sourcecode 1.35.25__py3-none-any.whl → 1.35.26__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.25"
+__version__ = "1.35.26"

sourcecode/migrate_check.py

@@ -868,9 +868,34 @@ def _find_build_files(root: Path) -> list[tuple[Path, str]]:
     return results
 
 
+def _resolve_maven_properties(text: str) -> str:
+    """Substitute ${prop} references with values from the <properties> block.
+
+    Handles single-level property references that appear in the same pom.xml.
+    Multi-level references (${a} where a=${b}) are resolved up to 3 passes.
+    """
+    props: dict[str, str] = {}
+    for m in re.finditer(r'<([A-Za-z][\w.\-]*)>\s*([^<${}]+?)\s*</\1>', text):
+        props[m.group(1)] = m.group(2).strip()
+    if not props:
+        return text
+
+    resolved = text
+    for _ in range(3):
+        def _sub(m: re.Match) -> str:  # noqa: E306
+            return props.get(m.group(1), m.group(0))
+        resolved_new = re.sub(r'\$\{([\w.\-]+)\}', _sub, resolved)
+        if resolved_new == resolved:
+            break
+        resolved = resolved_new
+    return resolved
+
+
 def _scan_dep_file(text: str, rel_path: str) -> list["MigrationFinding"]:
     """Apply dependency rules to a build file. Returns one finding per matched rule."""
     is_gradle = rel_path.endswith((".gradle", ".gradle.kts"))
+    if not is_gradle and rel_path.endswith(".xml"):
+        text = _resolve_maven_properties(text)
     findings: list[MigrationFinding] = []
     for rule in _DEP_RULES:
         if rule.quick_filter is not None and rule.quick_filter not in text:
@@ -1198,6 +1223,7 @@ def run_migrate_check(
         limitations.append(f"{xml_read_errors} XML file(s) could not be read and were skipped.")
 
     dep_read_errors = 0
+    raw_dep_findings: list[MigrationFinding] = []
     for abs_path, rel_path in build_files:
         try:
             text = abs_path.read_text(encoding="utf-8", errors="replace")
@@ -1206,7 +1232,20 @@ def run_migrate_check(
             continue
         dep_findings = _scan_dep_file(text, rel_path)
         filtered = [f for f in dep_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
-        all_findings.extend(filtered)
+        raw_dep_findings.extend(filtered)
+
+    # Deduplicate dep findings by rule_id: same dependency in parent + child poms
+    # is one logical finding. Keep the first occurrence (root pom sorts first).
+    _seen_dep_rules: dict[str, int] = {}  # rule_id → count
+    for f in raw_dep_findings:
+        _seen_dep_rules[f.rule_id] = _seen_dep_rules.get(f.rule_id, 0) + 1
+    _dedup_dep: list[MigrationFinding] = []
+    _emitted: set[str] = set()
+    for f in raw_dep_findings:
+        if f.rule_id not in _emitted:
+            _dedup_dep.append(f)
+            _emitted.add(f.rule_id)
+    all_findings.extend(_dedup_dep)
 
     if dep_read_errors:
         limitations.append(f"{dep_read_errors} build file(s) could not be read and were skipped.")

sourcecode/repository_ir.py

@@ -105,7 +105,12 @@ class EvidenceBundle:
 _PKG_RE = re.compile(r'^package\s+([\w.]+)\s*;', re.MULTILINE)
 _IMPORT_RE = re.compile(r'^import\s+(?:static\s+)?([\w.]+(?:\.\*)?)\s*;', re.MULTILINE)
 _ANN_RE = re.compile(r'^(@[\w.]+)')
-_ANN_WITH_ARGS_RE = re.compile(r'^(@[\w.]+)\s*(?:\(([^)]*)\))?')
+_ANN_WITH_ARGS_RE = re.compile(
+    r'^(@[\w.]+)\s*'
+    r'(?:\('
+    r'((?:[^()"\']*|"[^"]*"|\'[^\']*\'|\((?:[^()"\']*|"[^"]*"|\'[^\']*\')*\))*)'
+    r'\))?'
+)
 
 _CLASS_DECL_RE = re.compile(
     r'(?:^|(?<=\s))'
@@ -3303,6 +3308,52 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     else:
         security_model = "unknown"
 
+    # Detect XML-based Spring Security config. When present, per-endpoint
+    # none_detected is expected and does NOT mean the endpoint is unsecured —
+    # security is declared in XML (HttpSecurity rules, filter chains, web.xml
+    # security constraints). Update security_model and re-tag affected endpoints
+    # so the output cannot be misread as "unprotected".
+    _XML_SECURITY_RE = re.compile(
+        r'(?:xmlns(?::[a-z]+)?="http://www\.springframework\.org/schema/security"'
+        r'|<security:http\b'
+        r'|<http\s[^>]*use-expressions'
+        r'|spring-security-[2345]'
+        r'|xmlns:security="http://www\.springframework\.org/schema/security")',
+        re.IGNORECASE,
+    )
+    _xml_security_detected = False
+    _XML_GLOBS = (
+        "*security*.xml", "*Security*.xml",
+        "*applicationContext*.xml", "*-context.xml", "*Context.xml",
+        "*spring*.xml", "*Spring*.xml",
+    )
+    for _glob in _XML_GLOBS:
+        for _xf in root.rglob(_glob):
+            if "target/" in str(_xf).replace("\\", "/"):
+                continue
+            try:
+                _xt = _xf.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            if _XML_SECURITY_RE.search(_xt):
+                _xml_security_detected = True
+                break
+        if _xml_security_detected:
+            break
+
+    if _xml_security_detected and security_model == "unknown":
+        security_model = "xml_or_filter_chain"
+        # Re-tag per-endpoint none_detected → xml_or_filter_chain so the output
+        # cannot be misread as "endpoint is unprotected".
+        for ep in endpoints:
+            if ep.get("security", {}).get("policy") == "none_detected":
+                ep["security"] = {"policy": "xml_or_filter_chain"}
+        # Recompute no_security_signal (now counts only truly unknown endpoints)
+        no_security_signal = sum(
+            1 for e in endpoints
+            if e.get("security", {}).get("policy") == "none_detected"
+        )
+
     return {
         "endpoints": endpoints,
         "total": len(endpoints),

sourcecode/spring_event_topology.py

@@ -197,14 +197,17 @@ def _compute_event_risk(
     consumer_count: int,
     before_commit_count: int,
     cross_module: bool,
+    sync_in_tx_count: int = 0,
 ) -> str:
     """Deterministic risk scoring per spec.
 
     high: fanout > 5 OR cross-module propagation OR BEFORE_COMMIT consumers
+          OR sync @EventListener inside @Transactional publisher
     medium: 2–5 consumers
     low: ≤1 consumer
     """
-    if consumer_count > _RISK_FANOUT_HIGH or cross_module or before_commit_count > 0:
+    if (consumer_count > _RISK_FANOUT_HIGH or cross_module
+            or before_commit_count > 0 or sync_in_tx_count > 0):
         return "high"
     if consumer_count >= _RISK_FANOUT_MEDIUM:
         return "medium"
@@ -327,9 +330,23 @@ class EventTopologyOrchestrator:
         # ── 7. TX context ──────────────────────────────────────────────────
         after_commit = [c.fqn for c in consumers if c.transactional_phase == "AFTER_COMMIT"]
         before_commit_risks = [c.fqn for c in consumers if c.transactional_phase == "BEFORE_COMMIT"]
+
+        # Detect sync @EventListener inside @Transactional publisher.
+        # Plain @EventListener fires synchronously; if the publisher method is
+        # @Transactional the listener runs inside that TX — listener exception
+        # rolls back the outer TX, and DB state may be partially committed.
+        tx_publishers = [
+            p for p in publishers
+            if "@Transactional" in ((fqn_index.get(p) or {}).get("annotations") or [])
+        ]
+        sync_in_tx_risks = [
+            c.fqn for c in consumers
+            if c.type == "spring_event" and tx_publishers
+        ]
         tx_context = {
             "after_commit_consumers": after_commit,
             "before_commit_risks": before_commit_risks,
+            "sync_in_tx_risks": sync_in_tx_risks,
         }
 
         # ── 8. Cross-module detection ──────────────────────────────────────
@@ -352,6 +369,7 @@ class EventTopologyOrchestrator:
             consumer_count=len(consumers),
             before_commit_count=len(before_commit_risks),
             cross_module=cross_module,
+            sync_in_tx_count=len(sync_in_tx_risks),
         )
 
         # ── 10. Confidence ─────────────────────────────────────────────────
@@ -385,6 +403,7 @@ class EventTopologyOrchestrator:
                 "kafka_listeners_in_repo": kafka_count,
                 "rabbit_listeners_in_repo": rabbit_count,
                 "before_commit_risk_count": len(before_commit_risks),
+                "sync_in_tx_risk_count": len(sync_in_tx_risks),
                 "level2_events": list(level2_events.keys()),
                 "cross_module": cross_module,
                 "model_build_time_ms": model.build_time_ms,

{sourcecode-1.35.25.dist-info → sourcecode-1.35.26.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.25
+Version: 1.35.26
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.25-blue)
+![Version](https://img.shields.io/badge/version-1.35.26-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.25
+# sourcecode 1.35.26
 ```
 
 ---

{sourcecode-1.35.25.dist-info → sourcecode-1.35.26.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=1fGjuVJyBU95TOEnJBXLcVgGYs_QYMvaKwPypDXVP9g,104
+sourcecode/__init__.py,sha256=HYA42OYABbKZ43Trr1VCdpUkXMtz0AqpwPt0ENMTTjo,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -29,7 +29,7 @@ sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,
 sourcecode/license.py,sha256=3JCV2OeTVttKrOGBguU5uZC0c02Stig-KLB0mP2lNiY,22742
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=-jghKewJwMO0VCXML-ZY1KI_RQO5gd5-pyLCMg5u8jA,52971
+sourcecode/migrate_check.py,sha256=GuYK36DDFkwf07jbAgcoc-Ovq8ttLQNMsRqhsUilMzY,54514
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=ROFRQ8eSLBEMiixK9f45-RO7um4VEEcjoD5AA4I427I,3739
 sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrfjz2o,14423
@@ -40,14 +40,14 @@ sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=vTdWuFj0iRUavs4mOWl87JETR7Je9bKVeDycKBqOFp8,169640
+sourcecode/repository_ir.py,sha256=hl7Vc7o5LD0xWZ6Er7-x2IDrLurJZIfBKGPD-3cfraU,171754
 sourcecode/ris.py,sha256=RcqLVwC-doFcKKViYDkCjZLBqf_wzLES7-F6vHEeWzE,20419
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/semantic_analyzer.py,sha256=TDuC3wzZR2DPm1mgrAg1YSLk2QzJoueS3TZAmyGGpCU,89417
 sourcecode/serializer.py,sha256=7SBJIbpC_Lg0RGWq8jjNbF5TiuZwoP_fi0qhHnzQM8M,124386
-sourcecode/spring_event_topology.py,sha256=LvGv5RXtU_O-fVB_OO9eDD2UmZM72Jn2oUHgOo50Qm0,17157
+sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=8V91iHOg9hFgg6tLLl4FSsgrF-dBqOcO2s-K5sD_goA,5417
 sourcecode/spring_impact.py,sha256=Ohm2k3W4Wts8Kx8Z7DIM-J-cwGtTJBWKFBsX-WkupBQ,32943
 sourcecode/spring_model.py,sha256=IzMcM5ftw1_EHG3FGUDT7qdAMpo3eqbAE1LRuasfr_4,14739
@@ -94,8 +94,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=QSslxIwij8YkRWcVvxykODDrkiN_GAAEu3dUP7KIWeE,1651
-sourcecode-1.35.25.dist-info/METADATA,sha256=XdPhns9JN4tVct_5ARdKlbsb3w76e9rBFXZ_SI4-VC0,21297
-sourcecode-1.35.25.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.35.25.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.35.25.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.35.25.dist-info/RECORD,,
+sourcecode-1.35.26.dist-info/METADATA,sha256=M8Y5dAsVOUGs7ij_YJC26hy4SJtJ_4fFGZZ6NpuabKQ,21297
+sourcecode-1.35.26.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.35.26.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.35.26.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.35.26.dist-info/RECORD,,