sourcecode 1.58.0__tar.gz → 1.60.0__tar.gz

{sourcecode-1.58.0 → sourcecode-1.60.0}/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [1.60.0] — 2026-06-29
+
+### Changed
+- **Anonymous telemetry is now on by default (opt-out).** Previously telemetry
+  was strictly opt-in and disabled until the user accepted a y/N consent prompt.
+  It now defaults to **on** so usage metrics flow without an extra step, while
+  staying fully anonymous — no source code, paths, file names, secrets, or
+  repository content are ever collected. The first interactive run shows a
+  one-time **notice** (not a prompt) explaining what is collected and how to
+  disable. Disable any time with `sourcecode telemetry disable`,
+  `SOURCECODE_TELEMETRY=0`, or the `DO_NOT_TRACK=1` convention. With no explicit
+  choice, telemetry still defaults to **off in CI** (no human to see the notice);
+  an explicit opt-in is honored everywhere. README, `--help`, and
+  `docs/privacy.md` updated accordingly.
+
+## [1.59.0] — 2026-06-19
+
+### Fixed
+- **Event topology now recognizes generic-wrapper event publishers.**
+  `publishEvent(new SaveServiceEvent<>(obj))` and explicit forms like
+  `new SaveServiceEvent<Order>(obj)` were silently dropped: the publisher-edge
+  regex required the constructor `(` to immediately follow the class name, so any
+  diamond `<>` or type argument broke the match. `repo-ir` / event-topology then
+  reported no producers for the whole generic `*ServiceEvent` family (e.g. OpenMRS
+  `SaveServiceEvent`/`VoidServiceEvent`/`RetireServiceEvent`). The inline and
+  two-step publish scans now skip an optional (incl. nested) generic argument list.
+- **`impact-chain` now resolves intra-class method callers.** A query on a
+  private/helper method (e.g. `OrderServiceImpl#stopOrder`) found zero direct
+  callers and degraded to a wrong class-level expansion, because method-to-method
+  calls inside a single class produced no graph edge — only class-level `calls`
+  edges existed. The relation builder now emits method-level `calls` edges for
+  bare `m(...)` and `this.m(...)` invocations whose target is a sibling method of
+  the same class (string/comment-aware, overload-safe, no self-loops). The two
+  defects were found dogfooding the tool on OpenMRS issue #6197.
+
 ## [1.58.0] — 2026-06-19
 
 ### Added

{sourcecode-1.58.0 → sourcecode-1.60.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.58.0
+Version: 1.60.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.58.0-blue)
+![Version](https://img.shields.io/badge/version-1.59.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.58.0
+# sourcecode 1.59.0
 ```
 
 ---
@@ -742,7 +742,7 @@ All outputs include:
 
 ## Telemetry
 
-Anonymous, opt-in. Collects: version, OS, commands, flags, duration, repo size range, errors. No source code, paths, secrets, or output content.
+Anonymous, **on by default (opt-out)**. Collects: version, OS, commands, flags, duration, repo size range, errors. No source code, paths, secrets, or output content. A one-time notice is shown on first interactive run.
 
 ```bash
 sourcecode telemetry status
@@ -750,7 +750,7 @@ sourcecode telemetry enable
 sourcecode telemetry disable
 ```
 
-Or: `export SOURCECODE_TELEMETRY=0`
+Disable any time: `export SOURCECODE_TELEMETRY=0` (or `DO_NOT_TRACK=1`)
 
 ---
 

{sourcecode-1.58.0 → sourcecode-1.60.0}/README.md

@@ -2,7 +2,7 @@
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.58.0-blue)
+![Version](https://img.shields.io/badge/version-1.59.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 ---
@@ -76,7 +76,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.58.0
+# sourcecode 1.59.0
 ```
 
 ---
@@ -704,7 +704,7 @@ All outputs include:
 
 ## Telemetry
 
-Anonymous, opt-in. Collects: version, OS, commands, flags, duration, repo size range, errors. No source code, paths, secrets, or output content.
+Anonymous, **on by default (opt-out)**. Collects: version, OS, commands, flags, duration, repo size range, errors. No source code, paths, secrets, or output content. A one-time notice is shown on first interactive run.
 
 ```bash
 sourcecode telemetry status
@@ -712,7 +712,7 @@ sourcecode telemetry enable
 sourcecode telemetry disable
 ```
 
-Or: `export SOURCECODE_TELEMETRY=0`
+Disable any time: `export SOURCECODE_TELEMETRY=0` (or `DO_NOT_TRACK=1`)
 
 ---
 

{sourcecode-1.58.0 → sourcecode-1.60.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.58.0"
+version = "1.60.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.58.0 → sourcecode-1.60.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.58.0"
+__version__ = "1.60.0"

{sourcecode-1.58.0 → sourcecode-1.60.0}/src/sourcecode/cli.py

@@ -584,7 +584,7 @@ try:
 except Exception:
     pass
 
-telemetry_app = typer.Typer(help="Manage anonymous telemetry (opt-in).", rich_markup_mode="rich")
+telemetry_app = typer.Typer(help="Manage anonymous telemetry (on by default; opt-out).", rich_markup_mode="rich")
 app.add_typer(telemetry_app, name="telemetry")
 
 mcp_app = typer.Typer(help="MCP integration: setup, status, serve, remove.", rich_markup_mode="rich")
@@ -597,18 +597,18 @@ auth_app = typer.Typer(help="Authentication: status, logout.", rich_markup_mode=
 app.add_typer(auth_app, name="auth")
 
 
-def _maybe_ask_consent() -> None:
-    """Show first-run consent prompt once, on interactive TTYs only."""
+def _maybe_show_telemetry_notice() -> None:
+    """Show first-run telemetry notice once, on interactive TTYs only.
+
+    Telemetry is on by default (opt-out). We inform rather than ask, then
+    mark the notice as shown so it appears only once.
+    """
     try:
-        from sourcecode.telemetry.config import has_been_asked, set_enabled
-        from sourcecode.telemetry.consent import ask_for_consent
+        from sourcecode.telemetry.config import has_been_asked, mark_asked
+        from sourcecode.telemetry.consent import show_first_run_notice
         if not has_been_asked():
-            enabled = ask_for_consent()
-            set_enabled(enabled)
-            if enabled:
-                typer.echo("Telemetry enabled. Thank you. Disable: sourcecode telemetry disable", err=True)
-            else:
-                typer.echo("Telemetry disabled. Enable anytime: sourcecode telemetry enable", err=True)
+            show_first_run_notice()
+            mark_asked()
     except Exception:
         pass
 
@@ -1020,9 +1020,9 @@ def main(
       sourcecode /path/to/repo --compact  analyze specific path
       sourcecode --agent                agent-optimized output (full detail)
     """
-    # First-run consent (skip for telemetry/version/config subcommands)
+    # First-run telemetry notice (skip for telemetry/version/config subcommands)
     if ctx.invoked_subcommand not in ("telemetry", "version", "config"):
-        _maybe_ask_consent()
+        _maybe_show_telemetry_notice()
         _maybe_show_mcp_hint()
 
     # When a subcommand is invoked, skip the main analysis.
@@ -3342,12 +3342,12 @@ def telemetry_status() -> None:
     enabled = is_enabled()
     asked = has_been_asked()
     status = "enabled" if enabled else "disabled"
-    typer.echo(f"Telemetry: {status}")
+    typer.echo(f"Telemetry: {status} (on by default; opt-out)")
     if not asked:
-        typer.echo("  (consent not yet shown — will prompt on next run)")
+        typer.echo("  (first-run notice not yet shown — will show on next run)")
     typer.echo(f"  Config: {config_file_path()}")
-    typer.echo("  Disable permanently: sourcecode telemetry disable")
-    typer.echo("  Or set env var:      SOURCECODE_TELEMETRY=0")
+    typer.echo("  Disable: sourcecode telemetry disable")
+    typer.echo("  Or set env var: SOURCECODE_TELEMETRY=0  (or DO_NOT_TRACK=1)")
 
 
 @telemetry_app.command("enable")
@@ -3369,6 +3369,7 @@ def telemetry_disable() -> None:
     from sourcecode.telemetry.config import set_enabled
     set_enabled(False)
     typer.echo("Telemetry disabled. No data will be collected or sent.")
+    typer.echo("Telemetry is on by default; this opt-out is remembered.")
     typer.echo("Re-enable at any time: sourcecode telemetry enable")
 
 

{sourcecode-1.58.0 → sourcecode-1.60.0}/src/sourcecode/license.py

@@ -372,7 +372,7 @@ _init()
 # ---------------------------------------------------------------------------
 
 def _emit_telemetry(event: str, **kw: object) -> None:
-    """Best-effort telemetry emit. Respects opt-in; never raises or blocks."""
+    """Best-effort telemetry emit. Respects the user's opt-out; never raises or blocks."""
     try:
         from sourcecode import telemetry as _tel
         _tel.record(event, **kw)  # type: ignore[arg-type]

{sourcecode-1.58.0 → sourcecode-1.60.0}/src/sourcecode/repository_ir.py

@@ -347,12 +347,17 @@ _SPRING_OTHER: frozenset[str] = frozenset({
     "@MatrixParam", "@CookieParam", "@Context",
 })
 
-_PUBLISH_EVENT_RE = re.compile(r'\.publishEvent\s*\(\s*new\s+(\w+)\s*[(\{]')
+# Optional generic type args between the event class name and its constructor
+# parens — diamond `<>` or explicit `<Order>` / `<Map<String,Integer>>`.
+# Required so `publishEvent(new SaveServiceEvent<>(obj))` (generic event wrappers,
+# e.g. OpenMRS *ServiceEvent family) is recognised as a publisher edge.
+_GENERIC_ARGS = r'(?:<[^<>;{}()]*(?:<[^<>;{}()]*>[^<>;{}()]*)*>)?'
+_PUBLISH_EVENT_RE = re.compile(r'\.publishEvent\s*\(\s*new\s+(\w+)\s*' + _GENERIC_ARGS + r'\s*[(\{]')
 
 # Two-step publish: SomeEvent var = new SomeEvent(...); publisher.publishEvent(var)
 # Used when event is created before passing to publishEvent (common pattern).
 _PUBLISH_EVENT_CALL_RE = re.compile(r'\.publishEvent\s*\(')
-_NEW_EVENT_INSTANTIATION_RE = re.compile(r'\bnew\s+(\w+Event)\s*[\({]')
+_NEW_EVENT_INSTANTIATION_RE = re.compile(r'\bnew\s+(\w+Event)\s*' + _GENERIC_ARGS + r'\s*[\({]')
 
 # Keycloak SPI event fire pattern: XxxEvent.fire(session, ...)
 _FIRE_EVENT_RE = re.compile(r'\b(\w+Event)\.fire\s*\(')
@@ -1122,6 +1127,102 @@ def _build_same_package_map(symbols: list[SymbolRecord]) -> dict[str, dict[str,
     return result
 
 
+# Reserved words that read like calls (`if (`, `for (`, …). Can never be sibling
+# method names (Java reserves them), but guard the intra-class scan anyway.
+_CALL_KEYWORDS: frozenset[str] = frozenset({
+    "if", "for", "while", "switch", "catch", "return", "synchronized",
+    "new", "super", "this", "assert",
+})
+
+
+def _method_body(raw_lines: list[str], start_idx: int) -> str:
+    """Source text of the method/constructor declared at raw_lines[start_idx],
+    from its first '{' to the matching '}' (brace-matched, string/char aware).
+
+    The signature prefix before '{' is dropped so the method's own name is not
+    scanned as a call site. Returns "" for a bodyless declaration (abstract /
+    interface method terminated by ';' before any '{').
+    """
+    depth = 0
+    started = False
+    out: list[str] = []
+    for i in range(start_idx, len(raw_lines)):
+        line = raw_lines[i]
+        if not started:
+            if "{" in line:
+                started = True
+                line = line[line.index("{"):]
+            elif ";" in line:
+                return ""           # bodyless declaration
+            else:
+                continue            # multi-line signature continuation
+        out.append(line)
+        depth += _count_net_braces(line)
+        if depth <= 0:
+            break
+    return "\n".join(out)
+
+
+def _intra_class_call_edges(symbols: list[SymbolRecord], source: str) -> list[RelationEdge]:
+    """Method-level `calls` edges for intra-class invocations.
+
+    `discontinueOrder(){ stopOrder(...); }` →
+    OrderServiceImpl#discontinueOrder --calls--> OrderServiceImpl#stopOrder.
+
+    Class-level call scans miss method-to-method calls within a single class, so
+    impact-chain on a private/helper method (e.g. OrderServiceImpl#stopOrder) found
+    zero method-level callers and degraded to a wrong class-level expansion. Resolves
+    bare `m(...)` and `this.m(...)` calls whose target is a sibling METHOD of the same
+    class. Overloads link to all same-name siblings (arity not resolved by regex).
+    Deterministic, in-source only — no cross-file or runtime inference.
+    """
+    callers = [s for s in symbols if s.symbol_kind in ("method", "constructor") and s.line]
+    if not callers:
+        return []
+
+    # Per-class sibling index: simple method name → [method FQNs]. Constructors are
+    # not call targets (a `new X(...)` site is a different relation).
+    siblings: dict[str, dict[str, list[str]]] = {}
+    for s in symbols:
+        if s.symbol_kind == "method" and "#" in s.symbol:
+            cls = _enclosing_class(s.symbol)
+            name = s.symbol.rsplit("#", 1)[1]
+            siblings.setdefault(cls, {}).setdefault(name, []).append(s.symbol)
+    if not siblings:
+        return []
+
+    raw_lines = source.splitlines()
+    edges: list[RelationEdge] = []
+    for caller in callers:
+        cls = _enclosing_class(caller.symbol)
+        sib = siblings.get(cls)
+        if not sib:
+            continue
+        body = _method_body(raw_lines, caller.line - 1)
+        if not body:
+            continue
+        body = _STRING_LITERAL_RE.sub('', _strip_java_comments(body))
+        for name, fqns in sib.items():
+            if name in _CALL_KEYWORDS:
+                continue
+            # bare `name(` (not preceded by word char or '.') OR explicit `this.name(`
+            pat = (r'(?<![\w.])' + re.escape(name) + r'\s*\('
+                   + r'|\bthis\s*\.\s*' + re.escape(name) + r'\s*\(')
+            if not re.search(pat, body):
+                continue
+            for tgt in fqns:
+                if tgt == caller.symbol:
+                    continue        # skip self-recursion self-loop
+                edges.append(RelationEdge(
+                    from_symbol=caller.symbol,
+                    to_symbol=tgt,
+                    type="calls",
+                    confidence="medium",
+                    evidence={"type": "method_call", "value": f"{name}(...)"},
+                ))
+    return edges
+
+
 def _build_relations(
     symbols: list[SymbolRecord],
     raw_imports: list[str],
@@ -1557,6 +1658,9 @@ def _build_relations(
                         evidence={"type": "method_call", "value": f"{_tgt.split('.')[-1]}.…(…)"},
                     ))
 
+    # ── Intra-class method calls: EnclosingMethod -> calls -> SameClass#sibling ──
+    edges.extend(_intra_class_call_edges(symbols, source))
+
     seen: set[tuple[str, str, str]] = set()
     unique: list[RelationEdge] = []
     for e in edges:

{sourcecode-1.58.0 → sourcecode-1.60.0}/src/sourcecode/telemetry/__init__.py

@@ -1,12 +1,12 @@
-"""sourcecode telemetry — opt-in anonymous usage metrics.
+"""sourcecode telemetry — anonymous usage metrics, on by default (opt-out).
 
 Public API:
     is_enabled()          → bool
     record(event, **kw)   → None  (fire-and-forget)
     session_id()          → str   (ephemeral 8-char hex, new each process)
 
-Telemetry is strictly opt-in. It is disabled by default and can be disabled
-at any time via `sourcecode telemetry disable` or SOURCECODE_TELEMETRY=0.
+Telemetry is enabled by default and stays anonymous. It can be disabled at any
+time via `sourcecode telemetry disable`, SOURCECODE_TELEMETRY=0, or DO_NOT_TRACK=1.
 
 Nothing sensitive (code, paths, secrets, output) is ever collected.
 See docs/privacy.md for full details.

{sourcecode-1.58.0 → sourcecode-1.60.0}/src/sourcecode/telemetry/config.py

@@ -1,6 +1,10 @@
 """Persistent telemetry configuration.
 
+Telemetry is enabled by default (opt-out). It stays anonymous and never
+collects source code, paths, secrets or repository content.
+
 Config file: ~/.config/sourcecode/config.json
+Disable: `sourcecode telemetry disable`, SOURCECODE_TELEMETRY=0, or DO_NOT_TRACK=1
 Env override: SOURCECODE_TELEMETRY=0 (disable) or =1 (enable)
 """
 
@@ -14,6 +18,18 @@ from typing import Any
 _ENV_VAR = "SOURCECODE_TELEMETRY"
 _CONFIG_FILE = Path.home() / ".config" / "sourcecode" / "config.json"
 
+# CI markers — when no explicit choice has been made, telemetry defaults OFF
+# in CI (no human to see the first-run notice), ON otherwise.
+_CI_VARS = (
+    "CI", "CONTINUOUS_INTEGRATION", "GITHUB_ACTIONS", "CIRCLECI",
+    "TRAVIS", "JENKINS_URL", "BUILDKITE", "GITLAB_CI", "TF_BUILD",
+    "TEAMCITY_VERSION", "DRONE", "SEMAPHORE",
+)
+
+
+def _in_ci() -> bool:
+    return any(os.environ.get(v) for v in _CI_VARS)
+
 
 def _load() -> dict[str, Any]:
     try:
@@ -31,17 +47,27 @@ def _save(data: dict[str, Any]) -> None:
 
 
 def is_enabled() -> bool:
-    """True only when telemetry is explicitly opted in.
+    """True unless telemetry has been explicitly disabled.
 
-    Env var takes absolute precedence over config file.
-    Default is always disabled — telemetry is strictly opt-in.
+    Telemetry is enabled by default (opt-out). Precedence, highest first:
+      1. SOURCECODE_TELEMETRY env var (0 = off, 1 = on)
+      2. DO_NOT_TRACK env var (any value other than ""/"0" turns it off)
+      3. config file 'enabled' flag, if the user has made an explicit choice
+      4. default: True — except in CI, where it defaults to False
     """
     env = os.environ.get(_ENV_VAR, "").strip()
     if env == "0":
         return False
     if env == "1":
         return True
-    return bool(_load().get("telemetry", {}).get("enabled", False))
+    dnt = os.environ.get("DO_NOT_TRACK", "").strip()
+    if dnt not in ("", "0"):
+        return False
+    stored = _load().get("telemetry", {}).get("enabled")
+    if stored is not None:
+        return bool(stored)
+    # No explicit choice yet: on by default, off under CI.
+    return not _in_ci()
 
 
 def has_been_asked() -> bool:

{sourcecode-1.58.0 → sourcecode-1.60.0}/src/sourcecode/telemetry/consent.py

@@ -1,9 +1,11 @@
-"""First-run consent prompt.
+"""First-run telemetry notice.
 
-Shown exactly once, only on interactive TTYs, only when the user hasn't been
-asked before. Default answer is NO — the user must explicitly type 'y' to opt in.
+Telemetry is enabled by default (opt-out) and stays anonymous. The notice is
+shown exactly once, only on interactive TTYs, to inform the user that
+telemetry is on and how to turn it off. It does not ask a question — it
+informs and respects the user's right to disable.
 
-Prompt is written to stderr so it doesn't pollute stdout output.
+Notice is written to stderr so it doesn't pollute stdout output.
 """
 
 from __future__ import annotations
@@ -11,11 +13,11 @@ from __future__ import annotations
 import os
 import sys
 
-_PROMPT = """\
+_NOTICE = """\
 \033[2m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  sourcecode — optional anonymous telemetry
+  sourcecode — anonymous telemetry is ON by default
 
-  Help improve sourcecode by sharing anonymous usage metrics.
+  Anonymous usage metrics help improve sourcecode.
 
   Collected: tool version, Python version, OS, commands used,
   flags used, approximate repo size, execution duration, errors.
@@ -23,9 +25,9 @@ _PROMPT = """\
   Never collected: source code, file paths, file names, secrets,
   tokens, environment variables, or any repository content.
 
-  You can change this at any time:
+  Disable at any time:
     sourcecode telemetry disable
-    export SOURCECODE_TELEMETRY=0
+    export SOURCECODE_TELEMETRY=0   (or DO_NOT_TRACK=1)
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\033[0m
 """
 
@@ -43,21 +45,16 @@ def _is_interactive() -> bool:
     return not any(os.environ.get(v) for v in ci_vars)
 
 
-def ask_for_consent() -> bool:
-    """Show the consent prompt and return the user's choice.
+def show_first_run_notice() -> None:
+    """Print the one-time telemetry notice on interactive terminals.
 
-    Returns True if the user opted in, False otherwise.
-    Never raises. Default (Enter / non-y input) is False.
+    Never raises. Does nothing on non-interactive / CI environments.
+    Telemetry stays enabled regardless — this only informs the user.
     """
     if not _is_interactive():
-        return False
-
+        return
     try:
-        sys.stderr.write(_PROMPT)
-        sys.stderr.write("  Enable anonymous telemetry? [y/N]: ")
+        sys.stderr.write(_NOTICE)
         sys.stderr.flush()
-        answer = sys.stdin.readline().strip().lower()
-        sys.stderr.write("\n")
-        return answer == "y"
     except Exception:
-        return False
+        pass