sourcecode 1.31.9__tar.gz → 1.31.10__tar.gz

{sourcecode-1.31.9 → sourcecode-1.31.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.31.9
+Version: 1.31.10
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -225,7 +225,7 @@ Description-Content-Type: text/markdown
 
 **Deterministic, behavior-aware codebase context for AI agents and PR review.**
 
-![Version](https://img.shields.io/badge/version-1.31.9-blue)
+![Version](https://img.shields.io/badge/version-1.31.10-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -261,7 +261,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.9
+# sourcecode 1.31.10
 ```
 
 ---

{sourcecode-1.31.9 → sourcecode-1.31.10}/README.md

@@ -2,7 +2,7 @@
 
 **Deterministic, behavior-aware codebase context for AI agents and PR review.**
 
-![Version](https://img.shields.io/badge/version-1.31.9-blue)
+![Version](https://img.shields.io/badge/version-1.31.10-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -38,7 +38,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.9
+# sourcecode 1.31.10
 ```
 
 ---

{sourcecode-1.31.9 → sourcecode-1.31.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.31.9"
+version = "1.31.10"
 description = "Deterministic codebase context for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.31.9 → sourcecode-1.31.10}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.31.9"
+__version__ = "1.31.10"

{sourcecode-1.31.9 → sourcecode-1.31.10}/src/sourcecode/classifier.py

@@ -20,6 +20,7 @@ _API_FRAMEWORKS = {
     "Rocket",
     "Spring Boot",
     "Quarkus",
+    "Jakarta EE",   # JAX-RS / Jakarta REST — pure JAX-RS projects must not fall to "unknown"
     "Laravel",
     "Symfony",
     "Ktor",

{sourcecode-1.31.9 → sourcecode-1.31.10}/src/sourcecode/dependency_analyzer.py

@@ -128,8 +128,13 @@ def _infer_role(name: str, ecosystem: str, scope: str) -> str:
         return "runtime"
 
     if ecosystem == "java":
+        # Scope is authoritative: provided and dev scopes are not runtime, regardless of
+        # artifact name. Checking artifact patterns first would mis-classify spring-boot-test
+        # (scope=test) as "runtime", inflating false-positive fan-in signals.
         if scope == "provided":
             return "provided"
+        if is_dev:
+            return "devtool"
         artifact = n.split(":")[-1] if ":" in n else n
         if any(x in artifact for x in ("spring-boot", "spring-security")):
             return "runtime"
@@ -143,7 +148,7 @@ def _infer_role(name: str, ecosystem: str, scope: str) -> str:
             return "parsing"
         if any(x in artifact for x in ("jjwt", "nimbus-jose")):
             return "runtime"
-        return "devtool" if is_dev else "runtime"
+        return "runtime"
 
     return "devtool" if is_dev else "runtime"
 

{sourcecode-1.31.9 → sourcecode-1.31.10}/src/sourcecode/detectors/java.py

@@ -34,13 +34,16 @@ _HTTP_PATH_RE = re.compile(
 _REQUEST_METHOD_VERB_RE = re.compile(
     r'method\s*=\s*RequestMethod\.([A-Z]+)'
 )
-# @M3FiltroSeguridad custom security annotation
-_M3_FILTRO_RE = re.compile(r'@M3FiltroSeguridad\b')
-_M3_FILTRO_PARAMS_RE = re.compile(
-    r'@M3FiltroSeguridad\s*\(\s*'
-    r'(?:nombreRecurso\s*=\s*(?:"([^"]*)"|([\w.]+)))?'  # group 1: string literal, group 2: constant ref
-    r'(?:[^)]*nivelRequerido\s*=\s*(\d+))?'  # group 3: nivel
-)
+# Custom security annotation registry — extend here for project-specific annotations.
+# Each entry: annotation_simple_name → compiled params regex.
+# Groups: (1) resource string literal, (2) resource constant ref, (3) level integer.
+_CUSTOM_SECURITY_ANNOTATIONS: dict[str, re.Pattern] = {
+    "M3FiltroSeguridad": re.compile(
+        r'@M3FiltroSeguridad\s*\(\s*'
+        r'(?:nombreRecurso\s*=\s*(?:"([^"]*)"|([\w.]+)))?'
+        r'(?:[^)]*nivelRequerido\s*=\s*(\d+))?'
+    ),
+}
 
 # Security config detection
 _WEB_SECURITY_CONFIGURER_RE = re.compile(r'WebSecurityConfigurerAdapter\b')
@@ -436,7 +439,7 @@ class JavaDetector(AbstractDetector):
         ))
         if (not has_controller and not has_filter and not has_security
                 and "ControllerAdvice" not in content
-                and "M3FiltroSeguridad" not in content
+                and not any(ann in content for ann in _CUSTOM_SECURITY_ANNOTATIONS)
                 and not has_jax_rs and not has_cdi and not has_spi):
             return []
 
@@ -449,11 +452,13 @@ class JavaDetector(AbstractDetector):
             elif verb_match:
                 http_path = f"[{verb_match.group(1)}]"
             security_evidence = None
-            m3_match = _M3_FILTRO_PARAMS_RE.search(content)
-            if m3_match:
-                nombre = m3_match.group(1) or m3_match.group(2) or ""
-                nivel = m3_match.group(3) or ""
-                security_evidence = f"@M3FiltroSeguridad(nombreRecurso={nombre!r}, nivelRequerido={nivel})"
+            for _ann_name, _ann_re in _CUSTOM_SECURITY_ANNOTATIONS.items():
+                _m = _ann_re.search(content)
+                if _m:
+                    nombre = _m.group(1) or _m.group(2) or ""
+                    nivel = _m.group(3) or ""
+                    security_evidence = f"@{_ann_name}(nombreRecurso={nombre!r}, nivelRequerido={nivel})"
+                    break
             return [EntryPoint(
                 path=rel_path, stack="java", kind="rest_controller",
                 source="annotation", confidence="high",
@@ -474,11 +479,13 @@ class JavaDetector(AbstractDetector):
             elif verb_match:
                 http_path = f"[{verb_match.group(1)}]"
             security_evidence = None
-            m3_match = _M3_FILTRO_PARAMS_RE.search(content)
-            if m3_match:
-                nombre = m3_match.group(1) or m3_match.group(2) or ""
-                nivel = m3_match.group(3) or ""
-                security_evidence = f"@M3FiltroSeguridad(nombreRecurso={nombre!r}, nivelRequerido={nivel})"
+            for _ann_name, _ann_re in _CUSTOM_SECURITY_ANNOTATIONS.items():
+                _m = _ann_re.search(content)
+                if _m:
+                    nombre = _m.group(1) or _m.group(2) or ""
+                    nivel = _m.group(3) or ""
+                    security_evidence = f"@{_ann_name}(nombreRecurso={nombre!r}, nivelRequerido={nivel})"
+                    break
             return [EntryPoint(
                 path=rel_path, stack="java", kind="mvc_controller",
                 source="annotation", confidence="medium",
@@ -514,7 +521,10 @@ class JavaDetector(AbstractDetector):
             )]
 
         # --- JAX-RS resource class ---
-        if has_jax_rs and _JAX_RS_PATH_RE.search(content) and _JAX_RS_VERB_RE.search(content):
+        # Guard uses annotation PRESENCE ("@Path" in content), not _JAX_RS_PATH_RE, because
+        # the value-parsing regex fails for @Path(CONSTANT) and @Path(PREFIX + "/sub").
+        # _JAX_RS_PATH_RE is still used to extract the http_path display string when parseable.
+        if has_jax_rs and "@Path" in content and _JAX_RS_VERB_RE.search(content):
             path_m = _JAX_RS_PATH_RE.search(content)
             verb_m = _JAX_RS_VERB_RE.search(content)
             http_path: str | None = None

{sourcecode-1.31.9 → sourcecode-1.31.10}/src/sourcecode/prepare_context.py

@@ -2103,8 +2103,15 @@ class TaskContextBuilder:
         _uncommitted = uncommitted_files or set()
         _max_churn = max(_hotspots.values(), default=1)
 
+        # Per-file note counts — feeds code_note_count into RankingEngine for all tasks.
+        # RankingEngine is the sole ranking source; no ad-hoc annotation boost outside it.
+        _note_counts: dict[str, int] = {}
+        for _n in (code_notes or []):
+            _np = getattr(_n, "path", "")
+            if _np:
+                _note_counts[_np] = _note_counts.get(_np, 0) + 1
+
         # Pre-compute fix-bug signals (used only when task_name == "fix-bug")
-        _annotated_files: set[str] = set()
         _dominant_stack = ""
         _recently_changed_stacks: set[str] = set()
         # Query-aware signals extracted from symptom (class names, exception types, tokens)
@@ -2113,10 +2120,6 @@ class TaskContextBuilder:
         _symptom_tokens: set[str] = set()          # all lowercase tokens
 
         if task_name == "fix-bug":
-            _bug_kinds = {"FIXME", "BUG", "HACK", "XXX"}
-            for _n in (code_notes or []):
-                if getattr(_n, "kind", "").upper() in _bug_kinds:
-                    _annotated_files.add(getattr(_n, "path", ""))
 
             def _file_stack(p: str) -> str:
                 ext = Path(p).suffix.lower()
@@ -2167,13 +2170,15 @@ class TaskContextBuilder:
             if is_test and task_name != "generate-tests":
                 continue
 
-            # Structural + git signals from unified engine (task-weighted)
+            # Structural + git signals from unified engine (task-weighted).
+            # code_note_count routes annotation density through RankingEngine — single source.
             fs = engine.score(
                 path,
                 is_entrypoint=(path in runtime_entry_set),
                 git_churn=_hotspots.get(path, 0),
                 max_churn=_max_churn,
                 is_changed=(path in _uncommitted),
+                code_note_count=_note_counts.get(path, 0),
                 task=task_name,
             )
 
@@ -2264,9 +2269,6 @@ class TaskContextBuilder:
                 if _recency > 0:
                     content_boost += _recency
                     _why_parts.append(f"recent commits (+{_recency:.2f})")
-                if path in _annotated_files:
-                    content_boost += 0.20
-                    _why_parts.append("FIXME/BUG annotation (+0.20)")
                 _file_stk = _file_stack(path)
                 if _dominant_stack and _file_stk == _dominant_stack:
                     content_boost += 0.10

{sourcecode-1.31.9 → sourcecode-1.31.10}/src/sourcecode/repository_ir.py

@@ -225,6 +225,14 @@ _SPRING_OTHER: frozenset[str] = frozenset({
 
 _PUBLISH_EVENT_RE = re.compile(r'\.publishEvent\s*\(\s*new\s+(\w+)\s*[(\{]')
 
+# Keycloak SPI event fire pattern: XxxEvent.fire(session, ...)
+_FIRE_EVENT_RE = re.compile(r'\b(\w+Event)\.fire\s*\(')
+
+# Edge types used for subsystem grouping — semantic hierarchy only, not imports
+_SUBSYSTEM_STRUCTURAL_EDGES: frozenset[str] = frozenset({
+    "extends", "implements", "injects", "contained_in",
+})
+
 _HTTP_METHOD_MAP: dict[str, str] = {
     # Spring MVC
     "@GetMapping": "GET",
@@ -859,8 +867,8 @@ def _build_relations(
                     evidence={"type": "structural", "value": f"member of {enclosing}"},
                 ))
 
-    # Fix 5: Event flow edges — publishEvent publishers and @EventListener subscribers.
-    # listens_to_event: method with @EventListener → resolved event parameter type(s).
+    # Event flow edges — listens_to_event and publishes_event.
+    # Spring: method with @EventListener → resolved event parameter type(s).
     for sym in symbols:
         if sym.type == "method" and "@EventListener" in sym.annotations:
             for imp_fqn in sym.imports_used:
@@ -872,8 +880,9 @@ def _build_relations(
                     evidence={"type": "annotation", "value": "@EventListener"},
                 ))
 
