sourcecode 1.33.8__tar.gz → 1.33.10__tar.gz

{sourcecode-1.33.8 → sourcecode-1.33.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.33.8
+Version: 1.33.10
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -39,7 +39,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.33.8-blue)
+![Version](https://img.shields.io/badge/version-1.33.10-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---

{sourcecode-1.33.8 → sourcecode-1.33.10}/README.md

@@ -2,7 +2,7 @@
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.33.8-blue)
+![Version](https://img.shields.io/badge/version-1.33.10-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---

{sourcecode-1.33.8 → sourcecode-1.33.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.33.8"
+version = "1.33.10"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.33.8 → sourcecode-1.33.10}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.33.8"
+__version__ = "1.33.10"

{sourcecode-1.33.8 → sourcecode-1.33.10}/src/sourcecode/canonical_ir.py

@@ -445,10 +445,15 @@ def project_endpoint_surface(cir: CanonicalRepositoryIR) -> dict:
             # Backward compat: top-level required_permission for custom annotation
             if ep.security.policy == "custom_permission":
                 entry["required_permission"] = ep.security.required_permission
+        else:
+            entry["security"] = {"policy": "none_detected"}
 
         endpoints.append(entry)
 
-    no_security_signal = sum(1 for e in endpoints if "security" not in e)
+    no_security_signal = sum(
+        1 for e in endpoints
+        if e.get("security", {}).get("policy") == "none_detected"
+    )
     return {
         "endpoints": endpoints,
         "total": len(endpoints),

{sourcecode-1.33.8 → sourcecode-1.33.10}/src/sourcecode/mcp/server.py

@@ -524,10 +524,10 @@ def get_endpoints(repo_path: str = ".") -> dict:
 
     Maps to: sourcecode endpoints <repo_path>
     Returns: endpoints list with method, path, controller, handler fields;
-             security dict when authorization annotations are present
-             (policy: roles_allowed|permit_all|deny_all|authenticated|...);
+             security dict always present (policy: roles_allowed|permit_all|deny_all|
+             authenticated|...|none_detected); none_detected = no auth annotation found.
              total (int), no_security_signal (int), and security_model (str) fields.
-             no_security_signal counts endpoints with no recognized auth annotation.
+             no_security_signal counts endpoints where security.policy == "none_detected".
              security_model values: "filter_based" (centralized Spring Security config —
              high no_security_signal is expected and does NOT mean endpoints are unprotected),
              "annotation_based" (per-endpoint annotations only), "mixed" (both),

{sourcecode-1.33.8 → sourcecode-1.33.10}/src/sourcecode/repository_ir.py

@@ -232,6 +232,12 @@ _INJECT_ANNOTATIONS: frozenset[str] = frozenset({
     "@Autowired", "@Inject", "@Value", "@Qualifier", "@Resource",
 })
 
+# Lombok annotations that generate constructors injecting fields
+_LOMBOK_CTOR_ANNOTATIONS: frozenset[str] = frozenset({
+    "@RequiredArgsConstructor",  # injects private final fields
+    "@AllArgsConstructor",       # injects all non-static fields
+})
+
 _JAVA_ROLE_MAP: dict[str, str] = {
     # Spring MVC / Spring Boot
     "@RestController": "controller",
@@ -934,6 +940,58 @@ def _build_relations(
                     )},
                 ))
 
+    # ── Constructor injection ─────────────────────────────────────────────────
+    # Spring 4.3+ omits @Autowired when there is a single constructor.
+    # Both annotated and bare constructors get injects edges from ClassName#<init>
+    # to each resolvable parameter type so the reverse graph can propagate impact.
+    for sym in symbols:
+        if sym.symbol_kind != "constructor" or not sym.param_types:
+            continue
+        for simple_type in sym.param_types:
+            base = re.sub(r'<.*', '', simple_type).strip()
+            fqn = import_map.get(base)
+            if fqn:
+                edges.append(RelationEdge(
+                    from_symbol=sym.symbol,
+                    to_symbol=fqn,
+                    type="injects",
+                    confidence="high",
+                    evidence={"type": "constructor_param", "value": simple_type},
+                ))
+
+    # ── Lombok constructor injection ──────────────────────────────────────────
+    # @RequiredArgsConstructor: injects all private final fields.
+    # @AllArgsConstructor: injects all non-static fields.
+    # No explicit constructor symbol exists; edges are emitted from the class FQN.
+    for sym in symbols:
+        if sym.type not in ("class", "interface"):
+            continue
+        _has_req = "@RequiredArgsConstructor" in sym.annotations
+        _has_all = "@AllArgsConstructor" in sym.annotations
+        if not (_has_req or _has_all):
+            continue
+        _lombok_ann = "@RequiredArgsConstructor" if _has_req else "@AllArgsConstructor"
+        for _line in source.splitlines():
+            fld = _FIELD_DECL_RE.match(_line.strip())
+            if not fld:
+                continue
+            _mods = _parse_modifier_str(fld.group("modifiers") or "")
+            if "static" in _mods:
+                continue
+            if _has_req and "final" not in _mods:
+                continue
+            _ftype = fld.group("type").strip()
+            _base = re.sub(r'<.*', '', _ftype).strip()
+            _fqn = import_map.get(_base)
+            if _fqn:
+                edges.append(RelationEdge(
+                    from_symbol=sym.symbol,
+                    to_symbol=_fqn,
+                    type="injects",
+                    confidence="medium",
+                    evidence={"type": "lombok_constructor", "value": _lombok_ann},
+                ))
+
     for m in re.finditer(
         r'(?:class|interface)\s+(\w+)(?:\s+extends\s+([\w.<>?,\s]+?))?'
         r'(?:\s+implements\s+([\w.<>?,\s]+?))?\s*\{',
@@ -3015,7 +3073,10 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # "no_security_signal" = no recognized security annotation at method OR class level.
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
     # per-endpoint annotations — this count reflects annotation-based coverage only.
-    no_security_signal = sum(1 for e in endpoints if not e.get("security"))
+    no_security_signal = sum(
+        1 for e in endpoints
+        if e.get("security", {}).get("policy") == "none_detected"
+    )
 
     # Detect filter-based security: centralized Spring Security config class.
     # When present, high no_security_signal is expected — security is enforced by
@@ -3034,7 +3095,10 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             for sym in _class_syms
         )
     )
-    _has_annotation_security = any(e.get("security") for e in endpoints)
+    _has_annotation_security = any(
+        e.get("security", {}).get("policy") != "none_detected"
+        for e in endpoints
+    )
     if _filter_based and _has_annotation_security:
         security_model = "mixed"
     elif _filter_based: