sourcecode 1.35.19__py3-none-any.whl → 1.35.20__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.19"
+__version__ = "1.35.20"

sourcecode/cli.py

@@ -3722,6 +3722,80 @@ def endpoints_cmd(
 
 # ── Spring Semantic Audit ─────────────────────────────────────────────────────
 
+
+def _render_spring_audit_github_comment(result: "SpringAuditResult", min_severity: str = "low") -> str:  # type: ignore[name-defined]
+    """Render SpringAuditResult as a GitHub PR comment in Markdown."""
+    from sourcecode.spring_findings import SEVERITY_ORDER
+
+    min_order = SEVERITY_ORDER.get(min_severity, 3)
+    visible = [f for f in result.findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
+
+    sev = result.summary.get("by_severity", {})
+    total = result.summary.get("total_findings", 0)
+    blocking = sev.get("critical", 0) + sev.get("high", 0)
+
+    _ICONS = {"critical": "🔴", "high": "🟠", "medium": "🟡", "low": "🔵"}
+    _LABELS = {"critical": "CRITICAL", "high": "HIGH", "medium": "MEDIUM", "low": "LOW"}
+
+    if total == 0:
+        status_line = "✅ **Spring Audit — no findings**"
+    elif blocking > 0:
+        status_line = f"🔴 **Spring Audit — {total} finding{'s' if total != 1 else ''} ({blocking} blocking)**"
+    else:
+        status_line = f"🟡 **Spring Audit — {total} finding{'s' if total != 1 else ''} (0 blocking)**"
+
+    lines: list[str] = [status_line, ""]
+
+    if total > 0:
+        severity_counts = []
+        for sev_name in ("critical", "high", "medium", "low"):
+            n = sev.get(sev_name, 0)
+            if n:
+                severity_counts.append(f"{_ICONS[sev_name]} {n} {sev_name}")
+        lines.append("**Severity:** " + "  ·  ".join(severity_counts))
+        lines.append("")
+
+    if not visible:
+        lines.append(f"_No findings at or above `{min_severity}` severity._")
+        return "\n".join(lines)
+
+    lines += [
+        "| Sev | Pattern | File | Symbol | Title |",
+        "|-----|---------|------|--------|-------|",
+    ]
+    for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
+        icon = _ICONS.get(f.severity, "")
+        label = _LABELS.get(f.severity, f.severity.upper())
+        short_file = f.source_file.split("/")[-1] if "/" in f.source_file else f.source_file
+        short_sym = f.symbol.split(".")[-1] if "." in f.symbol else f.symbol
+        title_escaped = f.title.replace("|", "\\|")
+        lines.append(f"| {icon} {label} | `{f.pattern_id}` | `{short_file}` | `{short_sym}` | {title_escaped} |")
+
+    lines.append("")
+
+    if visible:
+        lines.append("<details>")
+        lines.append("<summary>Finding details</summary>")
+        lines.append("")
+        for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
+            icon = _ICONS.get(f.severity, "")
+            lines.append(f"### {icon} `{f.pattern_id}` — {f.title}")
+            lines.append(f"**File:** `{f.source_file}`  **Symbol:** `{f.symbol}`")
+            lines.append("")
+            lines.append(f.explanation)
+            lines.append("")
+            lines.append(f"**Fix:** {f.fix_hint}")
+            lines.append("")
+        lines.append("</details>")
+
+    lines += [
+        "",
+        f"_Generated by [sourcecode](https://github.com/sourcecode-ai/sourcecode) · "
+        f"scope: {result.scope} · min-severity: {min_severity}_",
+    ]
+    return "\n".join(lines)
+
+
 @app.command("spring-audit")
 def spring_audit_cmd(
     path: Path = typer.Argument(
@@ -3736,7 +3810,7 @@ def spring_audit_cmd(
         "json",
         "--format",
         "-f",
-        help="Output format: json (default) or yaml.",
+        help="Output format: json (default), yaml, or github-comment.",
         show_default=True,
     ),
     copy: bool = typer.Option(
@@ -3758,6 +3832,11 @@ def spring_audit_cmd(
         help="Minimum severity to include: critical, high, medium, or low (default).",
         show_default=True,
     ),
+    ci: bool = typer.Option(
+        False,
+        "--ci/--no-ci",
+        help="Exit with code 1 if any findings at or above --min-severity are found. For CI/CD gates.",
+    ),
 ) -> None:
     """Spring semantic audit: TX anomalies (TX-001..005) + security surface (SEC-001..003).
 
@@ -3772,6 +3851,12 @@ def spring_audit_cmd(
       SEC-002 CVE-2025-41248: @PreAuthorize on inherited method from generic supertype
       SEC-003 @Transactional on @Controller/@RestController (TX in wrong layer)
 
+    \b
+    CI/CD usage:
+      sourcecode spring-audit . --ci                             # exit 1 on any finding
+      sourcecode spring-audit . --ci --min-severity high         # exit 1 only on high/critical
+      sourcecode spring-audit . --ci --format github-comment     # Markdown PR comment + exit 1
+
     \b
     Examples:
       sourcecode spring-audit .
@@ -3818,15 +3903,27 @@ def spring_audit_cmd(
         )
         raise typer.Exit(code=1)
 
+    if format not in ("json", "yaml", "github-comment"):
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"Invalid format '{format}'.",
+            hint="format must be one of: json, yaml, github-comment.",
+            expected="json | yaml | github-comment",
+        )
+        raise typer.Exit(code=1)
+
     file_list = find_java_files(target)
     if not file_list:
-        data = SpringAuditResult(
+        empty_result = SpringAuditResult(
             spring_detected=False,
             scope=scope,
             limitations=["No Java files found in repository — Spring audit requires Java source."],
             metadata={"java_files_found": 0},
-        ).finalize().to_dict()
-        output = _serialize_dict(data, format)
+        ).finalize()
+        if format == "github-comment":
+            output = _render_spring_audit_github_comment(empty_result, min_severity)
+        else:
+            output = _serialize_dict(empty_result.to_dict(), format)
         if output_path is not None:
             output_path.write_text(output, encoding="utf-8")
             typer.echo("Spring audit written to " + str(output_path), err=True)
@@ -3885,7 +3982,10 @@ def spring_audit_cmd(
     except Exception:
         pass
 
-    output = _serialize_dict(data, format)
+    if format == "github-comment":
+        output = _render_spring_audit_github_comment(combined, min_severity)
+    else:
+        output = _serialize_dict(data, format)
 
     if output_path is not None:
         output_path.write_text(output, encoding="utf-8")
@@ -3899,6 +3999,9 @@ def spring_audit_cmd(
             if _copy_to_clipboard(output):
                 typer.echo("✓ copied to clipboard", err=True)
 
+    if ci and combined.findings:
+        raise typer.Exit(code=1)
+
 
 # ── Spring Boot Migration Check ───────────────────────────────────────────────
 

sourcecode/mcp/registry.py

@@ -1221,6 +1221,7 @@ _MCP_HIDDEN_CANONICAL_TOOLS: frozenset[str] = frozenset({
     # Listed here so validate_registry() skips CLI param-drift checks on the alias.
     "spring_audit",       # curated: repo_path + scope + min_severity only (strips output_path/format/copy)
     "impact_chain",       # curated: repo_path + symbol + depth + query_type with choices
+    "migrate_check",      # curated: repo_path + min_severity only (strips output_path/format/copy/ci)
     # MCP self-management (an agent is not the MCP client admin)
     "mcp_init",
     "mcp_serve",
@@ -1349,7 +1350,57 @@ query_type: "impact" (default) | "events"
         docstring_override=_IMPACT_CHAIN_DOC,
     )
 
-    return [spring_audit, impact_chain]
+    _MIGRATE_CHECK_DOC = """\
+Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA ONLY.
+
+When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
+or upgrading from Spring Boot 2.x to 3.x. Use BEFORE get_spring_audit when the goal
+is migration planning rather than ongoing Spring semantic audit.
+Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+
+Rules detected:
+  MIG-001 critical — javax.persistence imports (JPA; will not compile after migration)
+  MIG-002 high     — javax.servlet imports (Servlet API changed)
+  MIG-003 high     — javax.validation imports (Bean Validation changed)
+  MIG-004 high     — javax.transaction imports (TX API changed)
+  MIG-005 high     — extends WebSecurityConfigurerAdapter (removed in Spring Security 6)
+  MIG-006 medium   — javax.annotation imports (CDI annotations)
+  MIG-007 medium   — javax.inject imports (DI annotations)
+  MIG-008 medium   — javax.ws.rs imports (JAX-RS API)
+
+Returns: schema_version, readiness_score (0–100; 100=ready to migrate), blocking_count,
+  estimated_effort_days, spring_boot_2_detected, summary (total_findings, affected_files,
+  by_severity, by_rule), findings[], limitations, metadata.
+findings fields: id, rule_id, severity, title, source_file, first_line,
+  imports_found, explanation, fix_hint.
+
+repo_path: absolute path to the Java repository (default: current working directory).
+min_severity: "low" (default) | "medium" | "high" | "critical" — filter threshold.
+"""
+
+    migrate_check = _alias_spec(
+        "migrate_check",
+        "Spring Boot 2→3 migration readiness: javax→jakarta blockers. JAVA ONLY.",
+        ("migrate-check",),
+        (
+            ToolParamSpec("repo_path", "argument", str, required=False, default=".", is_path=True,
+                          help="Absolute path to the Java repository."),
+            ToolParamSpec("min_severity", "option", str, required=False, default="low",
+                          option_names=("--min-severity",), choices=("low", "medium", "high", "critical"),
+                          help="low (default) | medium | high | critical"),
+        ),
+        lambda inputs: [
+            "migrate-check",
+            str(inputs.get("repo_path", ".")),
+            "--min-severity", str(inputs.get("min_severity", "low")),
+        ],
+        supported_targets=("repo_path",),
+        unsupported_targets=("file_path",),
+        validator=validate_repo_path,
+        docstring_override=_MIGRATE_CHECK_DOC,
+    )
+
+    return [spring_audit, impact_chain, migrate_check]
 
 
 @lru_cache(maxsize=1)

sourcecode/mcp/server.py

@@ -649,6 +649,56 @@ def get_spring_audit(repo_path: str = ".", scope: str = "all") -> dict:
         )
 
 
+@mcp.tool()
+def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") -> dict:
+    """Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA ONLY.
+
+    When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
+    or upgrading from Spring Boot 2.x to 3.x. Call this BEFORE get_spring_audit when
+    the goal is migration planning — not ongoing audit.
+    Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+
+    Maps to: sourcecode migrate-check <repo_path> --min-severity <min_severity>
+    Returns: MigrationReport with schema_version, readiness_score (0–100; 100=ready to migrate),
+             blocking_count, estimated_effort_days, spring_boot_2_detected,
+             summary (total_findings, affected_files, by_severity, by_rule),
+             findings[], limitations, metadata.
+    findings fields: id, rule_id, severity, title, source_file, first_line,
+             imports_found, explanation, fix_hint.
+    Rules:
+      MIG-001 critical — javax.persistence (JPA, will not compile after migration)
+      MIG-002 high     — javax.servlet (Servlet API)
+      MIG-003 high     — javax.validation (Bean Validation)
+      MIG-004 high     — javax.transaction (TX API)
+      MIG-005 high     — extends WebSecurityConfigurerAdapter (removed in Spring Security 6)
+      MIG-006 medium   — javax.annotation (CDI annotations)
+      MIG-007 medium   — javax.inject (DI annotations)
+      MIG-008 medium   — javax.ws.rs (JAX-RS API)
+
+    repo_path: absolute path to the Java repository (default: current working directory).
+    min_severity: "low" (default) | "medium" | "high" | "critical" — filter threshold.
+    """
+    _raw = repo_path
+    try:
+        if not isinstance(repo_path, str):
+            return _err("repo_path must be a string", "INVALID_ARGUMENT")
+        if min_severity not in ("critical", "high", "medium", "low"):
+            return _err(
+                f"Invalid min_severity '{min_severity}' — must be one of: critical, high, medium, low",
+                "INVALID_ARGUMENT",
+            )
+        repo_path = _normalize_repo_path(repo_path)
+        _path_err = _check_repo_path(repo_path)
+        if _path_err is not None:
+            return _path_err
+        return _execute(["migrate-check", repo_path, "--min-severity", min_severity])
+    except Exception as exc:
+        return _err(
+            f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
+            "INTERNAL_ERROR",
+        )
+
+
 @mcp.tool()
 def get_impact_chain(repo_path: str = ".", symbol: str = "", depth: int = 4) -> dict:
     """Spring impact-chain: systemic blast radius of a symbol with TX/SEC semantic enrichment. JAVA/SPRING ONLY.

{sourcecode-1.35.19.dist-info → sourcecode-1.35.20.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.19
+Version: 1.35.20
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.16-blue)
+![Version](https://img.shields.io/badge/version-1.35.20-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.16
+# sourcecode 1.35.20
 ```
 
 ---

{sourcecode-1.35.19.dist-info → sourcecode-1.35.20.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=hzHULzlZzht_1GYLCF6iKVI8a1MFSsEJYu30xrAvGZU,104
+sourcecode/__init__.py,sha256=l8p-xmLEzkjJbgIarJoeYeAvJ-XevKuJ0pJk4s4nFtM,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -7,7 +7,7 @@ sourcecode/cache.py,sha256=wAyPrXN5DqiGivnMpeEuun2xHDKfBer2_oBsh6kj_vc,30447
 sourcecode/canonical_ir.py,sha256=uwpwCnJxMh_eiIVg4cOLv7-aZthvmDFcG4azCOycLkw,24281
 sourcecode/cir_graphs.py,sha256=rZi8JV4ZrAa2WSCeyNa4JIEKQ_yZzDZTsrvVz2KfuKA,8919
 sourcecode/classifier.py,sha256=2lYoSH3vOTkXZYPU7Go2WIet1-IuNzTWVhc-ULnXtgw,8024
-sourcecode/cli.py,sha256=CALwHKAoBv1MmhLE7ZingoarOxXTk3VUCrxF4CDYB20,233442
+sourcecode/cli.py,sha256=YOcCerZFukibhfR5urXXfGXqX9MOyZgK_cgiOdHJH_k,237764
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -80,9 +80,9 @@ sourcecode/detectors/terraform.py,sha256=cxORPR_zVLOJpHlh4e9JnFpkQsn_UnqMMom5yG6
 sourcecode/detectors/tooling.py,sha256=8CKbtxwQoABP-WyBRNmdAmHDOvAH57AR1cF4UKuWEdQ,2074
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
 sourcecode/mcp/orchestrator.py,sha256=BMi1D6liJHI3DXiaC8yeBLLP0wXajpCP3-vnRGqrvnw,26850
-sourcecode/mcp/registry.py,sha256=y9dBj00xlTun6ZsKer9HZJ4W70ZiSdOrY4d-jBe9e08,60460
+sourcecode/mcp/registry.py,sha256=XeshSuT6NMmeUZ2GCzNVcKcr-2Ljoj4qO-lvSrg17EM,63135
 sourcecode/mcp/runner.py,sha256=-Dp2qPGRkfNTVen6bKh7WtzQqpcEtsrXoiuajvshlKk,2866
-sourcecode/mcp/server.py,sha256=lBSQCw3yFe8rZHp2GGVcfua0EJUYZmsIUbvA4GIJv9s,52210
+sourcecode/mcp/server.py,sha256=G2vGG791pEjd7NNUP7vcDPsaFUEyfnGYyYJjMiiFZls,54789
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=B9CneieWTpaDSDIyW3S5nrlRlBpvfqUcgi93-mm_ApQ,2135
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -94,8 +94,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=QSslxIwij8YkRWcVvxykODDrkiN_GAAEu3dUP7KIWeE,1651
-sourcecode-1.35.19.dist-info/METADATA,sha256=PoK3wFYqg5mUZAk98YbNEx2Gvd7c55DmNlYqORyKox8,21297
-sourcecode-1.35.19.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.35.19.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.35.19.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.35.19.dist-info/RECORD,,
+sourcecode-1.35.20.dist-info/METADATA,sha256=KVCGOgyCNzyPgXlmXaBGm15I45DFenMGxvduoVE6gYg,21297
+sourcecode-1.35.20.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.35.20.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.35.20.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.35.20.dist-info/RECORD,,