sourcecode 1.35.15__tar.gz → 1.35.17__tar.gz

{sourcecode-1.35.15 → sourcecode-1.35.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.15
+Version: 1.35.17
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -17,6 +17,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
+Requires-Dist: defusedxml>=0.7
 Requires-Dist: mcp>=1.0.0
 Requires-Dist: pathspec>=1.0
 Requires-Dist: ruamel-yaml>=0.18
@@ -39,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.15-blue)
+![Version](https://img.shields.io/badge/version-1.35.16-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -113,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.15
+# sourcecode 1.35.16
 ```
 
 ---

{sourcecode-1.35.15 → sourcecode-1.35.17}/README.md

@@ -2,7 +2,7 @@
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.15-blue)
+![Version](https://img.shields.io/badge/version-1.35.16-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -76,7 +76,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.15
+# sourcecode 1.35.16
 ```
 
 ---

{sourcecode-1.35.15 → sourcecode-1.35.17}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.35.15"
+version = "1.35.17"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -31,6 +31,7 @@ dependencies = [
     "ruamel.yaml>=0.18",
     "tomli>=2.0; python_version < '3.11'",
     "mcp>=1.0.0",
+    "defusedxml>=0.7",
 ]
 
 [project.scripts]

{sourcecode-1.35.15 → sourcecode-1.35.17}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.15"
+__version__ = "1.35.17"

{sourcecode-1.35.15 → sourcecode-1.35.17}/src/sourcecode/ast_extractor.py

@@ -1196,7 +1196,7 @@ def _detect_role(path: str, contract: FileContract) -> str:
 def _extract_mybatis_xml(rel_path: str, source: str) -> FileContract:
     """Extract namespace and SQL operations from a MyBatis *Mapper.xml file."""
     import re as _re
-    from xml.etree import ElementTree
+    import defusedxml.ElementTree as ElementTree  # type: ignore[import]
 
     _NS_STRIP = _re.compile(r"\{[^}]+\}")
     _SQL_OPS = frozenset({"select", "insert", "update", "delete"})

{sourcecode-1.35.15 → sourcecode-1.35.17}/src/sourcecode/cli.py

@@ -197,9 +197,13 @@ Cold scan: 2–10s depending on repo size. Warm cache: 0.3–0.6s.
   [dim]modernize (full)                    dead zones, tangles, full coupling[/dim]
   [dim]fix-bug (full)                      complete risk-ranked file list[/dim]
   [dim]review-pr (expanded)               CI-grade PR review[/dim]
-  [dim]prepare-context delta               incremental context for CI/CD[/dim]
+  [dim]prepare-context delta               incremental context for CI/CD (30 free runs/repo)[/dim]
   [dim]prepare-context generate-tests      test gap analysis[/dim]
-  [dim]--full                              removes all truncation limits[/dim]
+  [dim]--full                              removes all truncation limits (free up to 500 files)[/dim]
+  [dim]--rank-by git-churn                 file volatility ranking via git history[/dim]
+  [dim]rich exports (HTML/PDF/CI)          structured reports for CI and stakeholders[/dim]
+  [dim]multi-repo analysis                 cross-repository blast radius[/dim]
+  [dim]team snapshots                      shared org-level cache[/dim]
 
   [dim cyan]→ sourcecode activate <key>[/dim cyan]
 """
@@ -573,7 +577,8 @@ GRAPH_EDGE_CHOICES = {"imports", "calls", "contains", "extends"}
 DOCS_DEPTH_CHOICES = ["module", "symbols", "full"]
 
 # ── Module-level constants ─────────────────────────────────────────────────────
-_FREE_TIER_NODE_CAP: int = 10  # semantic cap for graph nodes and semantic symbols in free tier
+_FREE_TIER_NODE_CAP: int = 50  # semantic cap for graph nodes and semantic symbols in free tier
+_FREE_FULL_FILE_THRESHOLD: int = 500  # Java source files; above this --full requires Pro
 _JAVA_MIN_SCAN_DEPTH: int = 12  # Maven src/main/java/<pkg>/<module>/File depth floor
 _JVM_STACKS: frozenset[str] = frozenset({"java", "kotlin", "scala", "groovy"})
 _IMPACT_PRIORITY_THRESHOLDS: list[tuple[float, str]] = [
@@ -878,6 +883,11 @@ def main(
         )
         raise typer.Exit(code=2)  # FIX-P2-7: arg validation → exit 2
 
+    # Pro gate for --rank-by git-churn: git history analysis is a Pro feature.
+    if rank_by == "git-churn":
+        from sourcecode.license import require_feature as _req_git_history
+        _req_git_history("git-history")
+
     if symbol is not None and not symbol.strip():
         _emit_error_json(
             INVALID_INPUT_CODE,
@@ -911,10 +921,21 @@ def main(
         )
         raise typer.Exit(code=2)  # FIX-P2-7: arg validation → exit 2
 
-    # Pro gate for --full: removing truncation limits is enterprise-scale functionality.
+    # Pro gate for --full: free tier allowed up to _FREE_FULL_FILE_THRESHOLD Java files.
     if full:
-        from sourcecode.license import require_feature as _req_full
-        _req_full("--full")
+        from sourcecode.license import is_pro as _full_is_pro
+        if not _full_is_pro:
+            from itertools import islice as _islice
+            _full_check_path = Path(_get_detected_path()).resolve()
+            _java_count = sum(
+                1 for _ in _islice(
+                    (p for p in _full_check_path.rglob("*.java") if ".git" not in p.parts),
+                    _FREE_FULL_FILE_THRESHOLD + 1,
+                )
+            )
+            if _java_count > _FREE_FULL_FILE_THRESHOLD:
+                from sourcecode.license import require_feature as _req_full
+                _req_full("--full")
 
     # P0-2 FIX: --compact and --full are mutually exclusive.
     # compact is designed to be a bounded summary; --full removes truncation limits,
@@ -2633,14 +2654,34 @@ def prepare_context_cmd(
         )
         raise typer.Exit(code=1)
 
-    # Pro gate: generate-tests and delta require an active Pro license.
-    _PRO_TASKS: frozenset[str] = frozenset({"generate-tests", "delta"})
-    if task in _PRO_TASKS:
+    # Pro gate: generate-tests requires Pro. delta allows 30 free runs per repo.
+    if task == "generate-tests":
         from sourcecode.license import require_feature as _require_feature
-        _extra: dict = {}
-        if task == "delta":
-            _extra["free_tier_alternative"] = "sourcecode prepare-context review-pr --since <ref>"
-        _require_feature(task, extra_fields=_extra if _extra else None)
+        _require_feature("generate-tests")
+    elif task == "delta":
+        from sourcecode.license import is_pro as _delta_is_pro
+        if not _delta_is_pro:
+            from sourcecode.license import check_delta_free_tier as _check_delta
+            _delta_allowed, _delta_used, _delta_remaining = _check_delta(str(path.resolve()))
+            if not _delta_allowed:
+                from sourcecode.license import require_feature as _require_feature_delta
+                _require_feature_delta(
+                    "delta",
+                    extra_fields={
+                        "free_tier_note": (
+                            f"Free quota of {30} delta runs per repository exhausted."
+                        ),
+                        "free_tier_alternative": "sourcecode prepare-context review-pr --since <ref>",
+                    },
+                )
+            # Within quota: emit a header note so CI logs show remaining runs.
+            elif _delta_remaining <= 5:
+                import sys as _sys_delta
+                _sys_delta.stderr.write(
+                    f"[sourcecode] delta free tier: {_delta_remaining} run(s) remaining"
+                    f" (used {_delta_used}/{30}). Upgrade to Pro for unlimited CI runs.\n"
+                )
+                _sys_delta.stderr.flush()
 
     # Validate --format: only "json" and "github-comment" are valid for prepare-context.
     # "yaml" is intentionally NOT supported here (use main command for yaml output).
@@ -4892,7 +4933,7 @@ def mcp_serve() -> None:
     except KeyboardInterrupt:
         log.info("sourcecode-mcp stopped")
     except Exception as exc:
-        log.critical("sourcecode-mcp fatal error: %s", exc, exc_info=True)
+        log.critical("sourcecode-mcp fatal error: %s: %s", type(exc).__name__, exc)
         raise typer.Exit(code=1)
 
