sourcecode 1.35.18__py3-none-any.whl → 1.35.20__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.18"
+__version__ = "1.35.20"

sourcecode/cli.py

@@ -240,6 +240,8 @@ _SUBCOMMANDS: frozenset[str] = frozenset(
         "pr-impact",
         # Class architectural summary
         "explain",
+        # Spring Boot 2→3 migration readiness
+        "migrate-check",
     }
 )
 
@@ -3720,6 +3722,80 @@ def endpoints_cmd(
 
 # ── Spring Semantic Audit ─────────────────────────────────────────────────────
 
+
+def _render_spring_audit_github_comment(result: "SpringAuditResult", min_severity: str = "low") -> str:  # type: ignore[name-defined]
+    """Render SpringAuditResult as a GitHub PR comment in Markdown."""
+    from sourcecode.spring_findings import SEVERITY_ORDER
+
+    min_order = SEVERITY_ORDER.get(min_severity, 3)
+    visible = [f for f in result.findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
+
+    sev = result.summary.get("by_severity", {})
+    total = result.summary.get("total_findings", 0)
+    blocking = sev.get("critical", 0) + sev.get("high", 0)
+
+    _ICONS = {"critical": "🔴", "high": "🟠", "medium": "🟡", "low": "🔵"}
+    _LABELS = {"critical": "CRITICAL", "high": "HIGH", "medium": "MEDIUM", "low": "LOW"}
+
+    if total == 0:
+        status_line = "✅ **Spring Audit — no findings**"
+    elif blocking > 0:
+        status_line = f"🔴 **Spring Audit — {total} finding{'s' if total != 1 else ''} ({blocking} blocking)**"
+    else:
+        status_line = f"🟡 **Spring Audit — {total} finding{'s' if total != 1 else ''} (0 blocking)**"
+
+    lines: list[str] = [status_line, ""]
+
+    if total > 0:
+        severity_counts = []
+        for sev_name in ("critical", "high", "medium", "low"):
+            n = sev.get(sev_name, 0)
+            if n:
+                severity_counts.append(f"{_ICONS[sev_name]} {n} {sev_name}")
+        lines.append("**Severity:** " + "  ·  ".join(severity_counts))
+        lines.append("")
+
+    if not visible:
+        lines.append(f"_No findings at or above `{min_severity}` severity._")
+        return "\n".join(lines)
+
+    lines += [
+        "| Sev | Pattern | File | Symbol | Title |",
+        "|-----|---------|------|--------|-------|",
+    ]
+    for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
+        icon = _ICONS.get(f.severity, "")
+        label = _LABELS.get(f.severity, f.severity.upper())
+        short_file = f.source_file.split("/")[-1] if "/" in f.source_file else f.source_file
+        short_sym = f.symbol.split(".")[-1] if "." in f.symbol else f.symbol
+        title_escaped = f.title.replace("|", "\\|")
+        lines.append(f"| {icon} {label} | `{f.pattern_id}` | `{short_file}` | `{short_sym}` | {title_escaped} |")
+
+    lines.append("")
+
+    if visible:
+        lines.append("<details>")
+        lines.append("<summary>Finding details</summary>")
+        lines.append("")
+        for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
+            icon = _ICONS.get(f.severity, "")
+            lines.append(f"### {icon} `{f.pattern_id}` — {f.title}")
+            lines.append(f"**File:** `{f.source_file}`  **Symbol:** `{f.symbol}`")
+            lines.append("")
+            lines.append(f.explanation)
+            lines.append("")
+            lines.append(f"**Fix:** {f.fix_hint}")
+            lines.append("")
+        lines.append("</details>")
+
+    lines += [
+        "",
+        f"_Generated by [sourcecode](https://github.com/sourcecode-ai/sourcecode) · "
+        f"scope: {result.scope} · min-severity: {min_severity}_",
+    ]
+    return "\n".join(lines)
+
+
 @app.command("spring-audit")
 def spring_audit_cmd(
     path: Path = typer.Argument(
@@ -3734,7 +3810,7 @@ def spring_audit_cmd(
         "json",
         "--format",
         "-f",
-        help="Output format: json (default) or yaml.",
+        help="Output format: json (default), yaml, or github-comment.",
         show_default=True,
     ),
     copy: bool = typer.Option(
@@ -3756,6 +3832,11 @@ def spring_audit_cmd(
         help="Minimum severity to include: critical, high, medium, or low (default).",
         show_default=True,
     ),
+    ci: bool = typer.Option(
+        False,
+        "--ci/--no-ci",
+        help="Exit with code 1 if any findings at or above --min-severity are found. For CI/CD gates.",
+    ),
 ) -> None:
     """Spring semantic audit: TX anomalies (TX-001..005) + security surface (SEC-001..003).
 
@@ -3770,6 +3851,12 @@ def spring_audit_cmd(
       SEC-002 CVE-2025-41248: @PreAuthorize on inherited method from generic supertype
       SEC-003 @Transactional on @Controller/@RestController (TX in wrong layer)
 
+    \b
+    CI/CD usage:
+      sourcecode spring-audit . --ci                             # exit 1 on any finding
+      sourcecode spring-audit . --ci --min-severity high         # exit 1 only on high/critical
+      sourcecode spring-audit . --ci --format github-comment     # Markdown PR comment + exit 1
+
     \b
     Examples:
       sourcecode spring-audit .
@@ -3816,15 +3903,27 @@ def spring_audit_cmd(
         )
         raise typer.Exit(code=1)
 
+    if format not in ("json", "yaml", "github-comment"):
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"Invalid format '{format}'.",
+            hint="format must be one of: json, yaml, github-comment.",
+            expected="json | yaml | github-comment",
+        )
+        raise typer.Exit(code=1)
+
     file_list = find_java_files(target)
     if not file_list:
-        data = SpringAuditResult(
+        empty_result = SpringAuditResult(
             spring_detected=False,
             scope=scope,
             limitations=["No Java files found in repository — Spring audit requires Java source."],
             metadata={"java_files_found": 0},
-        ).finalize().to_dict()
-        output = _serialize_dict(data, format)
+        ).finalize()
+        if format == "github-comment":
+            output = _render_spring_audit_github_comment(empty_result, min_severity)
+        else:
+            output = _serialize_dict(empty_result.to_dict(), format)
         if output_path is not None:
             output_path.write_text(output, encoding="utf-8")
             typer.echo("Spring audit written to " + str(output_path), err=True)
@@ -3883,7 +3982,10 @@ def spring_audit_cmd(
     except Exception:
         pass
 
-    output = _serialize_dict(data, format)
+    if format == "github-comment":
+        output = _render_spring_audit_github_comment(combined, min_severity)
+    else:
+        output = _serialize_dict(data, format)
 
     if output_path is not None:
         output_path.write_text(output, encoding="utf-8")
@@ -3897,6 +3999,119 @@ def spring_audit_cmd(
             if _copy_to_clipboard(output):
                 typer.echo("✓ copied to clipboard", err=True)
 
+    if ci and combined.findings:
+        raise typer.Exit(code=1)
+
+
+# ── Spring Boot Migration Check ───────────────────────────────────────────────
+
+
+@app.command("migrate-check")
+def migrate_check_cmd(
+    path: Path = typer.Argument(
+        Path("."),
+        help="Repository path to scan (default: current directory)",
+    ),
+    output_path: Optional[Path] = typer.Option(
+        None, "--output", "-o",
+        help="Write output to a file instead of stdout.",
+    ),
+    format: str = typer.Option(
+        "json",
+        "--format",
+        "-f",
+        help="Output format: json (default) or text.",
+        show_default=True,
+    ),
+    copy: bool = typer.Option(
+        False,
+        "--copy",
+        "-c",
+        help="Copy output to system clipboard after a successful run.",
+    ),
+    min_severity: str = typer.Option(
+        "low",
+        "--min-severity",
+        help="Minimum severity to include: critical, high, medium, or low (default).",
+        show_default=True,
+    ),
+) -> None:
+    """Spring Boot 2→3 migration readiness: detect javax→jakarta namespace blockers.
+
+    \b
+    Detects:
+      MIG-001  javax.persistence import (CRITICAL — JPA will not compile)
+      MIG-002  javax.servlet import (HIGH — Servlet API changed)
+      MIG-003  javax.validation import (HIGH — Bean Validation changed)
+      MIG-004  javax.transaction import (HIGH — TX API changed)
+      MIG-005  extends WebSecurityConfigurerAdapter (HIGH — removed in Spring 6)
+      MIG-006  javax.annotation import (MEDIUM)
+      MIG-007  javax.inject import (MEDIUM)
+      MIG-008  javax.ws.rs import (MEDIUM — JAX-RS changed)
+
+    \b
+    Examples:
+      sourcecode migrate-check .
+      sourcecode migrate-check /path/to/repo --format text
+      sourcecode migrate-check . --min-severity high
+      sourcecode migrate-check . --output migration.json
+    """
+    from sourcecode.repository_ir import find_java_files
+    from sourcecode.migrate_check import run_migrate_check
+
+    target = path.resolve()
+    if not target.exists() or not target.is_dir():
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"'{target}' is not a valid directory.",
+            path=str(target),
+            hint="Pass an existing repository directory.",
+            expected="A directory path.",
+        )
+        raise typer.Exit(code=1)
+
+    if format not in ("json", "text"):
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"Invalid format '{format}'.",
+            hint="format must be one of: json, text.",
+            expected="json | text",
+        )
+        raise typer.Exit(code=1)
+
+    if min_severity not in ("critical", "high", "medium", "low"):
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"Invalid min-severity '{min_severity}'.",
+            hint="min-severity must be one of: critical, high, medium, low.",
+            expected="critical | high | medium | low",
+        )
+        raise typer.Exit(code=1)
+
+    file_list = find_java_files(target)
+    report = run_migrate_check(file_list, target, min_severity=min_severity)
+
+    if format == "text":
+        output = report.to_text(min_severity=min_severity)
+    else:
+        output = _serialize_dict(report.to_dict(), "json")
+
+    if output_path is not None:
+        output_path.write_text(output, encoding="utf-8")
+        total = report.summary.get("total_findings", 0)
+        typer.echo(
+            f"Migration check written to {output_path} "
+            f"(score: {report.readiness_score}/100, {total} findings)",
+            err=True,
+        )
+    else:
+        sys.stdout.buffer.write(output.encode("utf-8"))
+        sys.stdout.buffer.write(b"\n")
+        sys.stdout.buffer.flush()
+        if copy:
+            if _copy_to_clipboard(output):
+                typer.echo("✓ copied to clipboard", err=True)
+
 
 # ── Spring Impact Chain ───────────────────────────────────────────────────────
 

sourcecode/mcp/registry.py

@@ -1221,6 +1221,7 @@ _MCP_HIDDEN_CANONICAL_TOOLS: frozenset[str] = frozenset({
     # Listed here so validate_registry() skips CLI param-drift checks on the alias.
     "spring_audit",       # curated: repo_path + scope + min_severity only (strips output_path/format/copy)
     "impact_chain",       # curated: repo_path + symbol + depth + query_type with choices
+    "migrate_check",      # curated: repo_path + min_severity only (strips output_path/format/copy/ci)
     # MCP self-management (an agent is not the MCP client admin)
     "mcp_init",
     "mcp_serve",
@@ -1349,7 +1350,57 @@ query_type: "impact" (default) | "events"
         docstring_override=_IMPACT_CHAIN_DOC,
     )
 
-    return [spring_audit, impact_chain]
+    _MIGRATE_CHECK_DOC = """\
+Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA ONLY.
+
+When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
+or upgrading from Spring Boot 2.x to 3.x. Use BEFORE get_spring_audit when the goal
+is migration planning rather than ongoing Spring semantic audit.
+Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+
+Rules detected:
+  MIG-001 critical — javax.persistence imports (JPA; will not compile after migration)
+  MIG-002 high     — javax.servlet imports (Servlet API changed)
+  MIG-003 high     — javax.validation imports (Bean Validation changed)
+  MIG-004 high     — javax.transaction imports (TX API changed)
+  MIG-005 high     — extends WebSecurityConfigurerAdapter (removed in Spring Security 6)
+  MIG-006 medium   — javax.annotation imports (CDI annotations)
+  MIG-007 medium   — javax.inject imports (DI annotations)
+  MIG-008 medium   — javax.ws.rs imports (JAX-RS API)
+
+Returns: schema_version, readiness_score (0–100; 100=ready to migrate), blocking_count,
+  estimated_effort_days, spring_boot_2_detected, summary (total_findings, affected_files,
+  by_severity, by_rule), findings[], limitations, metadata.
+findings fields: id, rule_id, severity, title, source_file, first_line,
+  imports_found, explanation, fix_hint.
+
+repo_path: absolute path to the Java repository (default: current working directory).
+min_severity: "low" (default) | "medium" | "high" | "critical" — filter threshold.
+"""
+
+    migrate_check = _alias_spec(
+        "migrate_check",
+        "Spring Boot 2→3 migration readiness: javax→jakarta blockers. JAVA ONLY.",
+        ("migrate-check",),
+        (
+            ToolParamSpec("repo_path", "argument", str, required=False, default=".", is_path=True,
+                          help="Absolute path to the Java repository."),
+            ToolParamSpec("min_severity", "option", str, required=False, default="low",
+                          option_names=("--min-severity",), choices=("low", "medium", "high", "critical"),
+                          help="low (default) | medium | high | critical"),
+        ),
+        lambda inputs: [
+            "migrate-check",
+            str(inputs.get("repo_path", ".")),
+            "--min-severity", str(inputs.get("min_severity", "low")),
+        ],
+        supported_targets=("repo_path",),
+        unsupported_targets=("file_path",),
+        validator=validate_repo_path,
+        docstring_override=_MIGRATE_CHECK_DOC,
+    )
+
+    return [spring_audit, impact_chain, migrate_check]
 
 
 @lru_cache(maxsize=1)

sourcecode/mcp/server.py

@@ -649,6 +649,56 @@ def get_spring_audit(repo_path: str = ".", scope: str = "all") -> dict:
         )
 
 
+@mcp.tool()
+def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") -> dict:
+    """Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA ONLY.
+
+    When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
+    or upgrading from Spring Boot 2.x to 3.x. Call this BEFORE get_spring_audit when
+    the goal is migration planning — not ongoing audit.
+    Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+
+    Maps to: sourcecode migrate-check <repo_path> --min-severity <min_severity>
+    Returns: MigrationReport with schema_version, readiness_score (0–100; 100=ready to migrate),
+             blocking_count, estimated_effort_days, spring_boot_2_detected,
+             summary (total_findings, affected_files, by_severity, by_rule),
+             findings[], limitations, metadata.
+    findings fields: id, rule_id, severity, title, source_file, first_line,
+             imports_found, explanation, fix_hint.
+    Rules:
+      MIG-001 critical — javax.persistence (JPA, will not compile after migration)
+      MIG-002 high     — javax.servlet (Servlet API)
+      MIG-003 high     — javax.validation (Bean Validation)
+      MIG-004 high     — javax.transaction (TX API)
+      MIG-005 high     — extends WebSecurityConfigurerAdapter (removed in Spring Security 6)
+      MIG-006 medium   — javax.annotation (CDI annotations)
+      MIG-007 medium   — javax.inject (DI annotations)
+      MIG-008 medium   — javax.ws.rs (JAX-RS API)
+
+    repo_path: absolute path to the Java repository (default: current working directory).
+    min_severity: "low" (default) | "medium" | "high" | "critical" — filter threshold.
+    """
+    _raw = repo_path
+    try:
+        if not isinstance(repo_path, str):
+            return _err("repo_path must be a string", "INVALID_ARGUMENT")
+        if min_severity not in ("critical", "high", "medium", "low"):
+            return _err(
+                f"Invalid min_severity '{min_severity}' — must be one of: critical, high, medium, low",
+                "INVALID_ARGUMENT",
+            )
+        repo_path = _normalize_repo_path(repo_path)
+        _path_err = _check_repo_path(repo_path)
+        if _path_err is not None:
+            return _path_err
+        return _execute(["migrate-check", repo_path, "--min-severity", min_severity])
+    except Exception as exc:
+        return _err(
+            f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
+            "INTERNAL_ERROR",
+        )
+
+
 @mcp.tool()
 def get_impact_chain(repo_path: str = ".", symbol: str = "", depth: int = 4) -> dict:
     """Spring impact-chain: systemic blast radius of a symbol with TX/SEC semantic enrichment. JAVA/SPRING ONLY.

sourcecode/migrate_check.py

@@ -0,0 +1,434 @@
+"""migrate_check.py — Spring Boot 2→3 (javax→jakarta) migration readiness checker.
+
+Scans Java source files for import namespaces and class patterns that must be
+updated when migrating from Spring Boot 2.x (javax.*) to Spring Boot 3.x (jakarta.*).
+
+Entry point: run_migrate_check(file_paths, root) → MigrationReport
+"""
+from __future__ import annotations
+
+import hashlib
+import re
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Optional
+
+
+# ---------------------------------------------------------------------------
+# Rule catalogue
+# ---------------------------------------------------------------------------
+
+@dataclass(frozen=True)
+class _Rule:
+    id: str
+    severity: str
+    title: str
+    explanation: str
+    fix_hint: str
+    import_pattern: Optional[re.Pattern] = None   # matches the import statement
+    extends_pattern: Optional[re.Pattern] = None  # matches an extends clause
+
+
+_IMPORT_RULES: list[_Rule] = [
+    _Rule(
+        id="MIG-001",
+        severity="critical",
+        title="javax.persistence import — JPA namespace not migrated to jakarta",
+        explanation=(
+            "Spring Boot 3 uses Jakarta EE 9 which moved JPA to the jakarta.persistence "
+            "namespace. Files importing javax.persistence will not compile after migration."
+        ),
+        fix_hint="Replace 'javax.persistence' with 'jakarta.persistence' across all affected files.",
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.persistence[^;]+);", re.MULTILINE),
+    ),
+    _Rule(
+        id="MIG-002",
+        severity="high",
+        title="javax.servlet import — Servlet API not migrated to jakarta",
+        explanation=(
+            "Spring Boot 3 bundles Jakarta Servlet 6.0. Filters, HttpServletRequest, and "
+            "HttpServletResponse referencing javax.servlet will break after migration."
+        ),
+        fix_hint="Replace 'javax.servlet' with 'jakarta.servlet' and update the servlet-api dependency.",
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.servlet[^;]+);", re.MULTILINE),
+    ),
+    _Rule(
+        id="MIG-003",
+        severity="high",
+        title="javax.validation import — Bean Validation not migrated to jakarta",
+        explanation=(
+            "Spring Boot 3 uses Hibernate Validator 8.x which implements jakarta.validation. "
+            "Constraint annotations (@NotNull, @Valid, etc.) under javax.validation will not be "
+            "picked up by the validator after migration."
+        ),
+        fix_hint="Replace 'javax.validation' with 'jakarta.validation'.",
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.validation[^;]+);", re.MULTILINE),
+    ),
+    _Rule(
+        id="MIG-004",
+        severity="high",
+        title="javax.transaction import — TX API not migrated to jakarta",
+        explanation=(
+            "Spring Boot 3 depends on Jakarta Transactions (jakarta.transaction). "
+            "Direct javax.transaction imports (@Transactional from javax or UserTransaction) "
+            "will resolve to the wrong class after migration."
+        ),
+        fix_hint="Replace 'javax.transaction' with 'jakarta.transaction'.",
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.transaction[^;]+);", re.MULTILINE),
+    ),
+    _Rule(
+        id="MIG-006",
+        severity="medium",
+        title="javax.annotation import — CDI annotations not migrated to jakarta",
+        explanation=(
+            "jakarta.annotation replaces javax.annotation in Jakarta EE 9+. "
+            "@PostConstruct, @PreDestroy, @Resource are affected."
+        ),
+        fix_hint="Replace 'javax.annotation' with 'jakarta.annotation'.",
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.annotation[^;]+);", re.MULTILINE),
+    ),
+    _Rule(
+        id="MIG-007",
+        severity="medium",
+        title="javax.inject import — DI annotations not migrated to jakarta",
+        explanation=(
+            "jakarta.inject replaces javax.inject in Jakarta EE 9+. "
+            "@Inject and @Named from javax.inject are affected."
+        ),
+        fix_hint="Replace 'javax.inject' with 'jakarta.inject'.",
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.inject[^;]+);", re.MULTILINE),
+    ),
+    _Rule(
+        id="MIG-008",
+        severity="medium",
+        title="javax.ws.rs import — JAX-RS API not migrated to jakarta",
+        explanation=(
+            "jakarta.ws.rs replaces javax.ws.rs in Jakarta EE 9+. "
+            "JAX-RS resource classes, Response, and client code are affected."
+        ),
+        fix_hint="Replace 'javax.ws.rs' with 'jakarta.ws.rs'.",
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.ws\.rs[^;]+);", re.MULTILINE),
+    ),
+]
+
+_EXTENDS_RULES: list[_Rule] = [
+    _Rule(
+        id="MIG-005",
+        severity="high",
+        title="extends WebSecurityConfigurerAdapter — removed in Spring Security 6",
+        explanation=(
+            "WebSecurityConfigurerAdapter was deprecated in Spring Security 5.7 and removed in "
+            "Spring Security 6 (Spring Boot 3). Classes extending it must be replaced with "
+            "SecurityFilterChain @Bean methods in a @Configuration class."
+        ),
+        fix_hint=(
+            "Remove the class extension and expose a SecurityFilterChain @Bean instead. "
+            "See the Spring Security 6 migration guide."
+        ),
+        extends_pattern=re.compile(r"\bextends\s+WebSecurityConfigurerAdapter\b"),
+    ),
+]
+
+_ALL_RULES: list[_Rule] = _IMPORT_RULES + _EXTENDS_RULES
+
+SEVERITY_ORDER: dict[str, int] = {"critical": 0, "high": 1, "medium": 2, "low": 3}
+
+
+# ---------------------------------------------------------------------------
+# Finding
+# ---------------------------------------------------------------------------
+
+@dataclass
+class MigrationFinding:
+    id: str               # deterministic: "{rule_id}-{file_hash[:12]}"
+    rule_id: str          # "MIG-001" .. "MIG-008"
+    severity: str         # "critical" | "high" | "medium" | "low"
+    title: str
+    source_file: str      # relative path
+    first_line: int       # 1-based line number of first match
+    imports_found: list[str] = field(default_factory=list)  # matched import statements
+    explanation: str = ""
+    fix_hint: str = ""
+
+    @staticmethod
+    def make_id(rule_id: str, source_file: str) -> str:
+        h = hashlib.sha256(f"{rule_id}:{source_file}".encode()).hexdigest()[:12]
+        return f"{rule_id}-{h}"
+
+    def to_dict(self) -> dict:
+        d: dict = {
+            "id": self.id,
+            "rule_id": self.rule_id,
+            "severity": self.severity,
+            "title": self.title,
+            "source_file": self.source_file,
+            "first_line": self.first_line,
+            "explanation": self.explanation,
+            "fix_hint": self.fix_hint,
+        }
+        if self.imports_found:
+            d["imports_found"] = self.imports_found
+        return d
+
+
+# ---------------------------------------------------------------------------
+# Report
+# ---------------------------------------------------------------------------
+
+@dataclass
+class MigrationReport:
+    schema_version: str = "1.0"
+    generated_at: str = ""
+    repo_id: str = ""
+    git_head: str = ""
+
+    # Core metrics
+    readiness_score: int = 100         # 0–100; 100 = ready to migrate
+    blocking_count: int = 0            # critical + high finding count
+    estimated_effort_days: float = 0.0
+    spring_boot_2_detected: bool = False
+
+    findings: list[MigrationFinding] = field(default_factory=list)
+    limitations: list[str] = field(default_factory=list)
+    summary: dict = field(default_factory=dict)
+    metadata: dict = field(default_factory=dict)
+
+    def finalize(self) -> "MigrationReport":
+        if not self.generated_at:
+            self.generated_at = datetime.now(timezone.utc).isoformat()
+
+        by_severity: dict[str, int] = {"critical": 0, "high": 0, "medium": 0, "low": 0}
+        by_rule: dict[str, int] = {}
+        affected_files: set[str] = set()
+
+        for f in self.findings:
+            by_severity[f.severity] = by_severity.get(f.severity, 0) + 1
+            by_rule[f.rule_id] = by_rule.get(f.rule_id, 0) + 1
+            affected_files.add(f.source_file)
+
+        self.blocking_count = by_severity["critical"] + by_severity["high"]
+
+        # Score: deduct per affected-file/severity combination (not per finding, to avoid
+        # double-counting a file that imports 10 javax.persistence classes).
+        critical_files: set[str] = set()
+        high_files: set[str] = set()
+        medium_files: set[str] = set()
+        low_files: set[str] = set()
+        for f in self.findings:
+            if f.severity == "critical":
+                critical_files.add(f.source_file)
+            elif f.severity == "high":
+                high_files.add(f.source_file)
+            elif f.severity == "medium":
+                medium_files.add(f.source_file)
+            else:
+                low_files.add(f.source_file)
+
+        deduction = (
+            len(critical_files) * 15
+            + len(high_files) * 8
+            + len(medium_files) * 3
+            + len(low_files) * 1
+        )
+        self.readiness_score = max(0, 100 - deduction)
+
+        # Effort: sum per distinct affected file weighted by severity
+        self.estimated_effort_days = round(
+            len(critical_files) * 0.5
+            + len(high_files) * 0.25
+            + len(medium_files) * 0.1
+            + len(low_files) * 0.05,
+            1,
+        )
+
+        self.summary = {
+            "total_findings": len(self.findings),
+            "affected_files": len(affected_files),
+            "by_severity": by_severity,
+            "by_rule": by_rule,
+        }
+        return self
+
+    def to_dict(self) -> dict:
+        return {
+            "schema_version": self.schema_version,
+            "generated_at": self.generated_at,
+            "repo_id": self.repo_id,
+            "git_head": self.git_head,
+            "readiness_score": self.readiness_score,
+            "blocking_count": self.blocking_count,
+            "estimated_effort_days": self.estimated_effort_days,
+            "spring_boot_2_detected": self.spring_boot_2_detected,
+            "summary": self.summary,
+            "findings": [f.to_dict() for f in self.findings],
+            "limitations": self.limitations,
+            "metadata": self.metadata,
+        }
+
+    def to_text(self, min_severity: str = "low") -> str:
+        min_order = SEVERITY_ORDER.get(min_severity, 3)
+        visible = [f for f in self.findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
+
+        lines: list[str] = [
+            f"Migration Readiness: {self.readiness_score}/100",
+            f"Blocking issues: {self.blocking_count}  "
+            f"(critical: {self.summary.get('by_severity', {}).get('critical', 0)}, "
+            f"high: {self.summary.get('by_severity', {}).get('high', 0)})",
+            f"Affected files: {self.summary.get('affected_files', 0)}",
+            f"Estimated effort: {self.estimated_effort_days}d",
+            "",
+        ]
+
+        if not visible:
+            lines.append("No findings at or above selected severity.")
+            return "\n".join(lines)
+
+        for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
+            lines.append(
+                f"{f.rule_id} [{f.severity.upper()}] {f.source_file}:{f.first_line}"
+            )
+            lines.append(f"  {f.title}")
+            lines.append(f"  Fix: {f.fix_hint}")
+            lines.append("")
+
+        return "\n".join(lines)
+
+
+# ---------------------------------------------------------------------------
+# Scanner
+# ---------------------------------------------------------------------------
+
+def _scan_file(
+    source: str,
+    rel_path: str,
+    rules: list[_Rule],
+) -> list[MigrationFinding]:
+    findings: list[MigrationFinding] = []
+
+    for rule in rules:
+        if rule.import_pattern is not None:
+            matches = list(rule.import_pattern.finditer(source))
+            if not matches:
+                continue
+            # Compute 1-based line number of first match
+            first_line = source[: matches[0].start()].count("\n") + 1
+            imports_found = [m.group(1) for m in matches]
+            findings.append(
+                MigrationFinding(
+                    id=MigrationFinding.make_id(rule.id, rel_path),
+                    rule_id=rule.id,
+                    severity=rule.severity,
+                    title=rule.title,
+                    source_file=rel_path,
+                    first_line=first_line,
+                    imports_found=imports_found,
+                    explanation=rule.explanation,
+                    fix_hint=rule.fix_hint,
+                )
+            )
+
+        elif rule.extends_pattern is not None:
+            m = rule.extends_pattern.search(source)
+            if m is None:
+                continue
+            first_line = source[: m.start()].count("\n") + 1
+            findings.append(
+                MigrationFinding(
+                    id=MigrationFinding.make_id(rule.id, rel_path),
+                    rule_id=rule.id,
+                    severity=rule.severity,
+                    title=rule.title,
+                    source_file=rel_path,
+                    first_line=first_line,
+                    explanation=rule.explanation,
+                    fix_hint=rule.fix_hint,
+                )
+            )
+
+    return findings
+
+
+# ---------------------------------------------------------------------------
+# Public entry point
+# ---------------------------------------------------------------------------
+
+def run_migrate_check(
+    file_paths: list[str],
+    root: Path,
+    *,
+    min_severity: str = "low",
+) -> MigrationReport:
+    """Scan Java files for Spring Boot 2→3 migration blockers.
+
+    Args:
+        file_paths:   Relative Java file paths (from find_java_files).
+        root:         Absolute repo root.
+        min_severity: Filter threshold — findings below this severity are excluded
+                      from the report. Choices: critical | high | medium | low.
+
+    Returns:
+        MigrationReport with findings, readiness_score, and effort estimate.
+    """
+    min_order = SEVERITY_ORDER.get(min_severity, 3)
+    all_findings: list[MigrationFinding] = []
+    limitations: list[str] = []
+    read_errors = 0
+
+    for rel_path in file_paths:
+        abs_path = root / rel_path
+        try:
+            source = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            read_errors += 1
+            continue
+
+        file_findings = _scan_file(source, rel_path, _ALL_RULES)
+        # Apply min_severity filter
+        filtered = [f for f in file_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
+        all_findings.extend(filtered)
+
+    if read_errors:
+        limitations.append(f"{read_errors} file(s) could not be read and were skipped.")
+
+    # Detect Spring Boot 2 pom.xml heuristic (best-effort, non-fatal)
+    spring_boot_2 = _detect_spring_boot_2(root)
+
+    report = MigrationReport(
+        spring_boot_2_detected=spring_boot_2,
+        findings=all_findings,
+        limitations=limitations,
+        metadata={
+            "java_files_scanned": len(file_paths),
+            "min_severity": min_severity,
+            "rules_applied": [r.id for r in _ALL_RULES],
+        },
+    )
+
+    # Populate git_head — non-fatal
+    try:
+        import subprocess as _sub
+        _r = _sub.run(
+            ["git", "-C", str(root), "rev-parse", "--short", "HEAD"],
+            capture_output=True, text=True, timeout=3,
+        )
+        if _r.returncode == 0:
+            report.git_head = _r.stdout.strip()
+    except Exception:
+        pass
+
+    return report.finalize()
+
+
+def _detect_spring_boot_2(root: Path) -> bool:
+    """Return True if any pom.xml or build.gradle declares spring-boot 2.x."""
+    _SB2 = re.compile(r"spring.boot[^\"'\n]*[\"']?2\.\d+", re.IGNORECASE)
+    for name in ("pom.xml", "build.gradle", "build.gradle.kts"):
+        candidate = root / name
+        try:
+            text = candidate.read_text(encoding="utf-8", errors="replace")
+            if _SB2.search(text):
+                return True
+        except OSError:
+            pass
+    return False

{sourcecode-1.35.18.dist-info → sourcecode-1.35.20.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.18
+Version: 1.35.20
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.16-blue)
+![Version](https://img.shields.io/badge/version-1.35.20-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.16
+# sourcecode 1.35.20
 ```
 
 ---

{sourcecode-1.35.18.dist-info → sourcecode-1.35.20.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=r4oQ6QPKKMHrjnfFwyEU8-Za6oZOvpxIorOgVbDG10o,104
+sourcecode/__init__.py,sha256=l8p-xmLEzkjJbgIarJoeYeAvJ-XevKuJ0pJk4s4nFtM,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -7,7 +7,7 @@ sourcecode/cache.py,sha256=wAyPrXN5DqiGivnMpeEuun2xHDKfBer2_oBsh6kj_vc,30447
 sourcecode/canonical_ir.py,sha256=uwpwCnJxMh_eiIVg4cOLv7-aZthvmDFcG4azCOycLkw,24281
 sourcecode/cir_graphs.py,sha256=rZi8JV4ZrAa2WSCeyNa4JIEKQ_yZzDZTsrvVz2KfuKA,8919
 sourcecode/classifier.py,sha256=2lYoSH3vOTkXZYPU7Go2WIet1-IuNzTWVhc-ULnXtgw,8024
-sourcecode/cli.py,sha256=k_MeCOfAlal3VORr6PaWr9sRbMbhKHOV0sI3O2jcxes,229485
+sourcecode/cli.py,sha256=YOcCerZFukibhfR5urXXfGXqX9MOyZgK_cgiOdHJH_k,237764
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -29,6 +29,7 @@ sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,
 sourcecode/license.py,sha256=3JCV2OeTVttKrOGBguU5uZC0c02Stig-KLB0mP2lNiY,22742
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
+sourcecode/migrate_check.py,sha256=KQJRuQPrZSDYnIsekEjF-6j6b702Cu-pjojo-teO4wM,16338
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=ROFRQ8eSLBEMiixK9f45-RO7um4VEEcjoD5AA4I427I,3739
 sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrfjz2o,14423
@@ -79,9 +80,9 @@ sourcecode/detectors/terraform.py,sha256=cxORPR_zVLOJpHlh4e9JnFpkQsn_UnqMMom5yG6
 sourcecode/detectors/tooling.py,sha256=8CKbtxwQoABP-WyBRNmdAmHDOvAH57AR1cF4UKuWEdQ,2074
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
 sourcecode/mcp/orchestrator.py,sha256=BMi1D6liJHI3DXiaC8yeBLLP0wXajpCP3-vnRGqrvnw,26850
-sourcecode/mcp/registry.py,sha256=y9dBj00xlTun6ZsKer9HZJ4W70ZiSdOrY4d-jBe9e08,60460
+sourcecode/mcp/registry.py,sha256=XeshSuT6NMmeUZ2GCzNVcKcr-2Ljoj4qO-lvSrg17EM,63135
 sourcecode/mcp/runner.py,sha256=-Dp2qPGRkfNTVen6bKh7WtzQqpcEtsrXoiuajvshlKk,2866
-sourcecode/mcp/server.py,sha256=lBSQCw3yFe8rZHp2GGVcfua0EJUYZmsIUbvA4GIJv9s,52210
+sourcecode/mcp/server.py,sha256=G2vGG791pEjd7NNUP7vcDPsaFUEyfnGYyYJjMiiFZls,54789
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=B9CneieWTpaDSDIyW3S5nrlRlBpvfqUcgi93-mm_ApQ,2135
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -93,8 +94,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=QSslxIwij8YkRWcVvxykODDrkiN_GAAEu3dUP7KIWeE,1651
-sourcecode-1.35.18.dist-info/METADATA,sha256=A-e9C9ArfzHZ7g2CPnXdfg2YGTRk_N1QfrFKbMT6QMs,21297
-sourcecode-1.35.18.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.35.18.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.35.18.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.35.18.dist-info/RECORD,,
+sourcecode-1.35.20.dist-info/METADATA,sha256=KVCGOgyCNzyPgXlmXaBGm15I45DFenMGxvduoVE6gYg,21297
+sourcecode-1.35.20.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.35.20.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.35.20.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.35.20.dist-info/RECORD,,