sourcecode 1.33.3__py3-none-any.whl → 1.33.5__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.33.3"
+__version__ = "1.33.5"

sourcecode/cli.py

@@ -658,7 +658,6 @@ def main(
     env_map: bool = typer.Option(
         False,
         "--env-map",
-        hidden=True,
         help="Map environment variables referenced across the codebase.",
     ),
     code_notes: bool = typer.Option(
@@ -1226,13 +1225,24 @@ def main(
                 _uncommitted = False
             _hit_source = "L2_view" if (_view_key and _core_hash) else "L1_core"
             _data_scope = "COMPACT" if compact else ("AGENT" if agent else "FULL")
+            # Recover generated_at from cached content before overwriting _cache block.
+            _cached_generated_at = None
+            try:
+                import json as _json_ga
+                _cached_generated_at = (
+                    _json_ga.loads(_cache_hit_content)
+                    .get("_cache", {})
+                    .get("generated_at")
+                )
+            except Exception:
+                pass
             _cache_hit_content = _inject_cache_meta(_cache_hit_content, {
                 "cache_source": _hit_source,
                 "git_head_at_generation": _git_sha,
                 "current_git_head": _git_sha,
                 "is_stale": False,
                 "has_uncommitted_changes": _uncommitted,
-                "generated_at": None,
+                "generated_at": _cached_generated_at,
                 "data_scope": _data_scope,
             })
         write_output(_cache_hit_content, output=output)
@@ -1880,8 +1890,9 @@ def main(
             if _gc_early and not (_bad_gc & set(_gc_early.limitations)):
                 _uc = _gc_early.uncommitted_changes
                 if _uc:
-                    # WORKTREE_UNSTAGED + WORKTREE_STAGED only; untracked excluded
-                    _allowed_changed_files = set(_uc.staged) | set(_uc.unstaged)
+                    # Include untracked (new files not yet staged) so new source files
+                    # are analyzed under --changed-only, not silently treated as "clean".
+                    _allowed_changed_files = set(_uc.staged) | set(_uc.unstaged) | set(_uc.untracked)
                 if not _allowed_changed_files:
                     # Git is available and confirms no uncommitted changes.
                     # Do NOT fall back to a full scan — that would silently produce
@@ -1900,10 +1911,10 @@ def main(
             changed_only = False
         if _git_confirmed_clean:
             _nc_payload = json.dumps({
-                "status": "working_tree_clean",
-                "no_changes": True,
                 "changed_files": [],
-                "message": "No uncommitted changes detected — working tree is clean.",
+                "message": "no uncommitted changes detected",
+                "analysis_scope": "empty",
+                "_meta": {"changed_only": True},
             }, ensure_ascii=False)
             write_output(_nc_payload, output=output)
             raise typer.Exit()
@@ -2626,7 +2637,14 @@ def prepare_context_cmd(
     if _task_include("improvement_opportunities") and output.improvement_opportunities:
         out["improvement_opportunities"] = output.improvement_opportunities
     if _task_include("test_gaps") and output.test_gaps:
-        out["test_gaps"] = output.test_gaps
+        # Emit both the canonical name (untested_sources) and the compat alias (test_gaps)
+        # so agents can use either. untested_sources is the correct semantic name.
+        out["untested_sources"] = output.test_gaps
+        out["test_gaps"] = output.test_gaps  # backward compat alias
+        if task == "generate-tests":
+            _et_count = getattr(output, "existing_test_count", None)
+            if _et_count is not None:
+                out["existing_test_count"] = _et_count
     # P0-2: fast-mode truncation transparency — always emit when truncated, even if test_gaps is []
     # Use `is True` (strict) so MagicMock objects in tests don't trigger this branch.
     if getattr(output, "truncated", False) is True:
@@ -3543,6 +3561,12 @@ def fix_bug_cmd(
       sourcecode impact <target>   — Propagate impact from a specific class
       sourcecode onboard .         — Full architecture context first
     """
+    if not symptom:
+        typer.echo(
+            "[fix-bug] Results are significantly better with --symptom. "
+            "Example: --symptom 'NullPointerException in PaymentService'",
+            err=True,
+        )
     ctx.invoke(
         prepare_context_cmd,
         task="fix-bug",
@@ -4298,19 +4322,21 @@ def cache_status_cmd(
 def cache_clear_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt."),
-    include_ris: bool = typer.Option(False, "--include-ris", help="Also delete the RIS snapshot (ris.json.gz). By default, RIS is preserved across clears."),
+    include_ris: bool = typer.Option(False, "--include-ris", hidden=True, help="Alias for --all. Preserved for backward compatibility."),
+    all_: bool = typer.Option(False, "--all", help="Also delete the RIS snapshot (ris.json.gz). By default, RIS is preserved across clears."),
 ) -> None:
     """Delete cached snapshots for a repository.
 
