sourcecode 1.35.19__py3-none-any.whl → 1.35.22__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.19"
+__version__ = "1.35.22"

sourcecode/cli.py

@@ -3722,6 +3722,80 @@ def endpoints_cmd(
 
 # ── Spring Semantic Audit ─────────────────────────────────────────────────────
 
+
+def _render_spring_audit_github_comment(result: "SpringAuditResult", min_severity: str = "low") -> str:  # type: ignore[name-defined]
+    """Render SpringAuditResult as a GitHub PR comment in Markdown."""
+    from sourcecode.spring_findings import SEVERITY_ORDER
+
+    min_order = SEVERITY_ORDER.get(min_severity, 3)
+    visible = [f for f in result.findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
+
+    sev = result.summary.get("by_severity", {})
+    total = result.summary.get("total_findings", 0)
+    blocking = sev.get("critical", 0) + sev.get("high", 0)
+
+    _ICONS = {"critical": "🔴", "high": "🟠", "medium": "🟡", "low": "🔵"}
+    _LABELS = {"critical": "CRITICAL", "high": "HIGH", "medium": "MEDIUM", "low": "LOW"}
+
+    if total == 0:
+        status_line = "✅ **Spring Audit — no findings**"
+    elif blocking > 0:
+        status_line = f"🔴 **Spring Audit — {total} finding{'s' if total != 1 else ''} ({blocking} blocking)**"
+    else:
+        status_line = f"🟡 **Spring Audit — {total} finding{'s' if total != 1 else ''} (0 blocking)**"
+
+    lines: list[str] = [status_line, ""]
+
+    if total > 0:
+        severity_counts = []
+        for sev_name in ("critical", "high", "medium", "low"):
+            n = sev.get(sev_name, 0)
+            if n:
+                severity_counts.append(f"{_ICONS[sev_name]} {n} {sev_name}")
+        lines.append("**Severity:** " + "  ·  ".join(severity_counts))
+        lines.append("")
+
+    if not visible:
+        lines.append(f"_No findings at or above `{min_severity}` severity._")
+        return "\n".join(lines)
+
+    lines += [
+        "| Sev | Pattern | File | Symbol | Title |",
+        "|-----|---------|------|--------|-------|",
+    ]
+    for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
+        icon = _ICONS.get(f.severity, "")
+        label = _LABELS.get(f.severity, f.severity.upper())
+        short_file = f.source_file.split("/")[-1] if "/" in f.source_file else f.source_file
+        short_sym = f.symbol.split(".")[-1] if "." in f.symbol else f.symbol
+        title_escaped = f.title.replace("|", "\\|")
+        lines.append(f"| {icon} {label} | `{f.pattern_id}` | `{short_file}` | `{short_sym}` | {title_escaped} |")
+
+    lines.append("")
+
+    if visible:
+        lines.append("<details>")
+        lines.append("<summary>Finding details</summary>")
+        lines.append("")
+        for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
+            icon = _ICONS.get(f.severity, "")
+            lines.append(f"### {icon} `{f.pattern_id}` — {f.title}")
+            lines.append(f"**File:** `{f.source_file}`  **Symbol:** `{f.symbol}`")
+            lines.append("")
+            lines.append(f.explanation)
+            lines.append("")
+            lines.append(f"**Fix:** {f.fix_hint}")
+            lines.append("")
+        lines.append("</details>")
+
+    lines += [
+        "",
+        f"_Generated by [sourcecode](https://github.com/sourcecode-ai/sourcecode) · "
+        f"scope: {result.scope} · min-severity: {min_severity}_",
+    ]
+    return "\n".join(lines)
+
+
 @app.command("spring-audit")
 def spring_audit_cmd(
     path: Path = typer.Argument(
@@ -3736,7 +3810,7 @@ def spring_audit_cmd(
         "json",
         "--format",
         "-f",
-        help="Output format: json (default) or yaml.",
+        help="Output format: json (default), yaml, or github-comment.",
         show_default=True,
     ),
     copy: bool = typer.Option(
@@ -3758,6 +3832,11 @@ def spring_audit_cmd(
         help="Minimum severity to include: critical, high, medium, or low (default).",
         show_default=True,
     ),
+    ci: bool = typer.Option(
+        False,
+        "--ci/--no-ci",
+        help="Exit with code 1 if any findings at or above --min-severity are found. For CI/CD gates.",
+    ),
 ) -> None:
     """Spring semantic audit: TX anomalies (TX-001..005) + security surface (SEC-001..003).
 
@@ -3772,6 +3851,12 @@ def spring_audit_cmd(
       SEC-002 CVE-2025-41248: @PreAuthorize on inherited method from generic supertype
       SEC-003 @Transactional on @Controller/@RestController (TX in wrong layer)
 
+    \b
+    CI/CD usage:
+      sourcecode spring-audit . --ci                             # exit 1 on any finding
+      sourcecode spring-audit . --ci --min-severity high         # exit 1 only on high/critical
+      sourcecode spring-audit . --ci --format github-comment     # Markdown PR comment + exit 1
+
     \b
     Examples:
       sourcecode spring-audit .
@@ -3818,15 +3903,28 @@ def spring_audit_cmd(
         )
         raise typer.Exit(code=1)
 
-    file_list = find_java_files(target)
+    if format not in ("json", "yaml", "github-comment"):
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"Invalid format '{format}'.",
+            hint="format must be one of: json, yaml, github-comment.",
+            expected="json | yaml | github-comment",
+        )
+        raise typer.Exit(code=1)
+
+    _file_limitations: list[str] = []
+    file_list = find_java_files(target, limitations=_file_limitations)
     if not file_list:
-        data = SpringAuditResult(
+        empty_result = SpringAuditResult(
             spring_detected=False,
             scope=scope,
             limitations=["No Java files found in repository — Spring audit requires Java source."],
             metadata={"java_files_found": 0},
-        ).finalize().to_dict()
-        output = _serialize_dict(data, format)
+        ).finalize()
+        if format == "github-comment":
+            output = _render_spring_audit_github_comment(empty_result, min_severity)
+        else:
+            output = _serialize_dict(empty_result.to_dict(), format)
         if output_path is not None:
             output_path.write_text(output, encoding="utf-8")
             typer.echo("Spring audit written to " + str(output_path), err=True)
@@ -3864,6 +3962,9 @@ def spring_audit_cmd(
             metadata=merged_meta,
         ).finalize()
 
+    if _file_limitations:
+        combined.limitations.extend(_file_limitations)
+
     # Populate git_head from repo HEAD — non-fatal.
     try:
         import subprocess as _sub_sa
@@ -3885,7 +3986,10 @@ def spring_audit_cmd(
     except Exception:
         pass
 
-    output = _serialize_dict(data, format)
+    if format == "github-comment":
+        output = _render_spring_audit_github_comment(combined, min_severity)
+    else:
+        output = _serialize_dict(data, format)
 
     if output_path is not None:
         output_path.write_text(output, encoding="utf-8")
@@ -3899,6 +4003,9 @@ def spring_audit_cmd(
             if _copy_to_clipboard(output):
                 typer.echo("✓ copied to clipboard", err=True)
 
+    if ci and combined.findings:
+        raise typer.Exit(code=1)
+
 
 # ── Spring Boot Migration Check ───────────────────────────────────────────────
 
@@ -3985,8 +4092,11 @@ def migrate_check_cmd(
         )
         raise typer.Exit(code=1)
 
-    file_list = find_java_files(target)
+    _file_limitations: list[str] = []
+    file_list = find_java_files(target, limitations=_file_limitations)
     report = run_migrate_check(file_list, target, min_severity=min_severity)
+    if _file_limitations:
+        report.limitations.extend(_file_limitations)
 
     if format == "text":
         output = report.to_text(min_severity=min_severity)

sourcecode/dependency_analyzer.py

@@ -1142,6 +1142,78 @@ class DependencyAnalyzer:
         records: list[DependencyRecord] = []
         deps_elem = root_elem.find(f"{ns}dependencies")
         if deps_elem is None:
+            # Multi-module aggregator POM: scan up to 5 declared submodule pom.xml files.
+            modules_elem = root_elem.find(f"{ns}modules")
+            if modules_elem is not None:
+                submodule_records: list[DependencyRecord] = []
+                submodule_limitations: list[str] = []
+                seen_submodule_deps: set[str] = set()
+                _all_modules = list(modules_elem.findall(f"{ns}module"))
+                if len(_all_modules) > 5:
+                    submodule_limitations.append(
+                        f"MAX_SUBMODULES_REACHED: scanned 5 of {len(_all_modules)} declared Maven submodules"
+                    )
+                for mod_elem in _all_modules[:5]:
+                    mod_name = (mod_elem.text or "").strip()
+                    if not mod_name:
+                        continue
+                    sub_pom = root / mod_name / "pom.xml"
+                    if not sub_pom.exists():
+                        continue
+                    try:
+                        sub_tree = ET.parse(sub_pom)
+                    except (ET.ParseError, OSError):
+                        continue
+                    sub_root = sub_tree.getroot()
+                    sub_ns_match = re.match(r"\{[^}]+\}", sub_root.tag)
+                    sub_ns = sub_ns_match.group(0) if sub_ns_match else ""
+                    sub_props = self._parse_maven_properties(sub_root, sub_ns)
+                    sub_dm = self._parse_dependency_management(sub_root, sub_ns, sub_props)
+                    # Inherit parent properties for version resolution
+                    for k, v in properties.items():
+                        sub_props.setdefault(k, v)
+                    for k, v in dm_versions.items():
+                        sub_dm.setdefault(k, v)
+                    sub_deps_elem = sub_root.find(f"{sub_ns}dependencies")
+                    if sub_deps_elem is None:
+                        continue
+                    for dep in sub_deps_elem.findall(f"{sub_ns}dependency"):
+                        gid = (dep.findtext(f"{sub_ns}groupId") or "").strip()
+                        aid = (dep.findtext(f"{sub_ns}artifactId") or "").strip()
+                        if not gid or not aid:
+                            continue
+                        dep_key = f"{gid}:{aid}"
+                        if dep_key in seen_submodule_deps:
+                            continue
+                        seen_submodule_deps.add(dep_key)
+                        ver_raw = (dep.findtext(f"{sub_ns}version") or "").strip() or None
+                        declared = self._resolve_maven_version(ver_raw, sub_props)
+                        if declared is None:
+                            declared = sub_dm.get(dep_key)
+                        scope_text = (dep.findtext(f"{sub_ns}scope") or "compile").strip().lower()
+                        if scope_text == "test":
+                            scope = "dev"
+                        elif scope_text == "provided":
+                            scope = "provided"
+                        else:
+                            scope = "direct"
+                        resolved_version = None
+                        if declared is None and parent_version:
+                            if gid == "org.springframework.boot":
+                                resolved_version = parent_version
+                            elif gid == "org.springframework.security" and "spring-security.version" in sub_props:
+                                resolved_version = sub_props["spring-security.version"]
+                        submodule_records.append(DependencyRecord(
+                            name=dep_key,
+                            ecosystem="java",
+                            scope=scope,
+                            declared_version=declared,
+                            resolved_version=resolved_version,
+                            source="manifest",
+                            manifest_path=f"{mod_name}/pom.xml",
+                        ))
+                if submodule_records:
+                    return submodule_records, submodule_limitations
             return [], ["java: pom.xml has no <dependencies> block"]
 
         for dep in deps_elem.findall(f"{ns}dependency"):

sourcecode/mcp/registry.py

@@ -1221,6 +1221,7 @@ _MCP_HIDDEN_CANONICAL_TOOLS: frozenset[str] = frozenset({
     # Listed here so validate_registry() skips CLI param-drift checks on the alias.
     "spring_audit",       # curated: repo_path + scope + min_severity only (strips output_path/format/copy)
     "impact_chain",       # curated: repo_path + symbol + depth + query_type with choices
+    "migrate_check",      # curated: repo_path + min_severity only (strips output_path/format/copy/ci)
     # MCP self-management (an agent is not the MCP client admin)
     "mcp_init",
     "mcp_serve",
@@ -1349,7 +1350,57 @@ query_type: "impact" (default) | "events"
         docstring_override=_IMPACT_CHAIN_DOC,
     )
 
-    return [spring_audit, impact_chain]
+    _MIGRATE_CHECK_DOC = """\
+Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA ONLY.
+
+When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
+or upgrading from Spring Boot 2.x to 3.x. Use BEFORE get_spring_audit when the goal
+is migration planning rather than ongoing Spring semantic audit.
+Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+
+Rules detected:
+  MIG-001 critical — javax.persistence imports (JPA; will not compile after migration)
+  MIG-002 high     — javax.servlet imports (Servlet API changed)
+  MIG-003 high     — javax.validation imports (Bean Validation changed)
+  MIG-004 high     — javax.transaction imports (TX API changed)
+  MIG-005 high     — extends WebSecurityConfigurerAdapter (removed in Spring Security 6)
+  MIG-006 medium   — javax.annotation imports (CDI annotations)
+  MIG-007 medium   — javax.inject imports (DI annotations)
+  MIG-008 medium   — javax.ws.rs imports (JAX-RS API)
+
+Returns: schema_version, readiness_score (0–100; 100=ready to migrate), blocking_count,
+  estimated_effort_days, spring_boot_2_detected, summary (total_findings, affected_files,
+  by_severity, by_rule), findings[], limitations, metadata.
+findings fields: id, rule_id, severity, title, source_file, first_line,
+  imports_found, explanation, fix_hint.
+
+repo_path: absolute path to the Java repository (default: current working directory).
+min_severity: "low" (default) | "medium" | "high" | "critical" — filter threshold.
+"""
+
+    migrate_check = _alias_spec(
+        "migrate_check",
+        "Spring Boot 2→3 migration readiness: javax→jakarta blockers. JAVA ONLY.",
+        ("migrate-check",),
+        (
+            ToolParamSpec("repo_path", "argument", str, required=False, default=".", is_path=True,
+                          help="Absolute path to the Java repository."),
+            ToolParamSpec("min_severity", "option", str, required=False, default="low",
+                          option_names=("--min-severity",), choices=("low", "medium", "high", "critical"),
+                          help="low (default) | medium | high | critical"),
+        ),
+        lambda inputs: [
+            "migrate-check",
+            str(inputs.get("repo_path", ".")),
+            "--min-severity", str(inputs.get("min_severity", "low")),
+        ],
+        supported_targets=("repo_path",),
+        unsupported_targets=("file_path",),
+        validator=validate_repo_path,
+        docstring_override=_MIGRATE_CHECK_DOC,
+    )
+
+    return [spring_audit, impact_chain, migrate_check]
 
 
 @lru_cache(maxsize=1)

sourcecode/mcp/server.py

@@ -192,7 +192,48 @@ def _execute(args: list[str]) -> dict | CallToolResult:
     return _ok(result)
 
 
+# Per-tool character budgets (4 chars ≈ 1 token; keeps Cursor under its 10k token limit).
+# List fields are trimmed front-to-back until output fits.
+_MCP_CHAR_BUDGETS: dict[str, int] = {
+    "get_agent_context":       38_000,
+    "get_spring_audit":        38_000,
+    "get_migration_readiness": 38_000,
+}
+_MCP_TRIM_FIELDS = (
+    "findings", "relevant_files", "key_dependencies",
+    "entry_points", "limitations", "gaps", "code_notes",
+)
+
+
+def _cap_mcp_output(tool_name: str, data: Any) -> Any:
+    """Trim list fields in data until JSON serialisation fits within the tool's char budget."""
+    budget = _MCP_CHAR_BUDGETS.get(tool_name)
+    if not budget or not isinstance(data, dict):
+        return data
+    if len(json.dumps(data, default=str)) <= budget:
+        return data
+    result = dict(data)
+    for field in _MCP_TRIM_FIELDS:
+        if field not in result or not isinstance(result[field], list):
+            continue
+        items = list(result[field])
+        while items and len(json.dumps(result, default=str)) > budget:
+            items = items[:-1]
+            result[field] = items
+        if len(json.dumps(result, default=str)) <= budget:
+            break
+    if len(json.dumps(result, default=str)) > budget:
+        result["_mcp_truncated"] = True
+        result["_mcp_truncation_note"] = (
+            f"Output capped at ~{budget // 4}k tokens for MCP compatibility. "
+            "Use CLI directly for full output."
+        )
+    return result
+
+
 _DEFAULT_TESTS_TIMEOUT_MS = 15_000
+_DEFAULT_SPRING_AUDIT_TIMEOUT_MS = 120_000   # 2 min
+_DEFAULT_IMPACT_TIMEOUT_MS = 60_000          # 1 min
 
 # Regex for MINGW paths: /c/some/path → C:/some/path
 _MINGW_PATH_RE = re.compile(r"^/([a-zA-Z])(/.*)?$")
@@ -568,7 +609,10 @@ def get_agent_context(repo_path: str = ".", git_context: bool = False) -> dict:
         args = [repo_path, "--agent"]
         if git_context:
             args.append("--git-context")
-        return _execute(args)
+        result = _execute(args)
+        if isinstance(result, dict) and result.get("success"):
+            result = _ok(_cap_mcp_output("get_agent_context", result.get("data")))
+        return result
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -641,7 +685,79 @@ def get_spring_audit(repo_path: str = ".", scope: str = "all") -> dict:
         _path_err = _check_repo_path(repo_path)
         if _path_err is not None:
             return _path_err
-        return _execute(["spring-audit", repo_path, "--scope", scope])
+        timeout_ms = int(os.environ.get("SOURCECODE_SPRING_AUDIT_TIMEOUT_MS", str(_DEFAULT_SPRING_AUDIT_TIMEOUT_MS)))
+        timeout_s = timeout_ms / 1000.0
+        _exec = concurrent.futures.ThreadPoolExecutor(max_workers=1)
+        try:
+            _fut = _exec.submit(_execute, ["spring-audit", repo_path, "--scope", scope])
+            _done, _pending = concurrent.futures.wait([_fut], timeout=timeout_s)
+            if _pending:
+                _exec.shutdown(wait=False)
+                return _ok({
+                    "truncated": True,
+                    "truncated_reason": f"timeout_{timeout_s:.0f}s",
+                    "analysis": "timed out — repository may be too large for MCP transport",
+                    "suggestion": f"Increase SOURCECODE_SPRING_AUDIT_TIMEOUT_MS (current: {timeout_ms}ms) or run via CLI directly",
+                })
+            result = _fut.result()
+        finally:
+            _exec.shutdown(wait=True)
+        if isinstance(result, dict) and result.get("success"):
+            result = _ok(_cap_mcp_output("get_spring_audit", result.get("data")))
+        return result
+    except Exception as exc:
+        return _err(
+            f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
+            "INTERNAL_ERROR",
+        )
+
+
+@mcp.tool()
+def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") -> dict:
+    """Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA ONLY.
+
+    When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
+    or upgrading from Spring Boot 2.x to 3.x. Call this BEFORE get_spring_audit when
+    the goal is migration planning — not ongoing audit.
+    Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+
+    Maps to: sourcecode migrate-check <repo_path> --min-severity <min_severity>
+    Returns: MigrationReport with schema_version, readiness_score (0–100; 100=ready to migrate),
+             blocking_count, estimated_effort_days, spring_boot_2_detected,
+             summary (total_findings, affected_files, by_severity, by_rule),
+             findings[], limitations, metadata.
+    findings fields: id, rule_id, severity, title, source_file, first_line,
+             imports_found, explanation, fix_hint.
+    Rules:
+      MIG-001 critical — javax.persistence (JPA, will not compile after migration)
+      MIG-002 high     — javax.servlet (Servlet API)
+      MIG-003 high     — javax.validation (Bean Validation)
+      MIG-004 high     — javax.transaction (TX API)
+      MIG-005 high     — extends WebSecurityConfigurerAdapter (removed in Spring Security 6)
+      MIG-006 medium   — javax.annotation (CDI annotations)
+      MIG-007 medium   — javax.inject (DI annotations)
+      MIG-008 medium   — javax.ws.rs (JAX-RS API)
+
+    repo_path: absolute path to the Java repository (default: current working directory).
+    min_severity: "low" (default) | "medium" | "high" | "critical" — filter threshold.
+    """
+    _raw = repo_path
+    try:
+        if not isinstance(repo_path, str):
+            return _err("repo_path must be a string", "INVALID_ARGUMENT")
+        if min_severity not in ("critical", "high", "medium", "low"):
+            return _err(
+                f"Invalid min_severity '{min_severity}' — must be one of: critical, high, medium, low",
+                "INVALID_ARGUMENT",
+            )
+        repo_path = _normalize_repo_path(repo_path)
+        _path_err = _check_repo_path(repo_path)
+        if _path_err is not None:
+            return _path_err
+        result = _execute(["migrate-check", repo_path, "--min-severity", min_severity])
+        if isinstance(result, dict) and result.get("success"):
+            result = _ok(_cap_mcp_output("get_migration_readiness", result.get("data")))
+        return result
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -681,7 +797,23 @@ def get_impact_chain(repo_path: str = ".", symbol: str = "", depth: int = 4) ->
         if _path_err is not None:
             return _path_err
         args = ["impact-chain", symbol.strip(), repo_path, "--depth", str(depth)]
-        return _execute(args)
+        timeout_ms = int(os.environ.get("SOURCECODE_IMPACT_TIMEOUT_MS", str(_DEFAULT_IMPACT_TIMEOUT_MS)))
+        timeout_s = timeout_ms / 1000.0
+        _exec = concurrent.futures.ThreadPoolExecutor(max_workers=1)
+        try:
+            _fut = _exec.submit(_execute, args)
+            _done, _pending = concurrent.futures.wait([_fut], timeout=timeout_s)
+            if _pending:
+                _exec.shutdown(wait=False)
+                return _ok({
+                    "truncated": True,
+                    "truncated_reason": f"timeout_{timeout_s:.0f}s",
+                    "analysis": "timed out — repository may be too large for MCP transport",
+                    "suggestion": f"Increase SOURCECODE_IMPACT_TIMEOUT_MS (current: {timeout_ms}ms) or run via CLI directly",
+                })
+            return _fut.result()
+        finally:
+            _exec.shutdown(wait=True)
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -1098,7 +1230,23 @@ def get_impact_context(repo_path: str = ".", target: str = "", depth: int = 4) -
         if _path_err is not None:
             return _path_err
         args = ["impact", target.strip(), repo_path, "--depth", str(depth)]
-        return _execute(args)
+        timeout_ms = int(os.environ.get("SOURCECODE_IMPACT_TIMEOUT_MS", str(_DEFAULT_IMPACT_TIMEOUT_MS)))
+        timeout_s = timeout_ms / 1000.0
+        _exec = concurrent.futures.ThreadPoolExecutor(max_workers=1)
+        try:
+            _fut = _exec.submit(_execute, args)
+            _done, _pending = concurrent.futures.wait([_fut], timeout=timeout_s)
+            if _pending:
+                _exec.shutdown(wait=False)
+                return _ok({
+                    "truncated": True,
+                    "truncated_reason": f"timeout_{timeout_s:.0f}s",
+                    "analysis": "timed out — repository may be too large for MCP transport",
+                    "suggestion": f"Increase SOURCECODE_IMPACT_TIMEOUT_MS (current: {timeout_ms}ms) or run via CLI directly",
+                })
+            return _fut.result()
+        finally:
+            _exec.shutdown(wait=True)
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -1219,9 +1367,22 @@ def _finalize_mcp_registry() -> None:
             structured_output=False,
         )
 
-    drift = validate_registry()
-    if drift:
-        raise RuntimeError(f"MCP registry drift detected: {drift}")
+    try:
+        drift = validate_registry()
+        if drift:
+            import warnings
+            warnings.warn(
+                f"MCP registry drift detected — server running with potential tool mismatch: {drift}",
+                RuntimeWarning,
+                stacklevel=2,
+            )
+    except Exception as _reg_exc:
+        import warnings
+        warnings.warn(
+            f"MCP registry validation failed — server starting in degraded mode: {_reg_exc}",
+            RuntimeWarning,
+            stacklevel=2,
+        )
 
 
 _finalize_mcp_registry()

sourcecode/repository_ir.py

@@ -3312,11 +3312,13 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     }
 
 
-def find_java_files(root: Path, *, max_files: int = 8000) -> list[str]:
+def find_java_files(root: Path, *, max_files: int = 8000, limitations: list[str] | None = None) -> list[str]:
     """Return relative paths to Java files under root, excluding test dirs and vendor."""
     results: list[str] = []
+    _capped = False
     for p in sorted(root.rglob("*.java")):
         if len(results) >= max_files:
+            _capped = True
             break
         try:
             rel = str(p.relative_to(root)).replace("\\", "/")
@@ -3334,6 +3336,10 @@ def find_java_files(root: Path, *, max_files: int = 8000) -> list[str]:
         if any(f in rel for f in ("/admin-client/", "/rest-client/", "/client-api/", "/api-client/")):
             continue
         results.append(rel)
+    if _capped and limitations is not None:
+        limitations.append(
+            f"MAX_JAVA_FILES_REACHED: scanned {max_files} files — repository likely has more"
+        )
     return results
 
 

sourcecode/spring_security_audit.py

@@ -418,12 +418,15 @@ class SecurityScanner:
         model: Optional[SpringSemanticModel] = None,
     ) -> list[SpringFinding]:
         all_findings: list[SpringFinding] = []
+        self._last_analysis_errors: list[str] = []
         for pattern in self.patterns:
             try:
                 found = _call_pattern_analyze(pattern, cir, tx_index, root, model)
                 all_findings.extend(found)
-            except Exception:
-                pass
+            except Exception as exc:
+                self._last_analysis_errors.append(
+                    f"{pattern.pattern_id}: {type(exc).__name__}: {exc}"
+                )
         deduped = deduplicate_findings(all_findings)
         return sorted(deduped, key=lambda f: (SEVERITY_ORDER.get(f.severity, 9), f.symbol))
 
@@ -475,16 +478,20 @@ def run_security_audit(
         or cir.metadata.get("security_model", "unknown") != "unknown"
     )
 
+    _sec_limitations = [
+        "SEC-001: only emitted for annotation_based security model",
+        "SEC-002: generic type detection is regex-based on extends edge signatures",
+        "SEC-003: only detects controllers visible via cir.endpoints",
+    ]
+    for _err in getattr(scanner, "_last_analysis_errors", []):
+        _sec_limitations.append(f"PATTERN_ERROR: {_err}")
+
     result = SpringAuditResult(
         repo_id=getattr(cir, "cir_hash", "")[:16],
         spring_detected=_spring_detected,
         scope="security",
         findings=findings,
-        limitations=[
-            "SEC-001: only emitted for annotation_based security model",
-            "SEC-002: generic type detection is regex-based on extends edge signatures",
-            "SEC-003: only detects controllers visible via cir.endpoints",
-        ],
+        limitations=_sec_limitations,
         metadata={
             "endpoints_analyzed": len(cir.endpoints),
             "security_model": cir.metadata.get("security_model", "unknown"),

sourcecode/spring_tx_analyzer.py

@@ -672,12 +672,15 @@ class TxPatternEngine:
         model: Optional[SpringSemanticModel] = None,
     ) -> list[SpringFinding]:
         all_findings: list[SpringFinding] = []
+        self._last_analysis_errors: list[str] = []
         for pattern in self.patterns:
             try:
                 found = _call_pattern_analyze(pattern, cir, tx_index, root, model)
                 all_findings.extend(found)
-            except Exception:
-                pass
+            except Exception as exc:
+                self._last_analysis_errors.append(
+                    f"{pattern.pattern_id}: {type(exc).__name__}: {exc}"
+                )
         deduped = deduplicate_findings(all_findings)
         return sorted(deduped, key=lambda f: (SEVERITY_ORDER.get(f.severity, 9), f.symbol))
 
@@ -721,15 +724,19 @@ def run_tx_audit(
 
     _spring_detected = tx_index.stats()["total"] > 0 or bool(model.bean_graph.beans)
 
+    _tx_limitations = [
+        "Self-invocation via this.method() not detected — requires AST-level analysis",
+        "Dynamic dispatch (interface/polymorphic calls) may produce incomplete call chains",
+    ]
+    for _err in getattr(engine, "_last_analysis_errors", []):
+        _tx_limitations.append(f"PATTERN_ERROR: {_err}")
+
     result = SpringAuditResult(
         repo_id=getattr(cir, "cir_hash", "")[:16],
         spring_detected=_spring_detected,
         scope="tx",
         findings=findings,
-        limitations=[
-            "Self-invocation via this.method() not detected — requires AST-level analysis",
-            "Dynamic dispatch (interface/polymorphic calls) may produce incomplete call chains",
-        ],
+        limitations=_tx_limitations,
         metadata={
             "symbols_analyzed": len(getattr(cir, "symbols", [])),
             "tx_boundaries_found": tx_index.stats()["total"],

{sourcecode-1.35.19.dist-info → sourcecode-1.35.22.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.19
+Version: 1.35.22
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.16-blue)
+![Version](https://img.shields.io/badge/version-1.35.20-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.16
+# sourcecode 1.35.20
 ```
 
 ---

{sourcecode-1.35.19.dist-info → sourcecode-1.35.22.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=hzHULzlZzht_1GYLCF6iKVI8a1MFSsEJYu30xrAvGZU,104
+sourcecode/__init__.py,sha256=p3pMcJ60xxF18F5C5hvsyn5B4uh1rOmKBO_RC94DPAA,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -7,7 +7,7 @@ sourcecode/cache.py,sha256=wAyPrXN5DqiGivnMpeEuun2xHDKfBer2_oBsh6kj_vc,30447
 sourcecode/canonical_ir.py,sha256=uwpwCnJxMh_eiIVg4cOLv7-aZthvmDFcG4azCOycLkw,24281
 sourcecode/cir_graphs.py,sha256=rZi8JV4ZrAa2WSCeyNa4JIEKQ_yZzDZTsrvVz2KfuKA,8919
 sourcecode/classifier.py,sha256=2lYoSH3vOTkXZYPU7Go2WIet1-IuNzTWVhc-ULnXtgw,8024
-sourcecode/cli.py,sha256=CALwHKAoBv1MmhLE7ZingoarOxXTk3VUCrxF4CDYB20,233442
+sourcecode/cli.py,sha256=wy5-T6Ba_hvqJoFkSROCJxOpsy_VzbYI98TlJIEeGW0,238063
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -15,7 +15,7 @@ sourcecode/context_summarizer.py,sha256=zlbm8ytdvJToohU108-dwBmEl52xl0gXpf6PZBOW
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=gvTdDniedm_mjq4vaHqnBY2UkQ0s00gtXqzTLILNXHc,28719
 sourcecode/coverage_parser.py,sha256=q0LeZJaX1bnntLu-ImksdBsMlpsVmk_iUfSaB4eaJGo,19702
-sourcecode/dependency_analyzer.py,sha256=5yUBN_Z75RWmBIbsfnMasPSUn-4IaLipt0A3b3LNVfc,56310
+sourcecode/dependency_analyzer.py,sha256=gvFJf9gHyUGRia3tdPz8s0aX2Re6aohMhb40uFEbjp0,60420
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=aNTyYgQk5noJDfJU6FmasmESOHfiomyJw5EvZqjy6qc,22213
@@ -40,7 +40,7 @@ sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=SOACZ4viYG8tpmL_-l4XqoX6bN4GmCeX5ZIr9tnuQyA,169298
+sourcecode/repository_ir.py,sha256=5meIvsVN4WlllStxIglZznILKcI0Q2t2XMLB9aVT3uc,169561
 sourcecode/ris.py,sha256=RcqLVwC-doFcKKViYDkCjZLBqf_wzLES7-F6vHEeWzE,20419
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -51,9 +51,9 @@ sourcecode/spring_event_topology.py,sha256=LvGv5RXtU_O-fVB_OO9eDD2UmZM72Jn2oUHgO
 sourcecode/spring_findings.py,sha256=8V91iHOg9hFgg6tLLl4FSsgrF-dBqOcO2s-K5sD_goA,5417
 sourcecode/spring_impact.py,sha256=Ohm2k3W4Wts8Kx8Z7DIM-J-cwGtTJBWKFBsX-WkupBQ,32943
 sourcecode/spring_model.py,sha256=IzMcM5ftw1_EHG3FGUDT7qdAMpo3eqbAE1LRuasfr_4,14739
-sourcecode/spring_security_audit.py,sha256=oaV-dK_5iSRwkWSJbMbzxfPbW376n3jTwnRPAspePjg,20293
+sourcecode/spring_security_audit.py,sha256=AmUkqoExkNZ3YxxZf9TwkwX-f7P_SETm0QC7VqEAqh4,20618
 sourcecode/spring_semantic.py,sha256=CiAf77p48-RFrUF0zbgww4w2Xigrbo1t5M3ZCDIfV_g,12032
-sourcecode/spring_tx_analyzer.py,sha256=_RyXblWwMgTfUVtoceTzCrAVmlQ2Ovf0dMcBOy-0-3w,30201
+sourcecode/spring_tx_analyzer.py,sha256=u4_ckdEFZUiIsHdUX4OaIhnvoTdAwrxNTFweG6vc7wE,30526
 sourcecode/summarizer.py,sha256=YspHEVeYJVmltq0FMtGZF8kIP3qiR2KLcanGL6Y7uTI,20747
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/workspace.py,sha256=X_6NmNnitvT3_38V-JDChydo_sR68s249hLFlrQskU0,8271
@@ -80,9 +80,9 @@ sourcecode/detectors/terraform.py,sha256=cxORPR_zVLOJpHlh4e9JnFpkQsn_UnqMMom5yG6
 sourcecode/detectors/tooling.py,sha256=8CKbtxwQoABP-WyBRNmdAmHDOvAH57AR1cF4UKuWEdQ,2074
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
 sourcecode/mcp/orchestrator.py,sha256=BMi1D6liJHI3DXiaC8yeBLLP0wXajpCP3-vnRGqrvnw,26850
-sourcecode/mcp/registry.py,sha256=y9dBj00xlTun6ZsKer9HZJ4W70ZiSdOrY4d-jBe9e08,60460
+sourcecode/mcp/registry.py,sha256=XeshSuT6NMmeUZ2GCzNVcKcr-2Ljoj4qO-lvSrg17EM,63135
 sourcecode/mcp/runner.py,sha256=-Dp2qPGRkfNTVen6bKh7WtzQqpcEtsrXoiuajvshlKk,2866
-sourcecode/mcp/server.py,sha256=lBSQCw3yFe8rZHp2GGVcfua0EJUYZmsIUbvA4GIJv9s,52210
+sourcecode/mcp/server.py,sha256=Zapr4lY0i4tqSXY2BfA283VzStHTohNr9N0uMnRSIIA,59911
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=B9CneieWTpaDSDIyW3S5nrlRlBpvfqUcgi93-mm_ApQ,2135
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -94,8 +94,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=QSslxIwij8YkRWcVvxykODDrkiN_GAAEu3dUP7KIWeE,1651
-sourcecode-1.35.19.dist-info/METADATA,sha256=PoK3wFYqg5mUZAk98YbNEx2Gvd7c55DmNlYqORyKox8,21297
-sourcecode-1.35.19.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.35.19.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.35.19.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.35.19.dist-info/RECORD,,
+sourcecode-1.35.22.dist-info/METADATA,sha256=myCZutK9p4r8d-O38SYo4et7pkpwASrkuJOnr_WIAac,21297
+sourcecode-1.35.22.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.35.22.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.35.22.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.35.22.dist-info/RECORD,,