sourcecode 1.35.14__tar.gz → 1.35.16__tar.gz

{sourcecode-1.35.14 → sourcecode-1.35.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.14
+Version: 1.35.16
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -17,6 +17,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
+Requires-Dist: defusedxml>=0.7
 Requires-Dist: mcp>=1.0.0
 Requires-Dist: pathspec>=1.0
 Requires-Dist: ruamel-yaml>=0.18
@@ -39,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.14-blue)
+![Version](https://img.shields.io/badge/version-1.35.16-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -113,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.14
+# sourcecode 1.35.16
 ```
 
 ---

{sourcecode-1.35.14 → sourcecode-1.35.16}/README.md

@@ -2,7 +2,7 @@
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.14-blue)
+![Version](https://img.shields.io/badge/version-1.35.16-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -76,7 +76,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.14
+# sourcecode 1.35.16
 ```
 
 ---

{sourcecode-1.35.14 → sourcecode-1.35.16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.35.14"
+version = "1.35.16"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -31,6 +31,7 @@ dependencies = [
     "ruamel.yaml>=0.18",
     "tomli>=2.0; python_version < '3.11'",
     "mcp>=1.0.0",
+    "defusedxml>=0.7",
 ]
 
 [project.scripts]

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.14"
+__version__ = "1.35.16"

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/ast_extractor.py

@@ -1196,7 +1196,7 @@ def _detect_role(path: str, contract: FileContract) -> str:
 def _extract_mybatis_xml(rel_path: str, source: str) -> FileContract:
     """Extract namespace and SQL operations from a MyBatis *Mapper.xml file."""
     import re as _re
-    from xml.etree import ElementTree
+    import defusedxml.ElementTree as ElementTree  # type: ignore[import]
 
     _NS_STRIP = _re.compile(r"\{[^}]+\}")
     _SQL_OPS = frozenset({"select", "insert", "update", "delete"})

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/cir_graphs.py

@@ -13,6 +13,8 @@ from __future__ import annotations
 
 from dataclasses import dataclass, field
 
+from sourcecode.fqn_utils import normalize_owner_fqn
+
 # ---------------------------------------------------------------------------
 # ImplementationGraph — CH-001
 # ---------------------------------------------------------------------------
@@ -179,12 +181,14 @@ class InjectionGraph:
             if not from_fqn or not to_fqn:
                 continue
 
-            # Resolve injector to class level
-            if "#" in from_fqn:
-                class_fqn = from_fqn.rsplit("#", 1)[0]
+            # Resolve injector to class level.
+            # Three formats emitted by the CIR parser:
+            #   Constructor: pkg.Class#<init>   → class = pkg.Class
+            #   Field:       pkg.Class.field    → class = pkg.Class  (normalize_owner_fqn)
+            #   Lombok:      pkg.Class          → class = pkg.Class  (already class-level)
+            class_fqn = normalize_owner_fqn(from_fqn)
+            if class_fqn != from_fqn:
                 injector_to_class[from_fqn] = class_fqn
-            else:
-                class_fqn = from_fqn
 
             # Build class → [dep, ...] and service → [class, ...] indices
             deps = deps_of.setdefault(class_fqn, [])

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/cli.py

@@ -4892,7 +4892,7 @@ def mcp_serve() -> None:
     except KeyboardInterrupt:
         log.info("sourcecode-mcp stopped")
     except Exception as exc:
-        log.critical("sourcecode-mcp fatal error: %s", exc, exc_info=True)
+        log.critical("sourcecode-mcp fatal error: %s: %s", type(exc).__name__, exc)
         raise typer.Exit(code=1)
 
 

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/dependency_analyzer.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import re
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET  # type: ignore[import]
 from collections.abc import Iterable
 from dataclasses import replace
 from pathlib import Path

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/explain.py

@@ -13,6 +13,8 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Optional
 
+from sourcecode.fqn_utils import normalize_owner_fqn
+
 if TYPE_CHECKING:
     from sourcecode.canonical_ir import CanonicalRepositoryIR
     from sourcecode.spring_model import SpringSemanticModel
@@ -255,8 +257,8 @@ def _build_callers(class_fqn: str, cir: "CanonicalRepositoryIR") -> list[str]:
     rev: dict = (getattr(cir, "reverse_graph", None) or {}).get(class_fqn) or {}
     for callers in rev.values():
         for caller_fqn in (callers or []):
-            # Strip method part to get class
-            cls_fqn = caller_fqn.rsplit("#", 1)[0] if "#" in caller_fqn else caller_fqn
+            # Normalize: field (pkg.Class.field) and method (pkg.Class#method) → class FQN
+            cls_fqn = normalize_owner_fqn(caller_fqn)
             if cls_fqn == class_fqn:
                 continue
             s = _simple(cls_fqn)

sourcecode-1.35.16/src/sourcecode/fqn_utils.py

@@ -0,0 +1,53 @@
+"""fqn_utils.py — FQN normalization utilities (single source of truth).
+
+All code that needs to distinguish class FQNs from member FQNs (methods, fields,
+constructors) must use these functions. No direct `.split("#")`, `.rsplit(".")`,
+or lowercase-heuristic checks elsewhere.
+
+Symbol FQN conventions in the CIR:
+  Class/Interface/Enum: pkg.ClassName               (no # or lowercase-last-seg)
+  Method:               pkg.ClassName#methodName    (hash separator)
+  Constructor:          pkg.ClassName#<init>        (hash, angle-bracket name)
+  Field:                pkg.ClassName.fieldName     (dot separator, lowercase last segment)
+  Inner class:          pkg.ClassName.InnerClass    (dot separator, uppercase last segment)
+"""
+from __future__ import annotations
+
+
+def normalize_owner_fqn(fqn: str) -> str:
+    """Extract the owning class FQN from any symbol FQN.
+
+    Examples:
+        PatientServiceImpl                     -> PatientServiceImpl
+        org.foo.PatientServiceImpl             -> org.foo.PatientServiceImpl
+        org.foo.PatientServiceImpl#savePatient -> org.foo.PatientServiceImpl
+        org.foo.PatientServiceImpl#<init>      -> org.foo.PatientServiceImpl
+        org.foo.PatientServiceImpl.dao         -> org.foo.PatientServiceImpl
+        org.foo.PatientServiceImpl.InnerClass  -> org.foo.PatientServiceImpl.InnerClass (unchanged)
+    """
+    if "#" in fqn:
+        return fqn.rsplit("#", 1)[0]
+    if "." in fqn:
+        last_seg = fqn.rsplit(".", 1)[1]
+        if last_seg and last_seg[0].islower():
+            return fqn.rsplit(".", 1)[0]
+    return fqn
+
+
+def is_member_fqn(fqn: str) -> bool:
+    """Return True for method/field/constructor FQNs; False for type FQNs.
+
+    True:  pkg.Class#method, pkg.Class#<init>, pkg.Class.fieldName
+    False: pkg.Class, pkg.outer.InnerClass, simple.Name
+    """
+    if "#" in fqn:
+        return True
+    if "." in fqn:
+        last_seg = fqn.rsplit(".", 1)[1]
+        return bool(last_seg and last_seg[0].islower())
+    return False
+
+
+def is_type_fqn(fqn: str) -> bool:
+    """Return True for class/interface/enum/record FQNs; False for member FQNs."""
+    return not is_member_fqn(fqn)

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/license.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -25,18 +26,23 @@ from typing import Optional
 # ---------------------------------------------------------------------------
 # Supabase endpoint config — hardcoded for production; override via env for dev
 # ---------------------------------------------------------------------------
-_SUPABASE_URL: str = os.environ.get(
-    "SOURCECODE_SUPABASE_URL",
-    "https://qkndlmyekvujjdgthtmz.supabase.co",
-)
+_DEFAULT_SUPABASE_URL: str = "https://qkndlmyekvujjdgthtmz.supabase.co"
+_SUPABASE_URL: str = os.environ.get("SOURCECODE_SUPABASE_URL", _DEFAULT_SUPABASE_URL)
 _SUPABASE_ANON_KEY: str = os.environ.get(
     "SOURCECODE_SUPABASE_ANON_KEY",
     "",  # Set SOURCECODE_SUPABASE_ANON_KEY to your project anon key
 )
+if _SUPABASE_URL != _DEFAULT_SUPABASE_URL:
+    sys.stderr.write(
+        f"[sourcecode] WARNING: SOURCECODE_SUPABASE_URL overridden to {_SUPABASE_URL!r}."
+        " License requests will be sent to this server.\n"
+    )
+    sys.stderr.flush()
 
 _LICENSE_DIR: Path = Path.home() / ".sourcecode"
 _LICENSE_FILE: Path = _LICENSE_DIR / "license.json"
 _CACHE_TTL_SECONDS: int = 86400  # 24 hours
+_LICENSE_KEY_RE = re.compile(r"^[A-Za-z0-9_\-]{1,200}$")
 
 # ---------------------------------------------------------------------------
 # Per-feature descriptions for upgrade UX
@@ -92,6 +98,21 @@ _license_data: Optional[dict] = None
 is_pro: bool = False
 
 
+def _write_license_file(data: dict) -> None:
+    """Atomically write license data via tmp file + rename."""
+    payload = json.dumps(data, indent=2, ensure_ascii=False).encode("utf-8")
+    tmp = _LICENSE_FILE.with_suffix(".tmp")
+    try:
+        tmp.write_bytes(payload)
+        tmp.replace(_LICENSE_FILE)
+    except Exception:
+        try:
+            tmp.unlink(missing_ok=True)
+        except Exception:
+            pass
+        raise
+
+
 def _load_license_file() -> Optional[dict]:
     """Read ~/.sourcecode/license.json. Returns parsed dict or None."""
     try:
@@ -173,10 +194,7 @@ def _maybe_revalidate() -> None:
     _license_data["validated_at"] = datetime.now(timezone.utc).isoformat()
     is_pro = _license_data.get("plan") == "pro"
     try:
-        _LICENSE_FILE.write_text(
-            json.dumps(_license_data, indent=2, ensure_ascii=False),
-            encoding="utf-8",
-        )
+        _write_license_file(_license_data)
     except Exception:
         pass
 
@@ -284,6 +302,9 @@ def activate_license(license_key: str) -> None:
     Outputs JSON to stdout; exits 0 on success, 1 on any failure.
     Never raises — all error paths emit JSON and call sys.exit(1).
     """
+    if not _LICENSE_KEY_RE.match(license_key):
+        _fail("invalid_license", "License key format is invalid.")
+
     if not _SUPABASE_ANON_KEY:
         _fail("configuration_error", "SOURCECODE_SUPABASE_ANON_KEY not set. Contact support.")
 
@@ -308,10 +329,7 @@ def activate_license(license_key: str) -> None:
         "activated_at": now,
         "validated_at": now,
     }
-    _LICENSE_FILE.write_text(
-        json.dumps(data, indent=2, ensure_ascii=False),
-        encoding="utf-8",
-    )
+    _write_license_file(data)
 
     output = {"status": "activated", "plan": "pro", "features": data["features"]}
     sys.stdout.write(json.dumps(output, ensure_ascii=False) + "\n")

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/pr_impact.py

@@ -20,6 +20,8 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import TYPE_CHECKING, Optional
 
+from sourcecode.fqn_utils import is_member_fqn
+
 if TYPE_CHECKING:
     from sourcecode.canonical_ir import CanonicalRepositoryIR
     from sourcecode.spring_model import SpringSemanticModel
@@ -147,7 +149,7 @@ def _build_file_class_index(cir: "CanonicalRepositoryIR") -> dict[str, list[str]
     for node in nodes:
         fqn: str = node.get("fqn") or ""
         sf: str = node.get("source_file") or ""
-        if not fqn or not sf or "#" in fqn:
+        if not fqn or not sf or is_member_fqn(fqn):
             continue
         index.setdefault(sf, []).append(fqn)
     return index

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/spring_impact.py

@@ -25,6 +25,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import TYPE_CHECKING, Optional
 
+from sourcecode.fqn_utils import normalize_owner_fqn
 from sourcecode.spring_findings import SEVERITY_ORDER, SpringFinding
 from sourcecode.spring_model import SpringSemanticModel
 
@@ -311,19 +312,13 @@ def _bfs_callers(
             if etype in _SKIP_EDGE_TYPES:
                 continue
             for caller in fqn_list:
-                _add_caller(caller, depth)
-                # CH-002: injects edge to a field/constructor node → also traverse
-                # the containing class, bypassing the skipped contained_in edge.
-                # Two formats emitted by the CIR parser:
-                #   Constructor injection: pkg.Class#<init>  (hash separator)
-                #   Field injection:       pkg.Class.field   (dot, lowercase last segment)
                 if etype == "injects":
-                    if "#" in caller:
-                        _add_caller(caller.rsplit("#", 1)[0], depth)
-                    elif "." in caller:
-                        last_seg = caller.rsplit(".", 1)[1]
-                        if last_seg and last_seg[0].islower():
-                            _add_caller(caller.rsplit(".", 1)[0], depth)
+                    # CH-002: field (pkg.Class.field) and constructor (pkg.Class#<init>)
+                    # FQNs are injection sites, not callers.  Normalize to owning class so
+                    # member FQNs never appear in direct_callers / indirect_callers.
+                    _add_caller(normalize_owner_fqn(caller), depth)
+                else:
+                    _add_caller(caller, depth)
 
     return direct, indirect, was_truncated
 

{sourcecode-1.35.14 → sourcecode-1.35.16}/src/sourcecode/telemetry/transport.py

@@ -20,7 +20,10 @@ _TIMEOUT_S = 3
 
 
 def _endpoint() -> str:
-    return os.environ.get("SOURCECODE_TELEMETRY_ENDPOINT", _DEFAULT_ENDPOINT)
+    override = os.environ.get("SOURCECODE_TELEMETRY_ENDPOINT")
+    if override and override.startswith("https://"):
+        return override
+    return _DEFAULT_ENDPOINT
 
 
 def _send_blocking(payload: dict[str, Any]) -> None: