exits 0 on success, 1 on any failure.
     Never raises — all error paths emit JSON and call sys.exit(1).
     """
-    import urllib.error
-    import urllib.request
-
-    # Bail early when Supabase isn't configured yet
-    if not _SUPABASE_ANON_KEY or _SUPABASE_URL == "https://YOUR_PROJECT.supabase.co":
-        _fail("configuration_error", "SOURCECODE_SUPABASE_URL / SOURCECODE_SUPABASE_ANON_KEY not configured.")
-
-    url = (
-        f"{_SUPABASE_URL}/rest/v1/users"
-        f"?license_key=eq.{license_key}"
-        f"&select=license_key,plan,email"
-    )
-    req = urllib.request.Request(url)
-    req.add_header("apikey", _SUPABASE_ANON_KEY)
-    req.add_header("Authorization", f"Bearer {_SUPABASE_ANON_KEY}")
-    req.add_header("Accept", "application/json")
+    if not _SUPABASE_ANON_KEY:
+        _fail("configuration_error", "SOURCECODE_SUPABASE_ANON_KEY not set. Contact support.")
 
-    try:
-        with urllib.request.urlopen(req, timeout=10) as resp:
-            body = resp.read().decode("utf-8")
-    except urllib.error.HTTPError as exc:
-        _fail("network_error", f"Supabase returned HTTP {exc.code}")
-    except Exception as exc:
-        _fail("network_error", str(exc))
+    result = _call_get_license(license_key)
 
-    try:
-        rows = json.loads(body)
-    except Exception:
-        _fail("network_error", "Invalid JSON response from Supabase")
+    if result is None:
+        _fail("network_error", "Could not reach license server. Check your internet connection.")
 
-    if not rows:
-        _fail("invalid_license", "License key not found")
+    if not result.get("valid"):
+        _fail("invalid_license", result.get("error", "License key is not valid or subscription is inactive."))
 
-    user = rows[0]
-    if user.get("plan") != "pro":
-        _fail("not_pro", "This license is not Pro")
+    if result.get("plan") != "pro":
+        _fail("not_pro", "This license is not a Pro license.")
 
-    # Write license file
     _LICENSE_DIR.mkdir(parents=True, exist_ok=True)
+    now = datetime.now(timezone.utc).isoformat()
     data = {
         "license_key": license_key,
-        "plan": "pro",
-        "email": user.get("email", ""),
-        "activated_at": datetime.now(timezone.utc).isoformat(),
+        "plan": result["plan"],
+        "features": result.get("features", []),
+        "email": result.get("email", ""),
+        "activated_at": now,
+        "validated_at": now,
     }
     _LICENSE_FILE.write_text(
         json.dumps(data, indent=2, ensure_ascii=False),
         encoding="utf-8",
     )
 
-    result = {"status": "activated", "plan": "pro"}
-    sys.stdout.write(json.dumps(result, ensure_ascii=False) + "\n")
+    output = {"status": "activated", "plan": "pro", "features": data["features"]}
+    sys.stdout.write(json.dumps(output, ensure_ascii=False) + "\n")
     sys.stdout.flush()
 
 

sourcecode/mcp/onboarding/applier.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import os
 from pathlib import Path
 
 _MCP_SERVERS_KEY = "mcpServers"
@@ -13,13 +14,14 @@ _ENTRY_VALUE: dict[str, object] = {
 
 
 def read_config(path: Path) -> dict:
-    """Parse JSON config from path. Returns empty dict if missing or empty."""
+    """Parse JSON config from path. Returns empty dict if missing, empty, or unreadable."""
     if not path.exists():
         return {}
-    raw = path.read_text(encoding="utf-8").strip()
-    if not raw:
+    try:
+        text = path.read_text(encoding="utf-8")
+        return json.loads(text) if text.strip() else {}
+    except (OSError, json.JSONDecodeError):
         return {}
-    return json.loads(raw)  # type: ignore[no-any-return]
 
 
 def is_installed(config: dict) -> bool:
@@ -49,9 +51,15 @@ def remove_entry(config: dict) -> dict:
 
 
 def write_config(path: Path, config: dict) -> None:
-    """Atomically write config as formatted JSON."""
+    """Atomically write config as formatted JSON using a temp file + os.replace."""
     path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(json.dumps(config, indent=2) + "\n", encoding="utf-8")
+    tmp = path.with_suffix(".tmp")
+    try:
+        tmp.write_text(json.dumps(config, indent=2) + "\n", encoding="utf-8")
+        os.replace(tmp, path)
+    finally:
+        if tmp.exists():
+            tmp.unlink(missing_ok=True)
 
 
 def validate(path: Path) -> bool:

sourcecode/mcp/runner.py

@@ -20,9 +20,9 @@ def run_command(args: list[str]) -> Any:
     Returns parsed JSON dict when output is valid JSON, else the raw string.
     Raises RuntimeError on non-zero exit or empty output.
     """
-    from sourcecode.cli import _detected_path, _preprocess_args, app
+    from sourcecode.cli import _set_detected_path, _preprocess_args, app
 
-    _detected_path[0] = "."
+    _set_detected_path(".")
     processed = _preprocess_args(list(args))
     result = _runner.invoke(app, processed)
 

sourcecode/mcp/server.py

@@ -454,18 +454,21 @@ def generate_tests_context(repo_path: str = ".", include_all: bool = False) -> d
         timeout_s = timeout_ms / 1000.0
 
         executor = concurrent.futures.ThreadPoolExecutor(max_workers=1)
-        future = executor.submit(_execute, args)
-        done, _not_done = concurrent.futures.wait([future], timeout=timeout_s)
-        if _not_done:
-            executor.shutdown(wait=False)
-            return _ok({
-                "truncated": True,
-                "truncated_reason": f"timeout_{timeout_ms // 1000}s" if timeout_ms >= 1000 else f"timeout_{timeout_ms}ms",
-                "files_analyzed": 0,
-                "results": [],
-            })
-        executor.shutdown(wait=False)
-        return future.result()
+        try:
+            future = executor.submit(_execute, args)
+            done, _not_done = concurrent.futures.wait([future], timeout=timeout_s)
+            if _not_done:
+                executor.shutdown(wait=False)
+                return _ok({
+                    "truncated": True,
+                    "truncated_reason": f"timeout_{timeout_ms // 1000}s" if timeout_ms >= 1000 else f"timeout_{timeout_ms}ms",
+                    "files_analyzed": 0,
+                    "results": [],
+                })
+            result = future.result()
+        finally:
+            executor.shutdown(wait=True)
+        return result
 
     except Exception as exc:
         return _err(
@@ -532,8 +535,8 @@ def modernize_context(repo_path: str = ".", format: str = "json") -> dict:
     try:
         if not isinstance(repo_path, str):
             return _err("repo_path must be a string", "INVALID_ARGUMENT")
-        if not isinstance(format, str) or format not in ("json", "yaml"):
-            return _err("format must be 'json' or 'yaml'", "INVALID_ARGUMENT")
+        if not isinstance(format, str) or format != "json":
+            return _err("format must be 'json' — yaml is not supported for modernize output", "INVALID_ARGUMENT")
         repo_path = _normalize_repo_path(repo_path)
         _path_err = _check_repo_path(repo_path)
         if _path_err is not None:

sourcecode/mcp_nudge.py

@@ -3,7 +3,12 @@
 Fires when:
   1. At least one known MCP client (Claude Desktop, Cursor) is installed
   2. sourcecode is NOT yet registered in that client's config
-  3. The nudge hasn't been shown this session (~/.sourcecode/nudge_shown flag)
+  3. The nudge hasn't been shown yet (~/.sourcecode/nudge_shown flag absent)
+
+The sentinel flag (~/.sourcecode/nudge_shown) persists globally on the
+filesystem — it is NOT session-scoped. Once written it suppresses all future
+nudges across all terminal sessions and process invocations until it is
+deleted (which `sourcecode mcp init` does on successful installation).
 
 Cleared by: a successful `sourcecode mcp init` (deletes the flag so the
 post-init detection finds is_installed=True and never nudges again).

sourcecode/redactor.py

@@ -23,6 +23,10 @@ _SECRET_PATTERNS: list[re.Pattern[str]] = [
     re.compile(r"sk-[A-Za-z0-9]{48}"),                        # OpenAI legacy key
     re.compile(r"AKIA[0-9A-Z]{16}"),                          # AWS Access Key ID
     re.compile(r"Bearer\s+[A-Za-z0-9\-._~+/]+=*"),           # Bearer tokens
+    re.compile(r"sk-ant-[A-Za-z0-9\-_]{32,}"),               # Anthropic API key
+    re.compile(r"hf_[A-Za-z0-9]{32,}"),                       # Hugging Face token
+    re.compile(r"sk_live_[A-Za-z0-9]{24,}"),                  # Stripe live secret key
+    re.compile(r"pk_live_[A-Za-z0-9]{24,}"),                  # Stripe live publishable key
 ]
 
 # Patrones de nombres de fichero que deben excluirse (SEC-02)

sourcecode/repository_ir.py

@@ -3246,7 +3246,7 @@ def compute_blast_radius(
     if _hub_class_guard and direct_callers:
         _n_direct = len(direct_callers)
         _k = min(_HUB_SAMPLE_SIZE, _n_direct)
-        _sample_seeds = random.sample(direct_callers, _k)
+        _sample_seeds = sorted(direct_callers, key=lambda x: str(x))[:_k]
         _sample_visited: set[str] = set(matched_fqns) | set(direct_callers)
         _sample_queue: list[tuple[str, int]] = [(c, 1) for c in _sample_seeds]
         _sample_indirect: list[str] = []

sourcecode/serializer.py

@@ -190,7 +190,7 @@ def _dependency_import_index(root: Path, file_paths: list[str]) -> set[str]:
         r"require\(['\"]([^'\"]+)['\"]\)|from\s+['\"]([^'\"]+)['\"])",
         re.MULTILINE,
     )
-    for path in file_paths[:2000]:
+    for path in file_paths[:500]:
         if Path(path).suffix.lower() not in {".py", ".js", ".ts", ".tsx", ".jsx", ".mjs", ".cjs"}:
             continue
         try:

{sourcecode-1.31.31.dist-info → sourcecode-1.32.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.31.31
+Version: 1.32.0
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -225,7 +225,7 @@ Description-Content-Type: text/markdown
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.31-blue)
+![Version](https://img.shields.io/badge/version-1.32.0-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -263,7 +263,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.31
+# sourcecode 1.32.0
 ```
 
 ---

{sourcecode-1.31.31.dist-info → sourcecode-1.32.0.dist-info}/RECORD

@@ -1,12 +1,12 @@
-sourcecode/__init__.py,sha256=1Q8tXMLCUF_dRIEoNcIN_LLVJVN4jXymK6NlDJ1O1sA,104
+sourcecode/__init__.py,sha256=1pcmq6UuzqBpI1Q4E_5ukKd_IJ8s8CN4xrW1_EyV0Gw,103
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=Ry3aYT9dc7XuLmWLT5IZ93RkCf_P14Qtew0nGPvUl_8,42184
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
 sourcecode/ast_extractor.py,sha256=_btmeOJIe3t-NicF94D5ZAesa2YIJ0_QNExGnbHxGFE,50578
-sourcecode/cache.py,sha256=TiYa3ECjBKtvlfCk7GvQ9v6gZkAITpH3ow9PubA7sUo,22946
+sourcecode/cache.py,sha256=pBrPdpPrOgpXHHQO670U3aUfVf5N3A3obsTKgiZtN4I,23030
 sourcecode/canonical_ir.py,sha256=_HM3AUmKSdna9u4dCoU6rpgSA6HdF8gzOKZykIUCNGY,23277
 sourcecode/classifier.py,sha256=yWeq6agTjkFa3zuNa-gdVIHtjoBoPoVlJnX-b7tdVJs,7851
-sourcecode/cli.py,sha256=757JuVOVVPLsWvqui4jQCaoDew0vSIg4l3ookLFdMqU,160341
+sourcecode/cli.py,sha256=7GfBpmy2_6lUbuNz8zft4Vof-WOeGnzpeSNwxzDQndM,163863
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -17,13 +17,13 @@ sourcecode/coverage_parser.py,sha256=q0LeZJaX1bnntLu-ImksdBsMlpsVmk_iUfSaB4eaJGo
 sourcecode/dependency_analyzer.py,sha256=Po7GKJnClCkXty0np1B4F1zo_bPeKAtgbehazhXuaBM,56493
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/entrypoint_classifier.py,sha256=MTa7yqbeuJ9XPbGCPuvtR9IqY-SN3hoXXyVtb3iXDhs,4316
-sourcecode/env_analyzer.py,sha256=GxCidahAAIptTdDFIlVB6URd4HBnBlIX_SqUov3MBRQ,22076
+sourcecode/env_analyzer.py,sha256=9_q_U_Q1tjiY5FSaeEImSDgToP2uHGrjBAFF7ihJn2I,22204
 sourcecode/file_classifier.py,sha256=QrYm7MlG29HQdAR1WOfpnIIBysAz62c5coz9eQ76meo,12892
 sourcecode/flow_analyzer.py,sha256=dSiuY4w49k29jW_EPXUOND9B5uVbuCA7kjnuHi-pIWA,28781
-sourcecode/git_analyzer.py,sha256=0Gyj-vMpIIN4nfriKXVRouNYBeJ59s6pQDX2Xu9Pq-U,13177
+sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
 sourcecode/graph_analyzer.py,sha256=iUK-7pSV-cvGqqD2hENdYmhnm0wcXFEyK-xnu5ul8OU,62515
-sourcecode/license.py,sha256=VuGBBnUvlDvGm_PA-mCL8WuxQnD4Fa23SG6xxVzFpfk,5461
-sourcecode/mcp_nudge.py,sha256=rJzr_dirC6L3VMsUBmzsSSJb-j-nphZy-qq7i2JPjEQ,2625
+sourcecode/license.py,sha256=m5n4PKZ7ZZZ17bpLjIsKwd94PXaIg5iS_2kFNjCV2Og,11378
+sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
 sourcecode/output_budget.py,sha256=43307mJEyUPU3MI-QEQoVxrcAvNyUzdzF_SAPgisBQE,6603
 sourcecode/path_filters.py,sha256=ROFRQ8eSLBEMiixK9f45-RO7um4VEEcjoD5AA4I427I,3739
@@ -31,15 +31,15 @@ sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrf
 sourcecode/prepare_context.py,sha256=RM7ka0rduJy8kwGHzLU9if6q7D9ST7tGjOf5LnsdTuw,201451
 sourcecode/progress.py,sha256=qn30sWaHOkjTgXsSBmiPkz7Rsbwc5oSlIe6JNEMYp_k,3149
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
-sourcecode/redactor.py,sha256=xuGcadGEHaPw4qZXlMDvzMCsr4VOkdp3oBQptHyJk8c,2884
+sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=MYF4FFkveAQps9SmTeTlh6ODiBz2F--_hWNeHMLtUHQ,8405
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=y6d_ldrgolNwAiniWe54tR5HUE-UsxfYe5zDS_GNmrY,152741
+sourcecode/repository_ir.py,sha256=rga0I9L0K-3kSMTF8R8slBH4Fkwwrh-ut4Y3h6GxLvY,152757
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/semantic_analyzer.py,sha256=TDuC3wzZR2DPm1mgrAg1YSLk2QzJoueS3TZAmyGGpCU,89417
-sourcecode/serializer.py,sha256=7TzN2GLtIP3PIVatoB98_7DQdoAkUNvvNVU7Bz7r_K8,123313
+sourcecode/serializer.py,sha256=3JBvsMDj5pt1RXpi1zJpk5DGWUKbeb2Jl622-kmYWD4,123312
 sourcecode/summarizer.py,sha256=BMHJA0Do4rBnabc1_BxHoETTNb5ew0VqCX_eY3_PdCg,20706
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/workspace.py,sha256=X_6NmNnitvT3_38V-JDChydo_sR68s249hLFlrQskU0,8271
@@ -65,10 +65,10 @@ sourcecode/detectors/systems.py,sha256=nYaKbGDFu0EOXFcd_1doWFT3tTUdkbxc2DjHUF5Tc
 sourcecode/detectors/terraform.py,sha256=cxORPR_zVLOJpHlh4e9JnFpkQsn_UnqMMom5yG65hZ4,1693
 sourcecode/detectors/tooling.py,sha256=8CKbtxwQoABP-WyBRNmdAmHDOvAH57AR1cF4UKuWEdQ,2074
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
-sourcecode/mcp/runner.py,sha256=7PnFjKYbgxFeDnqVeSntXHxZX7ZtK3-krDkEuVjI24M,1386
-sourcecode/mcp/server.py,sha256=YHhKKwhB0u-DsslX_zptJpplz3i3a_I4svrJg8IKgb4,23894
+sourcecode/mcp/runner.py,sha256=YSw2DXEICau6mCBr3Gfia3D_tKxMbRvIIXEh4cHC1SY,1390
+sourcecode/mcp/server.py,sha256=zbc4G5j2VAlVnluAksoSk6zV_wwgDevaH5Q4oVsl2kA,24018
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
-sourcecode/mcp/onboarding/applier.py,sha256=yfSMT0NKdZsjavtLkC8yQ7OtkfepOl5IXGByqg6bdEY,1894
+sourcecode/mcp/onboarding/applier.py,sha256=B9CneieWTpaDSDIyW3S5nrlRlBpvfqUcgi93-mm_ApQ,2135
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
 sourcecode/mcp/onboarding/detector.py,sha256=kDc0U6kXMuq_GivqwKrgJzIVLVeoLr3RQl63ksW10I8,3327
 sourcecode/mcp/onboarding/planner.py,sha256=Fopg5f72FDiPfldF7NOxYjcBA_w8hi_jBJpSz39lPb8,1332
@@ -78,8 +78,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=KJeIPCPWMdmbCP3ySGs2iUlia34U6vWne2dZsUezesw,1560
-sourcecode-1.31.31.dist-info/METADATA,sha256=25SDVwl1Kx6PdAtuhy9QVT9WTSIFDVX_yXyMuLAzRsY,31103
-sourcecode-1.31.31.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.31.31.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.31.31.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.31.31.dist-info/RECORD,,
+sourcecode-1.32.0.dist-info/METADATA,sha256=FHXYjifmhRxjdL38qMdsKuEz9_H2nJIrodG2c7R2LHM,31100
+sourcecode-1.32.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.32.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.32.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.32.0.dist-info/RECORD,,