sourcecode 1.35.16__tar.gz → 1.35.18__tar.gz

{sourcecode-1.35.16 → sourcecode-1.35.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.16
+Version: 1.35.18
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.35.16 → sourcecode-1.35.18}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.35.16"
+version = "1.35.18"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.35.16 → sourcecode-1.35.18}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.16"
+__version__ = "1.35.18"

{sourcecode-1.35.16 → sourcecode-1.35.18}/src/sourcecode/cli.py

@@ -167,6 +167,11 @@ Cold scan: 2–10s depending on repo size. Warm cache: 0.3–0.6s.
   sourcecode --compact --git-context    include git hotspots and uncommitted files
   sourcecode --agent                    full structured JSON for AI agents
 
+[bold]Auth commands:[/bold]
+  auth login                   [dim]# authenticate via browser (device code)[/dim]
+  auth status                  [dim]# show current plan and auth state[/dim]
+  auth logout                  [dim]# remove local credentials[/dim]
+
 [bold]Cache commands:[/bold]
   cache status                 [dim]# cache size, hit keys, last-warmed timestamp[/dim]
   cache warm                   [dim]# pre-build cache ahead of an agent session[/dim]
@@ -197,9 +202,13 @@ Cold scan: 2–10s depending on repo size. Warm cache: 0.3–0.6s.
   [dim]modernize (full)                    dead zones, tangles, full coupling[/dim]
   [dim]fix-bug (full)                      complete risk-ranked file list[/dim]
   [dim]review-pr (expanded)               CI-grade PR review[/dim]
-  [dim]prepare-context delta               incremental context for CI/CD[/dim]
+  [dim]prepare-context delta               incremental context for CI/CD (30 free runs/repo)[/dim]
   [dim]prepare-context generate-tests      test gap analysis[/dim]
-  [dim]--full                              removes all truncation limits[/dim]
+  [dim]--full                              removes all truncation limits (free up to 500 files)[/dim]
+  [dim]--rank-by git-churn                 file volatility ranking via git history[/dim]
+  [dim]rich exports (HTML/PDF/CI)          structured reports for CI and stakeholders[/dim]
+  [dim]multi-repo analysis                 cross-repository blast radius[/dim]
+  [dim]team snapshots                      shared org-level cache[/dim]
 
   [dim cyan]→ sourcecode activate <key>[/dim cyan]
 """
@@ -217,8 +226,8 @@ _SUBCOMMANDS: frozenset[str] = frozenset(
         "repo-ir", "mcp", "endpoints", "impact",
         # Enterprise workflow commands
         "onboard", "modernize", "fix-bug", "review-pr",
-        # License
-        "activate",
+        # License / auth
+        "activate", "auth",
         # Cache observability
         "cache",
         # RIS bootstrap
@@ -508,6 +517,9 @@ app.add_typer(mcp_app, name="mcp")
 cache_app = typer.Typer(help="Cache inspection and management.", rich_markup_mode="rich")
 app.add_typer(cache_app, name="cache")
 
+auth_app = typer.Typer(help="Authentication: login, status, logout.", rich_markup_mode="rich")
+app.add_typer(auth_app, name="auth")
+
 
 def _maybe_ask_consent() -> None:
     """Show first-run consent prompt once, on interactive TTYs only."""
@@ -573,7 +585,8 @@ GRAPH_EDGE_CHOICES = {"imports", "calls", "contains", "extends"}
 DOCS_DEPTH_CHOICES = ["module", "symbols", "full"]
 
 # ── Module-level constants ─────────────────────────────────────────────────────
-_FREE_TIER_NODE_CAP: int = 10  # semantic cap for graph nodes and semantic symbols in free tier
+_FREE_TIER_NODE_CAP: int = 50  # semantic cap for graph nodes and semantic symbols in free tier
+_FREE_FULL_FILE_THRESHOLD: int = 500  # Java source files; above this --full requires Pro
 _JAVA_MIN_SCAN_DEPTH: int = 12  # Maven src/main/java/<pkg>/<module>/File depth floor
 _JVM_STACKS: frozenset[str] = frozenset({"java", "kotlin", "scala", "groovy"})
 _IMPACT_PRIORITY_THRESHOLDS: list[tuple[float, str]] = [
@@ -878,6 +891,11 @@ def main(
         )
         raise typer.Exit(code=2)  # FIX-P2-7: arg validation → exit 2
 
+    # Pro gate for --rank-by git-churn: git history analysis is a Pro feature.
+    if rank_by == "git-churn":
+        from sourcecode.license import require_feature as _req_git_history
+        _req_git_history("git-history")
+
     if symbol is not None and not symbol.strip():
         _emit_error_json(
             INVALID_INPUT_CODE,
@@ -911,10 +929,21 @@ def main(
         )
         raise typer.Exit(code=2)  # FIX-P2-7: arg validation → exit 2
 
-    # Pro gate for --full: removing truncation limits is enterprise-scale functionality.
+    # Pro gate for --full: free tier allowed up to _FREE_FULL_FILE_THRESHOLD Java files.
     if full:
-        from sourcecode.license import require_feature as _req_full
-        _req_full("--full")
+        from sourcecode.license import is_pro as _full_is_pro
+        if not _full_is_pro:
+            from itertools import islice as _islice
+            _full_check_path = Path(_get_detected_path()).resolve()
+            _java_count = sum(
+                1 for _ in _islice(
+                    (p for p in _full_check_path.rglob("*.java") if ".git" not in p.parts),
+                    _FREE_FULL_FILE_THRESHOLD + 1,
+                )
+            )
+            if _java_count > _FREE_FULL_FILE_THRESHOLD:
+                from sourcecode.license import require_feature as _req_full
+                _req_full("--full")
 
     # P0-2 FIX: --compact and --full are mutually exclusive.
     # compact is designed to be a bounded summary; --full removes truncation limits,
@@ -2633,14 +2662,34 @@ def prepare_context_cmd(
         )
         raise typer.Exit(code=1)
 
-    # Pro gate: generate-tests and delta require an active Pro license.
-    _PRO_TASKS: frozenset[str] = frozenset({"generate-tests", "delta"})
-    if task in _PRO_TASKS:
+    # Pro gate: generate-tests requires Pro. delta allows 30 free runs per repo.
+    if task == "generate-tests":
         from sourcecode.license import require_feature as _require_feature
-        _extra: dict = {}
-        if task == "delta":
-            _extra["free_tier_alternative"] = "sourcecode prepare-context review-pr --since <ref>"
-        _require_feature(task, extra_fields=_extra if _extra else None)
+        _require_feature("generate-tests")
+    elif task == "delta":
+        from sourcecode.license import is_pro as _delta_is_pro
+        if not _delta_is_pro:
+            from sourcecode.license import check_delta_free_tier as _check_delta
+            _delta_allowed, _delta_used, _delta_remaining = _check_delta(str(path.resolve()))
+            if not _delta_allowed:
+                from sourcecode.license import require_feature as _require_feature_delta
+                _require_feature_delta(
+                    "delta",
+                    extra_fields={
+                        "free_tier_note": (
+                            f"Free quota of {30} delta runs per repository exhausted."
+                        ),
+                        "free_tier_alternative": "sourcecode prepare-context review-pr --since <ref>",
+                    },
+                )
+            # Within quota: emit a header note so CI logs show remaining runs.
+            elif _delta_remaining <= 5:
+                import sys as _sys_delta
+                _sys_delta.stderr.write(
+                    f"[sourcecode] delta free tier: {_delta_remaining} run(s) remaining"
+                    f" (used {_delta_used}/{30}). Upgrade to Pro for unlimited CI runs.\n"
+                )
+                _sys_delta.stderr.flush()
 
     # Validate --format: only "json" and "github-comment" are valid for prepare-context.
     # "yaml" is intentionally NOT supported here (use main command for yaml output).
@@ -4758,6 +4807,73 @@ def activate_cmd(
     _activate(license_key)
 
 
+# ---------------------------------------------------------------------------
+# Auth commands (device-flow login / status / logout)
+# ---------------------------------------------------------------------------
+
+@auth_app.command("login")
+def auth_login_cmd() -> None:
+    """Authenticate via browser (device code flow).
+
+    \b
+    The CLI shows a URL. Open it in your browser, log in with your account,
+    and the CLI completes authentication automatically.
+    Credentials are stored in ~/.sourcecode/license.json (30-min cache; Supabase is source of truth).
+
+    \b
+    Examples:
+      sourcecode auth login
+    """
+    from sourcecode.license import auth_login as _auth_login
+    _auth_login()
+
+
+@auth_app.command("status")
+def auth_status_cmd() -> None:
+    """Show current authentication and plan status."""
+    import json as _json
+    try:
+        from sourcecode.license import _license_data as _ld, is_pro as _ip
+    except Exception:
+        _ld = None
+        _ip = False
+
+    if not _ld:
+        out: dict = {"status": "unauthenticated", "pro": False}
+        sys.stdout.write(_json.dumps(out, ensure_ascii=False) + "\n")
+        sys.stdout.flush()
+        return
+
+    out = {
+        "status": "authenticated",
+        "auth_method": _ld.get("auth_method", "license_key"),
+        "email": _ld.get("email", ""),
+        "plan": _ld.get("plan", "unknown"),
+        "plan_status": _ld.get("status", "unknown"),
+        "pro": _ip,
+        "validated_at": _ld.get("validated_at") or _ld.get("activated_at") or "",
+    }
+    sys.stdout.write(_json.dumps(out, indent=2, ensure_ascii=False) + "\n")
+    sys.stdout.flush()
+
+
+@auth_app.command("logout")
+def auth_logout_cmd() -> None:
+    """Remove local credentials (does not cancel your subscription)."""
+    import json as _json
+    _lf = Path.home() / ".sourcecode" / "license.json"
+    if _lf.exists():
+        try:
+            _lf.unlink()
+            out: dict = {"status": "logged_out", "message": "Local credentials removed."}
+        except Exception as _exc:
+            out = {"status": "error", "message": str(_exc)}
+    else:
+        out = {"status": "logged_out", "message": "No local credentials found."}
+    sys.stdout.write(_json.dumps(out, ensure_ascii=False) + "\n")
+    sys.stdout.flush()
+
+
 @app.command("version")
 def version_cmd() -> None:
     """Show version and exit.

{sourcecode-1.35.16 → sourcecode-1.35.18}/src/sourcecode/license.py

@@ -41,7 +41,18 @@ if _SUPABASE_URL != _DEFAULT_SUPABASE_URL:
 
 _LICENSE_DIR: Path = Path.home() / ".sourcecode"
 _LICENSE_FILE: Path = _LICENSE_DIR / "license.json"
-_CACHE_TTL_SECONDS: int = 86400  # 24 hours
+_DELTA_RUNS_FILE: Path = _LICENSE_DIR / "delta_runs.json"
+_CACHE_TTL_SECONDS: int = 1800  # 30 minutes default; CI env overrides to 24h (see _get_cache_ttl)
+_CACHE_TTL_CI_SECONDS: int = 86400  # 24 hours — CI containers must not re-validate mid-run
+
+
+def _get_cache_ttl() -> int:
+    """Return TTL in seconds. CI containers get 24h to avoid mid-run network calls."""
+    return _CACHE_TTL_CI_SECONDS if os.environ.get("SOURCECODE_CI") else _CACHE_TTL_SECONDS
+_DELTA_FREE_LIMIT: int = 30
+_DEVICE_POLL_INTERVAL_S: float = 2.5
+_DEVICE_POLL_TIMEOUT_S: float = 300.0  # 5-minute window for user to complete browser auth
+_AUTH_BASE_URL: str = "https://sourcecode.dev"
 _LICENSE_KEY_RE = re.compile(r"^[A-Za-z0-9_\-]{1,200}$")
 
 # ---------------------------------------------------------------------------
@@ -83,12 +94,37 @@ _FEATURE_INFO: dict[str, dict[str, str]] = {
         "value": "Reduces test debt systematically across the entire codebase.",
     },
     "--full": {
-        "display": "--full flag",
+        "display": "--full flag (large repos)",
         "description": (
             "Removes truncation limits on transactional boundaries, DTO mappers, and large result sets."
+            " Free tier may use --full on repositories under 500 Java source files."
         ),
         "value": "Essential for complete analysis of enterprise-scale codebases.",
     },
+    "git-history": {
+        "display": "git history analysis",
+        "description": (
+            "Churn ranking, commit frequency per file, volatility signals over 90-day window."
+        ),
+        "value": "Identifies which files change most — the highest-risk targets in any refactor.",
+    },
+    "multi-repo": {
+        "display": "multi-repo analysis",
+        "description": (
+            "Cross-repository dependency graphs, shared module impact, and org-level blast radius."
+        ),
+        "value": "Required for microservices and monorepo architectures.",
+    },
+    "export-rich": {
+        "display": "rich exports (HTML/PDF/CI)",
+        "description": "Structured HTML reports, PDF exports, and CI-consumable risk summaries.",
+        "value": "Embed analysis into your CI pipeline or share with non-CLI stakeholders.",
+    },
+    "team-snapshots": {
+        "display": "team snapshot sharing",
+        "description": "Shared org-level snapshots and multi-user cache access.",
+        "value": "Eliminates cold-cache overhead across the entire engineering team.",
+    },
 }
 
 # ---------------------------------------------------------------------------
@@ -113,6 +149,40 @@ def _write_license_file(data: dict) -> None:
         raise
 
 
+def _read_delta_runs() -> dict:
+    try:
+        if _DELTA_RUNS_FILE.exists():
+            return json.loads(_DELTA_RUNS_FILE.read_text(encoding="utf-8"))
+    except Exception:
+        pass
+    return {}
+
+
+def check_delta_free_tier(repo_path: str) -> "tuple[bool, int, int]":
+    """Check and consume one delta free-tier run for repo_path.
+
+    Returns (allowed, runs_used, runs_remaining).
+    When allowed=True the run count is incremented atomically.
+    When allowed=False the quota is exhausted — caller should gate to Pro.
+    """
+    import hashlib
+    key = hashlib.sha256(str(Path(repo_path).resolve()).encode()).hexdigest()[:16]
+    runs = _read_delta_runs()
+    used = int(runs.get(key, 0))
+    if used >= _DELTA_FREE_LIMIT:
+        return False, used, 0
+    new_used = used + 1
+    runs[key] = new_used
+    try:
+        _LICENSE_DIR.mkdir(parents=True, exist_ok=True)
+        tmp = _DELTA_RUNS_FILE.with_suffix(".tmp")
+        tmp.write_text(json.dumps(runs, indent=2, ensure_ascii=False), encoding="utf-8")
+        tmp.replace(_DELTA_RUNS_FILE)
+    except Exception:
+        pass
+    return True, new_used, max(0, _DELTA_FREE_LIMIT - new_used)
+
+
 def _load_license_file() -> Optional[dict]:
     """Read ~/.sourcecode/license.json. Returns parsed dict or None."""
     try:
@@ -152,6 +222,78 @@ def _call_get_license(license_key: str) -> Optional[dict]:
         return None  # Network error — caller decides what to do
 
 
+def _generate_device_code() -> str:
+    """Generate a human-readable device code: XXXX-XXXX-XXXX."""
+    import uuid
+    raw = uuid.uuid4().hex.upper()
+    return f"{raw[:4]}-{raw[4:8]}-{raw[8:12]}"
+
+
+def _call_device_check(device_code: str) -> Optional[dict]:
+    """Poll /device-check edge function. Returns dict or None on network error.
+
+    Expected responses:
+      {"status": "pending"}
+      {"status": "complete", "device_token": "...", "email": "...", "plan": "pro", ...}
+      {"status": "error", "message": "..."}
+    """
+    import urllib.error
+    import urllib.request
+
+    if not _SUPABASE_ANON_KEY:
+        return None
+
+    url = f"{_SUPABASE_URL}/functions/v1/device-check"
+    body = json.dumps({"device_code": device_code}).encode("utf-8")
+    req = urllib.request.Request(url, data=body, method="POST")
+    req.add_header("apikey", _SUPABASE_ANON_KEY)
+    req.add_header("Authorization", f"Bearer {_SUPABASE_ANON_KEY}")
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Accept", "application/json")
+    try:
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return json.loads(resp.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        try:
+            return json.loads(exc.read().decode("utf-8", errors="replace"))
+        except Exception:
+            return {"status": "error", "message": f"HTTP {exc.code}"}
+    except Exception:
+        return None
+
+
+def _call_get_user_plan(device_token: str) -> Optional[dict]:
+    """Fetch current plan/status for an authenticated device token.
+
+    Expected response:
+      {"valid": true, "plan": "pro", "status": "active", "features": [...], "email": "..."}
+      {"valid": false, "error": "token_revoked"}
+    """
+    import urllib.error
+    import urllib.request
+
+    if not _SUPABASE_ANON_KEY:
+        return None
+
+    url = f"{_SUPABASE_URL}/functions/v1/get-user-plan"
+    body = json.dumps({"device_token": device_token}).encode("utf-8")
+    req = urllib.request.Request(url, data=body, method="POST")
+    req.add_header("apikey", _SUPABASE_ANON_KEY)
+    req.add_header("Authorization", f"Bearer {_SUPABASE_ANON_KEY}")
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Accept", "application/json")
+    try:
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return json.loads(resp.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        try:
+            return json.loads(exc.read().decode("utf-8", errors="replace"))
+        except Exception:
+            return {"valid": False, "error": f"HTTP {exc.code}"}
+    except Exception:
+        return None
+
+
 def _maybe_revalidate() -> None:
     """Re-validate cached license if stale. Mutates globals; never raises."""
     global _license_data, is_pro
@@ -159,18 +301,55 @@ def _maybe_revalidate() -> None:
     if not _license_data:
         return
 
-    validated_at_str = _license_data.get("validated_at") or _license_data.get("activated_at")
+    validated_at_str = (
+        _license_data.get("validated_at")
+        or _license_data.get("activated_at")
+        or _license_data.get("authenticated_at")
+    )
     if validated_at_str:
         try:
             validated_at = datetime.fromisoformat(validated_at_str)
             if validated_at.tzinfo is None:
                 validated_at = validated_at.replace(tzinfo=timezone.utc)
             age = (datetime.now(timezone.utc) - validated_at).total_seconds()
-            if age < _CACHE_TTL_SECONDS:
+            if age < _get_cache_ttl():
                 return
         except Exception:
             pass
 
+    auth_method = _license_data.get("auth_method")
+
+    if auth_method == "device_flow":
+        device_token = _license_data.get("device_token")
+        if not device_token:
+            return
+        result = _call_get_user_plan(device_token)
+        if result is None:
+            return  # Network error — keep cached (offline-first)
+        if not result.get("valid", True):
+            _license_data = None
+            is_pro = False
+            try:
+                if _LICENSE_FILE.exists():
+                    _LICENSE_FILE.unlink()
+            except Exception:
+                pass
+            return
+        _license_data["plan"] = result.get("plan", "free")
+        _license_data["status"] = result.get("status", "active")
+        _license_data["features"] = result.get("features", [])
+        _license_data["validated_at"] = datetime.now(timezone.utc).isoformat()
+        is_pro = (
+            _license_data.get("plan") == "pro"
+            and _license_data.get("status", "active") != "inactive"
+        )
+        try:
+            _write_license_file(_license_data)
+        except Exception:
+            pass
+        return
+
+    # Key-based auth (existing flow / legacy)
     key = _license_data.get("license_key")
     if not key:
         return
@@ -205,6 +384,7 @@ def _init() -> None:
     is_pro = (
         _license_data is not None
         and _license_data.get("plan") == "pro"
+        and _license_data.get("status", "active") != "inactive"
     )
 
 
@@ -293,7 +473,105 @@ def require_pro(feature_name: str) -> None:
 
 
 # ---------------------------------------------------------------------------
-# Activation
+# Device-flow authentication
+# ---------------------------------------------------------------------------
+
+def _finish_device_auth(result: dict) -> None:
+    """Persist device-flow credentials and emit success JSON. Exits on error."""
+    global _license_data, is_pro
+
+    device_token = result.get("device_token") or result.get("access_token") or ""
+    email = result.get("email", "")
+    plan = result.get("plan", "free")
+    plan_status = (
+        result.get("status_detail")
+        or result.get("user_status")
+        or result.get("status", "active")
+    )
+    features = result.get("features") or []
+
+    if not device_token:
+        sys.stderr.write("\n")
+        _fail("auth_error", "Authentication completed but no session token received. Contact support.")
+
+    _LICENSE_DIR.mkdir(parents=True, exist_ok=True)
+    now = datetime.now(timezone.utc).isoformat()
+    data: dict = {
+        "auth_method": "device_flow",
+        "device_token": device_token,
+        "email": email,
+        "plan": plan,
+        "status": plan_status,
+        "features": features,
+        "authenticated_at": now,
+        "validated_at": now,
+    }
+    _write_license_file(data)
+    _license_data = data
+    is_pro = plan == "pro" and plan_status != "inactive"
+
+    sys.stderr.write(f"\n  Authenticated as {email}.  Plan: {plan}\n\n")
+    sys.stderr.flush()
+
+    output: dict = {"status": "authenticated", "email": email, "plan": plan, "pro": is_pro}
+    if not is_pro:
+        output["upgrade_hint"] = "https://sourcecode.dev/pricing"
+    else:
+        output["features"] = features
+    sys.stdout.write(json.dumps(output, ensure_ascii=False) + "\n")
+    sys.stdout.flush()
+
+
+def auth_login() -> None:
+    """Device code authentication flow.
+
+    Shows a browser URL; polls the backend every 2.5 s until the user
+    completes authentication or the 5-minute window expires.
+    Writes credentials to ~/.sourcecode/license.json on success.
+    Exits 0 on success, 1 on any failure.
+    """
+    import time
+
+    device_code = _generate_device_code()
+    activate_url = f"{_AUTH_BASE_URL}/activate?code={device_code}"
+
+    sys.stderr.write(f"\n  Open this URL to authenticate:\n  {activate_url}\n\n  Waiting")
+    sys.stderr.flush()
+
+    deadline = time.monotonic() + _DEVICE_POLL_TIMEOUT_S
+    _tick = 0
+
+    while time.monotonic() < deadline:
+        time.sleep(_DEVICE_POLL_INTERVAL_S)
+        _tick += 1
+        if _tick % 4 == 0:
+            sys.stderr.write(".")
+            sys.stderr.flush()
+
+        result = _call_device_check(device_code)
+        if result is None:
+            continue  # network blip — keep polling
+
+        status = result.get("status")
+        if status == "pending":
+            continue
+
+        if status == "complete":
+            _finish_device_auth(result)
+            return
+
+        if status == "error" or result.get("error"):
+            sys.stderr.write("\n")
+            _fail("auth_error", result.get("message") or result.get("error") or "Authentication failed.")
+
+        # Unknown status — keep polling
+
+    sys.stderr.write("\n")
+    _fail("auth_timeout", "Authentication timed out after 5 minutes. Please try again.")
+
+
+# ---------------------------------------------------------------------------
+# Activation (key-based — legacy / direct key entry)
 # ---------------------------------------------------------------------------
 
 def activate_license(license_key: str) -> None: