sourcecode 1.35.20__tar.gz → 1.35.23__tar.gz

{sourcecode-1.35.20 → sourcecode-1.35.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.20
+Version: 1.35.23
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.20-blue)
+![Version](https://img.shields.io/badge/version-1.35.23-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.20
+# sourcecode 1.35.23
 ```
 
 ---

{sourcecode-1.35.20 → sourcecode-1.35.23}/README.md

@@ -2,7 +2,7 @@
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.20-blue)
+![Version](https://img.shields.io/badge/version-1.35.23-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -76,7 +76,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.20
+# sourcecode 1.35.23
 ```
 
 ---

{sourcecode-1.35.20 → sourcecode-1.35.23}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.35.20"
+version = "1.35.23"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.20"
+__version__ = "1.35.23"

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/canonical_ir.py

@@ -244,11 +244,11 @@ def _route_to_canonical_endpoint(route: dict) -> CanonicalEndpoint:
     security_dict = route.get("security_annotations")
     security: Optional[CanonicalSecurity] = None
     if security_dict:
-        # Determine source_scope from inheritance_depth:
-        # depth=0 → annotation on method or class (method takes precedence)
-        # depth>0 → inherited from parent class
         depth = route.get("inheritance_depth") or 0
-        scope = "inherited" if depth > 0 else "method"
+        if depth > 0:
+            scope = "inherited"
+        else:
+            scope = security_dict.get("_scope", "method")
         security = CanonicalSecurity.from_policy_dict(security_dict, source_scope=scope)
 
     endpoint_id = CanonicalEndpoint.make_id(method, path, controller_class, handler_symbol)

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/cli.py

@@ -3912,7 +3912,8 @@ def spring_audit_cmd(
         )
         raise typer.Exit(code=1)
 
-    file_list = find_java_files(target)
+    _file_limitations: list[str] = []
+    file_list = find_java_files(target, limitations=_file_limitations)
     if not file_list:
         empty_result = SpringAuditResult(
             spring_detected=False,
@@ -3961,6 +3962,9 @@ def spring_audit_cmd(
             metadata=merged_meta,
         ).finalize()
 
+    if _file_limitations:
+        combined.limitations.extend(_file_limitations)
+
     # Populate git_head from repo HEAD — non-fatal.
     try:
         import subprocess as _sub_sa
@@ -4088,8 +4092,11 @@ def migrate_check_cmd(
         )
         raise typer.Exit(code=1)
 
-    file_list = find_java_files(target)
+    _file_limitations: list[str] = []
+    file_list = find_java_files(target, limitations=_file_limitations)
     report = run_migrate_check(file_list, target, min_severity=min_severity)
+    if _file_limitations:
+        report.limitations.extend(_file_limitations)
 
     if format == "text":
         output = report.to_text(min_severity=min_severity)

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/dependency_analyzer.py

@@ -1142,6 +1142,78 @@ class DependencyAnalyzer:
         records: list[DependencyRecord] = []
         deps_elem = root_elem.find(f"{ns}dependencies")
         if deps_elem is None:
+            # Multi-module aggregator POM: scan up to 5 declared submodule pom.xml files.
+            modules_elem = root_elem.find(f"{ns}modules")
+            if modules_elem is not None:
+                submodule_records: list[DependencyRecord] = []
+                submodule_limitations: list[str] = []
+                seen_submodule_deps: set[str] = set()
+                _all_modules = list(modules_elem.findall(f"{ns}module"))
+                if len(_all_modules) > 5:
+                    submodule_limitations.append(
+                        f"MAX_SUBMODULES_REACHED: scanned 5 of {len(_all_modules)} declared Maven submodules"
+                    )
+                for mod_elem in _all_modules[:5]:
+                    mod_name = (mod_elem.text or "").strip()
+                    if not mod_name:
+                        continue
+                    sub_pom = root / mod_name / "pom.xml"
+                    if not sub_pom.exists():
+                        continue
+                    try:
+                        sub_tree = ET.parse(sub_pom)
+                    except (ET.ParseError, OSError):
+                        continue
+                    sub_root = sub_tree.getroot()
+                    sub_ns_match = re.match(r"\{[^}]+\}", sub_root.tag)
+                    sub_ns = sub_ns_match.group(0) if sub_ns_match else ""
+                    sub_props = self._parse_maven_properties(sub_root, sub_ns)
+                    sub_dm = self._parse_dependency_management(sub_root, sub_ns, sub_props)
+                    # Inherit parent properties for version resolution
+                    for k, v in properties.items():
+                        sub_props.setdefault(k, v)
+                    for k, v in dm_versions.items():
+                        sub_dm.setdefault(k, v)
+                    sub_deps_elem = sub_root.find(f"{sub_ns}dependencies")
+                    if sub_deps_elem is None:
+                        continue
+                    for dep in sub_deps_elem.findall(f"{sub_ns}dependency"):
+                        gid = (dep.findtext(f"{sub_ns}groupId") or "").strip()
+                        aid = (dep.findtext(f"{sub_ns}artifactId") or "").strip()
+                        if not gid or not aid:
+                            continue
+                        dep_key = f"{gid}:{aid}"
+                        if dep_key in seen_submodule_deps:
+                            continue
+                        seen_submodule_deps.add(dep_key)
+                        ver_raw = (dep.findtext(f"{sub_ns}version") or "").strip() or None
+                        declared = self._resolve_maven_version(ver_raw, sub_props)
+                        if declared is None:
+                            declared = sub_dm.get(dep_key)
+                        scope_text = (dep.findtext(f"{sub_ns}scope") or "compile").strip().lower()
+                        if scope_text == "test":
+                            scope = "dev"
+                        elif scope_text == "provided":
+                            scope = "provided"
+                        else:
+                            scope = "direct"
+                        resolved_version = None
+                        if declared is None and parent_version:
+                            if gid == "org.springframework.boot":
+                                resolved_version = parent_version
+                            elif gid == "org.springframework.security" and "spring-security.version" in sub_props:
+                                resolved_version = sub_props["spring-security.version"]
+                        submodule_records.append(DependencyRecord(
+                            name=dep_key,
+                            ecosystem="java",
+                            scope=scope,
+                            declared_version=declared,
+                            resolved_version=resolved_version,
+                            source="manifest",
+                            manifest_path=f"{mod_name}/pom.xml",
+                        ))
+                if submodule_records:
+                    return submodule_records, submodule_limitations
             return [], ["java: pom.xml has no <dependencies> block"]
 
         for dep in deps_elem.findall(f"{ns}dependency"):

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/mcp/server.py

@@ -192,7 +192,48 @@ def _execute(args: list[str]) -> dict | CallToolResult:
     return _ok(result)
 
 
+# Per-tool character budgets (4 chars ≈ 1 token; keeps Cursor under its 10k token limit).
+# List fields are trimmed front-to-back until output fits.
+_MCP_CHAR_BUDGETS: dict[str, int] = {
+    "get_agent_context":       38_000,
+    "get_spring_audit":        38_000,
+    "get_migration_readiness": 38_000,
+}
+_MCP_TRIM_FIELDS = (
+    "findings", "relevant_files", "key_dependencies",
+    "entry_points", "limitations", "gaps", "code_notes",
+)
+
+
+def _cap_mcp_output(tool_name: str, data: Any) -> Any:
+    """Trim list fields in data until JSON serialisation fits within the tool's char budget."""
+    budget = _MCP_CHAR_BUDGETS.get(tool_name)
+    if not budget or not isinstance(data, dict):
+        return data
+    if len(json.dumps(data, default=str)) <= budget:
+        return data
+    result = dict(data)
+    for field in _MCP_TRIM_FIELDS:
+        if field not in result or not isinstance(result[field], list):
+            continue
+        items = list(result[field])
+        while items and len(json.dumps(result, default=str)) > budget:
+            items = items[:-1]
+            result[field] = items
+        if len(json.dumps(result, default=str)) <= budget:
+            break
+    if len(json.dumps(result, default=str)) > budget:
+        result["_mcp_truncated"] = True
+        result["_mcp_truncation_note"] = (
+            f"Output capped at ~{budget // 4}k tokens for MCP compatibility. "
+            "Use CLI directly for full output."
+        )
+    return result
+
+
 _DEFAULT_TESTS_TIMEOUT_MS = 15_000
+_DEFAULT_SPRING_AUDIT_TIMEOUT_MS = 120_000   # 2 min
+_DEFAULT_IMPACT_TIMEOUT_MS = 60_000          # 1 min
 
 # Regex for MINGW paths: /c/some/path → C:/some/path
 _MINGW_PATH_RE = re.compile(r"^/([a-zA-Z])(/.*)?$")
@@ -568,7 +609,10 @@ def get_agent_context(repo_path: str = ".", git_context: bool = False) -> dict:
         args = [repo_path, "--agent"]
         if git_context:
             args.append("--git-context")
-        return _execute(args)
+        result = _execute(args)
+        if isinstance(result, dict) and result.get("success"):
+            result = _ok(_cap_mcp_output("get_agent_context", result.get("data")))
+        return result
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -641,7 +685,26 @@ def get_spring_audit(repo_path: str = ".", scope: str = "all") -> dict:
         _path_err = _check_repo_path(repo_path)
         if _path_err is not None:
             return _path_err
-        return _execute(["spring-audit", repo_path, "--scope", scope])
+        timeout_ms = int(os.environ.get("SOURCECODE_SPRING_AUDIT_TIMEOUT_MS", str(_DEFAULT_SPRING_AUDIT_TIMEOUT_MS)))
+        timeout_s = timeout_ms / 1000.0
+        _exec = concurrent.futures.ThreadPoolExecutor(max_workers=1)
+        try:
+            _fut = _exec.submit(_execute, ["spring-audit", repo_path, "--scope", scope])
+            _done, _pending = concurrent.futures.wait([_fut], timeout=timeout_s)
+            if _pending:
+                _exec.shutdown(wait=False)
+                return _ok({
+                    "truncated": True,
+                    "truncated_reason": f"timeout_{timeout_s:.0f}s",
+                    "analysis": "timed out — repository may be too large for MCP transport",
+                    "suggestion": f"Increase SOURCECODE_SPRING_AUDIT_TIMEOUT_MS (current: {timeout_ms}ms) or run via CLI directly",
+                })
+            result = _fut.result()
+        finally:
+            _exec.shutdown(wait=True)
+        if isinstance(result, dict) and result.get("success"):
+            result = _ok(_cap_mcp_output("get_spring_audit", result.get("data")))
+        return result
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -691,7 +754,10 @@ def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") ->
         _path_err = _check_repo_path(repo_path)
         if _path_err is not None:
             return _path_err
-        return _execute(["migrate-check", repo_path, "--min-severity", min_severity])
+        result = _execute(["migrate-check", repo_path, "--min-severity", min_severity])
+        if isinstance(result, dict) and result.get("success"):
+            result = _ok(_cap_mcp_output("get_migration_readiness", result.get("data")))
+        return result
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -731,7 +797,23 @@ def get_impact_chain(repo_path: str = ".", symbol: str = "", depth: int = 4) ->
         if _path_err is not None:
             return _path_err
         args = ["impact-chain", symbol.strip(), repo_path, "--depth", str(depth)]
-        return _execute(args)
+        timeout_ms = int(os.environ.get("SOURCECODE_IMPACT_TIMEOUT_MS", str(_DEFAULT_IMPACT_TIMEOUT_MS)))
+        timeout_s = timeout_ms / 1000.0
+        _exec = concurrent.futures.ThreadPoolExecutor(max_workers=1)
+        try:
+            _fut = _exec.submit(_execute, args)
+            _done, _pending = concurrent.futures.wait([_fut], timeout=timeout_s)
+            if _pending:
+                _exec.shutdown(wait=False)
+                return _ok({
+                    "truncated": True,
+                    "truncated_reason": f"timeout_{timeout_s:.0f}s",
+                    "analysis": "timed out — repository may be too large for MCP transport",
+                    "suggestion": f"Increase SOURCECODE_IMPACT_TIMEOUT_MS (current: {timeout_ms}ms) or run via CLI directly",
+                })
+            return _fut.result()
+        finally:
+            _exec.shutdown(wait=True)
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -1148,7 +1230,23 @@ def get_impact_context(repo_path: str = ".", target: str = "", depth: int = 4) -
         if _path_err is not None:
             return _path_err
         args = ["impact", target.strip(), repo_path, "--depth", str(depth)]
-        return _execute(args)
+        timeout_ms = int(os.environ.get("SOURCECODE_IMPACT_TIMEOUT_MS", str(_DEFAULT_IMPACT_TIMEOUT_MS)))
+        timeout_s = timeout_ms / 1000.0
+        _exec = concurrent.futures.ThreadPoolExecutor(max_workers=1)
+        try:
+            _fut = _exec.submit(_execute, args)
+            _done, _pending = concurrent.futures.wait([_fut], timeout=timeout_s)
+            if _pending:
+                _exec.shutdown(wait=False)
+                return _ok({
+                    "truncated": True,
+                    "truncated_reason": f"timeout_{timeout_s:.0f}s",
+                    "analysis": "timed out — repository may be too large for MCP transport",
+                    "suggestion": f"Increase SOURCECODE_IMPACT_TIMEOUT_MS (current: {timeout_ms}ms) or run via CLI directly",
+                })
+            return _fut.result()
+        finally:
+            _exec.shutdown(wait=True)
     except Exception as exc:
         return _err(
             f"Internal error: {type(exc).__name__}: {exc} — repo_path recibido: {_raw}",
@@ -1269,9 +1367,22 @@ def _finalize_mcp_registry() -> None:
             structured_output=False,
         )
 
