sourcecode 1.31.32__tar.gz → 1.32.1__tar.gz

{sourcecode-1.31.32 → sourcecode-1.32.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.31.32
+Version: 1.32.1
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -225,7 +225,7 @@ Description-Content-Type: text/markdown
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.32-blue)
+![Version](https://img.shields.io/badge/version-1.32.0-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -263,7 +263,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.32
+# sourcecode 1.32.0
 ```
 
 ---

{sourcecode-1.31.32 → sourcecode-1.32.1}/README.md

@@ -2,7 +2,7 @@
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.32-blue)
+![Version](https://img.shields.io/badge/version-1.32.0-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -40,7 +40,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.32
+# sourcecode 1.32.0
 ```
 
 ---

sourcecode-1.32.1/docs/PRODUCT_AUDIT.md

@@ -0,0 +1,170 @@
+# Phase 1 — Product Intelligence Report
+> Tested against: BroadleafCommerce (2,985 Java files), Keycloak (7,885 Java files), atlas-cli itself (Python/Typer).
+> All findings from live CLI execution. No assumptions.
+
+---
+
+## 1. What sourcecode is
+
+A Python CLI that performs **static structural analysis** of Java/Spring/Maven codebases and produces **structured JSON** designed for direct injection into AI coding agents or consumption by CI/CD pipelines.
+
+It builds a deterministic symbol graph (classes, methods, annotation roles, import/injection edges) and answers structural questions about that graph: who depends on what, what endpoints exist, what is risky to change.
+
+**It is not:**
+- A linter or static analyzer in the SonarQube sense
+- An LLM wrapper — no AI calls, no network required
+- A runtime or security scanner
+- A polyglot tool (Spring-specific features are ~nil outside Java)
+
+---
+
+## 2. What it does extremely well
+
+### Blast-radius analysis (`impact`)
+Confirmed: `sourcecode impact ExtensionManager BroadleafCommerce` returned in <1s:
+- `risk_level: high`, `risk_score: 100`
+- 30 direct callers, 50 indirect callers, **106 endpoints affected**
+
+This is the clearest "wow moment" in the product. Running it on `OrderPaymentServiceImpl` returned 15 direct callers + the exact payment workflow chain in the correct order. For an engineer about to refactor a service, this replaces 2–4 hours of manual graph tracing.
+
+**Caveat found:** Targeting `Impl` classes returns only injection-free callers (often zero in Spring Boot). The tool must be targeted at the **interface**. `OrderService` not `OrderServiceImpl`. The CLI does not auto-suggest this — friction point.
+
+### Endpoint extraction (`endpoints`)
+Confirmed: 613 Spring MVC + JAX-RS endpoints extracted from Keycloak in <1s. 110 from BroadleafCommerce. Zero false positives observed in sample. This is legitimately useful for auditing API surface before migrations.
+
+### Stack detection + entry point mapping (`--compact`, `--agent`)
+Correctly identified:
+- Keycloak: Quarkus + Jakarta EE, @QuarkusMain, 40+ entry points ranked by type
+- BroadleafCommerce: Spring Boot + Spring MVC, 41 @Transactional boundaries
+- atlas-cli itself: Python + Typer
+
+Architecture classification is less reliable: Quarkus SPI model classified as "layered" (inaccurate). Spring layered apps classified correctly.
+
+### Symptom-driven bug triage (`fix-bug --symptom`)
+Tested with `--symptom "payment"` on BroadleafCommerce. Top results:
+- `OrderPaymentDaoImpl`, `SecureOrderPaymentDaoImpl`, `DefaultPaymentGatewayCheckoutService` — all directly correct
+
+Evidence chain in `symptom_explain` shows: keyword match → content match → path match → git history. Signal quality is high for specific symptoms.
+
+### Coupling detection (`modernize`)
+Correctly identified `ExtensionManager` (in_degree: 209) and `Order` (in_degree: 251) as highest-risk nodes. `dead_zone_candidates` includes `ProcessURLAction`, `RequestContext` — classes with zero callers. This is accurate and immediately actionable.
+
+### Performance
+- Cached (content-hash): ~0.17s for both 3K-file and 7K-file repos
+- Cold scan: ~2.9s (BroadleafCommerce), ~9.0s (Keycloak)
+- These numbers are remarkable for the scale. No competitor does Java structural analysis this fast.
+
+---
+
+## 3. What it does poorly / gaps
+
+### review-pr — LOW confidence is common
+Tested on both repos. Output consistently shows `"confidence": "LOW"` on the `summary` field. `analysis_limiter.missing_signals: ["dependency_graph"]` explains it — the PR diff analysis doesn't have the full symbol graph available for role classification. For validator classes (not annotated), it falls back to `"classification_method": "git_diff_only"`. The output is still useful (changed files, test coverage, modules) but the low confidence signal is jarring.
+
+### Impl vs interface confusion
+`impact OrderServiceImpl` → `0 direct_callers`. No auto-correction. For users unfamiliar with Spring DI traversal patterns, this looks broken. The README explains it, but a first-time user will be confused.
+
+### `hotspot_candidates` empty in annotation-heavy codebases
+`modernize` on BroadleafCommerce returned `hotspot_candidates` with only 2 entries despite the repo having obvious hotspots. In annotation-heavy codebases, the highest-coupled nodes are `@AdminPresentationClass` (285 in_degree), `Order` (251), `AdminPresentation` (228) — but these are annotation types and JPA entities, not services/controllers, so they don't qualify for `hotspot_candidates`. `high_coupling_nodes` shows them correctly. The README warns about this; the CLI output doesn't explain it.
+
+### No automatic "here's what to do next" nudge in edge cases
+When `impact` returns `direct_callers: []`, no suggestion to try the interface. When `hotspot_candidates` is empty, no pointer to `high_coupling_nodes`. These silent empty states feel like failures rather than "try X instead."
+
+### `project_summary` pulled from README
+Keycloak's summary is marketing copy ("provides user federation, strong authentication...") not an architectural description. Misleading when fed to agents.
+
+### Architecture classification unreliable for SPI/plugin patterns
+Quarkus extension model, OSGi, SPI-heavy architectures all get classified as "layered." Confidence correctly downgraded to `medium`, but the label is wrong.
+
+### No non-Java codebase analysis
+Outside Java/Spring, you get stack detection and file structure but no endpoint extraction, no impact analysis, no transactional boundary detection. For polyglot repos it's partial at best.
+
+---
+
+## 4. Unique differentiators
+
+1. **Speed at scale**: No other static analysis tool returns Java structural analysis for 7K+ files in <10s cold. This is an architectural achievement.
+2. **Spring DI-aware traversal**: Understanding `@Autowired` interface injection is genuinely rare in open-source tooling. Most grep/AST tools return 0 callers on interface-injected Spring services.
+3. **Deterministic, content-hash-cached output**: Safe for CI/CD. Same input = same output. Most AI-context tools are non-deterministic.
+4. **Token-bounded by design**: Every AI-facing mode is size-bounded. Direct injection without overflow risk.
+5. **No external dependencies**: No API keys, no network, no Docker. `pip install sourcecode` and it works offline. Privacy constraint satisfied for enterprise customers.
+6. **MCP integration**: Already live — `mcp serve`, `mcp init`, `mcp status`. Works with Claude Desktop and Cursor. Makes sourcecode a context server for agentic workflows.
+
+---
+
+## 5. Ideal user profile
+
+**Primary:**
+- Senior/staff engineer on a Java/Spring monolith (3K–20K Java files)
+- Using AI coding agents (Claude Code, GitHub Copilot, Cursor) for development
+- Working in a team where "what breaks if I change X" takes 30min+ manually
+- Pre-refactor safety checks, PR reviews, or onboarding to unfamiliar codebases
+
+**Secondary:**
+- Tech lead running a modernization initiative (coupling analysis, dead zone detection)
+- Platform engineer adding a PR risk gate to CI pipeline
+- Developer relations / new hire onboarding context generation
+
+**Not a fit:**
+- Frontend/React/TypeScript shops (Spring-specific features don't apply)
+- Teams without Java/Spring codebases
+- Teams looking for code quality / lint / style tooling
+
+---
+
+## 6. Real-world use cases (top 10)
+
+1. **Pre-refactor check**: "I'm about to change `OrderService` — what endpoints break?" → `impact`
+2. **New codebase onboarding**: "What is this 3,000-class repo and where do I start?" → `onboard`
+3. **AI agent session start**: "Give me bounded context for Claude" → `--agent` or `--compact`
+4. **Bug triage**: "NPE in checkout — which files are involved?" → `fix-bug --symptom "NullPointerException checkout"`
+5. **PR review augmentation**: "Does this PR have test coverage? What's the blast radius?" → `review-pr`
+6. **API surface audit**: "What endpoints does this service expose before migration?" → `endpoints`
+7. **Modernization planning**: "What's the most dangerous class to refactor?" → `modernize`
+8. **CI/CD PR gate**: Parse `ci_decision` and `test_coverage_risk` fields in pipeline
+9. **Security pre-audit**: "What endpoints exist and which have `@PreAuthorize`?" → `endpoints` + `--compact`
+10. **MCP context server**: Give an AI agent access to live structural analysis without token-stuffing
+
+---
+
+## 7. Non-use cases
+
+- Code quality / style / lint (use Checkstyle, SonarQube)
+- Security vulnerability scanning (use OWASP Dependency-Check, Snyk)
+- Runtime performance analysis (use JProfiler, async-profiler)
+- Non-Java codebases for structural analysis
+- Teams looking for "AI that writes code" (sourcecode produces context *for* AI, not code)
+- Dynamic/runtime behavior analysis
+
+---
+
+## 8. "Wow moments"
+
+1. `sourcecode impact ExtensionManager` → "106 endpoints affected, risk: HIGH" in <1s on a 3K-file repo
+2. `sourcecode endpoints keycloak` → 613 endpoints extracted from a 7,885-file repo in <1s
+3. `sourcecode fix-bug --symptom "payment"` → top result is `OrderPaymentDaoImpl`, `DefaultPaymentGatewayCheckoutService` — correct without any AI
+4. `sourcecode --compact` on Keycloak (7,885 files) → 9s cold, 0.17s cached, complete structural summary
+5. `sourcecode modernize BroadleafCommerce` → identifies `ExtensionManager` as highest-risk node (209 dependents), exactly matches intuition of experienced engineers on the codebase
+
+---
+
+## 9. Friction points in UX/CLI
+
+1. `impact OrderServiceImpl` → `direct_callers: []` with no suggestion to try `OrderService` — looks broken
+2. `review-pr` `"confidence": "LOW"` on every commit — alarming label for a legitimate result
+3. `hotspot_candidates: []` in annotation-heavy repos — no explanation, no fallback
+4. `--compact` vs `--agent` — unclear when to use which without reading docs
+5. No `--help` shortcut that explains the Spring interface vs impl distinction
+6. `project_summary` sourced from README marketing copy — not architectural description
+7. `fix-bug` output can be very large without `--output` flag — no token budget warning in terminal
+
+---
+
+## 10. Suggested positioning (1–2 lines)
+
+> Instant blast-radius analysis and AI-ready structural context for Java/Spring monoliths.
+> Run before every refactor, every PR, every AI agent session.
+
+Or more aggressive:
+
+> Before you change a Spring service, know exactly what breaks. sourcecode maps the blast radius in seconds.

sourcecode-1.32.1/docs/USER_GUIDE.md

@@ -0,0 +1,371 @@
+# sourcecode — User Guide
+
+**sourcecode** analyzes Java/Spring/Maven repositories and produces structured JSON for AI coding agents and CI/CD pipelines. It answers two questions: *what breaks if I change X* and *what does this codebase do*.
+
+---
+
+## What is it
+
+A local CLI. No API keys. No network calls. No account required.
+
+It builds a deterministic symbol graph (classes, annotations, injection edges, HTTP routes) from your repository's source files and answers structural questions about that graph. All analysis is static — it reads code, not runtime behavior.
+
+**Optimized for:** Spring Boot / Spring MVC monoliths. JAX-RS (Quarkus, Jersey) endpoint extraction at ~65% recall. Stack detection works on any codebase.
+
+---
+
+## Installation
+
+```bash
+# macOS / Linux via Homebrew (recommended)
+brew tap haroundominique/sourcecode
+brew install sourcecode
+
+# pip / pipx
+pip install sourcecode
+pipx install sourcecode   # isolated install, no venv needed
+
+# Verify
+sourcecode version
+# sourcecode 1.32.0
+```
+
+Requires Python 3.10+.
+
+---
+
+## License activation (Pro features)
+
+Free features work immediately after install. Pro commands (`impact`, `review-pr`, `fix-bug`, `modernize`, `generate-tests`) require an active license.
+
+```bash
+sourcecode activate SC-XXXX-XXXX-XXXX
+```
+
+On success:
+
+```json
+{"status": "activated", "plan": "pro", "features": ["impact", "review-pr", "fix-bug", "modernize", "generate-tests"]}
+```
+
+License is cached in `~/.sourcecode/license.json` and re-validated every 24 hours. Works offline after first activation — network errors keep the cached state.
+
+---
+
+## Core commands
+
+### `sourcecode --compact`
+
+High-signal structural summary. Use at the start of any AI agent session.
+
+```bash
+sourcecode /path/to/repo --compact
+sourcecode . --compact --git-context   # includes commit hotspots
+sourcecode . --compact --copy          # copy to clipboard
+```
+
+Output (~2,500–4,000 tokens): detected stacks, entry points, dependencies, transactional boundaries (Spring), env vars, confidence level, analysis gaps.
+
+### `sourcecode --agent`
+
+More structured version of `--compact`. Designed for AI agent system prompt injection.
+
+```bash
+sourcecode /repo --agent --output context.json
+cat context.json | claude -p "Explain the architecture"
+```
+
+Output (~4,500–5,500 tokens): project identity, entry points, file relevance ranking, architecture classification, confidence.
+
+### `sourcecode onboard`
+
+Full structural context for an unfamiliar codebase. Answers: "What is this repo and where do I start?"
+
+```bash
+sourcecode onboard /path/to/repo
+sourcecode onboard . --llm-prompt     # appends a ready-to-use prompt
+sourcecode onboard . --output onboard.json
+```
+
+Output: architecture summary, subsystems, key entry points, hotspots, tech-debt signals, analysis gaps.
+
+### `sourcecode endpoints`
+
+Extract all REST endpoints from Spring MVC and JAX-RS annotations.
+
+```bash
+sourcecode endpoints /path/to/repo
+sourcecode endpoints . --format yaml
+```
+
+Output: list of `{method, path, controller, handler}`. Covers `@GetMapping`, `@PostMapping`, `@PutMapping`, `@DeleteMapping`, `@PatchMapping`, `@RequestMapping`, `@GET`, `@POST`, `@PUT`, `@DELETE`, `@PATCH` + `@Path`.
+
+**Note:** JAX-RS sub-resource locator pattern (endpoints mounted dynamically via factory methods) is not individually counted — ~65% recall for JAX-RS.
+
+### `sourcecode impact` [Pro]
+
+Blast-radius analysis: who depends on a class and what breaks if it changes.
+
+```bash
+sourcecode impact OrderService /repo
+sourcecode impact OrderService . --depth 6
+sourcecode impact org.example.UserService /repo   # FQN form
+sourcecode impact UserService.java /repo          # file form
+```
+
+Output: `direct_callers`, `indirect_callers` (BFS to `--depth`), `endpoints_affected`, `transactional_boundaries_touched`, `risk_score` (0–100), `risk_level` (low/medium/high).
+
+**Critical:** In Spring Boot, always target the **interface**, not the implementation.
+
+```bash
+sourcecode impact OrderService /repo      # ✓ correct — returns callers via @Autowired
+sourcecode impact OrderServiceImpl /repo  # ✗ wrong — returns 0 callers (DI blindness)
+```
+
+If you get `direct_callers: []` with `resolution: exact` for a `@Service` class, re-run with the interface name.
+
+### `sourcecode fix-bug` [Pro]
+
+Risk-ranked file list correlated to a bug symptom.
+
+```bash
+sourcecode fix-bug /repo --symptom "NullPointerException in checkout"
+sourcecode fix-bug . --symptom "payment timeout"
+sourcecode fix-bug . --symptom "OIDC token refresh fails after realm update"
+```
+
+Output: `relevant_files` (ranked by symptom match evidence), `suspected_areas` with evidence chain (keyword → path → content → git correlation).
+
+**Best results with specific symptoms.** Generic symptoms ("error", "bug") return noisy file lists.
+
+### `sourcecode review-pr` [Pro]
+
+PR diff analysis: changed files, test coverage gaps, blast radius of changed classes.
+
+```bash
+sourcecode review-pr . --since main
+sourcecode review-pr . --since origin/main --format github-comment
+sourcecode review-pr . --since HEAD~3 --output review.json
+```
+
+Output: `changed_files`, `review_hotspots`, `suggested_review_order`, `test_coverage_risk`, `impact_summary`, `ci_decision`.
+
+Parse `ci_decision` and `test_coverage_risk` for automated CI gates:
+
+```bash
+DECISION=$(jq -r '.ci_decision' review.json)
+RISK=$(jq -r '.test_coverage_risk.risk_level' review.json)
+```
+
+### `sourcecode modernize` [Pro]
+
+Identifies coupling hotspots, dead zones, and cross-module tangles.
+
+```bash
+sourcecode modernize /path/to/repo
+```
+
+Output:
+- `high_coupling_nodes` — classes with highest fan-in degree (risky to change)
+- `hotspot_candidates` — services/controllers with high coupling (subset of above)
+- `dead_zone_candidates` — classes with zero callers (safe to remove)
+- `cross_module_tangles` — packages with bidirectional coupling
+
+**Note:** In annotation-heavy codebases, `hotspot_candidates` may be empty — annotation types and JPA entities dominate the coupling graph but don't qualify as hotspots. Check `high_coupling_nodes` directly.
+
+---
+
+## Typical workflows
+
+### Onboarding a new codebase (you or an AI agent)
+
+```bash
+# Step 1: get bounded context
+sourcecode onboard /repo
+
+# Step 2: understand the entry points + architecture
+sourcecode /repo --compact
+
+# Step 3: pipe to an AI agent
+sourcecode /repo --agent | claude -p "Explain the main request flow through this service"
+```
+
+### Pre-refactor safety check
+
+```bash
+# Always target the interface in Spring Boot repos:
+sourcecode impact OrderService /repo
+
+# Parse the risk level programmatically:
+sourcecode impact OrderService /repo | jq '{risk_level, risk_score, direct_callers_count: (.direct_callers | length), endpoints_count: (.endpoints_affected | length)}'
+
+# If touching a very large hub interface, use depth=1 for speed:
+sourcecode impact KeycloakSession /repo --depth 1
+```
+
+### Bug triage
+
+```bash
+# Specific symptoms → best signal:
+sourcecode fix-bug /repo --symptom "NullPointerException OrderService.findOrderById line 234"
+
+# Save full output for complex bugs:
+sourcecode fix-bug /repo --symptom "payment gateway timeout" --output triage.json
+
+# Top files will include:
+# - symptom_match: direct keyword/path match
+# - suspected_areas: annotations + evidence chain
+# - relevant_files: risk-ranked by composite score
+```
+
+### PR review
+
+```bash
+# JSON output for automated gates:
+sourcecode review-pr . --since origin/main --output review.json
+jq '{ci_decision, test_coverage_risk, impact_summary}' review.json
+
+# Markdown comment for GitHub:
+sourcecode review-pr . --since main --format github-comment
+
+# Specific range:
+sourcecode review-pr . --since HEAD~5
+```
+
+### Understand the REST API surface
+
+```bash
+sourcecode endpoints /repo
+sourcecode endpoints /repo | jq '.endpoints | map(select(.method == "POST"))' # POST endpoints only
+sourcecode endpoints /repo --output endpoints.json
+```
+
+### MCP server (AI agent integration)
+
+```bash
+# One-time setup (Claude Desktop / Cursor):
+sourcecode mcp init
+
+# Verify setup:
+sourcecode mcp status
+
+# Start server manually:
+sourcecode mcp serve
+
+# Remove:
+sourcecode mcp remove
+```
+
+The MCP server exposes structural analysis tools to AI agents without requiring the agent to call the CLI directly. Claude Desktop and Cursor can query impact, endpoints, and context through the MCP protocol.
+
+---
+
+## Output schema
+
+All commands output structured JSON to stdout unless `--output` is specified.
+
+Common fields:
+- `schema_version` — format version
+- `confidence_summary.overall` — `high` / `medium` / `low`
+- `analysis_gaps` — list of what could not be analyzed and why
+
+Java/Spring-specific fields (when detected):
+- `transactional_boundaries` — classes annotated with `@Transactional`
+- `language_version` — from `maven.compiler.source`
+- `deployment.spring_boot_version`
+- `deployment.packaging` — `jar` or `war`
+- `mybatis` — mapper interface/XML pairing summary
+
+### Output modes
+
+| Mode | When to use | Token size |
+|------|-------------|-----------|
+| `--compact` | AI session start, high-level overview | 2,500–4,000 |
+| `--agent` | AI agent system prompt injection | 4,500–5,500 |
+| `onboard` | Task-structured agent/developer onboarding | ~2,600 |
+| `fix-bug` (trimmed) | Bug triage with token budget | ~4,600 |
+| `--full` | Remove truncation limits | unlimited |
+
+---
+
+## Caching
+
+Analysis is cached by content hash. Unchanged files do not re-scan.
+
+- Cache hit speedup: 13–33× depending on repo size
+- BroadleafCommerce (2,985 files): 2.9s cold → 0.20s cached
+- Keycloak (7,885 files): 9.0s cold → 0.27s cached
+- Bypass: `sourcecode --no-cache`
+
+The cache is stored locally. No content leaves your machine.
+
+---
+
+## Flags reference
+
+| Flag | Short | Description |
+|------|-------|-------------|
+| `--compact` | | High-signal summary + transactional boundaries |
+| `--agent` | | Structured JSON for AI agent injection |
+| `--full` | | Remove truncation limits |
+| `--git-context` | `-g` | Add commit hotspots and uncommitted file count |
+| `--changed-only` | | Limit to git-modified files |
+| `--depth N` | | Traversal depth (default: 4, max: 20) |
+| `--format` | `-f` | `json` (default) or `yaml` |
+| `--output` | `-o` | Write to file instead of stdout |
+| `--no-cache` | | Force fresh analysis |
+| `--copy` | `-c` | Copy output to clipboard |
+| `--no-redact` | | Disable automatic secret redaction |
+| `--exclude PATTERN` | | Skip directories matching pattern |
+| `--version` | `-v` | Show version and exit |
+
+---
+
+## Troubleshooting
+
+### `impact` returns 0 callers for a @Service class
+
+You're targeting the implementation. Spring Boot uses interface injection.
+
+```bash
+# Wrong:
+sourcecode impact UserServiceImpl /repo   # 0 callers
+
+# Correct:
+sourcecode impact UserService /repo       # real blast radius
+```
+
+### `hotspot_candidates` is empty after `modernize`
+
+Check `high_coupling_nodes` instead. In annotation-heavy codebases, the highest-coupled symbols are annotation types and JPA entities, not services. These are excluded from `hotspot_candidates` by role filter.
+
+### `review-pr` shows `confidence: LOW`
+
+Expected for small commits or commits touching files without annotation signals. The output is still accurate — low confidence means the role classification fell back to filename/git-diff only. Check `analysis_limiter.missing_signals` for details.
+
+### `endpoints` shows 0 for a Spring project
+
+Most common causes:
+1. Endpoints use non-standard annotation composition (meta-annotations). Direct `@GetMapping` detection only.
+2. JAX-RS sub-resource locator pattern — endpoints mounted dynamically.
+3. Kotlin Spring controllers (Java-only analysis).
+
+### Cold scan is slow (>30s)
+
+For very large repos (15K+ Java files), consider:
+- `--fast` flag (skips deep content search): `sourcecode fix-bug --fast`
+- `--exclude legacy,generated` to skip non-production code
+- After first run, cache hits will be <1s
+
+---
+
+## Limitations
+
+- Static analysis only — no runtime behavior, no bytecode analysis
+- No semantic code understanding — reads structure, not logic
+- Spring MVC layered apps: high accuracy. Quarkus SPI/plugin model: architecture classification may be inaccurate
+- JAX-RS subresource locator pattern: ~65% endpoint recall
+- `impact` on implementation classes returns implementation-specific callers only — always target the interface in Spring Boot
+- `no_security_signal` on endpoints = no method-level annotations found. Does not mean the endpoint is unsecured (Spring Security filter chains are not analyzed)
+- `project_summary` is extracted from README — may reflect marketing copy rather than architectural description
+- Works offline; no AI inference — outputs structural facts, not quality judgments

{sourcecode-1.31.32 → sourcecode-1.32.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.31.32"
+version = "1.32.1"
 description = "Deterministic codebase context for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.31.32 → sourcecode-1.32.1}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.31.32"
+__version__ = "1.32.1"