-    # publishes_event: class that calls publishEvent(new XxxEvent(...)) → event type FQN.
     _class_syms = [s for s in symbols if s.type in ("class", "interface") and "#" not in s.symbol]
+
+    # Spring: class that calls publishEvent(new XxxEvent(...)) → event type FQN.
     for m in _PUBLISH_EVENT_RE.finditer(source):
         event_simple = m.group(1)
         event_fqn = import_map.get(event_simple, event_simple)
@@ -886,6 +895,32 @@ def _build_relations(
                 evidence={"type": "method_call", "value": f"publishEvent(new {event_simple})"},
             ))
 
+    # Keycloak SPI: XxxEvent.fire(...) static dispatch → publishes_event.
+    for m in _FIRE_EVENT_RE.finditer(source):
+        event_simple = m.group(1)
+        event_fqn = import_map.get(event_simple, event_simple)
+        for cls_sym in _class_syms:
+            edges.append(RelationEdge(
+                from_symbol=cls_sym.symbol,
+                to_symbol=event_fqn,
+                type="publishes_event",
+                confidence="medium",
+                evidence={"type": "method_call", "value": f"{event_simple}.fire(...)"},
+            ))
+
+    # Keycloak SPI: class implementing EventListenerProvider → listens_to_event.
+    _ELP_IFACE = "EventListenerProvider"
+    for sym in symbols:
+        if sym.type == "class" and _ELP_IFACE in (sym.signature or ""):
+            event_fqn = import_map.get("Event", "org.keycloak.events.Event")
+            edges.append(RelationEdge(
+                from_symbol=sym.symbol,
+                to_symbol=event_fqn,
+                type="listens_to_event",
+                confidence="high",
+                evidence={"type": "signature", "value": f"implements {_ELP_IFACE}"},
+            ))
+
     seen: set[tuple[str, str, str]] = set()
     unique: list[RelationEdge] = []
     for e in edges:
@@ -1248,49 +1283,72 @@ def _common_package_prefix(fqns: list[str]) -> str:
 