     By default, RIS (ris.json.gz) is preserved — it is the persistent structural
-    index used for cold-start bootstrapping.  Use --include-ris to also clear it.
+    index used for cold-start bootstrapping.  Use --all to also clear it.
     """
     from sourcecode import cache as _cm
     target = Path(path).resolve()
+    _clear_ris = include_ris or all_
     if not yes:
-        _ris_note = " (including RIS)" if include_ris else " (RIS preserved — use --include-ris to also clear it)"
+        _ris_note = " (including RIS)" if _clear_ris else " (RIS preserved — use --all to also clear it)"
         typer.confirm(f"Delete all cache files for {target}{_ris_note}?", abort=True)
-    removed = _cm.clear(target, clear_ris=include_ris)
+    removed = _cm.clear(target, clear_ris=_clear_ris)
     typer.echo(f"Removed {removed} file(s).")
 
 

sourcecode/prepare_context.py

@@ -391,6 +391,8 @@ class TaskOutput:
     # P0-2: fast-mode truncation transparency
     truncated: bool = False
     truncated_reason: Optional[str] = None
+    # generate-tests: count of existing test files found (complements untested_sources)
+    existing_test_count: Optional[int] = None
 
 
 @dataclass
@@ -2237,6 +2239,8 @@ class TaskContextBuilder:
             # P0-2: fast-mode truncation transparency
             truncated=_fast_truncated,
             truncated_reason=_fast_truncated_reason,
+            # generate-tests: count of test files found alongside untested_sources
+            existing_test_count=len(test_set) if task_name == "generate-tests" else None,
         )
 
     def render_prompt(self, output: TaskOutput) -> str:

sourcecode/repository_ir.py

@@ -201,6 +201,20 @@ _FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
     "@EnableGlobalMethodSecurity",
 })
 
+# Programmatic security: method-call patterns that indicate runtime auth enforcement.
+_PROGRAMMATIC_SECURITY_RE = re.compile(
+    r"\b(?:hasRole|hasAuthority|isAuthenticated|requirePermission|checkPermission"
+    r"|assertAuthorized|authenticate)\s*\("
+    r"|(?:Authentication|SecurityContext|Principal|AuthorizationManager|AccessDecisionManager)\b"
+    r"|throw\s+new\s+(?:AccessDeniedException|UnauthorizedException|ForbiddenException|AuthenticationException)\b",
+    re.MULTILINE,
+)
+
+
+def _has_programmatic_security(source: str) -> bool:
+    return bool(_PROGRAMMATIC_SECURITY_RE.search(source))
+
+
 _MODIFIER_WORDS: frozenset[str] = frozenset({
     "public", "private", "protected", "static", "final", "abstract",
     "synchronized", "native", "strictfp", "transient", "volatile", "default",
@@ -2365,6 +2379,7 @@ def _build_route_surface(
 
     routes: list[dict] = []
     seen: set[tuple] = set()
+    _prog_sec_cache: dict[str, Optional[bool]] = {}  # declaring_file → has_programmatic
 
     # Phase 2: emit own endpoint symbols and record them per class.
     # Each method emits one route per resolved effective prefix.
@@ -2414,6 +2429,19 @@ def _build_route_surface(
         _cls_sym_for_sec = class_sym_by_simple.get(cls_simple)
         _sec = _route_security_from_sym(sym, _cls_sym_for_sec)
 
+        # Programmatic security fallback: scan controller file when no annotation found.
+        if _sec is None:
+            _decl_file = sym.declaring_file or ""
+            if _decl_file and _decl_file not in _prog_sec_cache:
+                try:
+                    _prog_sec_cache[_decl_file] = _has_programmatic_security(
+                        Path(_decl_file).read_text(encoding="utf-8", errors="ignore")
+                    )
+                except Exception:
+                    _prog_sec_cache[_decl_file] = False
+            if _prog_sec_cache.get(_decl_file):
+                _sec = {"policy": "programmatic"}
+
         for prefix in effective_prefixes:
             # P1 fix: re.sub collapses any number of consecutive slashes (///, //, etc.)
             # Single .replace("//", "/") fails for triple-slash from prefix="/" + suffix="/{id}".
@@ -2434,8 +2462,7 @@ def _build_route_surface(
                     "stable_id": sym.stable_id,
                     "inheritance_depth": 0,
                 }
-                if _sec is not None:
-                    _route_entry["security_annotations"] = _sec
+                _route_entry["security_annotations"] = _sec
                 routes.append(_route_entry)
 
     # Phase 3: inheritance projection — subclasses with zero own endpoints
@@ -2966,10 +2993,10 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
         # Use security_annotations already extracted by _build_route_surface
         # via the canonical _route_security_from_sym extractor.
         security_info = route.get("security_annotations")
+        entry["security"] = security_info  # always present; None = no security signal
         if security_info:
-            entry["security"] = security_info
             # Backward compat: keep required_permission for custom annotation
-            if security_info.get("policy") == "custom_permission":
+            if isinstance(security_info, dict) and security_info.get("policy") == "custom_permission":
                 entry["required_permission"] = security_info["required_permission"]
         endpoints.append(entry)
 
@@ -2988,7 +3015,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # "no_security_signal" = no recognized security annotation at method OR class level.
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
     # per-endpoint annotations — this count reflects annotation-based coverage only.
-    no_security_signal = sum(1 for e in endpoints if "security" not in e)
+    no_security_signal = sum(1 for e in endpoints if not e.get("security"))
 
     # Detect filter-based security: centralized Spring Security config class.
     # When present, high no_security_signal is expected — security is enforced by
@@ -3007,7 +3034,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             for sym in _class_syms
         )
     )
-    _has_annotation_security = any("security" in e for e in endpoints)
+    _has_annotation_security = any(e.get("security") for e in endpoints)
     if _filter_based and _has_annotation_security:
         security_model = "mixed"
     elif _filter_based:
@@ -3090,8 +3117,34 @@ def compute_blast_radius(
     subsystems: list[dict] = ir.get("subsystems") or []
 
     # ── 1. Resolve target → one or more FQNs ─────────────────────────────────
+    _path_like = "/" in target or "\\" in target or target.endswith(".java")
     resolution, matched_fqns = _resolve_target(target, reverse_graph, graph_nodes)
 
+    # File-path input with ambiguous resolution: require the user to be specific.
+    if _path_like and len(matched_fqns) > 1:
+        _candidates = sorted(matched_fqns)
+        return {
+            "target": target,
+            "resolution": "ambiguous_path",
+            "message": (
+                f"Path '{target}' matches {len(matched_fqns)} classes in the IR. "
+                "Pass the full FQN to select one."
+            ),
+            "candidates": _candidates,
+            "direct_callers": [],
+            "indirect_callers": [],
+            "endpoints_affected": [],
+            "mappers_affected": [],
+            "security_surface_affected": [],
+            "cross_module_impact": [],
+            "transactional_boundaries_touched": [],
+            "risk_score": 0.0,
+            "risk_level": "unknown",
+            "confidence_score": 0.0,
+            "confidence_level": "low",
+            "explanation": f"Ambiguous path — {len(matched_fqns)} candidates found.",
+        }
+
     if not matched_fqns:
         # Build a short candidate list to help the user
         _candidates = _blast_radius_candidates(target, reverse_graph, graph_nodes)

sourcecode/ris.py

@@ -393,12 +393,40 @@ def get_cold_start_context(repo_root: Path) -> dict:
         # An empty list does NOT mean "no endpoints exist" — it means the endpoint
         # index has not been built yet.  Agents must call get_endpoints to populate.
         _api_complete = not _is_java or bool(endpoints)
+
+        # Build structural validation for Java/Spring repos.
+        # Detects when the RIS snapshot is structurally incomplete (controllers found
+        # but endpoint index was never built), so agents can decide whether to rebuild.
+        _controllers_in_map = ris.structural_map.get("controllers", [])
+        _controllers_in_api = ris.api_surface.get("controllers_index", [])
+        _controllers_found = len(_controllers_in_map) or len(_controllers_in_api)
+        _endpoints_found = len(endpoints)
+        # Spring is detected when controllers exist in structural map or api surface.
+        _spring_detected = bool(_controllers_found) or bool(_controllers_in_api)
+        _validation_status = (
+            "incomplete_snapshot"
+            if _is_java and _spring_detected and _endpoints_found == 0
+            else "valid"
+        )
+        _validation: dict = {
+            "spring_detected": _spring_detected,
+            "controllers_found": _controllers_found,
+            "endpoints_found": _endpoints_found,
+            "status": _validation_status,
+        }
+
+        # When the snapshot is structurally incomplete, downgrade status so agents
+        # don't assume cold_start_ready when critical sections are missing.
+        _status_base = "cold_start_stale" if stale else "cold_start_ready"
+        if _validation_status == "incomplete_snapshot" and not stale:
+            _status_base = "cold_start_incomplete"
+
         result: dict = {
-            "status": "cold_start_stale" if stale else "cold_start_ready",
+            "status": _status_base,
             "repo_id": ris.repo_id,
             "git_head": ris.git_head,
             "current_git_head": current_head,
-            "stale": stale,
+            "stale": stale or (_validation_status == "incomplete_snapshot"),
             "has_uncommitted_changes": uncommitted,
             "last_updated_at": ris.last_updated_at,
             "cache_source": "RIS",
@@ -408,6 +436,7 @@ def get_cold_start_context(repo_root: Path) -> dict:
             "entrypoints": ris.structural_map.get("entrypoints", []),
             "endpoints": endpoints,
             "hotspots": ris.git_context_snapshot.get("hotspots", []),
+            "validation": _validation,
         }
         if not endpoints and _is_java:
             result["endpoints_hint"] = (

{sourcecode-1.33.3.dist-info → sourcecode-1.33.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.33.3
+Version: 1.33.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -39,7 +39,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.33.3-blue)
+![Version](https://img.shields.io/badge/version-1.33.4-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -113,7 +113,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.33.3
+# sourcecode 1.33.4
 ```
 
 ---

{sourcecode-1.33.3.dist-info → sourcecode-1.33.5.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=qhL6fTfXMRERDWiwrW3g08_u6w-wnYzM6RnzJHpyq2M,103
+sourcecode/__init__.py,sha256=1rtjkdHP6M265Dvjzw_Pe1-jjy13_C_oBKGBnxQCbUk,103
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -7,7 +7,7 @@ sourcecode/cache.py,sha256=wAyPrXN5DqiGivnMpeEuun2xHDKfBer2_oBsh6kj_vc,30447
 sourcecode/cache.tmp_new,sha256=-IvV7CojiZjqeKMln1m-lqI0QVA2uFGWmYir4XRFOUk,27970
 sourcecode/canonical_ir.py,sha256=_HM3AUmKSdna9u4dCoU6rpgSA6HdF8gzOKZykIUCNGY,23277
 sourcecode/classifier.py,sha256=2lYoSH3vOTkXZYPU7Go2WIet1-IuNzTWVhc-ULnXtgw,8024
-sourcecode/cli.py,sha256=ithP9KPwvJsoSH1nOPYw6LDXQqHa5sIP6Xpt8G1MgK8,180063
+sourcecode/cli.py,sha256=EMs-sz83Fpl4evsU56xuU_S6ZL0TMzZp9nW9V1bra-I,181396
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -29,14 +29,14 @@ sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7
 sourcecode/output_budget.py,sha256=43307mJEyUPU3MI-QEQoVxrcAvNyUzdzF_SAPgisBQE,6603
 sourcecode/path_filters.py,sha256=ROFRQ8eSLBEMiixK9f45-RO7um4VEEcjoD5AA4I427I,3739
 sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrfjz2o,14423
-sourcecode/prepare_context.py,sha256=uZo0r7QBXUmQdfTp3w_A1XI-OzFAlcoH7F76_p7IQjo,205311
+sourcecode/prepare_context.py,sha256=aL4WS62wozw9iG_v3UrU00Qc7lGgckUB5RY5ApPblo8,205618
 sourcecode/progress.py,sha256=qn30sWaHOkjTgXsSBmiPkz7Rsbwc5oSlIe6JNEMYp_k,3149
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=MYF4FFkveAQps9SmTeTlh6ODiBz2F--_hWNeHMLtUHQ,8405
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=-NjBQUT7zyya4ng8Hq0-ChoiHZkUif9lr-Q878gmj8M,153163
-sourcecode/ris.py,sha256=G89xhjg-JAQXsi4ox2Z3HGwWiOd6sWNPQqWRbUT-MPk,15927
+sourcecode/repository_ir.py,sha256=WtUPRVrvJju6Lrvm_7iTDk57qJFCAh-LJalLtX8jzIk,155595
+sourcecode/ris.py,sha256=vkIe_v-jjceeb0Adhn-Kw5eFXE_nIkGHflOnQYPycTk,17411
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
@@ -80,8 +80,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=KJeIPCPWMdmbCP3ySGs2iUlia34U6vWne2dZsUezesw,1560
-sourcecode-1.33.3.dist-info/METADATA,sha256=2PnPfTRRy6IDMJajZkRqfE8M_j0HJjYjOVuwRBlKfYg,16440
-sourcecode-1.33.3.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.33.3.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.33.3.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.33.3.dist-info/RECORD,,
+sourcecode-1.33.5.dist-info/METADATA,sha256=0CKSD6Q2_A9noOoPyeC4I0A-JuYA8bo3aIAu-kxtm1A,16440
+sourcecode-1.33.5.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.33.5.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.33.5.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.33.5.dist-info/RECORD,,