-    drift = validate_registry()
-    if drift:
-        raise RuntimeError(f"MCP registry drift detected: {drift}")
+    try:
+        drift = validate_registry()
+        if drift:
+            import warnings
+            warnings.warn(
+                f"MCP registry drift detected — server running with potential tool mismatch: {drift}",
+                RuntimeWarning,
+                stacklevel=2,
+            )
+    except Exception as _reg_exc:
+        import warnings
+        warnings.warn(
+            f"MCP registry validation failed — server starting in degraded mode: {_reg_exc}",
+            RuntimeWarning,
+            stacklevel=2,
+        )
 
 
 _finalize_mcp_registry()

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/migrate_check.py

@@ -422,7 +422,7 @@ def run_migrate_check(
 
 def _detect_spring_boot_2(root: Path) -> bool:
     """Return True if any pom.xml or build.gradle declares spring-boot 2.x."""
-    _SB2 = re.compile(r"spring.boot[^\"'\n]*[\"']?2\.\d+", re.IGNORECASE)
+    _SB2 = re.compile(r"spring[-.]boot[^\"'\n]*[\"']?2\.\d+", re.IGNORECASE)
     for name in ("pom.xml", "build.gradle", "build.gradle.kts"):
         candidate = root / name
         try:

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/prepare_context.py

@@ -1034,6 +1034,12 @@ class TaskContextBuilder:
                 if g
             ]
 
+            _ris_key_deps = compact.get("key_dependencies") or []
+            # Fall through to full analysis if deps expected but RIS has none.
+            # RIS may have been built before dependency analysis was run on this repo.
+            if spec.enable_dependencies and not _ris_key_deps:
+                return None
+
             return TaskOutput(
                 task=task_name,
                 goal=spec.goal,
@@ -1043,7 +1049,7 @@ class TaskContextBuilder:
                 suspected_areas=[],
                 improvement_opportunities=[],
                 test_gaps=[],
-                key_dependencies=compact.get("key_dependencies") or [],
+                key_dependencies=_ris_key_deps,
                 code_notes_summary=None,
                 limitations=[],
                 confidence=compact.get("confidence") or compact.get("confidence_summary") or "high",
@@ -1303,7 +1309,20 @@ class TaskContextBuilder:
             from dataclasses import asdict
             from sourcecode.dependency_analyzer import DependencyAnalyzer
 
-            dep_records, dep_summary = DependencyAnalyzer().analyze(self.root)
+            _dep_analyzer = DependencyAnalyzer()
+            dep_records, dep_summary = _dep_analyzer.analyze(self.root)
+            # For multi-module repos (Maven/Gradle), root pom.xml is a parent POM
+            # with few deps. Per-workspace analysis finds the actual module deps.
+            if workspace_analysis.workspaces:
+                for _ws in workspace_analysis.workspaces:
+                    _ws_root = self.root / _ws.path
+                    if _ws_root.exists() and _ws_root.is_dir():
+                        try:
+                            _ws_deps, _ws_summary = _dep_analyzer.analyze(_ws_root)
+                            dep_records = dep_records + _ws_deps
+                            dep_summary.limitations.extend(_ws_summary.limitations)
+                        except Exception:
+                            pass
             primary_eco = stacks[0].stack if stacks else ""
             _direct_raw = [
                 d for d in dep_records

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/repository_ir.py

@@ -2543,6 +2543,7 @@ def _route_security_from_sym(
     for candidate in filter(None, [method_sym, class_sym]):
         result = _extract_from(candidate)
         if result is not None:
+            result["_scope"] = "class" if candidate is class_sym else "method"
             return result
     return None
 
@@ -3312,11 +3313,13 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     }
 
 
-def find_java_files(root: Path, *, max_files: int = 8000) -> list[str]:
+def find_java_files(root: Path, *, max_files: int = 8000, limitations: list[str] | None = None) -> list[str]:
     """Return relative paths to Java files under root, excluding test dirs and vendor."""
     results: list[str] = []
+    _capped = False
     for p in sorted(root.rglob("*.java")):
         if len(results) >= max_files:
+            _capped = True
             break
         try:
             rel = str(p.relative_to(root)).replace("\\", "/")
@@ -3334,6 +3337,10 @@ def find_java_files(root: Path, *, max_files: int = 8000) -> list[str]:
         if any(f in rel for f in ("/admin-client/", "/rest-client/", "/client-api/", "/api-client/")):
             continue
         results.append(rel)
+    if _capped and limitations is not None:
+        limitations.append(
+            f"MAX_JAVA_FILES_REACHED: scanned {max_files} files — repository likely has more"
+        )
     return results
 
 

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/spring_security_audit.py

@@ -418,12 +418,15 @@ class SecurityScanner:
         model: Optional[SpringSemanticModel] = None,
     ) -> list[SpringFinding]:
         all_findings: list[SpringFinding] = []
+        self._last_analysis_errors: list[str] = []
         for pattern in self.patterns:
             try:
                 found = _call_pattern_analyze(pattern, cir, tx_index, root, model)
                 all_findings.extend(found)
-            except Exception:
-                pass
+            except Exception as exc:
+                self._last_analysis_errors.append(
+                    f"{pattern.pattern_id}: {type(exc).__name__}: {exc}"
+                )
         deduped = deduplicate_findings(all_findings)
         return sorted(deduped, key=lambda f: (SEVERITY_ORDER.get(f.severity, 9), f.symbol))
 
@@ -475,16 +478,20 @@ def run_security_audit(
         or cir.metadata.get("security_model", "unknown") != "unknown"
     )
 
+    _sec_limitations = [
+        "SEC-001: only emitted for annotation_based security model",
+        "SEC-002: generic type detection is regex-based on extends edge signatures",
+        "SEC-003: only detects controllers visible via cir.endpoints",
+    ]
+    for _err in getattr(scanner, "_last_analysis_errors", []):
+        _sec_limitations.append(f"PATTERN_ERROR: {_err}")
+
     result = SpringAuditResult(
         repo_id=getattr(cir, "cir_hash", "")[:16],
         spring_detected=_spring_detected,
         scope="security",
         findings=findings,
-        limitations=[
-            "SEC-001: only emitted for annotation_based security model",
-            "SEC-002: generic type detection is regex-based on extends edge signatures",
-            "SEC-003: only detects controllers visible via cir.endpoints",
-        ],
+        limitations=_sec_limitations,
         metadata={
             "endpoints_analyzed": len(cir.endpoints),
             "security_model": cir.metadata.get("security_model", "unknown"),

{sourcecode-1.35.20 → sourcecode-1.35.23}/src/sourcecode/spring_tx_analyzer.py

@@ -672,12 +672,15 @@ class TxPatternEngine:
         model: Optional[SpringSemanticModel] = None,
     ) -> list[SpringFinding]:
         all_findings: list[SpringFinding] = []
+        self._last_analysis_errors: list[str] = []
         for pattern in self.patterns:
             try:
                 found = _call_pattern_analyze(pattern, cir, tx_index, root, model)
                 all_findings.extend(found)
-            except Exception:
-                pass
+            except Exception as exc:
+                self._last_analysis_errors.append(
+                    f"{pattern.pattern_id}: {type(exc).__name__}: {exc}"
+                )
         deduped = deduplicate_findings(all_findings)
         return sorted(deduped, key=lambda f: (SEVERITY_ORDER.get(f.severity, 9), f.symbol))
 
@@ -721,15 +724,19 @@ def run_tx_audit(
 
     _spring_detected = tx_index.stats()["total"] > 0 or bool(model.bean_graph.beans)
 
+    _tx_limitations = [
+        "Self-invocation via this.method() not detected — requires AST-level analysis",
+        "Dynamic dispatch (interface/polymorphic calls) may produce incomplete call chains",
+    ]
+    for _err in getattr(engine, "_last_analysis_errors", []):
+        _tx_limitations.append(f"PATTERN_ERROR: {_err}")
+
     result = SpringAuditResult(
         repo_id=getattr(cir, "cir_hash", "")[:16],
         spring_detected=_spring_detected,
         scope="tx",
         findings=findings,
-        limitations=[
-            "Self-invocation via this.method() not detected — requires AST-level analysis",
-            "Dynamic dispatch (interface/polymorphic calls) may produce incomplete call chains",
-        ],
+        limitations=_tx_limitations,
         metadata={
             "symbols_analyzed": len(getattr(cir, "symbols", [])),
             "tx_boundaries_found": tx_index.stats()["total"],