 
 def _subsystem_label(package_prefix: str) -> str:
-    """Derive short human label from package prefix (last meaningful segment)."""
+    """Derive short human label enforcing minimum meaningful depth.
+
+    For org.keycloak.services → "keycloak.services" (not "services" alone).
+    Avoids single-segment labels like "org" or "keycloak" that convey nothing.
+    """
     parts = [p for p in package_prefix.split(".") if p]
-    # Skip generic top-level segments
     _SKIP = {"com", "org", "net", "io", "java", "javax"}
     meaningful = [p for p in parts if p not in _SKIP]
-    return meaningful[-1] if meaningful else (parts[-1] if parts else package_prefix)
-
-
-def _detect_subsystems(all_fqns: list[str], relations: list[RelationEdge]) -> list[dict]:
-    """Connected components of the relation graph (Union-Find, graph-only).
-
-    Returns labeled subsystem objects instead of raw FQN arrays.
+    if not meaningful:
+        return parts[-1] if parts else package_prefix
+    # Use last two meaningful segments for disambiguation:
+    # org.keycloak.services → ["keycloak", "services"] → "keycloak.services"
+    if len(meaningful) >= 2:
+        return f"{meaningful[-2]}.{meaningful[-1]}"
+    return meaningful[-1]
+
+
+def _canonical_subsystem_pkg(fqn: str) -> str:
+    """Canonical subsystem package for a FQN — minimum depth 3 for org/com/net/io packages.
+
+    org.keycloak.services.FooResource  → org.keycloak.services
+    org.keycloak.FooClass              → org.keycloak
+    com.example.util.Helper            → com.example.util
+    SomeTopLevelClass                  → SomeTopLevelClass
+
+    Never returns a bare TLD ("org", "com") — that collapses all classes into one subsystem.
+    When only 1 lowercase segment exists before the class boundary, grabs one raw segment
+    (even if uppercase) to force at least 2-segment grouping.
+    """
+    _TOP_LEVEL = {"com", "org", "net", "io", "java", "javax"}
+    parts: list[str] = []
+    for segment in fqn.split("."):
+        if "#" in segment or (segment and segment[0].isupper()):
+            break
+        parts.append(segment)
+    if not parts:
+        return fqn.rsplit(".", 1)[0] if "." in fqn else fqn
+    if parts[0] in _TOP_LEVEL and len(parts) >= 3:
+        return ".".join(parts[:3])
+    # Prevent bare TLD collapse: "org" or "com" alone as subsystem key is meaningless
+    # and groups ALL classes under that TLD into a single giant component.
+    # When only the TLD was collected before hitting a class boundary, grab the next
+    # raw FQN segment (may be uppercase) to produce a 2-segment grouping key.
+    if parts[0] in _TOP_LEVEL and len(parts) == 1:
+        raw = fqn.split(".")
+        if len(raw) >= 2:
+            return f"{raw[0]}.{raw[1].split('#')[0]}"
+    return ".".join(parts)
+
+
+def _detect_subsystems(all_fqns: list[str], relations: list[RelationEdge]) -> list[dict]:  # noqa: ARG001
+    """Group symbols by canonical subsystem package (minimum depth org.keycloak.<module>).
+
+    Uses package-prefix grouping instead of Union-Find on relation edges.
+    Union-Find on imports produced one giant component ("org") for large monorepos.
+    Package-prefix grouping at depth 3 yields meaningful module-level subsystems.
     """
-    fqn_set = set(all_fqns)
-    parent: dict[str, str] = {fqn: fqn for fqn in all_fqns}
-
-    def find(x: str) -> str:
-        while parent[x] != x:
-            parent[x] = parent[parent[x]]
-            x = parent[x]
-        return x
-
-    def union(x: str, y: str) -> None:
-        rx, ry = find(x), find(y)
-        if rx != ry:
-            parent[rx] = ry
-
-    for edge in relations:
-        f, t = edge.from_symbol, edge.to_symbol
-        if f in fqn_set and t in fqn_set:
-            union(f, t)
-
     components: dict[str, list[str]] = {}
     for fqn in all_fqns:
-        root = find(fqn)
-        components.setdefault(root, []).append(fqn)
+        pkg = _canonical_subsystem_pkg(fqn)
+        components.setdefault(pkg, []).append(fqn)
 
     result: list[dict] = []
-    for members in sorted(components.values()):
+    for pkg_prefix, members in sorted(components.items()):
         members = sorted(members)
-        pkg_prefix = _common_package_prefix(members)
         label = _subsystem_label(pkg_prefix)
-        # Summary: first 3 short class names + total count
         short_names = [m.split(".")[-1].split("#")[0] for m in members[:3]]
         summary = ", ".join(short_names)
         if len(members) > 3:
@@ -1409,6 +1467,56 @@ def _bfs_impact_with_paths(
 # Phase 5 — Assembly: single output contract
 # ---------------------------------------------------------------------------
 
+def _compute_analysis_gaps(
+    symbols: list[SymbolRecord],
+    spring_summary: dict,
+    route_surface: list[dict],
+    relations: list[RelationEdge],
+) -> list[dict]:
+    """Compute structural analysis gaps — real system failures, not cosmetic issues."""
+    gaps: list[dict] = []
+
+    if not symbols:
+        gaps.append({
+            "area": "symbol_extraction",
+            "reason": "No Java symbols extracted — check path or file access",
+            "impact": "high",
+        })
+        return gaps
+
+    controllers = spring_summary.get("controllers", [])
+    if controllers and not route_surface:
+        gaps.append({
+            "area": "route_surface",
+            "reason": (
+                f"{len(controllers)} controller(s) detected but route_surface is empty — "
+                "JAX-RS @Path or Spring @RequestMapping annotations may be missing"
+            ),
+            "impact": "high",
+        })
+
+    # Detect EventListenerProvider implementations via class signature, not class name.
+    # A class named "CustomProcessor" implementing EventListenerProvider would be missed
+    # by a class-name check but is correctly found via its implements clause in signature.
+    _ELP_IFACE = "EventListenerProvider"
+    elp_impls = [
+        sym.symbol for sym in symbols
+        if sym.type == "class" and _ELP_IFACE in (sym.signature or "")
+    ]
+    event_edges = [e for e in relations if e.type in ("listens_to_event", "publishes_event")]
+    if elp_impls and not event_edges:
+        gaps.append({
+            "area": "event_flow",
+            "reason": (
+                f"{len(elp_impls)} EventListenerProvider implementation(s) found but "
+                "no event flow edges detected"
+            ),
+            "impact": "medium",
+        })
+
+    return gaps
+
+
 def _edge_to_dict(edge: RelationEdge) -> dict:
     return {
         "from": edge.from_symbol,
@@ -1629,19 +1737,18 @@ def _assemble(
             by_type.setdefault(e.type, []).append(e.from_symbol)
         reverse_graph_out[target] = by_type
 
-    # IC-005: aggregate event flow edges already built in _build_relations
+    # IC-005: aggregate event flow edges already built in _build_relations.
+    # Always emit spring_events (even when empty) so callers don't need key-presence checks.
     _listen_edges = [e for e in sorted_rels if e.type == "listens_to_event"]
     _publish_edges = [e for e in sorted_rels if e.type == "publishes_event"]
-    _spring_events: Optional[dict] = None
-    if _listen_edges or _publish_edges:
-        _spring_events = {
-            "listeners": sorted({e.from_symbol for e in _listen_edges}),
-            "publishers": sorted({e.from_symbol for e in _publish_edges}),
-            "event_types": sorted({e.to_symbol for e in _listen_edges + _publish_edges}),
-            "flow_count": len(_listen_edges) + len(_publish_edges),
-        }
+    _spring_events: dict = {
+        "listeners": sorted({e.from_symbol for e in _listen_edges}),
+        "publishers": sorted({e.from_symbol for e in _publish_edges}),
+        "event_types": sorted({e.to_symbol for e in _listen_edges + _publish_edges}),
+        "flow_count": len(_listen_edges) + len(_publish_edges),
+    }
 
-    return {
+    _base = {
         "schema_version": "final-v1",
         "graph": {
             "nodes": graph_nodes,
@@ -1662,11 +1769,19 @@ def _assemble(
         },
         "subsystems": subsystems,
         "change_set": change_set_out,
-        "route_surface": _build_route_surface(sorted_syms, route_diffs, extends_map={
-            e.from_symbol: e.to_symbol.split(".")[-1]
-            for e in sorted_rels if e.type == "extends"
-        }),
-        **({"spring_events": _spring_events} if _spring_events else {}),
+    }
+
+    _route_surface = _build_route_surface(sorted_syms, route_diffs, extends_map={
+        e.from_symbol: e.to_symbol.split(".")[-1]
+        for e in sorted_rels if e.type == "extends"
+    })
+    _analysis_gaps = _compute_analysis_gaps(sorted_syms, spring_summary, _route_surface, sorted_rels)
+
+    return {
+        **_base,
+        "route_surface": _route_surface,
+        "spring_events": _spring_events,
+        "analysis_gaps": _analysis_gaps,
         "audit": {
             "dropped_fields": dropped_fields,
         },
@@ -1713,7 +1828,12 @@ def _build_route_surface(
             # JAX-RS: class-level @Path is the resource prefix.
             args = sym.annotation_values.get("@Path", "")
             prefixes = _parse_route_paths(args) if args else [""]
-        class_info[simple] = {"fqn": sym.symbol, "prefixes": prefixes, "own_endpoints": []}
+        class_info[simple] = {
+            "fqn": sym.symbol,
+            "prefixes": prefixes,
+            "own_endpoints": [],
+            "has_path_ann": "@Path" in sym.annotations or "@RequestMapping" in sym.annotations,
+        }
 
     routes: list[dict] = []
     seen: set[tuple] = set()
@@ -1732,6 +1852,15 @@ def _build_route_surface(
         # JAX-RS: HTTP verb annotations carry no path; path lives in @Path on the method.
         if ann_name in _JAXRS_HTTP_ANNOTATIONS:
             suffix = _parse_route_path(sym.annotation_values.get("@Path", ""))
+            # Skip JAX-RS routes with no server-side path binding — client proxy interfaces
+            # have HTTP verb annotations but neither a class-level @Path nor a method @Path.
+            # Use has_path_ann (annotation presence) not just prefix value: @Path args may be
+            # unparsed (multi-line, constant expression) yet the class IS a server resource.
+            _cls_entry = class_info.get(cls_simple, {})
+            cls_prefixes = _cls_entry.get("prefixes", [""])
+            cls_has_path = _cls_entry.get("has_path_ann", False)
+            if not suffix and not cls_has_path and all(not p for p in cls_prefixes):
+                continue
         else:
             suffix = _parse_route_path(args)
         method = _parse_route_http_method(ann_name, args) or "GET"

{sourcecode-1.31.9 → sourcecode-1.31.10}/src/sourcecode/semantic_analyzer.py

@@ -54,10 +54,18 @@ _MAPPER_IFACE_RE = re.compile(
 _EXTENDS_RE = re.compile(
     r'(?:class|interface)\s+([A-Z][A-Za-z0-9_]*)\s+extends\s+([A-Z][A-Za-z0-9_]*)'
 )
-_M3_FILTRO_METHOD_RE = re.compile(
-    r'@M3FiltroSeguridad(?:\([^)]*\))?\s+(?:@[^\s]+\s+)*'
-    r'(?:public|private|protected)\s+\w[\w<>\[\]]*\s+([a-z][A-Za-z0-9_]*)\s*\('
-)
+# Custom AOP annotation registry — extend here for project-specific security/AOP annotations.
+# Each entry: (method_regex, impl_symbol_name).
+# method_regex must capture the annotated method name in group 1.
+_CUSTOM_AOP_ANNOTATIONS: list[tuple[re.Pattern, str]] = [
+    (
+        re.compile(
+            r'@M3FiltroSeguridad(?:\([^)]*\))?\s+(?:@[^\s]+\s+)*'
+            r'(?:public|private|protected)\s+\w[\w<>\[\]]*\s+([a-z][A-Za-z0-9_]*)\s*\('
+        ),
+        "M3FiltroSeguridadImpl",
+    ),
+]
 _LOMBOK_CLASS_RE = re.compile(
     r'(@(?:Data|Slf4j|Builder|AllArgsConstructor|NoArgsConstructor)(?:\([^)]*\))?\s+)*'
     r'(?:public\s+)?(?:class|interface)\s+([A-Z][A-Za-z0-9_]*)',
@@ -1061,19 +1069,20 @@ class SemanticAnalyzer:
                 method="heuristic",
             ))
 
-        # P3-C: @M3FiltroSeguridad AOP proxy edges
-        for m in _M3_FILTRO_METHOD_RE.finditer(content):
-            method_name = m.group(1)
-            line = content[: m.start()].count("\n") + 1
-            calls.append(CallRecord(
-                caller_path=rel_path,
-                caller_symbol="M3FiltroSeguridadImpl",
-                callee_path=rel_path,
-                callee_symbol=method_name,
-                call_line=line,
-                confidence="medium",
-                method="heuristic",
-            ))
+        # P3-C: Custom AOP annotation proxy edges — driven by _CUSTOM_AOP_ANNOTATIONS registry
+        for _aop_re, _aop_impl in _CUSTOM_AOP_ANNOTATIONS:
+            for m in _aop_re.finditer(content):
+                method_name = m.group(1)
+                line = content[: m.start()].count("\n") + 1
+                calls.append(CallRecord(
+                    caller_path=rel_path,
+                    caller_symbol=_aop_impl,
+                    callee_path=rel_path,
+                    callee_symbol=method_name,
+                    call_line=line,
+                    confidence="medium",
+                    method="heuristic",
+                ))
 
         return symbols, calls