sourcecode 1.35.27__tar.gz → 1.35.28__tar.gz

{sourcecode-1.35.27 → sourcecode-1.35.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.27
+Version: 1.35.28
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.27-blue)
+![Version](https://img.shields.io/badge/version-1.35.28-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,9 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.27
+# sourcecode 1.35.28
+
+**v1.35.28** — 7 bug fixes: `rename-class` cross-package disambiguation (BUG-4), `rename-class` collision detection (BUG-2), `find_java_files` false positive on `com/test/` package paths (BUG-1), `cold-start --compact` correct key names (BUG-6), `@EnableMethodSecurity` no longer suppresses SEC-001 (BUG-3), `explain` @Entity stereotype detection (BUG-5), XML+annotation mixed security retagging (BUG-7).
 ```
 
 ---

{sourcecode-1.35.27 → sourcecode-1.35.28}/README.md

@@ -2,7 +2,7 @@
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.27-blue)
+![Version](https://img.shields.io/badge/version-1.35.28-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -76,7 +76,9 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.27
+# sourcecode 1.35.28
+
+**v1.35.28** — 7 bug fixes: `rename-class` cross-package disambiguation (BUG-4), `rename-class` collision detection (BUG-2), `find_java_files` false positive on `com/test/` package paths (BUG-1), `cold-start --compact` correct key names (BUG-6), `@EnableMethodSecurity` no longer suppresses SEC-001 (BUG-3), `explain` @Entity stereotype detection (BUG-5), XML+annotation mixed security retagging (BUG-7).
 ```
 
 ---

{sourcecode-1.35.27 → sourcecode-1.35.28}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.35.27"
+version = "1.35.28"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.35.27 → sourcecode-1.35.28}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.27"
+__version__ = "1.35.28"

{sourcecode-1.35.27 → sourcecode-1.35.28}/src/sourcecode/cli.py

@@ -5397,10 +5397,13 @@ def cold_start_cmd(
     result = _gcs(target)
     if compact:
         # P1-C: cap at ~10K tokens — keep only fields essential for orientation.
-        _cs_keys = {"status", "git_head", "stacks", "entry_points",
-                    "key_dependencies", "project_type", "project_summary",
-                    "validation", "_meta"}
+        # BUG-6 fix: use actual RIS key names (summary/entrypoints, not stacks/entry_points)
+        _cs_keys = {"status", "git_head", "summary", "entrypoints", "endpoints",
+                    "project_type", "validation", "_meta"}
         result = {k: v for k, v in result.items() if k in _cs_keys}
+        # Truncate endpoints to first 30 to stay within ~10K token budget
+        if isinstance(result.get("endpoints"), list):
+            result["endpoints"] = result["endpoints"][:30]
         result["_meta"] = {**(result.get("_meta") or {}), "compact_mode": True,
                            "full_available": "sourcecode cold-start (without --compact)"}
     _out = _json.dumps(result, indent=2, ensure_ascii=False)

{sourcecode-1.35.27 → sourcecode-1.35.28}/src/sourcecode/explain.py

@@ -28,6 +28,9 @@ _STEREOTYPE_DESC: dict[str, str] = {
     "component": "Spring @Component — general-purpose bean",
     "configuration": "Spring @Configuration — bean factory / config",
     "bean": "Spring @Bean — managed component",
+    "entity": "JPA @Entity — persistent domain object mapped to a database table",
+    "mappedsuperclass": "JPA @MappedSuperclass — base class sharing persistent state with subclasses",
+    "embeddable": "JPA @Embeddable — value object embedded in owning entity table",
 }
 
 _SECURITY_ANNOTATION_PREFIXES = (

{sourcecode-1.35.27 → sourcecode-1.35.28}/src/sourcecode/rename_refactor.py

@@ -106,7 +106,11 @@ def _collect_java_files(root: Path, *, include_tests: bool = True) -> list[Path]
         if any(part in _VENDOR_DIRS for part in parts[:-1]):
             continue
         if not include_tests:
-            if "/test/" in rel or "/tests/" in rel or rel.startswith("test/"):
+            if (
+                "/src/test/" in rel or rel.startswith("src/test/")
+                or "/src/tests/" in rel or rel.startswith("src/tests/")
+                or rel.startswith("test/") or rel.startswith("tests/")
+            ):
                 continue
         results.append(p)
     return results
@@ -150,10 +154,42 @@ def _find_class_file(
 
 def _apply_rename(source: str, old_name: str, new_name: str) -> str:
     """Apply word-boundary replacement for class name (PascalCase and camelCase forms)."""
-    # PascalCase replacement: all type references, declarations, imports
     result = re.sub(r'\b' + re.escape(old_name) + r'\b', new_name, source)
 
-    # camelCase instance names: serviceA → serviceB (only when different from PascalCase)
+    old_camel = _to_camel(old_name)
+    new_camel = _to_camel(new_name)
+    if old_camel != old_name and old_camel in result:
+        result = re.sub(r'\b' + re.escape(old_camel) + r'\b', new_camel, result)
+
+    return result
+
+
+# Matches a class/interface/enum/record declaration of a given name
+_CLASS_DECL_RE_TMPL = r'\b(?:class|interface|enum|record)\s+{name}\b'
+# Matches a constructor declaration: optional access modifier + ClassName + (
+_CTOR_DECL_RE_TMPL = r'^\s*(?:(?:public|protected|private)\s+)?' + r'{name}\s*\('
+
+
+def _apply_rename_refs_only(source: str, old_name: str, new_name: str) -> str:
+    """Rename old_name→new_name in a non-source file (import/type references only).
+
+    Skips lines containing a class/interface/enum/record declaration or constructor
+    declaration of old_name, so that a class sharing the simple name in another
+    package is not corrupted.
+    """
+    class_decl_re = re.compile(_CLASS_DECL_RE_TMPL.format(name=re.escape(old_name)))
+    ctor_decl_re = re.compile(_CTOR_DECL_RE_TMPL.format(name=re.escape(old_name)))
+    ref_re = re.compile(r'\b' + re.escape(old_name) + r'\b')
+
+    lines = source.splitlines(keepends=True)
+    result_lines = []
+    for line in lines:
+        if class_decl_re.search(line) or ctor_decl_re.search(line):
+            result_lines.append(line)
+        else:
+            result_lines.append(ref_re.sub(new_name, line))
+    result = ''.join(result_lines)
+
     old_camel = _to_camel(old_name)
     new_camel = _to_camel(new_name)
     if old_camel != old_name and old_camel in result:
@@ -245,6 +281,19 @@ def rename_class(
     result.old_file = str(source_file.relative_to(root)).replace("\\", "/")
     result.new_file = str(new_file_path.relative_to(root)).replace("\\", "/")
 
+    # BUG-2: check for collision anywhere in the repo, not just same directory
+    collision = next(
+        (f for f in java_files if f.stem == new_name and f.resolve() != new_file_path.resolve()),
+        None,
+    )
+    if collision is not None:
+        collision_rel = str(collision.relative_to(root)).replace("\\", "/")
+        result.errors.append(
+            f"'{new_name}' already exists at '{collision_rel}' — "
+            f"rename would create a duplicate class name. Pass --force to override."
+        )
+        return result
+
     if new_file_path.exists() and new_file_path != source_file:
         result.errors.append(
             f"Target file '{result.new_file}' already exists — aborting to avoid overwrite."
@@ -260,15 +309,18 @@ def rename_class(
             result.errors.append(f"Could not read '{java_file}': {e}")
             continue
 
-        new_text = _apply_rename(old_text, old_name, new_name)
+        is_source = java_file == source_file
+        if is_source:
+            new_text = _apply_rename(old_text, old_name, new_name)
+        else:
+            # BUG-4: use refs-only variant to avoid clobbering same-named class in other package
+            new_text = _apply_rename_refs_only(old_text, old_name, new_name)
         if new_text == old_text:
             continue
 
         rel_path = str(java_file.relative_to(root)).replace("\\", "/")
         diff = _make_diff(old_text, new_text, rel_path)
 
-        # Determine intent
-        is_source = java_file == source_file
         if is_source:
             intent = f"Renamed class declaration: {old_name} → {new_name}"
         else:

{sourcecode-1.35.27 → sourcecode-1.35.28}/src/sourcecode/repository_ir.py

@@ -202,8 +202,9 @@ _SECURITY_MARKER_ANNOTATIONS: frozenset[str] = frozenset({
 # is expected and does NOT mean endpoints are unprotected.
 _FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
     "@EnableWebSecurity",
-    "@EnableMethodSecurity",
-    "@EnableGlobalMethodSecurity",
+    # @EnableMethodSecurity / @EnableGlobalMethodSecurity enable per-method annotation
+    # security (@PreAuthorize/@Secured), NOT a filter chain — must NOT be treated as
+    # filter_based or SEC-001 is suppressed for every unannotated endpoint.
 })
 
 # Programmatic security: method-call patterns that indicate runtime auth enforcement.
@@ -2893,6 +2894,48 @@ def build_repo_ir(
     )
     ir = _assemble(all_symbols, unique_relations, all_changed, spring_summary, route_diffs_arg)
 
+    # BUG-7: XML Spring Security detection for the canonical CIR pipeline.
+    # _assemble only sees Java symbols — XML config is invisible to it.
+    # Scan here (where root is available) and retag route_surface entries so
+    # build_canonical_ir produces correct CanonicalEndpoint.security values.
+    _xml_sec_re = re.compile(
+        r'(?:xmlns(?::[a-z]+)?="http://www\.springframework\.org/schema/security"'
+        r'|<security:http\b'
+        r'|<http\s[^>]*use-expressions'
+        r'|spring-security-[2345]'
+        r'|xmlns:security="http://www\.springframework\.org/schema/security")',
+        re.IGNORECASE,
+    )
+    _xml_sec_detected = False
+    for _xml_glob in (
+        "*security*.xml", "*Security*.xml",
+        "*applicationContext*.xml", "*-context.xml", "*Context.xml",
+        "*spring*.xml", "*Spring*.xml",
+    ):
+        for _xf in root.rglob(_xml_glob):
+            if "target/" in str(_xf).replace("\\", "/"):
+                continue
+            try:
+                _xt = _xf.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            if _xml_sec_re.search(_xt):
+                _xml_sec_detected = True
+                break
+        if _xml_sec_detected:
+            break
+    if _xml_sec_detected:
+        _sec_model = ir.get("security_model", "unknown")
+        if _sec_model == "unknown":
+            ir["security_model"] = "xml_or_filter_chain"
+        elif _sec_model in ("annotation_based", "mixed"):
+            ir["security_model"] = "mixed"
+        # Retag route_surface entries that have no security (would become none_detected in CIR)
+        for _r in ir.get("route_surface") or []:
+            _r_sec = _r.get("security_annotations")
+            if _r_sec is None or (isinstance(_r_sec, dict) and _r_sec.get("policy") == "none_detected"):
+                _r["security_annotations"] = {"policy": "xml_or_filter_chain"}
+
     # L-6: inject analysis_meta — files_read, lines_read, symbols_analyzed, token_estimate
     ir["analysis_meta"] = {
         "files_read": _meta_files_read,
@@ -3358,13 +3401,18 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
         if _xml_security_detected:
             break
 
-    if _xml_security_detected and security_model == "unknown":
-        security_model = "xml_or_filter_chain"
-        # Re-tag per-endpoint none_detected → xml_or_filter_chain so the output
-        # cannot be misread as "endpoint is unprotected".
+    if _xml_security_detected:
+        # Re-tag per-endpoint none_detected → xml_or_filter_chain regardless of security_model.
+        # BUG-7 fix: previously only ran when model == "unknown", causing false-positive SEC-001
+        # when annotation security (@PreAuthorize) coexisted with XML security config.
         for ep in endpoints:
             if ep.get("security", {}).get("policy") == "none_detected":
                 ep["security"] = {"policy": "xml_or_filter_chain"}
+        if security_model == "unknown":
+            security_model = "xml_or_filter_chain"
+        elif security_model in ("annotation_based", "mixed"):
+            security_model = "mixed"
+        # filter_based stays filter_based — XML + filter chain is still filter_based
         # Recompute no_security_signal (now counts only truly unknown endpoints)
         no_security_signal = sum(
             1 for e in endpoints
@@ -3395,7 +3443,11 @@ def find_java_files(root: Path, *, max_files: int = 8000, limitations: list[str]
             continue
         parts = rel.split("/")
         # Skip test dirs
-        if "/test/" in rel or "/tests/" in rel or rel.startswith("test/"):
+        if (
+            "/src/test/" in rel or rel.startswith("src/test/")
+            or "/src/tests/" in rel or rel.startswith("src/tests/")
+            or rel.startswith("test/") or rel.startswith("tests/")
+        ):
             continue
         # Skip vendor/generated/build dirs
         if any(part in _VENDOR_DIRS for part in parts[:-1]):

{sourcecode-1.35.27 → sourcecode-1.35.28}/src/sourcecode/spring_model.py

@@ -41,6 +41,8 @@ _CALL_SKIP: frozenset[str] = frozenset({"annotated_with", "mapped_to", "containe
 _BEAN_ANNOTATIONS: frozenset[str] = frozenset({
     "@Component", "@Service", "@Repository",
     "@Controller", "@RestController", "@Configuration", "@Bean",
+    # JPA persistence annotations — not Spring beans but need stereotype recognition in explain
+    "@Entity", "@MappedSuperclass", "@Embeddable",
 })
 
 _GENERIC_PARAM_RE = re.compile(r"<[A-Z][\w,\s<>?]*>")