sourcecode 1.35.27__tar.gz → 1.35.29__tar.gz

{sourcecode-1.35.27 → sourcecode-1.35.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.27
+Version: 1.35.29
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.27-blue)
+![Version](https://img.shields.io/badge/version-1.35.29-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,9 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.27
+# sourcecode 1.35.29
+
+**v1.35.28** — 7 bug fixes: `rename-class` cross-package disambiguation (BUG-4), `rename-class` collision detection (BUG-2), `find_java_files` false positive on `com/test/` package paths (BUG-1), `cold-start --compact` correct key names (BUG-6), `@EnableMethodSecurity` no longer suppresses SEC-001 (BUG-3), `explain` @Entity stereotype detection (BUG-5), XML+annotation mixed security retagging (BUG-7).
 ```
 
 ---

{sourcecode-1.35.27 → sourcecode-1.35.29}/README.md

@@ -2,7 +2,7 @@
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.27-blue)
+![Version](https://img.shields.io/badge/version-1.35.29-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -76,7 +76,9 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.27
+# sourcecode 1.35.29
+
+**v1.35.28** — 7 bug fixes: `rename-class` cross-package disambiguation (BUG-4), `rename-class` collision detection (BUG-2), `find_java_files` false positive on `com/test/` package paths (BUG-1), `cold-start --compact` correct key names (BUG-6), `@EnableMethodSecurity` no longer suppresses SEC-001 (BUG-3), `explain` @Entity stereotype detection (BUG-5), XML+annotation mixed security retagging (BUG-7).
 ```
 
 ---

{sourcecode-1.35.27 → sourcecode-1.35.29}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.35.27"
+version = "1.35.29"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.35.27 → sourcecode-1.35.29}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.27"
+__version__ = "1.35.29"

{sourcecode-1.35.27 → sourcecode-1.35.29}/src/sourcecode/cli.py

@@ -5397,10 +5397,13 @@ def cold_start_cmd(
     result = _gcs(target)
     if compact:
         # P1-C: cap at ~10K tokens — keep only fields essential for orientation.
-        _cs_keys = {"status", "git_head", "stacks", "entry_points",
-                    "key_dependencies", "project_type", "project_summary",
-                    "validation", "_meta"}
+        # BUG-6 fix: use actual RIS key names (summary/entrypoints, not stacks/entry_points)
+        _cs_keys = {"status", "git_head", "summary", "entrypoints", "endpoints",
+                    "project_type", "validation", "_meta"}
         result = {k: v for k, v in result.items() if k in _cs_keys}
+        # Truncate endpoints to first 30 to stay within ~10K token budget
+        if isinstance(result.get("endpoints"), list):
+            result["endpoints"] = result["endpoints"][:30]
         result["_meta"] = {**(result.get("_meta") or {}), "compact_mode": True,
                            "full_available": "sourcecode cold-start (without --compact)"}
     _out = _json.dumps(result, indent=2, ensure_ascii=False)

{sourcecode-1.35.27 → sourcecode-1.35.29}/src/sourcecode/explain.py

@@ -28,6 +28,9 @@ _STEREOTYPE_DESC: dict[str, str] = {
     "component": "Spring @Component — general-purpose bean",
     "configuration": "Spring @Configuration — bean factory / config",
     "bean": "Spring @Bean — managed component",
+    "entity": "JPA @Entity — persistent domain object mapped to a database table",
+    "mappedsuperclass": "JPA @MappedSuperclass — base class sharing persistent state with subclasses",
+    "embeddable": "JPA @Embeddable — value object embedded in owning entity table",
 }
 
 _SECURITY_ANNOTATION_PREFIXES = (

{sourcecode-1.35.27 → sourcecode-1.35.29}/src/sourcecode/rename_refactor.py

@@ -106,7 +106,11 @@ def _collect_java_files(root: Path, *, include_tests: bool = True) -> list[Path]
         if any(part in _VENDOR_DIRS for part in parts[:-1]):
             continue
         if not include_tests:
-            if "/test/" in rel or "/tests/" in rel or rel.startswith("test/"):
+            if (
+                "/src/test/" in rel or rel.startswith("src/test/")
+                or "/src/tests/" in rel or rel.startswith("src/tests/")
+                or rel.startswith("test/") or rel.startswith("tests/")
+            ):
                 continue
         results.append(p)
     return results
@@ -150,10 +154,42 @@ def _find_class_file(
 
 def _apply_rename(source: str, old_name: str, new_name: str) -> str:
     """Apply word-boundary replacement for class name (PascalCase and camelCase forms)."""
-    # PascalCase replacement: all type references, declarations, imports
     result = re.sub(r'\b' + re.escape(old_name) + r'\b', new_name, source)
 
-    # camelCase instance names: serviceA → serviceB (only when different from PascalCase)
+    old_camel = _to_camel(old_name)
+    new_camel = _to_camel(new_name)
+    if old_camel != old_name and old_camel in result:
+        result = re.sub(r'\b' + re.escape(old_camel) + r'\b', new_camel, result)
+
+    return result
+
+
+# Matches a class/interface/enum/record declaration of a given name
+_CLASS_DECL_RE_TMPL = r'\b(?:class|interface|enum|record)\s+{name}\b'
+# Matches a constructor declaration: optional access modifier + ClassName + (
+_CTOR_DECL_RE_TMPL = r'^\s*(?:(?:public|protected|private)\s+)?' + r'{name}\s*\('
+
+
+def _apply_rename_refs_only(source: str, old_name: str, new_name: str) -> str:
+    """Rename old_name→new_name in a non-source file (import/type references only).
+
+    Skips lines containing a class/interface/enum/record declaration or constructor
+    declaration of old_name, so that a class sharing the simple name in another
+    package is not corrupted.
+    """
+    class_decl_re = re.compile(_CLASS_DECL_RE_TMPL.format(name=re.escape(old_name)))
+    ctor_decl_re = re.compile(_CTOR_DECL_RE_TMPL.format(name=re.escape(old_name)))
+    ref_re = re.compile(r'\b' + re.escape(old_name) + r'\b')
+
+    lines = source.splitlines(keepends=True)
+    result_lines = []
+    for line in lines:
+        if class_decl_re.search(line) or ctor_decl_re.search(line):
+            result_lines.append(line)
+        else:
+            result_lines.append(ref_re.sub(new_name, line))
+    result = ''.join(result_lines)
+
     old_camel = _to_camel(old_name)
     new_camel = _to_camel(new_name)
     if old_camel != old_name and old_camel in result:
@@ -245,6 +281,19 @@ def rename_class(
     result.old_file = str(source_file.relative_to(root)).replace("\\", "/")
     result.new_file = str(new_file_path.relative_to(root)).replace("\\", "/")
 
+    # BUG-2: check for collision anywhere in the repo, not just same directory
+    collision = next(
+        (f for f in java_files if f.stem == new_name and f.resolve() != new_file_path.resolve()),
+        None,
+    )
+    if collision is not None:
+        collision_rel = str(collision.relative_to(root)).replace("\\", "/")
+        result.errors.append(
+            f"'{new_name}' already exists at '{collision_rel}' — "
+            f"rename would create a duplicate class name. Pass --force to override."
+        )
+        return result
+
     if new_file_path.exists() and new_file_path != source_file:
         result.errors.append(
             f"Target file '{result.new_file}' already exists — aborting to avoid overwrite."
@@ -260,15 +309,18 @@ def rename_class(
             result.errors.append(f"Could not read '{java_file}': {e}")
             continue
 
-        new_text = _apply_rename(old_text, old_name, new_name)
+        is_source = java_file == source_file
+        if is_source:
+            new_text = _apply_rename(old_text, old_name, new_name)
+        else:
+            # BUG-4: use refs-only variant to avoid clobbering same-named class in other package
+            new_text = _apply_rename_refs_only(old_text, old_name, new_name)
         if new_text == old_text:
             continue
 
         rel_path = str(java_file.relative_to(root)).replace("\\", "/")
         diff = _make_diff(old_text, new_text, rel_path)
 
-        # Determine intent
-        is_source = java_file == source_file
         if is_source:
             intent = f"Renamed class declaration: {old_name} → {new_name}"
         else:

{sourcecode-1.35.27 → sourcecode-1.35.29}/src/sourcecode/repository_ir.py

@@ -202,8 +202,9 @@ _SECURITY_MARKER_ANNOTATIONS: frozenset[str] = frozenset({
 # is expected and does NOT mean endpoints are unprotected.
 _FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
     "@EnableWebSecurity",
-    "@EnableMethodSecurity",
-    "@EnableGlobalMethodSecurity",
+    # @EnableMethodSecurity / @EnableGlobalMethodSecurity enable per-method annotation
+    # security (@PreAuthorize/@Secured), NOT a filter chain — must NOT be treated as
+    # filter_based or SEC-001 is suppressed for every unannotated endpoint.
 })
 
 # Programmatic security: method-call patterns that indicate runtime auth enforcement.
@@ -360,6 +361,50 @@ def _strip_java_comments(source: str) -> str:
     source = _LINE_COMMENT_RE.sub(' ', source)
     return source
 
+
+def _parse_annotation_line(line: str) -> tuple[str, str]:
+    """Parse annotation name and args from a line starting with '@'.
+
+    Returns (ann_name, ann_args) where ann_args is content inside the outermost ().
+    Uses O(n) character scanning instead of regex to avoid catastrophic backtracking
+    on lines with deeply nested annotation arguments (e.g. @APIResponse with @Content
+    containing @Schema — 3-level nesting that breaks _ANN_WITH_ARGS_RE).
+    """
+    if not line.startswith('@'):
+        return "", ""
+    i = 1
+    while i < len(line) and (line[i].isalnum() or line[i] in ('_', '.')):
+        i += 1
+    ann_name = line[:i]
+    while i < len(line) and line[i] in (' ', '\t'):
+        i += 1
+    if i >= len(line) or line[i] != '(':
+        return ann_name, ""
+    depth = 0
+    in_string = False
+    string_char = ''
+    start = i + 1
+    i += 1
+    while i < len(line):
+        c = line[i]
+        if in_string:
+            if c == '\\':
+                i += 2
+                continue
+            if c == string_char:
+                in_string = False
+        elif c in ('"', "'"):
+            in_string = True
+            string_char = c
+        elif c == '(':
+            depth += 1
+        elif c == ')':
+            if depth == 0:
+                return ann_name, line[start:i]
+            depth -= 1
+        i += 1
+    return ann_name, line[start:]
+
 # Edge types used for subsystem grouping — semantic hierarchy only, not imports
 _SUBSYSTEM_STRUCTURAL_EDGES: frozenset[str] = frozenset({
     "extends", "implements", "injects", "contained_in",
@@ -409,22 +454,27 @@ _BFS_MAX_DEPTH: int = 3
 # Regex to strip leading annotations from a single parameter (e.g. @NotNull @Valid String name)
 _ANN_PREFIX_RE = re.compile(r'^(?:@\w+\s*(?:\([^)]*\))?\s*)+')
 
+# Used by _count_net_braces fast path: strip string/char literals before counting braces.
+# Handles escape sequences (\\) so escaped quotes don't close the literal prematurely.
+_STRING_LITERAL_RE = re.compile(r'"(?:[^"\\]|\\.)*"|\'(?:[^\'\\]|\\.)*\'')
+
+# Module-level cache for class-keyword detection (avoids recompilation per _extract_symbols call)
+_CLASS_KW_RE = re.compile(r'\b(?:class|interface|enum)\s+[A-Z]')
+
 
 # ---------------------------------------------------------------------------
 # Stable ID helpers
 # ---------------------------------------------------------------------------
 
-def _normalize_type_name(raw: str) -> str:
-    """Strip annotations, final modifier, and param name; return only type.
+_FINAL_STRIP_RE = re.compile(r'\bfinal\s+')
+_TYPE_PARAM_RE = re.compile(r'^([\w<>\[\].,? ]+?)\s+\w+$')
 
-    "(Long id)"    -> strip after parsing → "Long"
-    "@NotNull User user" → "User"
-    "List<String>" → "List<String>"
-    """
+
+def _normalize_type_name(raw: str) -> str:
+    """Strip annotations, final modifier, and param name; return only type."""
     raw = _ANN_PREFIX_RE.sub("", raw).strip()
-    raw = re.sub(r'\bfinal\s+', "", raw).strip()
-    # "Type name" → extract Type (rightmost word is the param name)
-    m = re.match(r'^([\w<>\[\].,? ]+?)\s+\w+$', raw)
+    raw = _FINAL_STRIP_RE.sub("", raw).strip()
+    m = _TYPE_PARAM_RE.match(raw)
     if m:
         return m.group(1).strip()
     return raw.strip()
@@ -502,26 +552,15 @@ def _compute_stable_id(
 # ---------------------------------------------------------------------------
 
 def _count_net_braces(line: str) -> int:
-    depth = 0
-    in_str = False
-    in_char = False
-    i = 0
-    while i < len(line):
-        ch = line[i]
-        if ch == '\\' and (in_str or in_char):
-            i += 2
-            continue
-        if ch == '"' and not in_char:
-            in_str = not in_str
-        elif ch == "'" and not in_str:
-            in_char = not in_char
-        elif not in_str and not in_char:
-            if ch == '{':
-                depth += 1
-            elif ch == '}':
-                depth -= 1
-        i += 1
-    return depth
+    # Fast exit: no braces on this line at all
+    if '{' not in line and '}' not in line:
+        return 0
+    # Fast path: no string/char literals — count directly (C-speed)
+    if '"' not in line and "'" not in line:
+        return line.count('{') - line.count('}')
+    # Slow path: strip string/char literals first so quoted braces don't count
+    clean = _STRING_LITERAL_RE.sub('', line)
+    return clean.count('{') - clean.count('}')
 
 
 def _extract_modifiers(text: str) -> list[str]:
@@ -590,7 +629,6 @@ def _extract_symbols(source: str, rel_path: str) -> tuple[str, list[SymbolRecord
     _raw_lines = source.splitlines()
     _joined: list[str] = []
     _i = 0
-    _CLASS_KW_RE = re.compile(r'\b(?:class|interface|enum)\s+[A-Z]')
     while _i < len(_raw_lines):
         _line = _raw_lines[_i]
         _stripped = _line.strip()
@@ -632,10 +670,8 @@ def _extract_symbols(source: str, rel_path: str) -> tuple[str, list[SymbolRecord
         net = _count_net_braces(stripped)
 
         if stripped.startswith("@"):
-            ann_m = _ANN_WITH_ARGS_RE.match(stripped)
-            if ann_m:
-                ann = ann_m.group(1)
-                ann_args = ann_m.group(2) or ""
+            ann, ann_args = _parse_annotation_line(stripped)
+            if ann:
                 if ann not in pending_anns:
                     pending_anns.append(ann)
                 if ann_args and ann in _CAPTURE_ANN_ARGS:
@@ -1140,17 +1176,26 @@ def _build_relations(
                     evidence={"type": "signature", "value": f"implements {iface}"},
                 ))
 
-    for m_path, class_fqn in _extract_mapped_paths(source, "").items():
-        for sym in symbols:
-            if sym.type in ("class", "interface") and (
-                "@RestController" in sym.annotations or "@Controller" in sym.annotations
-            ):
+    # mapped_to edges: controller class → class-level @RequestMapping path prefix.
+    # O(N) scan of symbols — do NOT call _extract_mapped_paths(source) here because
+    # _REQUEST_MAPPING_RE also matches method-level @GetMapping/@PostMapping, producing
+    # O(N_methods) paths × O(N_syms) inner loop = O(N²) on files with many endpoints.
+    for sym in symbols:
+        if sym.type not in ("class", "interface"):
+            continue
+        if "@RestController" not in sym.annotations and "@Controller" not in sym.annotations:
+            continue
+        if "@RequestMapping" not in sym.annotations:
+            continue
+        _rm_args = sym.annotation_values.get("@RequestMapping", "")
+        for _m_path in _parse_route_paths(_rm_args):
+            if _m_path:
                 edges.append(RelationEdge(
                     from_symbol=sym.symbol,
-                    to_symbol=m_path,
+                    to_symbol=_m_path,
                     type="mapped_to",
                     confidence="high",
-                    evidence={"type": "annotation", "value": f"@RequestMapping(\"{m_path}\")"},
+                    evidence={"type": "annotation", "value": f"@RequestMapping(\"{_m_path}\")"},
                 ))
 
     # contained_in edges: method/field → enclosing class (structural membership)
@@ -1418,9 +1463,18 @@ def _collect_file_constants(source: str) -> dict[str, str]:
     Returns {simple_name: value} covering all classes in the file.
     Used by _resolve_ann_path_expr to fold constant references in @RequestMapping args.
     """
+    # Fast path: skip entirely when no declarations present (C-speed string scan)
+    if 'static final String' not in source:
+        return {}
+    # Scan only candidate lines (skips full-source regex over 100KB files).
+    # Running _STATIC_FINAL_STR_RE over the whole source is O(source_size) due to
+    # optional modifier group backtracking; per-line match is far cheaper.
     constants: dict[str, str] = {}
-    for m in _STATIC_FINAL_STR_RE.finditer(source):
-        constants[m.group(1)] = m.group(2)
+    for line in source.splitlines():
+        if 'static' in line and 'final' in line and 'String' in line and '=' in line and '"' in line:
+            m = _STATIC_FINAL_STR_RE.search(line)
+            if m:
+                constants[m.group(1)] = m.group(2)
     return constants
 
 
@@ -2204,11 +2258,19 @@ def _assemble(
 
     all_fqns_set = {s.symbol for s in sorted_syms}
 
-    # Bounded BFS reachability per node (graph-only)
-    bfs_reach: dict[str, int] = {
-        s.symbol: _bfs_reachability(s.symbol, adjacency)
-        for s in sorted_syms
-    }
+    # Bounded BFS reachability per node (graph-only).
+    # Skipped when symbol count exceeds threshold: O(N*(V+E)) BFS for every symbol
+    # hangs on large repos (keycloak: 80K+ symbols → 180s+ with no output).
+    # bfs_reach contributes only 0.1× weight vs in_deg+out_deg; skipping it on large
+    # repos causes no accuracy loss for spring-audit/endpoints/security analysis.
+    _BFS_SYMBOL_THRESHOLD: int = 5000
+    if len(sorted_syms) <= _BFS_SYMBOL_THRESHOLD:
+        bfs_reach: dict[str, int] = {
+            s.symbol: _bfs_reachability(s.symbol, adjacency)
+            for s in sorted_syms
+        }
+    else:
+        bfs_reach = {}
 
     # Normalize centrality across all nodes
     max_raw = max(
@@ -2828,6 +2890,29 @@ def build_repo_ir(
     # type map before building relations.  Java classes in the same package
     # reference each other without import statements, so import_map alone cannot
     # resolve them — _build_same_package_map provides the cross-file fallback.
+    #
+    # Pre-scan filter: skip full symbol extraction for files that have no
+    # Spring/JAX-RS/CDI annotations. These files (utility classes, model beans,
+    # SPI interfaces) contribute no endpoints, transactions, or security findings
+    # to spring-audit. The text scan is C-speed vs O(lines) Python parse loop.
+    # Non-annotated files still register their package+class via a lightweight
+    # regex scan so same-package type resolution remains correct.
+    _ANNOTATION_MARKERS: tuple[str, ...] = (
+        '@Controller', '@RestController', '@Service', '@Repository',
+        '@Component', '@Configuration', '@Bean', '@Transactional',
+        '@Path', '@GET', '@POST', '@PUT', '@DELETE', '@PATCH',
+        '@PreAuthorize', '@RolesAllowed', '@Secured', '@EnableWebSecurity',
+        '@SpringBootApplication', '@EventListener', '@TransactionalEventListener',
+        '@RequiredArgsConstructor', '@AllArgsConstructor',
+        '@Inject', '@ApplicationScoped', '@RequestScoped', '@Singleton',
+        '@EnableMethodSecurity', '@EnableGlobalMethodSecurity',
+        # JPA / persistence (needed for stereotype detection in all commands)
+        '@Entity', '@MappedSuperclass', '@Embeddable',
+        # AOP / messaging / event sourcing
+        '@Aspect', '@Aggregate', '@Document',
+        # Spring Data
+        '@Query', '@NamedQuery',
+    )
     _per_file: list[tuple[str, str, str, list[str], list[SymbolRecord]]] = []
     for rel_path in sorted(file_paths):
         abs_path = root / rel_path
@@ -2838,6 +2923,23 @@ def build_repo_ir(
         _meta_files_read += 1
         _meta_lines_read += source.count("\n") + (1 if source and not source.endswith("\n") else 0)
         _meta_chars_read += len(source)
+        # Fast pre-scan: if file has no relevant annotations skip full extraction.
+        # Still register package/class name for same-package resolution.
+        if not any(marker in source for marker in _ANNOTATION_MARKERS):
+            pkg_m = _PKG_RE.search(source)
+            _pkg = pkg_m.group(1) if pkg_m else ""
+            # Minimal class-name symbols for same-package map (no methods/fields)
+            _min_syms: list[SymbolRecord] = []
+            for _cm in re.finditer(r'(?:class|interface|enum)\s+(\w+)', source):
+                _cls_name = _cm.group(1)
+                _fqn = f"{_pkg}.{_cls_name}" if _pkg else _cls_name
+                _min_syms.append(SymbolRecord(
+                    symbol=_fqn, type="class", confidence="medium",
+                    declaring_file=rel_path,
+                ))
+            all_symbols.extend(_min_syms)
+            # No relations needed for non-annotated files
+            continue
         package, symbols, raw_imports = _extract_symbols(source, rel_path)
         all_symbols.extend(symbols)
         _per_file.append((rel_path, source, package, raw_imports, symbols))
@@ -2893,6 +2995,48 @@ def build_repo_ir(
     )
     ir = _assemble(all_symbols, unique_relations, all_changed, spring_summary, route_diffs_arg)
 
+    # BUG-7: XML Spring Security detection for the canonical CIR pipeline.
+    # _assemble only sees Java symbols — XML config is invisible to it.
+    # Scan here (where root is available) and retag route_surface entries so
+    # build_canonical_ir produces correct CanonicalEndpoint.security values.
+    _xml_sec_re = re.compile(
+        r'(?:xmlns(?::[a-z]+)?="http://www\.springframework\.org/schema/security"'
+        r'|<security:http\b'
+        r'|<http\s[^>]*use-expressions'
+        r'|spring-security-[2345]'
+        r'|xmlns:security="http://www\.springframework\.org/schema/security")',
+        re.IGNORECASE,
+    )
+    _xml_sec_detected = False
+    for _xml_glob in (
+        "*security*.xml", "*Security*.xml",
+        "*applicationContext*.xml", "*-context.xml", "*Context.xml",
+        "*spring*.xml", "*Spring*.xml",
+    ):
+        for _xf in root.rglob(_xml_glob):
+            if "target/" in str(_xf).replace("\\", "/"):
+                continue
+            try:
+                _xt = _xf.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            if _xml_sec_re.search(_xt):
+                _xml_sec_detected = True
+                break
+        if _xml_sec_detected:
+            break
+    if _xml_sec_detected:
+        _sec_model = ir.get("security_model", "unknown")
+        if _sec_model == "unknown":
+            ir["security_model"] = "xml_or_filter_chain"
+        elif _sec_model in ("annotation_based", "mixed"):
+            ir["security_model"] = "mixed"
+        # Retag route_surface entries that have no security (would become none_detected in CIR)
+        for _r in ir.get("route_surface") or []:
+            _r_sec = _r.get("security_annotations")
+            if _r_sec is None or (isinstance(_r_sec, dict) and _r_sec.get("policy") == "none_detected"):
+                _r["security_annotations"] = {"policy": "xml_or_filter_chain"}
+
     # L-6: inject analysis_meta — files_read, lines_read, symbols_analyzed, token_estimate
     ir["analysis_meta"] = {
         "files_read": _meta_files_read,
@@ -3358,13 +3502,18 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
         if _xml_security_detected:
             break
 
-    if _xml_security_detected and security_model == "unknown":
-        security_model = "xml_or_filter_chain"
-        # Re-tag per-endpoint none_detected → xml_or_filter_chain so the output
-        # cannot be misread as "endpoint is unprotected".
+    if _xml_security_detected:
+        # Re-tag per-endpoint none_detected → xml_or_filter_chain regardless of security_model.
+        # BUG-7 fix: previously only ran when model == "unknown", causing false-positive SEC-001
+        # when annotation security (@PreAuthorize) coexisted with XML security config.
         for ep in endpoints:
             if ep.get("security", {}).get("policy") == "none_detected":
                 ep["security"] = {"policy": "xml_or_filter_chain"}
+        if security_model == "unknown":
+            security_model = "xml_or_filter_chain"
+        elif security_model in ("annotation_based", "mixed"):
+            security_model = "mixed"
+        # filter_based stays filter_based — XML + filter chain is still filter_based
         # Recompute no_security_signal (now counts only truly unknown endpoints)
         no_security_signal = sum(
             1 for e in endpoints
@@ -3395,7 +3544,11 @@ def find_java_files(root: Path, *, max_files: int = 8000, limitations: list[str]
             continue
         parts = rel.split("/")
         # Skip test dirs
-        if "/test/" in rel or "/tests/" in rel or rel.startswith("test/"):
+        if (
+            "/src/test/" in rel or rel.startswith("src/test/")
+            or "/src/tests/" in rel or rel.startswith("src/tests/")
+            or rel.startswith("test/") or rel.startswith("tests/")
+        ):
             continue
         # Skip vendor/generated/build dirs
         if any(part in _VENDOR_DIRS for part in parts[:-1]):

{sourcecode-1.35.27 → sourcecode-1.35.29}/src/sourcecode/spring_model.py

@@ -41,6 +41,8 @@ _CALL_SKIP: frozenset[str] = frozenset({"annotated_with", "mapped_to", "containe
 _BEAN_ANNOTATIONS: frozenset[str] = frozenset({
     "@Component", "@Service", "@Repository",
     "@Controller", "@RestController", "@Configuration", "@Bean",
+    # JPA persistence annotations — not Spring beans but need stereotype recognition in explain
+    "@Entity", "@MappedSuperclass", "@Embeddable",
 })
 
 _GENERIC_PARAM_RE = re.compile(r"<[A-Z][\w,\s<>?]*>")