sourcecode 1.33.4__py3-none-any.whl → 1.33.5__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.33.4"
+__version__ = "1.33.5"

sourcecode/cli.py

@@ -1225,13 +1225,24 @@ def main(
                 _uncommitted = False
             _hit_source = "L2_view" if (_view_key and _core_hash) else "L1_core"
             _data_scope = "COMPACT" if compact else ("AGENT" if agent else "FULL")
+            # Recover generated_at from cached content before overwriting _cache block.
+            _cached_generated_at = None
+            try:
+                import json as _json_ga
+                _cached_generated_at = (
+                    _json_ga.loads(_cache_hit_content)
+                    .get("_cache", {})
+                    .get("generated_at")
+                )
+            except Exception:
+                pass
             _cache_hit_content = _inject_cache_meta(_cache_hit_content, {
                 "cache_source": _hit_source,
                 "git_head_at_generation": _git_sha,
                 "current_git_head": _git_sha,
                 "is_stale": False,
                 "has_uncommitted_changes": _uncommitted,
-                "generated_at": None,
+                "generated_at": _cached_generated_at,
                 "data_scope": _data_scope,
             })
         write_output(_cache_hit_content, output=output)

sourcecode/repository_ir.py

@@ -201,6 +201,20 @@ _FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
     "@EnableGlobalMethodSecurity",
 })
 
+# Programmatic security: method-call patterns that indicate runtime auth enforcement.
+_PROGRAMMATIC_SECURITY_RE = re.compile(
+    r"\b(?:hasRole|hasAuthority|isAuthenticated|requirePermission|checkPermission"
+    r"|assertAuthorized|authenticate)\s*\("
+    r"|(?:Authentication|SecurityContext|Principal|AuthorizationManager|AccessDecisionManager)\b"
+    r"|throw\s+new\s+(?:AccessDeniedException|UnauthorizedException|ForbiddenException|AuthenticationException)\b",
+    re.MULTILINE,
+)
+
+
+def _has_programmatic_security(source: str) -> bool:
+    return bool(_PROGRAMMATIC_SECURITY_RE.search(source))
+
+
 _MODIFIER_WORDS: frozenset[str] = frozenset({
     "public", "private", "protected", "static", "final", "abstract",
     "synchronized", "native", "strictfp", "transient", "volatile", "default",
@@ -2365,6 +2379,7 @@ def _build_route_surface(
 
     routes: list[dict] = []
     seen: set[tuple] = set()
+    _prog_sec_cache: dict[str, Optional[bool]] = {}  # declaring_file → has_programmatic
 
     # Phase 2: emit own endpoint symbols and record them per class.
     # Each method emits one route per resolved effective prefix.
@@ -2414,6 +2429,19 @@ def _build_route_surface(
         _cls_sym_for_sec = class_sym_by_simple.get(cls_simple)
         _sec = _route_security_from_sym(sym, _cls_sym_for_sec)
 
+        # Programmatic security fallback: scan controller file when no annotation found.
+        if _sec is None:
+            _decl_file = sym.declaring_file or ""
+            if _decl_file and _decl_file not in _prog_sec_cache:
+                try:
+                    _prog_sec_cache[_decl_file] = _has_programmatic_security(
+                        Path(_decl_file).read_text(encoding="utf-8", errors="ignore")
+                    )
+                except Exception:
+                    _prog_sec_cache[_decl_file] = False
+            if _prog_sec_cache.get(_decl_file):
+                _sec = {"policy": "programmatic"}
+
         for prefix in effective_prefixes:
             # P1 fix: re.sub collapses any number of consecutive slashes (///, //, etc.)
             # Single .replace("//", "/") fails for triple-slash from prefix="/" + suffix="/{id}".
@@ -2434,8 +2462,7 @@ def _build_route_surface(
                     "stable_id": sym.stable_id,
                     "inheritance_depth": 0,
                 }
-                if _sec is not None:
-                    _route_entry["security_annotations"] = _sec
+                _route_entry["security_annotations"] = _sec
                 routes.append(_route_entry)
 
     # Phase 3: inheritance projection — subclasses with zero own endpoints
@@ -2966,10 +2993,10 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
         # Use security_annotations already extracted by _build_route_surface
         # via the canonical _route_security_from_sym extractor.
         security_info = route.get("security_annotations")
+        entry["security"] = security_info  # always present; None = no security signal
         if security_info:
-            entry["security"] = security_info
             # Backward compat: keep required_permission for custom annotation
-            if security_info.get("policy") == "custom_permission":
+            if isinstance(security_info, dict) and security_info.get("policy") == "custom_permission":
                 entry["required_permission"] = security_info["required_permission"]
         endpoints.append(entry)
 
@@ -2988,7 +3015,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # "no_security_signal" = no recognized security annotation at method OR class level.
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
     # per-endpoint annotations — this count reflects annotation-based coverage only.
-    no_security_signal = sum(1 for e in endpoints if "security" not in e)
+    no_security_signal = sum(1 for e in endpoints if not e.get("security"))
 
     # Detect filter-based security: centralized Spring Security config class.
     # When present, high no_security_signal is expected — security is enforced by
@@ -3007,7 +3034,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             for sym in _class_syms
         )
     )
-    _has_annotation_security = any("security" in e for e in endpoints)
+    _has_annotation_security = any(e.get("security") for e in endpoints)
     if _filter_based and _has_annotation_security:
         security_model = "mixed"
     elif _filter_based:
@@ -3090,8 +3117,34 @@ def compute_blast_radius(
     subsystems: list[dict] = ir.get("subsystems") or []
 
     # ── 1. Resolve target → one or more FQNs ─────────────────────────────────
+    _path_like = "/" in target or "\\" in target or target.endswith(".java")
     resolution, matched_fqns = _resolve_target(target, reverse_graph, graph_nodes)
 
+    # File-path input with ambiguous resolution: require the user to be specific.
+    if _path_like and len(matched_fqns) > 1:
+        _candidates = sorted(matched_fqns)
+        return {
+            "target": target,
+            "resolution": "ambiguous_path",
+            "message": (
+                f"Path '{target}' matches {len(matched_fqns)} classes in the IR. "
+                "Pass the full FQN to select one."
+            ),
+            "candidates": _candidates,
+            "direct_callers": [],
+            "indirect_callers": [],
+            "endpoints_affected": [],
+            "mappers_affected": [],
+            "security_surface_affected": [],
+            "cross_module_impact": [],
+            "transactional_boundaries_touched": [],
+            "risk_score": 0.0,
+            "risk_level": "unknown",
+            "confidence_score": 0.0,
+            "confidence_level": "low",
+            "explanation": f"Ambiguous path — {len(matched_fqns)} candidates found.",
+        }
+
     if not matched_fqns:
         # Build a short candidate list to help the user
         _candidates = _blast_radius_candidates(target, reverse_graph, graph_nodes)

{sourcecode-1.33.4.dist-info → sourcecode-1.33.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.33.4
+Version: 1.33.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.33.4.dist-info → sourcecode-1.33.5.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=oG8RdsJRmrxoLhAnBA3rq7bWu7SPvQTfWedYeipB42k,103
+sourcecode/__init__.py,sha256=1rtjkdHP6M265Dvjzw_Pe1-jjy13_C_oBKGBnxQCbUk,103
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -7,7 +7,7 @@ sourcecode/cache.py,sha256=wAyPrXN5DqiGivnMpeEuun2xHDKfBer2_oBsh6kj_vc,30447
 sourcecode/cache.tmp_new,sha256=-IvV7CojiZjqeKMln1m-lqI0QVA2uFGWmYir4XRFOUk,27970
 sourcecode/canonical_ir.py,sha256=_HM3AUmKSdna9u4dCoU6rpgSA6HdF8gzOKZykIUCNGY,23277
 sourcecode/classifier.py,sha256=2lYoSH3vOTkXZYPU7Go2WIet1-IuNzTWVhc-ULnXtgw,8024
-sourcecode/cli.py,sha256=K2FT1wLNZuG_-9nKSOGdYbk-5GQkn4u7C2NR6IxdePY,180950
+sourcecode/cli.py,sha256=EMs-sz83Fpl4evsU56xuU_S6ZL0TMzZp9nW9V1bra-I,181396
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -35,7 +35,7 @@ sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=MYF4FFkveAQps9SmTeTlh6ODiBz2F--_hWNeHMLtUHQ,8405
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=-NjBQUT7zyya4ng8Hq0-ChoiHZkUif9lr-Q878gmj8M,153163
+sourcecode/repository_ir.py,sha256=WtUPRVrvJju6Lrvm_7iTDk57qJFCAh-LJalLtX8jzIk,155595
 sourcecode/ris.py,sha256=vkIe_v-jjceeb0Adhn-Kw5eFXE_nIkGHflOnQYPycTk,17411
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -80,8 +80,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=KJeIPCPWMdmbCP3ySGs2iUlia34U6vWne2dZsUezesw,1560
-sourcecode-1.33.4.dist-info/METADATA,sha256=Q9XlsPNiuahPxhrDZUU8OqtH1U_DH77rv22bnvblazA,16440
-sourcecode-1.33.4.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.33.4.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.33.4.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.33.4.dist-info/RECORD,,
+sourcecode-1.33.5.dist-info/METADATA,sha256=0CKSD6Q2_A9noOoPyeC4I0A-JuYA8bo3aIAu-kxtm1A,16440
+sourcecode-1.33.5.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.33.5.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.33.5.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.33.5.dist-info/RECORD,,