 

{sourcecode-1.35.15 → sourcecode-1.35.17}/src/sourcecode/dependency_analyzer.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import re
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET  # type: ignore[import]
 from collections.abc import Iterable
 from dataclasses import replace
 from pathlib import Path

{sourcecode-1.35.15 → sourcecode-1.35.17}/src/sourcecode/license.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -25,18 +26,25 @@ from typing import Optional
 # ---------------------------------------------------------------------------
 # Supabase endpoint config — hardcoded for production; override via env for dev
 # ---------------------------------------------------------------------------
-_SUPABASE_URL: str = os.environ.get(
-    "SOURCECODE_SUPABASE_URL",
-    "https://qkndlmyekvujjdgthtmz.supabase.co",
-)
+_DEFAULT_SUPABASE_URL: str = "https://qkndlmyekvujjdgthtmz.supabase.co"
+_SUPABASE_URL: str = os.environ.get("SOURCECODE_SUPABASE_URL", _DEFAULT_SUPABASE_URL)
 _SUPABASE_ANON_KEY: str = os.environ.get(
     "SOURCECODE_SUPABASE_ANON_KEY",
     "",  # Set SOURCECODE_SUPABASE_ANON_KEY to your project anon key
 )
+if _SUPABASE_URL != _DEFAULT_SUPABASE_URL:
+    sys.stderr.write(
+        f"[sourcecode] WARNING: SOURCECODE_SUPABASE_URL overridden to {_SUPABASE_URL!r}."
+        " License requests will be sent to this server.\n"
+    )
+    sys.stderr.flush()
 
 _LICENSE_DIR: Path = Path.home() / ".sourcecode"
 _LICENSE_FILE: Path = _LICENSE_DIR / "license.json"
+_DELTA_RUNS_FILE: Path = _LICENSE_DIR / "delta_runs.json"
 _CACHE_TTL_SECONDS: int = 86400  # 24 hours
+_DELTA_FREE_LIMIT: int = 30
+_LICENSE_KEY_RE = re.compile(r"^[A-Za-z0-9_\-]{1,200}$")
 
 # ---------------------------------------------------------------------------
 # Per-feature descriptions for upgrade UX
@@ -77,12 +85,37 @@ _FEATURE_INFO: dict[str, dict[str, str]] = {
         "value": "Reduces test debt systematically across the entire codebase.",
     },
     "--full": {
-        "display": "--full flag",
+        "display": "--full flag (large repos)",
         "description": (
             "Removes truncation limits on transactional boundaries, DTO mappers, and large result sets."
+            " Free tier may use --full on repositories under 500 Java source files."
         ),
         "value": "Essential for complete analysis of enterprise-scale codebases.",
     },
+    "git-history": {
+        "display": "git history analysis",
+        "description": (
+            "Churn ranking, commit frequency per file, volatility signals over 90-day window."
+        ),
+        "value": "Identifies which files change most — the highest-risk targets in any refactor.",
+    },
+    "multi-repo": {
+        "display": "multi-repo analysis",
+        "description": (
+            "Cross-repository dependency graphs, shared module impact, and org-level blast radius."
+        ),
+        "value": "Required for microservices and monorepo architectures.",
+    },
+    "export-rich": {
+        "display": "rich exports (HTML/PDF/CI)",
+        "description": "Structured HTML reports, PDF exports, and CI-consumable risk summaries.",
+        "value": "Embed analysis into your CI pipeline or share with non-CLI stakeholders.",
+    },
+    "team-snapshots": {
+        "display": "team snapshot sharing",
+        "description": "Shared org-level snapshots and multi-user cache access.",
+        "value": "Eliminates cold-cache overhead across the entire engineering team.",
+    },
 }
 
 # ---------------------------------------------------------------------------
@@ -92,6 +125,55 @@ _license_data: Optional[dict] = None
 is_pro: bool = False
 
 
+def _write_license_file(data: dict) -> None:
+    """Atomically write license data via tmp file + rename."""
+    payload = json.dumps(data, indent=2, ensure_ascii=False).encode("utf-8")
+    tmp = _LICENSE_FILE.with_suffix(".tmp")
+    try:
+        tmp.write_bytes(payload)
+        tmp.replace(_LICENSE_FILE)
+    except Exception:
+        try:
+            tmp.unlink(missing_ok=True)
+        except Exception:
+            pass
+        raise
+
+
+def _read_delta_runs() -> dict:
+    try:
+        if _DELTA_RUNS_FILE.exists():
+            return json.loads(_DELTA_RUNS_FILE.read_text(encoding="utf-8"))
+    except Exception:
+        pass
+    return {}
+
+
+def check_delta_free_tier(repo_path: str) -> "tuple[bool, int, int]":
+    """Check and consume one delta free-tier run for repo_path.
+
+    Returns (allowed, runs_used, runs_remaining).
+    When allowed=True the run count is incremented atomically.
+    When allowed=False the quota is exhausted — caller should gate to Pro.
+    """
+    import hashlib
+    key = hashlib.sha256(str(Path(repo_path).resolve()).encode()).hexdigest()[:16]
+    runs = _read_delta_runs()
+    used = int(runs.get(key, 0))
+    if used >= _DELTA_FREE_LIMIT:
+        return False, used, 0
+    new_used = used + 1
+    runs[key] = new_used
+    try:
+        _LICENSE_DIR.mkdir(parents=True, exist_ok=True)
+        tmp = _DELTA_RUNS_FILE.with_suffix(".tmp")
+        tmp.write_text(json.dumps(runs, indent=2, ensure_ascii=False), encoding="utf-8")
+        tmp.replace(_DELTA_RUNS_FILE)
+    except Exception:
+        pass
+    return True, new_used, max(0, _DELTA_FREE_LIMIT - new_used)
+
+
 def _load_license_file() -> Optional[dict]:
     """Read ~/.sourcecode/license.json. Returns parsed dict or None."""
     try:
@@ -173,10 +255,7 @@ def _maybe_revalidate() -> None:
     _license_data["validated_at"] = datetime.now(timezone.utc).isoformat()
     is_pro = _license_data.get("plan") == "pro"
     try:
-        _LICENSE_FILE.write_text(
-            json.dumps(_license_data, indent=2, ensure_ascii=False),
-            encoding="utf-8",
-        )
+        _write_license_file(_license_data)
     except Exception:
         pass
 
@@ -284,6 +363,9 @@ def activate_license(license_key: str) -> None:
     Outputs JSON to stdout; exits 0 on success, 1 on any failure.
     Never raises — all error paths emit JSON and call sys.exit(1).
     """
+    if not _LICENSE_KEY_RE.match(license_key):
+        _fail("invalid_license", "License key format is invalid.")
+
     if not _SUPABASE_ANON_KEY:
         _fail("configuration_error", "SOURCECODE_SUPABASE_ANON_KEY not set. Contact support.")
 
@@ -308,10 +390,7 @@ def activate_license(license_key: str) -> None:
         "activated_at": now,
         "validated_at": now,
     }
-    _LICENSE_FILE.write_text(
-        json.dumps(data, indent=2, ensure_ascii=False),
-        encoding="utf-8",
-    )
+    _write_license_file(data)
 
     output = {"status": "activated", "plan": "pro", "features": data["features"]}
     sys.stdout.write(json.dumps(output, ensure_ascii=False) + "\n")

{sourcecode-1.35.15 → sourcecode-1.35.17}/src/sourcecode/telemetry/transport.py

@@ -20,7 +20,10 @@ _TIMEOUT_S = 3
 
 
 def _endpoint() -> str:
-    return os.environ.get("SOURCECODE_TELEMETRY_ENDPOINT", _DEFAULT_ENDPOINT)
+    override = os.environ.get("SOURCECODE_TELEMETRY_ENDPOINT")
+    if override and override.startswith("https://"):
+        return override
+    return _DEFAULT_ENDPOINT
 
 
 def _send_blocking(payload: dict[str, Any]) -> None: