sourcecode 1.35.15__py3-none-any.whl → 1.35.16__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.15"
+__version__ = "1.35.16"

sourcecode/ast_extractor.py

@@ -1196,7 +1196,7 @@ def _detect_role(path: str, contract: FileContract) -> str:
 def _extract_mybatis_xml(rel_path: str, source: str) -> FileContract:
     """Extract namespace and SQL operations from a MyBatis *Mapper.xml file."""
     import re as _re
-    from xml.etree import ElementTree
+    import defusedxml.ElementTree as ElementTree  # type: ignore[import]
 
     _NS_STRIP = _re.compile(r"\{[^}]+\}")
     _SQL_OPS = frozenset({"select", "insert", "update", "delete"})

sourcecode/cli.py

@@ -4892,7 +4892,7 @@ def mcp_serve() -> None:
     except KeyboardInterrupt:
         log.info("sourcecode-mcp stopped")
     except Exception as exc:
-        log.critical("sourcecode-mcp fatal error: %s", exc, exc_info=True)
+        log.critical("sourcecode-mcp fatal error: %s: %s", type(exc).__name__, exc)
         raise typer.Exit(code=1)
 
 

sourcecode/dependency_analyzer.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import re
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET  # type: ignore[import]
 from collections.abc import Iterable
 from dataclasses import replace
 from pathlib import Path

sourcecode/license.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -25,18 +26,23 @@ from typing import Optional
 # ---------------------------------------------------------------------------
 # Supabase endpoint config — hardcoded for production; override via env for dev
 # ---------------------------------------------------------------------------
-_SUPABASE_URL: str = os.environ.get(
-    "SOURCECODE_SUPABASE_URL",
-    "https://qkndlmyekvujjdgthtmz.supabase.co",
-)
+_DEFAULT_SUPABASE_URL: str = "https://qkndlmyekvujjdgthtmz.supabase.co"
+_SUPABASE_URL: str = os.environ.get("SOURCECODE_SUPABASE_URL", _DEFAULT_SUPABASE_URL)
 _SUPABASE_ANON_KEY: str = os.environ.get(
     "SOURCECODE_SUPABASE_ANON_KEY",
     "",  # Set SOURCECODE_SUPABASE_ANON_KEY to your project anon key
 )
+if _SUPABASE_URL != _DEFAULT_SUPABASE_URL:
+    sys.stderr.write(
+        f"[sourcecode] WARNING: SOURCECODE_SUPABASE_URL overridden to {_SUPABASE_URL!r}."
+        " License requests will be sent to this server.\n"
+    )
+    sys.stderr.flush()
 
 _LICENSE_DIR: Path = Path.home() / ".sourcecode"
 _LICENSE_FILE: Path = _LICENSE_DIR / "license.json"
 _CACHE_TTL_SECONDS: int = 86400  # 24 hours
+_LICENSE_KEY_RE = re.compile(r"^[A-Za-z0-9_\-]{1,200}$")
 
 # ---------------------------------------------------------------------------
 # Per-feature descriptions for upgrade UX
@@ -92,6 +98,21 @@ _license_data: Optional[dict] = None
 is_pro: bool = False
 
 
+def _write_license_file(data: dict) -> None:
+    """Atomically write license data via tmp file + rename."""
+    payload = json.dumps(data, indent=2, ensure_ascii=False).encode("utf-8")
+    tmp = _LICENSE_FILE.with_suffix(".tmp")
+    try:
+        tmp.write_bytes(payload)
+        tmp.replace(_LICENSE_FILE)
+    except Exception:
+        try:
+            tmp.unlink(missing_ok=True)
+        except Exception:
+            pass
+        raise
+
+
 def _load_license_file() -> Optional[dict]:
     """Read ~/.sourcecode/license.json. Returns parsed dict or None."""
     try:
@@ -173,10 +194,7 @@ def _maybe_revalidate() -> None:
     _license_data["validated_at"] = datetime.now(timezone.utc).isoformat()
     is_pro = _license_data.get("plan") == "pro"
     try:
-        _LICENSE_FILE.write_text(
-            json.dumps(_license_data, indent=2, ensure_ascii=False),
-            encoding="utf-8",
-        )
+        _write_license_file(_license_data)
     except Exception:
         pass
 
@@ -284,6 +302,9 @@ def activate_license(license_key: str) -> None:
     Outputs JSON to stdout; exits 0 on success, 1 on any failure.
     Never raises — all error paths emit JSON and call sys.exit(1).
     """
+    if not _LICENSE_KEY_RE.match(license_key):
+        _fail("invalid_license", "License key format is invalid.")
+
     if not _SUPABASE_ANON_KEY:
         _fail("configuration_error", "SOURCECODE_SUPABASE_ANON_KEY not set. Contact support.")
 
@@ -308,10 +329,7 @@ def activate_license(license_key: str) -> None:
         "activated_at": now,
         "validated_at": now,
     }
-    _LICENSE_FILE.write_text(
-        json.dumps(data, indent=2, ensure_ascii=False),
-        encoding="utf-8",
-    )
+    _write_license_file(data)
 
     output = {"status": "activated", "plan": "pro", "features": data["features"]}
     sys.stdout.write(json.dumps(output, ensure_ascii=False) + "\n")

sourcecode/telemetry/transport.py

@@ -20,7 +20,10 @@ _TIMEOUT_S = 3
 
 
 def _endpoint() -> str:
-    return os.environ.get("SOURCECODE_TELEMETRY_ENDPOINT", _DEFAULT_ENDPOINT)
+    override = os.environ.get("SOURCECODE_TELEMETRY_ENDPOINT")
+    if override and override.startswith("https://"):
+        return override
+    return _DEFAULT_ENDPOINT
 
 
 def _send_blocking(payload: dict[str, Any]) -> None:

{sourcecode-1.35.15.dist-info → sourcecode-1.35.16.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.15
+Version: 1.35.16
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -17,6 +17,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
+Requires-Dist: defusedxml>=0.7
 Requires-Dist: mcp>=1.0.0
 Requires-Dist: pathspec>=1.0
 Requires-Dist: ruamel-yaml>=0.18
@@ -39,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.15-blue)
+![Version](https://img.shields.io/badge/version-1.35.16-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -113,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.15
+# sourcecode 1.35.16
 ```
 
 ---

{sourcecode-1.35.15.dist-info → sourcecode-1.35.16.dist-info}/RECORD

@@ -1,13 +1,13 @@
-sourcecode/__init__.py,sha256=cfSxdJ1Ut5rv-mW6fk0pRREJG25MhsYUleGDv8xHWRE,104
+sourcecode/__init__.py,sha256=jc7t99MAOVoZuqPXgeqrR2Amq4B-LnZtcO_-sTvoMSo,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
-sourcecode/ast_extractor.py,sha256=_btmeOJIe3t-NicF94D5ZAesa2YIJ0_QNExGnbHxGFE,50578
+sourcecode/ast_extractor.py,sha256=sa6CmLpn-k5G3_Hzxn8hAlZ5-TS-EVzXDD0Gvxd2jzs,50613
 sourcecode/cache.py,sha256=wAyPrXN5DqiGivnMpeEuun2xHDKfBer2_oBsh6kj_vc,30447
 sourcecode/canonical_ir.py,sha256=uwpwCnJxMh_eiIVg4cOLv7-aZthvmDFcG4azCOycLkw,24281
 sourcecode/cir_graphs.py,sha256=rZi8JV4ZrAa2WSCeyNa4JIEKQ_yZzDZTsrvVz2KfuKA,8919
 sourcecode/classifier.py,sha256=2lYoSH3vOTkXZYPU7Go2WIet1-IuNzTWVhc-ULnXtgw,8024
-sourcecode/cli.py,sha256=HgpX5PJ4zoMxVNWt3ZZ5W1ViVGfIxKk4tOQEb6u-iyU,224559
+sourcecode/cli.py,sha256=uQXXwKp1qnviXG-Qgnl34_5ioPeKPuXLDh7IXXZ3aaA,224568
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -15,7 +15,7 @@ sourcecode/context_summarizer.py,sha256=zlbm8ytdvJToohU108-dwBmEl52xl0gXpf6PZBOW
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=gvTdDniedm_mjq4vaHqnBY2UkQ0s00gtXqzTLILNXHc,28719
 sourcecode/coverage_parser.py,sha256=q0LeZJaX1bnntLu-ImksdBsMlpsVmk_iUfSaB4eaJGo,19702
-sourcecode/dependency_analyzer.py,sha256=Hh4I9B1_0mHNnUXYhZeLIHd-B2fYu7kt9x1abG7VVO0,56285
+sourcecode/dependency_analyzer.py,sha256=5yUBN_Z75RWmBIbsfnMasPSUn-4IaLipt0A3b3LNVfc,56310
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=aNTyYgQk5noJDfJU6FmasmESOHfiomyJw5EvZqjy6qc,22213
@@ -26,7 +26,7 @@ sourcecode/flow_analyzer.py,sha256=dSiuY4w49k29jW_EPXUOND9B5uVbuCA7kjnuHi-pIWA,2
 sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
 sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,62403
-sourcecode/license.py,sha256=B3NNCHg1t8Le0_dViwAXnpWTplXA_5ihxh2bs774vWE,11782
+sourcecode/license.py,sha256=-sPY4VuSYSe5dZyy7uFoWn9tHFcKlQkhZU0kgbwypo8,12499
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
@@ -92,9 +92,9 @@ sourcecode/telemetry/config.py,sha256=Pir0WHp4z-9Qclnn2NDZ3vwitqsMkOAJckmwjUSxrk
 sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWnII,2237
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
-sourcecode/telemetry/transport.py,sha256=KJeIPCPWMdmbCP3ySGs2iUlia34U6vWne2dZsUezesw,1560
-sourcecode-1.35.15.dist-info/METADATA,sha256=UwU_XvS_CUWBrkoCOzMcwPMnKwuvADpKnWzX107_Ms8,21266
-sourcecode-1.35.15.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.35.15.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.35.15.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.35.15.dist-info/RECORD,,
+sourcecode/telemetry/transport.py,sha256=QSslxIwij8YkRWcVvxykODDrkiN_GAAEu3dUP7KIWeE,1651
+sourcecode-1.35.16.dist-info/METADATA,sha256=LkCx5nRHlMV_wsznbY9xRh0muC06f_qtM6K9aHP2WbM,21297
+sourcecode-1.35.16.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.35.16.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.35.16.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.35.16.dist-info/RECORD,,