sourcecode 1.33.3__tar.gz → 1.33.5__tar.gz

{sourcecode-1.33.3 → sourcecode-1.33.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.33.3
+Version: 1.33.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -39,7 +39,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.33.3-blue)
+![Version](https://img.shields.io/badge/version-1.33.4-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -113,7 +113,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.33.3
+# sourcecode 1.33.4
 ```
 
 ---

{sourcecode-1.33.3 → sourcecode-1.33.5}/README.md

@@ -2,7 +2,7 @@
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.33.3-blue)
+![Version](https://img.shields.io/badge/version-1.33.4-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -76,7 +76,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.33.3
+# sourcecode 1.33.4
 ```
 
 ---

{sourcecode-1.33.3 → sourcecode-1.33.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.33.3"
+version = "1.33.5"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.33.3 → sourcecode-1.33.5}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.33.3"
+__version__ = "1.33.5"

{sourcecode-1.33.3 → sourcecode-1.33.5}/src/sourcecode/cli.py

@@ -658,7 +658,6 @@ def main(
     env_map: bool = typer.Option(
         False,
         "--env-map",
-        hidden=True,
         help="Map environment variables referenced across the codebase.",
     ),
     code_notes: bool = typer.Option(
@@ -1226,13 +1225,24 @@ def main(
                 _uncommitted = False
             _hit_source = "L2_view" if (_view_key and _core_hash) else "L1_core"
             _data_scope = "COMPACT" if compact else ("AGENT" if agent else "FULL")
+            # Recover generated_at from cached content before overwriting _cache block.
+            _cached_generated_at = None
+            try:
+                import json as _json_ga
+                _cached_generated_at = (
+                    _json_ga.loads(_cache_hit_content)
+                    .get("_cache", {})
+                    .get("generated_at")
+                )
+            except Exception:
+                pass
             _cache_hit_content = _inject_cache_meta(_cache_hit_content, {
                 "cache_source": _hit_source,
                 "git_head_at_generation": _git_sha,
                 "current_git_head": _git_sha,
                 "is_stale": False,
                 "has_uncommitted_changes": _uncommitted,
-                "generated_at": None,
+                "generated_at": _cached_generated_at,
                 "data_scope": _data_scope,
             })
         write_output(_cache_hit_content, output=output)
@@ -1880,8 +1890,9 @@ def main(
             if _gc_early and not (_bad_gc & set(_gc_early.limitations)):
                 _uc = _gc_early.uncommitted_changes
                 if _uc:
-                    # WORKTREE_UNSTAGED + WORKTREE_STAGED only; untracked excluded
-                    _allowed_changed_files = set(_uc.staged) | set(_uc.unstaged)
+                    # Include untracked (new files not yet staged) so new source files
+                    # are analyzed under --changed-only, not silently treated as "clean".
+                    _allowed_changed_files = set(_uc.staged) | set(_uc.unstaged) | set(_uc.untracked)
                 if not _allowed_changed_files:
                     # Git is available and confirms no uncommitted changes.
                     # Do NOT fall back to a full scan — that would silently produce
@@ -1900,10 +1911,10 @@ def main(
             changed_only = False
         if _git_confirmed_clean:
             _nc_payload = json.dumps({
-                "status": "working_tree_clean",
-                "no_changes": True,
                 "changed_files": [],
-                "message": "No uncommitted changes detected — working tree is clean.",
+                "message": "no uncommitted changes detected",
+                "analysis_scope": "empty",
+                "_meta": {"changed_only": True},
             }, ensure_ascii=False)
             write_output(_nc_payload, output=output)
             raise typer.Exit()
@@ -2626,7 +2637,14 @@ def prepare_context_cmd(
     if _task_include("improvement_opportunities") and output.improvement_opportunities:
         out["improvement_opportunities"] = output.improvement_opportunities
     if _task_include("test_gaps") and output.test_gaps:
-        out["test_gaps"] = output.test_gaps
+        # Emit both the canonical name (untested_sources) and the compat alias (test_gaps)
+        # so agents can use either. untested_sources is the correct semantic name.
+        out["untested_sources"] = output.test_gaps
+        out["test_gaps"] = output.test_gaps  # backward compat alias
+        if task == "generate-tests":
+            _et_count = getattr(output, "existing_test_count", None)
+            if _et_count is not None:
+                out["existing_test_count"] = _et_count
     # P0-2: fast-mode truncation transparency — always emit when truncated, even if test_gaps is []
     # Use `is True` (strict) so MagicMock objects in tests don't trigger this branch.
     if getattr(output, "truncated", False) is True:
@@ -3543,6 +3561,12 @@ def fix_bug_cmd(
       sourcecode impact <target>   — Propagate impact from a specific class
       sourcecode onboard .         — Full architecture context first
     """
+    if not symptom:
+        typer.echo(
+            "[fix-bug] Results are significantly better with --symptom. "
+            "Example: --symptom 'NullPointerException in PaymentService'",
+            err=True,
+        )
     ctx.invoke(
         prepare_context_cmd,
         task="fix-bug",
@@ -4298,19 +4322,21 @@ def cache_status_cmd(
 def cache_clear_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt."),
-    include_ris: bool = typer.Option(False, "--include-ris", help="Also delete the RIS snapshot (ris.json.gz). By default, RIS is preserved across clears."),
+    include_ris: bool = typer.Option(False, "--include-ris", hidden=True, help="Alias for --all. Preserved for backward compatibility."),
+    all_: bool = typer.Option(False, "--all", help="Also delete the RIS snapshot (ris.json.gz). By default, RIS is preserved across clears."),
 ) -> None:
     """Delete cached snapshots for a repository.
 
     By default, RIS (ris.json.gz) is preserved — it is the persistent structural
-    index used for cold-start bootstrapping.  Use --include-ris to also clear it.
+    index used for cold-start bootstrapping.  Use --all to also clear it.
     """
     from sourcecode import cache as _cm
     target = Path(path).resolve()
+    _clear_ris = include_ris or all_
     if not yes:
-        _ris_note = " (including RIS)" if include_ris else " (RIS preserved — use --include-ris to also clear it)"
+        _ris_note = " (including RIS)" if _clear_ris else " (RIS preserved — use --all to also clear it)"
         typer.confirm(f"Delete all cache files for {target}{_ris_note}?", abort=True)
-    removed = _cm.clear(target, clear_ris=include_ris)
+    removed = _cm.clear(target, clear_ris=_clear_ris)
     typer.echo(f"Removed {removed} file(s).")
 
 

{sourcecode-1.33.3 → sourcecode-1.33.5}/src/sourcecode/prepare_context.py

@@ -391,6 +391,8 @@ class TaskOutput:
     # P0-2: fast-mode truncation transparency
     truncated: bool = False
     truncated_reason: Optional[str] = None
+    # generate-tests: count of existing test files found (complements untested_sources)
+    existing_test_count: Optional[int] = None
 
 
 @dataclass
@@ -2237,6 +2239,8 @@ class TaskContextBuilder:
             # P0-2: fast-mode truncation transparency
             truncated=_fast_truncated,
             truncated_reason=_fast_truncated_reason,
+            # generate-tests: count of test files found alongside untested_sources
+            existing_test_count=len(test_set) if task_name == "generate-tests" else None,
         )
 
     def render_prompt(self, output: TaskOutput) -> str:

{sourcecode-1.33.3 → sourcecode-1.33.5}/src/sourcecode/repository_ir.py

@@ -201,6 +201,20 @@ _FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
     "@EnableGlobalMethodSecurity",
 })
 
+# Programmatic security: method-call patterns that indicate runtime auth enforcement.
+_PROGRAMMATIC_SECURITY_RE = re.compile(
+    r"\b(?:hasRole|hasAuthority|isAuthenticated|requirePermission|checkPermission"
+    r"|assertAuthorized|authenticate)\s*\("
+    r"|(?:Authentication|SecurityContext|Principal|AuthorizationManager|AccessDecisionManager)\b"
+    r"|throw\s+new\s+(?:AccessDeniedException|UnauthorizedException|ForbiddenException|AuthenticationException)\b",
+    re.MULTILINE,
+)
+
+
+def _has_programmatic_security(source: str) -> bool:
+    return bool(_PROGRAMMATIC_SECURITY_RE.search(source))
+
+
 _MODIFIER_WORDS: frozenset[str] = frozenset({
     "public", "private", "protected", "static", "final", "abstract",
     "synchronized", "native", "strictfp", "transient", "volatile", "default",
@@ -2365,6 +2379,7 @@ def _build_route_surface(
 
     routes: list[dict] = []
     seen: set[tuple] = set()
+    _prog_sec_cache: dict[str, Optional[bool]] = {}  # declaring_file → has_programmatic
 
     # Phase 2: emit own endpoint symbols and record them per class.
     # Each method emits one route per resolved effective prefix.
@@ -2414,6 +2429,19 @@ def _build_route_surface(
         _cls_sym_for_sec = class_sym_by_simple.get(cls_simple)
         _sec = _route_security_from_sym(sym, _cls_sym_for_sec)
 
+        # Programmatic security fallback: scan controller file when no annotation found.
+        if _sec is None:
+            _decl_file = sym.declaring_file or ""
+            if _decl_file and _decl_file not in _prog_sec_cache:
+                try:
+                    _prog_sec_cache[_decl_file] = _has_programmatic_security(
+                        Path(_decl_file).read_text(encoding="utf-8", errors="ignore")
+                    )
+                except Exception:
+                    _prog_sec_cache[_decl_file] = False
+            if _prog_sec_cache.get(_decl_file):
+                _sec = {"policy": "programmatic"}
+
         for prefix in effective_prefixes:
             # P1 fix: re.sub collapses any number of consecutive slashes (///, //, etc.)
             # Single .replace("//", "/") fails for triple-slash from prefix="/" + suffix="/{id}".
@@ -2434,8 +2462,7 @@ def _build_route_surface(
                     "stable_id": sym.stable_id,
                     "inheritance_depth": 0,
                 }
-                if _sec is not None:
-                    _route_entry["security_annotations"] = _sec
+                _route_entry["security_annotations"] = _sec
                 routes.append(_route_entry)
 
     # Phase 3: inheritance projection — subclasses with zero own endpoints
@@ -2966,10 +2993,10 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
         # Use security_annotations already extracted by _build_route_surface
         # via the canonical _route_security_from_sym extractor.
         security_info = route.get("security_annotations")
+        entry["security"] = security_info  # always present; None = no security signal
         if security_info:
-            entry["security"] = security_info
             # Backward compat: keep required_permission for custom annotation
-            if security_info.get("policy") == "custom_permission":
+            if isinstance(security_info, dict) and security_info.get("policy") == "custom_permission":
                 entry["required_permission"] = security_info["required_permission"]
         endpoints.append(entry)
 
@@ -2988,7 +3015,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # "no_security_signal" = no recognized security annotation at method OR class level.
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
     # per-endpoint annotations — this count reflects annotation-based coverage only.
-    no_security_signal = sum(1 for e in endpoints if "security" not in e)
+    no_security_signal = sum(1 for e in endpoints if not e.get("security"))
 
     # Detect filter-based security: centralized Spring Security config class.
     # When present, high no_security_signal is expected — security is enforced by
@@ -3007,7 +3034,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             for sym in _class_syms
         )
     )
-    _has_annotation_security = any("security" in e for e in endpoints)
+    _has_annotation_security = any(e.get("security") for e in endpoints)
     if _filter_based and _has_annotation_security:
         security_model = "mixed"
     elif _filter_based:
@@ -3090,8 +3117,34 @@ def compute_blast_radius(
     subsystems: list[dict] = ir.get("subsystems") or []
 
     # ── 1. Resolve target → one or more FQNs ─────────────────────────────────
+    _path_like = "/" in target or "\\" in target or target.endswith(".java")
     resolution, matched_fqns = _resolve_target(target, reverse_graph, graph_nodes)
 
+    # File-path input with ambiguous resolution: require the user to be specific.
+    if _path_like and len(matched_fqns) > 1:
+        _candidates = sorted(matched_fqns)
+        return {
+            "target": target,
+            "resolution": "ambiguous_path",
+            "message": (
+                f"Path '{target}' matches {len(matched_fqns)} classes in the IR. "
+                "Pass the full FQN to select one."
+            ),
+            "candidates": _candidates,
+            "direct_callers": [],
+            "indirect_callers": [],
+            "endpoints_affected": [],
+            "mappers_affected": [],
+            "security_surface_affected": [],
+            "cross_module_impact": [],
+            "transactional_boundaries_touched": [],
+            "risk_score": 0.0,
+            "risk_level": "unknown",
+            "confidence_score": 0.0,
+            "confidence_level": "low",
+            "explanation": f"Ambiguous path — {len(matched_fqns)} candidates found.",
+        }
+
     if not matched_fqns:
         # Build a short candidate list to help the user
         _candidates = _blast_radius_candidates(target, reverse_graph, graph_nodes)

{sourcecode-1.33.3 → sourcecode-1.33.5}/src/sourcecode/ris.py

@@ -393,12 +393,40 @@ def get_cold_start_context(repo_root: Path) -> dict:
         # An empty list does NOT mean "no endpoints exist" — it means the endpoint
         # index has not been built yet.  Agents must call get_endpoints to populate.
         _api_complete = not _is_java or bool(endpoints)
+
+        # Build structural validation for Java/Spring repos.
+        # Detects when the RIS snapshot is structurally incomplete (controllers found
+        # but endpoint index was never built), so agents can decide whether to rebuild.
+        _controllers_in_map = ris.structural_map.get("controllers", [])
+        _controllers_in_api = ris.api_surface.get("controllers_index", [])
+        _controllers_found = len(_controllers_in_map) or len(_controllers_in_api)
+        _endpoints_found = len(endpoints)
+        # Spring is detected when controllers exist in structural map or api surface.
+        _spring_detected = bool(_controllers_found) or bool(_controllers_in_api)
+        _validation_status = (
+            "incomplete_snapshot"
+            if _is_java and _spring_detected and _endpoints_found == 0
+            else "valid"
+        )
+        _validation: dict = {
+            "spring_detected": _spring_detected,
+            "controllers_found": _controllers_found,
+            "endpoints_found": _endpoints_found,
+            "status": _validation_status,
+        }
+
+        # When the snapshot is structurally incomplete, downgrade status so agents
+        # don't assume cold_start_ready when critical sections are missing.
+        _status_base = "cold_start_stale" if stale else "cold_start_ready"
+        if _validation_status == "incomplete_snapshot" and not stale:
+            _status_base = "cold_start_incomplete"
+
         result: dict = {
-            "status": "cold_start_stale" if stale else "cold_start_ready",
+            "status": _status_base,
             "repo_id": ris.repo_id,
             "git_head": ris.git_head,
             "current_git_head": current_head,
-            "stale": stale,
+            "stale": stale or (_validation_status == "incomplete_snapshot"),
             "has_uncommitted_changes": uncommitted,
             "last_updated_at": ris.last_updated_at,
             "cache_source": "RIS",
@@ -408,6 +436,7 @@ def get_cold_start_context(repo_root: Path) -> dict:
             "entrypoints": ris.structural_map.get("entrypoints", []),
             "endpoints": endpoints,
             "hotspots": ris.git_context_snapshot.get("hotspots", []),
+            "validation": _validation,
         }
         if not endpoints and _is_java:
             result["endpoints_hint"] = (