sourcecode 1.35.32__py3-none-any.whl → 1.35.33__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.32"
+__version__ = "1.35.33"

sourcecode/architecture_analyzer.py

@@ -237,7 +237,7 @@ class ArchitectureAnalyzer:
             return ArchitectureAnalysis(
                 requested=True,
                 pattern="unknown",
-                limitations=["Arquitectura no inferida: proyecto sin archivos de codigo suficientes"],
+                limitations=["Architecture not inferred: insufficient source files in project"],
                 evidence=[{"type": "none", "paths": [], "reason": "insufficient source files", "confidence": "high"}],
                 tentative=False,
             )

sourcecode/classifier.py

@@ -19,6 +19,10 @@ _API_FRAMEWORKS = {
     "Actix Web",
     "Rocket",
     "Spring Boot",
+    "Spring MVC",
+    "Spring WebFlux",
+    "Micronaut",
+    "Vert.x",
     "Quarkus",
     "Jakarta EE",   # JAX-RS / Jakarta REST — pure JAX-RS projects must not fall to "unknown"
     "Laravel",

sourcecode/cli.py

@@ -1227,159 +1227,164 @@ def main(
                 except Exception:
                     pass
 
-            if _git_sha and _git_root_str:
-                _excl_key = (
-                    ",".join(sorted(e.strip() for e in exclude.split(",") if e.strip()))
-                    if exclude else ""
-                )
+            _excl_key = (
+                ",".join(sorted(e.strip() for e in exclude.split(",") if e.strip()))
+                if exclude else ""
+            )
 
-                # ── Core (analysis) flags: affect which analyzers run + scan config ──
-                # Use effective_depth (not raw depth) so Java auto-adjustment is captured.
-                # acv = ANALYZER_CACHE_VERSION — bumped only when analysis logic/schema
-                # changes, NOT on every package release.  Prevents patch-bump cache wipes.
-                _core_flags_str = (
-                    f"acv={_cache_mod.ANALYZER_CACHE_VERSION},"
-                    f"dep={dependencies},gm={graph_modules},"
-                    f"docs={docs},fm={full_metrics},sem={semantics},"
-                    f"arch={architecture},gc={git_context},em={env_map},"
-                    f"cn={code_notes},"
-                    f"ex={_excl_key},depth={effective_depth}"
-                )
-                _core_h = _hashlib.sha256(_core_flags_str.encode()).hexdigest()[:8]
+            # ── Core (analysis) flags: affect which analyzers run + scan config ──
+            # Use effective_depth (not raw depth) so Java auto-adjustment is captured.
+            # acv = ANALYZER_CACHE_VERSION — bumped only when analysis logic/schema
+            # changes, NOT on every package release.  Prevents patch-bump cache wipes.
+            _core_flags_str = (
+                f"acv={_cache_mod.ANALYZER_CACHE_VERSION},"
+                f"dep={dependencies},gm={graph_modules},"
+                f"docs={docs},fm={full_metrics},sem={semantics},"
+                f"arch={architecture},gc={git_context},em={env_map},"
+                f"cn={code_notes},"
+                f"ex={_excl_key},depth={effective_depth}"
+            )
+            _core_h = _hashlib.sha256(_core_flags_str.encode()).hexdigest()[:8]
+            if _git_sha and _git_root_str:
                 _core_key = f"{_git_sha}-{_core_h}"
-
-                # ── View flags: output presentation only (no re-analysis needed) ──
-                _view_flags_str = (
-                    f"c={compact},ag={agent},mode={mode},fmt={format},full={full},"
-                    f"co={changed_only},tree={tree},nt={no_tree},"
-                    f"rb={rank_by},sym={symbol},ep={entrypoints_only},"
-                    f"nr={no_redact},gd={graph_detail},dd={docs_depth},"
-                    f"mn={max_nodes},ge={graph_edges},mi={max_importers},"
-                    f"eg={emit_graph}"
-                )
-                _view_h = _hashlib.sha256(_view_flags_str.encode()).hexdigest()[:8]
-
-                # ── Lookup ──────────────────────────────────────────────────────
-                # Step 1: try L1 to obtain the core_hash needed for L2 key
-                _l1_result = _cache_mod.read_core(target, _core_key)
-
-                # P1-A: --env-map misses L1 when base (em=False) exists.
-                # Try the base key so env analysis can be injected lazily (<1 s)
-                # instead of triggering a 17 s full rescan.
-                _l1_needs_env_inject = False
-                if _l1_result is None and env_map:
-                    _base_flags = _core_flags_str.replace(",em=True,", ",em=False,")
-                    _base_h8 = _hashlib.sha256(_base_flags.encode()).hexdigest()[:8]
-                    _base_key = f"{_git_sha}-{_base_h8}"
-                    _base_result = _cache_mod.read_core(target, _base_key)
-                    if _base_result is not None:
-                        _l1_result = _base_result
-                        _l1_needs_env_inject = True
-
-                if _l1_result is not None:
-                    _core_dict_l1, _core_hash = _l1_result
-                    _view_key = f"{_core_hash}-{_view_h}"
-
-                    # Step 2: try L2 (exact view match).
-                    # Skip L2 for --changed-only: the stored view is a previous
-                    # diff snapshot that is stale for the current diff.
-                    if not changed_only:
-                        _cache_hit_content = _cache_mod.read_view(target, _view_key)
-
-                    # Step 3: L1 hit but L2 miss → rebuild view from core dict
-                    if _cache_hit_content is None:
-                        try:
-                            from sourcecode.serializer import build_view_from_core as _bvfc
-                            _rebuilt = _bvfc(
-                                _core_dict_l1,
-                                compact=compact,
-                                agent=agent,
-                                full=full,
-                                no_tree=no_tree,
-                                tree=tree,
-                            )
-                            # P1-A: inject env analysis when base L1 (em=False) was used.
-                            # EnvAnalyzer walks only env/config files — typically <1 s.
-                            if _rebuilt is not None and _l1_needs_env_inject and compact:
-                                try:
-                                    from sourcecode.env_analyzer import EnvAnalyzer as _EnvA_p1a
-                                    _env_r_p1a, _env_s_p1a = _EnvA_p1a().analyze(target, {})
-                                    if _env_s_p1a and (getattr(_env_s_p1a, "total", 0) or _env_r_p1a):
-                                        _es_p1a: dict = {
-                                            "total": getattr(_env_s_p1a, "total", 0),
-                                            "required": getattr(_env_s_p1a, "required_count", 0),
-                                        }
-                                        _cats = getattr(_env_s_p1a, "categories", None)
-                                        if _cats:
-                                            _es_p1a["categories"] = _cats
-                                        _rebuilt = dict(_rebuilt)
-                                        _rebuilt["env_summary"] = _es_p1a
-                                        if _env_r_p1a:
-                                            _sorted_er = sorted(
-                                                _env_r_p1a,
-                                                key=lambda e: (
-                                                    not getattr(e, "required", False),
-                                                    getattr(e, "key", ""),
-                                                ),
-                                            )
-                                            _rebuilt["env_map"] = [
-                                                {
-                                                    "key": getattr(e, "key", ""),
-                                                    **({"required": True} if getattr(e, "required", False) else {}),
-                                                    **({"category": getattr(e, "category", None)} if getattr(e, "category", None) else {}),
-                                                }
-                                                for e in _sorted_er[:15]
-                                            ]
-                                except Exception:
-                                    pass  # env inject failed — continue without env data
-                            if _rebuilt is not None:
-                                # Apply redaction
-                                if not no_redact:
-                                    from sourcecode.redactor import redact_dict as _red_l1
-                                    _rebuilt = _red_l1(_rebuilt)
-                                # Apply output budget
-                                if agent:
-                                    from sourcecode.output_budget import (
-                                        trim_to_budget as _trim_l1,
-                                        BUDGET_AGENT,
-                                    )
-                                    _rebuilt = _trim_l1(_rebuilt, BUDGET_AGENT, label="agent")
-                                elif compact:
-                                    from sourcecode.output_budget import (
-                                        trim_to_budget as _trim_l1c,
-                                        BUDGET_COMPACT,
-                                    )
-                                    _rebuilt = _trim_l1c(_rebuilt, BUDGET_COMPACT, label="compact")
-                                # Serialize
-                                if format == "yaml":
-                                    from io import StringIO as _SIO_L1
-                                    from ruamel.yaml import YAML as _YAML_L1
-                                    _yl1 = _YAML_L1()
-                                    _yl1.default_flow_style = False
-                                    _yl1.representer.add_representer(
-                                        type(None),
-                                        lambda d, v: d.represent_scalar(
-                                            "tag:yaml.org,2002:null", "null"
-                                        ),
-                                    )
-                                    _sl1 = _SIO_L1()
-                                    _yl1.dump(_rebuilt, _sl1)
-                                    _cache_hit_content = _sl1.getvalue()
-                                else:
-                                    import json as _json_l1
-                                    _cache_hit_content = _json_l1.dumps(
-                                        _rebuilt, indent=2, ensure_ascii=False
-                                    )
-                                # Cache rebuilt view in L2 (skip for --changed-only: stale diff)
-                                if _cache_hit_content and not changed_only:
-                                    _cache_mod.write_view(
-                                        target,
-                                        _view_key,
-                                        _cache_hit_content,
-                                        fmt=format,
-                                    )
-                        except Exception:
-                            _cache_hit_content = None  # rebuild failed → full analysis
+            else:
+                # No git history (untracked/no-commit repo) — stable synthetic key
+                # scoped per repo path via cache_dir(); invalidated by --no-cache or cache clear.
+                _core_key = f"nogit-{_core_h}"
+
+            # ── View flags: output presentation only (no re-analysis needed) ──
+            _view_flags_str = (
+                f"c={compact},ag={agent},mode={mode},fmt={format},full={full},"
+                f"co={changed_only},tree={tree},nt={no_tree},"
+                f"rb={rank_by},sym={symbol},ep={entrypoints_only},"
+                f"nr={no_redact},gd={graph_detail},dd={docs_depth},"
+                f"mn={max_nodes},ge={graph_edges},mi={max_importers},"
+                f"eg={emit_graph}"
+            )
+            _view_h = _hashlib.sha256(_view_flags_str.encode()).hexdigest()[:8]
+
+            # ── Lookup ──────────────────────────────────────────────────────
+            # Step 1: try L1 to obtain the core_hash needed for L2 key
+            _l1_result = _cache_mod.read_core(target, _core_key)
+
+            # P1-A: --env-map misses L1 when base (em=False) exists.
+            # Try the base key so env analysis can be injected lazily (<1 s)
+            # instead of triggering a 17 s full rescan.
+            _l1_needs_env_inject = False
+            if _l1_result is None and env_map:
+                _base_flags = _core_flags_str.replace(",em=True,", ",em=False,")
+                _base_h8 = _hashlib.sha256(_base_flags.encode()).hexdigest()[:8]
+                _sha_prefix = _git_sha if _git_sha else "nogit"
+                _base_key = f"{_sha_prefix}-{_base_h8}"
+                _base_result = _cache_mod.read_core(target, _base_key)
+                if _base_result is not None:
+                    _l1_result = _base_result
+                    _l1_needs_env_inject = True
+
+            if _l1_result is not None:
+                _core_dict_l1, _core_hash = _l1_result
+                _view_key = f"{_core_hash}-{_view_h}"
+
+                # Step 2: try L2 (exact view match).
+                # Skip L2 for --changed-only: the stored view is a previous
+                # diff snapshot that is stale for the current diff.
+                if not changed_only:
+                    _cache_hit_content = _cache_mod.read_view(target, _view_key)
+
+                # Step 3: L1 hit but L2 miss → rebuild view from core dict
+                if _cache_hit_content is None:
+                    try:
+                        from sourcecode.serializer import build_view_from_core as _bvfc
+                        _rebuilt = _bvfc(
+                            _core_dict_l1,
+                            compact=compact,
+                            agent=agent,
+                            full=full,
+                            no_tree=no_tree,
+                            tree=tree,
+                        )
+                        # P1-A: inject env analysis when base L1 (em=False) was used.
+                        # EnvAnalyzer walks only env/config files — typically <1 s.
+                        if _rebuilt is not None and _l1_needs_env_inject and compact:
+                            try:
+                                from sourcecode.env_analyzer import EnvAnalyzer as _EnvA_p1a
+                                _env_r_p1a, _env_s_p1a = _EnvA_p1a().analyze(target, {})
+                                if _env_s_p1a and (getattr(_env_s_p1a, "total", 0) or _env_r_p1a):
+                                    _es_p1a: dict = {
+                                        "total": getattr(_env_s_p1a, "total", 0),
+                                        "required": getattr(_env_s_p1a, "required_count", 0),
+                                    }
+                                    _cats = getattr(_env_s_p1a, "categories", None)
+                                    if _cats:
+                                        _es_p1a["categories"] = _cats
+                                    _rebuilt = dict(_rebuilt)
+                                    _rebuilt["env_summary"] = _es_p1a
+                                    if _env_r_p1a:
+                                        _sorted_er = sorted(
+                                            _env_r_p1a,
+                                            key=lambda e: (
+                                                not getattr(e, "required", False),
+                                                getattr(e, "key", ""),
+                                            ),
+                                        )
+                                        _rebuilt["env_map"] = [
+                                            {
+                                                "key": getattr(e, "key", ""),
+                                                **({"required": True} if getattr(e, "required", False) else {}),
+                                                **({"category": getattr(e, "category", None)} if getattr(e, "category", None) else {}),
+                                            }
+                                            for e in _sorted_er[:15]
+                                        ]
+                            except Exception:
+                                pass  # env inject failed — continue without env data
+                        if _rebuilt is not None:
+                            # Apply redaction
+                            if not no_redact:
+                                from sourcecode.redactor import redact_dict as _red_l1
+                                _rebuilt = _red_l1(_rebuilt)
+                            # Apply output budget
+                            if agent:
+                                from sourcecode.output_budget import (
+                                    trim_to_budget as _trim_l1,
+                                    BUDGET_AGENT,
+                                )
+                                _rebuilt = _trim_l1(_rebuilt, BUDGET_AGENT, label="agent")
+                            elif compact:
+                                from sourcecode.output_budget import (
+                                    trim_to_budget as _trim_l1c,
+                                    BUDGET_COMPACT,
+                                )
+                                _rebuilt = _trim_l1c(_rebuilt, BUDGET_COMPACT, label="compact")
+                            # Serialize
+                            if format == "yaml":
+                                from io import StringIO as _SIO_L1
+                                from ruamel.yaml import YAML as _YAML_L1
+                                _yl1 = _YAML_L1()
+                                _yl1.default_flow_style = False
+                                _yl1.representer.add_representer(
+                                    type(None),
+                                    lambda d, v: d.represent_scalar(
+                                        "tag:yaml.org,2002:null", "null"
+                                    ),
+                                )
+                                _sl1 = _SIO_L1()
+                                _yl1.dump(_rebuilt, _sl1)
+                                _cache_hit_content = _sl1.getvalue()
+                            else:
+                                import json as _json_l1
+                                _cache_hit_content = _json_l1.dumps(
+                                    _rebuilt, indent=2, ensure_ascii=False
+                                )
+                            # Cache rebuilt view in L2 (skip for --changed-only: stale diff)
+                            if _cache_hit_content and not changed_only:
+                                _cache_mod.write_view(
+                                    target,
+                                    _view_key,
+                                    _cache_hit_content,
+                                    fmt=format,
+                                )
+                    except Exception:
+                        _cache_hit_content = None  # rebuild failed → full analysis
 
         except Exception:
             _core_key = ""
@@ -2290,6 +2295,11 @@ def main(
         try:
             from sourcecode.ris import _has_uncommitted_changes as _huc_fresh
             _uncommitted_fresh = _huc_fresh(target)
+            # _huc_fresh uses --untracked-files=no — it misses repos where all
+            # files are untracked (no staged/unstaged changes to tracked files).
+            # Promote to True when _allowed_changed_files contains untracked files.
+            if not _uncommitted_fresh and _allowed_changed_files:
+                _uncommitted_fresh = True
         except Exception:
             _uncommitted_fresh = False
         import datetime as _dt
@@ -2335,44 +2345,51 @@ def main(
         import atexit as _atexit
         import threading as _threading
 
-        # Capture all closure state before handing off to thread
-        _bg_sm = sm
-        _bg_target = target
-        _bg_core_key = _core_key
-        _bg_view_key = _view_key
-        _bg_view_flags_str = _view_flags_str
-        _bg_content = content
-        _bg_format = format
-        _bg_hashlib = _hashlib
-        _bg_cache_mod = _cache_mod
-
-        def _write_cache_async() -> None:
-            try:
-                from sourcecode.serializer import core_view as _core_view_fn
-                _core_dict_write = _core_view_fn(_bg_sm)
-                _written_core_hash = _bg_cache_mod.write_core(
-                    _bg_target, _bg_core_key, _core_dict_write
-                )
-                if _written_core_hash:
-                    _vk = _bg_view_key
-                    if not _vk:
-                        _wvh = _bg_hashlib.sha256(_bg_view_flags_str.encode()).hexdigest()[:8]
-                        _vk = f"{_written_core_hash}-{_wvh}"
-                    _bg_cache_mod.write_view(
-                        _bg_target,
-                        _vk,
-                        _bg_content,
-                        fmt=_bg_format,
-                        layers=_compute_analyzer_fingerprints(),
+        # Pre-compute core dict in the main thread — avoids the 5-second atexit
+        # join race on large repos where core_view(sm) itself takes seconds.
+        # Background thread only does gzip + disk I/O (fast, bounded latency).
+        _bg_core_dict: dict | None = None
+        try:
+            from sourcecode.serializer import core_view as _core_view_fn
+            _bg_core_dict = _core_view_fn(sm)
+        except Exception:
+            pass
+
+        if _bg_core_dict is not None:
+            _bg_target = target
+            _bg_core_key = _core_key
+            _bg_view_key = _view_key
+            _bg_view_flags_str = _view_flags_str
+            _bg_content = content
+            _bg_format = format
+            _bg_hashlib = _hashlib
+            _bg_cache_mod = _cache_mod
+
+            def _write_cache_async() -> None:
+                try:
+                    _written_core_hash = _bg_cache_mod.write_core(
+                        _bg_target, _bg_core_key, _bg_core_dict
                     )
-                    from sourcecode.cache import cache_dir as _cdir, _gc as _run_gc
-                    _run_gc(_cdir(_bg_target))
-            except Exception:
-                pass
+                    if _written_core_hash:
+                        _vk = _bg_view_key
+                        if not _vk:
+                            _wvh = _bg_hashlib.sha256(_bg_view_flags_str.encode()).hexdigest()[:8]
+                            _vk = f"{_written_core_hash}-{_wvh}"
+                        _bg_cache_mod.write_view(
+                            _bg_target,
+                            _vk,
+                            _bg_content,
+                            fmt=_bg_format,
+                            layers=_compute_analyzer_fingerprints(),
+                        )
+                        from sourcecode.cache import cache_dir as _cdir, _gc as _run_gc
+                        _run_gc(_cdir(_bg_target))
+                except Exception:
+                    pass
 
-        _cache_write_thread = _threading.Thread(target=_write_cache_async, daemon=True)
-        _cache_write_thread.start()
-        _atexit.register(_cache_write_thread.join, 5.0)
+            _cache_write_thread = _threading.Thread(target=_write_cache_async, daemon=True)
+            _cache_write_thread.start()
+            _atexit.register(_cache_write_thread.join, 30.0)
 
     # Update RIS with aggregated snapshot data (non-fatal side-effect).
     # Update RIS whenever git is available, even when L1/L2 cache is skipped

sourcecode/dependency_analyzer.py

@@ -1277,6 +1277,11 @@ class DependencyAnalyzer:
 
         return records, limitations
 
+    def _strip_gradle_comments(self, content: str) -> str:
+        content = re.sub(r"/\*.*?\*/", "", content, flags=re.DOTALL)
+        content = re.sub(r"//[^\n]*", "", content)
+        return content
+
     def _analyze_gradle(self, root: Path) -> tuple[list[DependencyRecord], list[str]]:
         for filename in ("build.gradle", "build.gradle.kts"):
             gradle_file = root / filename
@@ -1287,7 +1292,22 @@ class DependencyAnalyzer:
                     return [], [f"gradle: error reading {filename}"]
                 props = self._parse_gradle_properties(root, content)
                 records = self._parse_gradle_dependencies(content, props, filename)
-                return records, ["gradle: no compatible lockfile found; transitive dependencies unavailable"]
+
+                # Follow apply from: 'other.gradle' directives (simple string literals only)
+                apply_pat = re.compile(
+                    r"""apply\s+from\s*:\s*["']([^"'${}\s]+\.gradle(?:\.kts)?)["']"""
+                )
+                for m in apply_pat.finditer(self._strip_gradle_comments(content)):
+                    applied_path = root / m.group(1)
+                    if applied_path.exists() and applied_path.resolve() != gradle_file.resolve():
+                        try:
+                            applied_content = applied_path.read_text(encoding="utf-8", errors="replace")
+                            more = self._parse_gradle_dependencies(applied_content, props, m.group(1))
+                            records.extend(more)
+                        except OSError:
+                            pass
+
+                return self._dedupe(records), ["gradle: no compatible lockfile found; transitive dependencies unavailable"]
         return [], []
 
     def _parse_gradle_properties(self, root: Path, content: str) -> dict[str, str]:
@@ -1326,6 +1346,7 @@ class DependencyAnalyzer:
     def _parse_gradle_dependencies(
         self, content: str, props: dict[str, str], manifest_path: str
     ) -> list[DependencyRecord]:
+        content = self._strip_gradle_comments(content)
         _DIRECT = frozenset({
             "implementation", "api", "compileOnly", "runtimeOnly", "compile", "provided",
             "compileClasspath", "runtimeClasspath",

sourcecode/migrate_check.py

@@ -506,7 +506,7 @@ _LEGACY_API_RULES: list[_Rule] = [
         ),
         fix_hint=(
             "Replace Date with LocalDate/LocalDateTime/ZonedDateTime, "
-            "Calendar with java.time.Calendar, "
+            "Calendar with LocalDate or ZonedDateTime (java.time — no Calendar equivalent), "
             "SimpleDateFormat with DateTimeFormatter (thread-safe)."
         ),
         migration_target="java_8_best_practice",
@@ -1299,16 +1299,31 @@ _STATIC_LIMITATIONS: list[str] = [
 
 
 def _detect_spring_boot_2(root: Path) -> bool:
-    """Return True if any pom.xml or build.gradle declares spring-boot 2.x."""
+    """Return True if any build file in the repo declares spring-boot 2.x.
+
+    Checks root build files plus one level of child modules to handle monorepos
+    where the Spring Boot parent version lives in a submodule pom.xml.
+    """
     _SB2 = re.compile(
-        r"(?:spring[.\-]boot[.\-]?(?:version|starter|parent)[^=\n]*[=:\s>\"']?\s*)"
-        r"2\.\d+[\.\d]*|"
-        r"<version>\s*2\.\d+[\.\d]*\s*</version>.*spring.boot|"
-        r"spring.boot.*<version>\s*2\.\d+",
+        # Maven: <parent>...<artifactId>spring-boot-*</artifactId>...<version>2.x
+        r"spring[.\-]?boot.*?<version>\s*2\.\d+|"
+        r"<version>\s*2\.\d+[\.\d]*\s*</version>.*?spring[.\-]?boot|"
+        # Maven properties: <spring.boot.version>2.x or spring-boot.version=2.x
+        r"spring[.\-_]?boot[.\-_]?version\s*[=>\"'\s]+2\.\d+|"
+        # Gradle plugin: id 'org.springframework.boot' version '2.x'
+        r"org\.springframework\.boot[^\n]*?['\"']2\.\d+",
         re.IGNORECASE | re.DOTALL,
     )
-    for name in ("pom.xml", "build.gradle", "build.gradle.kts"):
-        candidate = root / name
+    # Candidate build files: root + one level deep (child modules in monorepos)
+    root_files = [
+        root / name
+        for name in ("pom.xml", "build.gradle", "build.gradle.kts", "gradle.properties")
+    ]
+    child_poms = list(root.glob("*/pom.xml"))
+    child_gradle = list(root.glob("*/build.gradle")) + list(root.glob("*/build.gradle.kts"))
+    # Limit child scan to 30 files to stay fast on large monorepos
+    candidates = root_files + (child_poms + child_gradle)[:30]
+    for candidate in candidates:
         try:
             text = candidate.read_text(encoding="utf-8", errors="replace")
             if _SB2.search(text):

sourcecode/path_filters.py

@@ -78,7 +78,8 @@ def is_test_path(path: str) -> bool:
         or name.endswith(".spec.js")
         or (name.endswith("test.java") and name != "test.java")
         or name.endswith("tests.java")
-        or (name.startswith("test") and name.endswith(".java") and len(name) > 9)
+        or (name.startswith("test") and name.endswith(".java") and len(name) > 9
+            and "/src/main/" not in norm)
     ):
         return True
 

sourcecode/repository_ir.py

@@ -3408,6 +3408,31 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # No independent re-extraction here — _route_security_from_sym is the single
     # source of truth for security policy extraction.
 
+    # Detect interface-based Spring MVC controllers (implements Controller).
+    # These predate annotation-style and have URL mapping in XML, not annotations.
+    # We emit a synthetic "(xml-mapped)" entry so they appear in the endpoint surface.
+    _SPRING_CONTROLLER_IFACE = "org.springframework.web.servlet.mvc.Controller"
+    _annotated_classes = {
+        route.get("effective_class", "").split(".")[-1]
+        for route in routes
+    }
+    for sym in all_symbols:
+        if sym.type != "class":
+            continue
+        if _SPRING_CONTROLLER_IFACE not in sym.imports_used:
+            continue
+        cls_simple = sym.symbol.split(".")[-1]
+        if cls_simple in _annotated_classes:
+            continue
+        routes.append({
+            "symbol": f"{sym.symbol}#handleRequest",
+            "effective_class": sym.symbol,
+            "method": "ANY",
+            "path": "(xml-mapped)",
+            "security_annotations": None,
+            "note": "interface-based Spring MVC controller — URL mapped via XML",
+        })
+
     endpoints: list[dict] = []
     for route in routes:
         handler = (
@@ -3994,7 +4019,9 @@ def compute_blast_radius(
     )
     risk_score = round(min(raw_score, 100.0), 2)
 
-    if risk_score >= 20 or n_ep >= 3 or n_txn >= 2:
+    if risk_score >= 30 or (n_ep >= 5 and n_txn >= 2):
+        risk_level = "critical"
+    elif risk_score >= 20 or n_ep >= 3 or n_txn >= 2:
         risk_level = "high"
     elif risk_score >= 5 or n_ep >= 1 or n_txn >= 1:
         risk_level = "medium"

sourcecode/spring_impact.py

@@ -465,9 +465,9 @@ def _compute_risk(
     caller_score = min(direct_callers * 2.0 + indirect_callers * 0.5, 20.0)
     total = finding_score + endpoint_score + caller_score
 
-    if total >= 20.0:
+    if total >= 25.0:
         level = "critical"
-    elif total >= 10.0:
+    elif total >= 12.0:
         level = "high"
     elif total >= 4.0:
         level = "medium"

sourcecode/spring_model.py

@@ -45,6 +45,9 @@ _BEAN_ANNOTATIONS: frozenset[str] = frozenset({
     "@Entity", "@MappedSuperclass", "@Embeddable",
 })
 
+# JPA stereotypes that are NOT Spring IoC beans — present in any JPA project (Quarkus, JEE, etc.)
+_JPA_ONLY_STEREOTYPES: frozenset[str] = frozenset({"entity", "mappedsuperclass", "embeddable"})
+
 _GENERIC_PARAM_RE = re.compile(r"<[A-Z][\w,\s<>?]*>")
 
 
@@ -213,6 +216,10 @@ class BeanGraph:
     def is_bean(self, fqn: str) -> bool:
         return fqn in self.beans
 
+    def has_spring_beans(self) -> bool:
+        """True only if Spring IoC beans exist — JPA entities do not count."""
+        return any(b.stereotype not in _JPA_ONLY_STEREOTYPES for b in self.beans.values())
+
     def get_stereotype(self, fqn: str) -> str:
         node = self.beans.get(fqn)
         return node.stereotype if node else ""

sourcecode/spring_security_audit.py

@@ -21,7 +21,7 @@ from sourcecode.spring_findings import (
     SEVERITY_ORDER,
     deduplicate_findings,
 )
-from sourcecode.spring_model import InheritanceGraph, SpringSemanticModel
+from sourcecode.spring_model import BeanGraph, InheritanceGraph, SpringSemanticModel
 from sourcecode.spring_semantic import TransactionBoundaryIndex, build_tx_index
 
 if TYPE_CHECKING:
@@ -472,11 +472,8 @@ def run_security_audit(
 
     elapsed_ms = round((time.monotonic() - t0) * 1000, 1)
 
-    _spring_detected = (
-        (model is not None and bool(model.bean_graph.beans))
-        or tx_index.stats()["total"] > 0
-        or cir.metadata.get("security_model", "unknown") != "unknown"
-    )
+    _bean_graph = model.bean_graph if model is not None else BeanGraph.build(cir)
+    _spring_detected = _bean_graph.has_spring_beans() or tx_index.stats()["total"] > 0
 
     _sec_limitations = [
         "SEC-001: only emitted for annotation_based security model",

sourcecode/spring_tx_analyzer.py

@@ -722,7 +722,7 @@ def run_tx_audit(
 
     elapsed_ms = round((time.monotonic() - t0) * 1000, 1)
 
-    _spring_detected = tx_index.stats()["total"] > 0 or bool(model.bean_graph.beans)
+    _spring_detected = tx_index.stats()["total"] > 0 or model.bean_graph.has_spring_beans()
 
     _tx_limitations = [
         "Self-invocation via this.method() not detected — requires AST-level analysis",

{sourcecode-1.35.32.dist-info → sourcecode-1.35.33.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.32
+Version: 1.35.33
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.32-blue)
+![Version](https://img.shields.io/badge/version-1.35.33-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.32
+# sourcecode 1.35.33
 
 **v1.35.28** — 7 bug fixes: `rename-class` cross-package disambiguation (BUG-4), `rename-class` collision detection (BUG-2), `find_java_files` false positive on `com/test/` package paths (BUG-1), `cold-start --compact` correct key names (BUG-6), `@EnableMethodSecurity` no longer suppresses SEC-001 (BUG-3), `explain` @Entity stereotype detection (BUG-5), XML+annotation mixed security retagging (BUG-7).
 ```

{sourcecode-1.35.32.dist-info → sourcecode-1.35.33.dist-info}/RECORD

@@ -1,13 +1,13 @@
-sourcecode/__init__.py,sha256=ODn86wcZpbd0bfIC-gO0QCjwYQ2DntE3iTlUzYkn9Eo,104
+sourcecode/__init__.py,sha256=iEPW1VKpIapMFx1-ORA_vdq1Ke_GeAEHxf6haX6UZ80,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
-sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
+sourcecode/architecture_analyzer.py,sha256=liCwQmLgb5vplohy8arjYxs_HOIv5C9MjLh_gY6bc5Q,44115
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
 sourcecode/ast_extractor.py,sha256=sa6CmLpn-k5G3_Hzxn8hAlZ5-TS-EVzXDD0Gvxd2jzs,50613
 sourcecode/cache.py,sha256=wAyPrXN5DqiGivnMpeEuun2xHDKfBer2_oBsh6kj_vc,30447
 sourcecode/canonical_ir.py,sha256=c_lYTVoegg-1W2dZ34_2s3tN8L0GVx7eiDRh9ghdSD8,24178
 sourcecode/cir_graphs.py,sha256=rZi8JV4ZrAa2WSCeyNa4JIEKQ_yZzDZTsrvVz2KfuKA,8919
-sourcecode/classifier.py,sha256=2lYoSH3vOTkXZYPU7Go2WIet1-IuNzTWVhc-ULnXtgw,8024
-sourcecode/cli.py,sha256=pcblBewwYo8t8VIwc7naWeHT33khsLARQxc8O9ZYX_U,250086
+sourcecode/classifier.py,sha256=hKzg-nQ47htqqIUzSGvYxv15cXrA3KgICTwJmdqal0o,8095
+sourcecode/cli.py,sha256=3rbloccTkwexz8RdKpvMMBSSru27F0091unER2jZVDc,250580
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -15,7 +15,7 @@ sourcecode/context_summarizer.py,sha256=zlbm8ytdvJToohU108-dwBmEl52xl0gXpf6PZBOW
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=gvTdDniedm_mjq4vaHqnBY2UkQ0s00gtXqzTLILNXHc,28719
 sourcecode/coverage_parser.py,sha256=q0LeZJaX1bnntLu-ImksdBsMlpsVmk_iUfSaB4eaJGo,19702
-sourcecode/dependency_analyzer.py,sha256=gvFJf9gHyUGRia3tdPz8s0aX2Re6aohMhb40uFEbjp0,60420
+sourcecode/dependency_analyzer.py,sha256=qEnRiKFkleZJyLf_DyznJbWD1GJ881iG4RRDqH9oGQ4,61524
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=aNTyYgQk5noJDfJU6FmasmESOHfiomyJw5EvZqjy6qc,22213
@@ -30,9 +30,9 @@ sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,
 sourcecode/license.py,sha256=3JCV2OeTVttKrOGBguU5uZC0c02Stig-KLB0mP2lNiY,22742
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=GuYK36DDFkwf07jbAgcoc-Ovq8ttLQNMsRqhsUilMzY,54514
+sourcecode/migrate_check.py,sha256=vowVIAxVaHU8vhZUEt-HrWrWM38m6a5INHJQGjEg5E0,55390
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
-sourcecode/path_filters.py,sha256=ROFRQ8eSLBEMiixK9f45-RO7um4VEEcjoD5AA4I427I,3739
+sourcecode/path_filters.py,sha256=EN1RGZRvLq5EcPgpjYV_IyCKVlAQQn2bbpEisQ5LpGg,3780
 sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrfjz2o,14423
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
 sourcecode/prepare_context.py,sha256=nvBs5dCzTQMsm5jNEuXp7JHE5l9YIgUmv__pDWbLYgQ,222289
@@ -42,7 +42,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=rWCsXoDxJNdsmkUXjPtHphT5CjYOgEPmcc817_8Gu-Y,12538
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=r-6LtwR7FYfXU5GEKg7BZfwJMtHBBnnaCiCkJMX04u8,182227
+sourcecode/repository_ir.py,sha256=2urePvYhsOWtbe-RnT8kASTsSvlR3xqztnpPBU4tFdY,183359
 sourcecode/ris.py,sha256=RcqLVwC-doFcKKViYDkCjZLBqf_wzLES7-F6vHEeWzE,20419
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -51,11 +51,11 @@ sourcecode/semantic_analyzer.py,sha256=4OdG6tTSnTvq3_dSWMbQu8Ad1ndSCKeG-b9qM4hIx
 sourcecode/serializer.py,sha256=GR1RcgY2abmanTIHiYzRXuOnhB2MidBVAiETat1w5cU,124724
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=8V91iHOg9hFgg6tLLl4FSsgrF-dBqOcO2s-K5sD_goA,5417
-sourcecode/spring_impact.py,sha256=9pNteDyV9kEfWiPlS3nngrQwJ5-cOk7eI0Qta5U_80Y,33456
-sourcecode/spring_model.py,sha256=oFpRgRZHXykptZxiN9-jsm4TNKT9ltlSWKNFmJ6tUf0,16184
-sourcecode/spring_security_audit.py,sha256=AmUkqoExkNZ3YxxZf9TwkwX-f7P_SETm0QC7VqEAqh4,20618
+sourcecode/spring_impact.py,sha256=QMsRiuIW76FrxtFjV6iJRh0uHl07vE0rQ3x9fbFLLZw,33456
+sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
+sourcecode/spring_security_audit.py,sha256=XtPJ1SXlZJ8k6VYmaWuAp7Bbir4UmreAL7doIGQ5I7o,20595
 sourcecode/spring_semantic.py,sha256=O1nKSGVzlukuxLHQVuCPxc-XrcrMFxwlHA20_dmEGgM,13307
-sourcecode/spring_tx_analyzer.py,sha256=DgauE1gUIuLorbNxMdSwIlXJxK_wTHgc0pDV0HyxWPY,30710
+sourcecode/spring_tx_analyzer.py,sha256=FdFcyqPp3aT9oJ-PKrnXcTA6s69wdvzG-NBm0GMGPTU,30717
 sourcecode/summarizer.py,sha256=zgdps7yS2IktAbWe7IWz0oUcr3QIuNPRGrsScbZ4R1g,21797
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/workspace.py,sha256=X_6NmNnitvT3_38V-JDChydo_sR68s249hLFlrQskU0,8271
@@ -96,8 +96,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=QSslxIwij8YkRWcVvxykODDrkiN_GAAEu3dUP7KIWeE,1651
-sourcecode-1.35.32.dist-info/METADATA,sha256=JHM-I0fCoFifX8sZKT7ONpl_WvjLnH7btFCd-YXP7lM,21705
-sourcecode-1.35.32.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.35.32.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.35.32.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.35.32.dist-info/RECORD,,
+sourcecode-1.35.33.dist-info/METADATA,sha256=t2-bN_WFdMDu1-wae-AEc3kfo13peCzTHER1jdvp7IE,21705
+sourcecode-1.35.33.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.35.33.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.35.33.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.35.33.dist-info/RECORD,,