sourcecode 1.62.0__tar.gz → 1.64.0__tar.gz

{sourcecode-1.62.0 → sourcecode-1.64.0}/CHANGELOG.md

@@ -1,5 +1,95 @@
 # Changelog
 
+## [1.64.0] — 2026-06-30
+
+### Fixed — zero false-positive blockers (`migrate-check` / `endpoints`)
+
+A Pro audit of a real enterprise repo (Alfresco Content Services Community, 6,549
+classes) surfaced false blockers that would have invalidated a ~2 person-month
+budget decision. A migration blocker is a high-cost claim: if the tool cannot
+**prove** it from resolved AST/dependency signals, it must not be declared. This
+release enforces that — blockers operate on parsed imports / fully-qualified type
+references, never on a substring inside a comment, Javadoc, string literal, or
+classpath resource path. The `hibernate` sub-`schema_version` is now **2.1**.
+
+- **Phantom Hibernate eliminated.** Hibernate detection now requires real evidence:
+  an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+  parsed `import {jakarta,javax}.persistence.*`. Absent all three →
+  `hibernate.detected = false`, no `hibernate_rewrite` headline, no phantom effort.
+  All scanning runs on source with comments + string/char literals stripped (line
+  numbers preserved), so an `org.hibernate.dialect.*` substring in Javadoc or an
+  iBatis resource path can no longer trigger a verdict. Over-generic Criteria tokens
+  (`Predicate`, `Root<`, `Criterion`, `Conjunction`, `Disjunction`) were dropped —
+  they collide with project-owned domain classes. SPI bare-name matches
+  (`implements XInterceptor`, `extends XEventListener`) now require an
+  `org.hibernate` import in the same file; FQN-anchored SPI matches still count
+  on their own. New `hibernate.evidence{}` records the proof + `confidence`.
+- **MIG-004 / jakarta rules respect a JDK allowlist.** `javax.transaction.xa.*`
+  (the Java SE `java.transaction.xa` module), `javax.annotation.processing.*`,
+  `javax.sql.*`, `javax.xml.parsers/transform/...`, `javax.management.*`,
+  `javax.crypto.*`, and the other permanent JDK/JSR `javax` namespaces no longer
+  count as jakarta-migration findings. App-level `javax.transaction.Transactional`,
+  `javax.annotation.PostConstruct`, etc. are still flagged (true positives kept).
+  Matching is by fully-qualified import prefix, not simple name or partial token.
+- **`readiness_score` no longer sinks on an N/A dimension.** A dimension that does
+  not apply (e.g. Hibernate on a repo with no Hibernate) is reported as N/A
+  (`score: null`), never as 0. New `applicable_dimensions{}` and `readiness_note`
+  make the aggregate's derivation explicit — read the per-dimension breakdown +
+  `blocking_count`, not the single number.
+- **`endpoints` never implies "no API".** When the Spring-MVC surface is empty but
+  another REST framework is present (Alfresco WebScripts via `*.desc.xml` +
+  `AbstractWebScript`/`DeclarativeWebScript`, JAX-RS, or mapped Servlets),
+  `security_model` becomes `"undetermined"` (not `"unknown"`), a
+  `non_spring_rest_surface{}` block is emitted, and a warning states the surface is
+  unmodeled — so `total: 0` is never read as "this app exposes no endpoints".
+
+### Tests
+
+- New `tests/test_falsepositive_fixes.py` — positive **and** negative fixtures per
+  bug (phantom comment-only repo, project-owned `Dialect`/`Criteria`/`Interceptor`
+  classes, `javax.transaction.xa`, WebScripts) alongside the true positives that
+  must be preserved (real Hibernate, `javax.transaction.Transactional`,
+  `@RestController`). Full suite: 2827 passed.
+
+## [1.63.0] — 2026-06-29
+
+### Added — actionable Hibernate rewrite targets (`migrate-check`)
+
+The Hibernate stratification went from **diagnostic** (how many files/occurrences
+per layer) to **actionable** (what to rewrite, where, and to what) so a migration
+agent can consume the output directly without re-parsing the repo. The `hibernate`
+section gains a sub-`schema_version` (now **2.0**); all existing keys preserved.
+
+- **`hibernate.rewrite_targets[]`** — one machine-readable target per call site:
+  `id`, `layer`, `source_file`, `line_start`/`line_end`, `current_pattern`,
+  `current_snippet`, `target_api` (the Hibernate-6 destination), `migration_kind`
+  (`manual_rewrite` / `assisted` / `mechanical` / `review`), `auto_migratable`,
+  `blocking_reason`, `symbol` (enclosing `Class#method`), `module`, `dynamic`.
+  Mapping rules: legacy `org.hibernate.Criteria`/`Restrictions`/`Projections` →
+  `CriteriaBuilder` (manual); `@Type(type=)` → `@Type(value=)`/`@JdbcTypeCode`
+  (mechanical, auto); `@TypeDef`/`@GenericGenerator` → assisted; concatenated HQL →
+  assisted + `runtime-resolved string`; `UserType`/`Interceptor`/`EventListener`/SPI
+  → its H6 contract (manual). Standard JPA annotations emit **no** targets.
+- **Per-layer migration-kind sub-counts** in `risk_matrix` (`manual_count`,
+  `assisted_count`, `mechanical_count`, `review_count`); Criteria adds
+  `static_count` vs `dynamic_count`; SPI adds `userType_rewrite_count` vs
+  `userType_resolvable_count` — so dynamic/reflexive cost is not blended into static.
+- **Honest effort** — each layer carries `effort_range` `{low, high, confidence}`
+  (legacy `estimated_effort` string kept); `hibernate.total_effort_range_days`
+  aggregates them; `hibernate.effort_model` exposes the auditable formula and the
+  caveat that layers may share files (the total is an upper bound, not deduplicated).
+- **`hibernate_readiness` (0–100)** — 4th readiness dimension alongside
+  jakarta/boot3/jdk. It does **not** sink the headline `readiness_score` (Hibernate
+  is an orthogonal rewrite axis), but in a rewrite zone `headline_blocker` is set to
+  `"hibernate_rewrite"` so a reader of "62/100" is not misled.
+- **`hibernate.golden_sql_hotspots[]`** — classes/methods that concentrate dynamic
+  query generation, ranked by reflexive-query volume — where to pin golden-SQL tests.
+
+### Fixed
+
+- `get_migration_readiness` MCP test asserted the pre-1.62 report `schema_version`
+  `1.3`; the v1.62.0 schema bump to `1.4` made it stale. Corrected to `1.4`.
+
 ## [1.62.0] — 2026-06-29
 
 ### Added — Hibernate 5.x → 6.x migration stratification (`migrate-check`)

{sourcecode-1.62.0 → sourcecode-1.64.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.62.0
+Version: 1.64.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -377,6 +377,8 @@ Extracts all Spring MVC (`@GetMapping`, `@PostMapping`, `@RequestMapping`, etc.)
 
 **Functional / WebFlux routing (honest limitation).** Routes registered via the functional DSL — `route().GET("/path", handler)` / `RouterFunction` / `CustomEndpoint`, common in reactive Spring apps — are **not** modeled (their real paths depend on `nest()`/group-version prefixes that can't be resolved statically). Rather than emit partial paths that would mislead, the output reports a `functional_routing` block (`files`, `route_registrations`, `modeled: false`) plus a warning. When the annotation surface is empty but functional routes exist, the warning explicitly tells you not to read it as "no endpoints". Annotation-based (MVC/JAX-RS) repos are unaffected.
 
+**Non-Spring REST frameworks (never "no API").** When the Spring-MVC surface is empty but the repo exposes REST another way — Alfresco WebScripts (`*.desc.xml` descriptors + classes extending `AbstractWebScript`/`DeclarativeWebScript`), JAX-RS, or mapped Servlets — `security_model` is reported as `"undetermined"` (never `"unknown"`, which downstream reads as "no security"), a `non_spring_rest_surface` block names the detected frameworks, and a warning states the surface is unmodeled. `total: 0` therefore can never be read as "this application exposes no API".
+
 **Custom security annotations.** Enterprise repos often guard endpoints with a bespoke annotation instead of `@PreAuthorize`/`@Secured`. Drop a `sourcecode.config.json` at the repo root to teach the scanner about it — otherwise those endpoints report `policy: "none_detected"`:
 
 ```json
@@ -657,6 +659,74 @@ Detects migration blockers across Java source files, Spring XML config files, an
 
 Each finding includes `severity`, `title`, `source_file`, `first_line`, `explanation`, `fix_hint`, `migration_target`, and `openrewrite_recipe` (when an automated recipe exists).
 
+#### Hibernate 5.x → 6.x stratification (the `hibernate` output section)
+
+A Hibernate major upgrade is **not** a single dependency bump for systems that use
+dynamic persistence. `migrate-check` stratifies Hibernate exposure into four
+independent migration domains — never one aggregated score — and emits **actionable,
+machine-readable rewrite targets** so a migration agent can consume the output
+directly instead of re-parsing the repo. Sub-`schema_version`: `2.1`.
+
+> **Evidence-gated (no false blockers).** Hibernate detection requires real proof —
+> an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+> parsed `import {jakarta,javax}.persistence.*`. Absent all three,
+> `hibernate.detected` is `false` (no `hibernate_rewrite` headline, no phantom
+> effort). Scanning runs on source with comments + string/char literals stripped, so
+> an `org.hibernate.*` substring in Javadoc or a classpath resource path never
+> triggers a verdict; bare-name SPI matches (`implements XInterceptor`) require an
+> `org.hibernate` import in the same file. The proof is recorded under
+> `hibernate.evidence{}` with a `confidence`.
+
+**Four layers** (each on its own risk axis):
+
+| Layer | Baseline | Escalates to |
+|-------|----------|--------------|
+| `jpa_annotations` | LOW (namespace handled by jakarta) | HIGH on deprecated `@Type(type=)` / `@TypeDef` / `@GenericGenerator` |
+| `criteria_api` | HIGH (JPA Criteria semantics changed; legacy `org.hibernate.Criteria` removed) | **CRITICAL** when built via reflection / abstraction DAOs (`DynamicEntityDao`, `GenericDao`, `BasicPersistenceModule`) |
+| `hql_string_queries` | MEDIUM (revalidate against H6 parser) | HIGH on string concatenation (SQL shape not statically inferable) |
+| `hibernate_spi_internal` | CRITICAL blocker | `UserType`, `CompositeUserType`, `Interceptor`, `EventListener`, `org.hibernate.engine.spi` |
+
+**Output keys (under `hibernate`):**
+
+- `classification` — `upgrade_zone` / `upgrade_with_care` / `rewrite_zone`. Any of
+  {dynamic Criteria, custom SPI, reflection-built queries, concatenated query
+  strings} forces **`rewrite_zone`** ("HIGH RISK REWRITE ZONE, NOT UPGRADE ZONE").
+- `risk_matrix[]` — per layer: `risk`, `reason`, `effort_range {low, high, confidence}`,
+  `file_count`, `occurrence_count`, migration-kind sub-counts (`manual_count`,
+  `assisted_count`, `mechanical_count`, `review_count`); Criteria adds
+  `static_count` vs `dynamic_count`; SPI adds `userType_rewrite_count` vs
+  `userType_resolvable_count`.
+- `rewrite_targets[]` — one actionable target per call site: `id`, `layer`,
+  `source_file`, `line_start`/`line_end`, `current_pattern`, `current_snippet`,
+  `target_api` (the Hibernate-6 destination), `migration_kind`
+  (`manual_rewrite` / `assisted` / `mechanical` / `review`), `auto_migratable`,
+  `blocking_reason`, `symbol` (enclosing `Class#method`), `module`, `dynamic`.
+- `module_exposure_map` — per Maven/Gradle module: `max_risk`, layers present, and
+  `dynamic-criteria` / `custom-SPI` / `reflection` tags.
+- `critical_call_chains[]` — dynamic query-generation paths (reflection-based DAOs).
+- `golden_sql_hotspots[]` — classes/methods ranked by dynamic-query volume — where
+  to pin golden-SQL behaviour tests before migrating.
+- `total_effort_range_days` + `effort_model` — aggregate range plus the auditable
+  formula (and the caveat that layers may share files, so the total is an upper bound).
+- `stop_conditions_triggered[]`, `risk_separation` (observable vs inferred runtime risk).
+
+The report also exposes **`hibernate_readiness`** (0–100) as a fourth readiness
+dimension alongside `jakarta_readiness` / `boot3_readiness` / `jdk_modernization`.
+Hibernate is an orthogonal rewrite axis, so it does not sink the headline
+`readiness_score`; instead, in a rewrite zone the top-level `headline_blocker` is set
+to `"hibernate_rewrite"` so a reader of the headline score is not misled.
+
+A dimension that does not apply (e.g. Hibernate on a repo with no Hibernate) is
+reported as **N/A** (`score: null`), never as `0`. The top-level
+`applicable_dimensions{}` records which dimensions apply and `readiness_note`
+states that `readiness_score` is a derived aggregate over applicable dimensions
+only — for decisions, read the per-dimension breakdown + `blocking_count`.
+
+```bash
+# inspect only the Hibernate rewrite targets
+sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'
+```
+
 ### `rename-class` — Java class rename
 
 ```bash

{sourcecode-1.62.0 → sourcecode-1.64.0}/README.md

@@ -339,6 +339,8 @@ Extracts all Spring MVC (`@GetMapping`, `@PostMapping`, `@RequestMapping`, etc.)
 
 **Functional / WebFlux routing (honest limitation).** Routes registered via the functional DSL — `route().GET("/path", handler)` / `RouterFunction` / `CustomEndpoint`, common in reactive Spring apps — are **not** modeled (their real paths depend on `nest()`/group-version prefixes that can't be resolved statically). Rather than emit partial paths that would mislead, the output reports a `functional_routing` block (`files`, `route_registrations`, `modeled: false`) plus a warning. When the annotation surface is empty but functional routes exist, the warning explicitly tells you not to read it as "no endpoints". Annotation-based (MVC/JAX-RS) repos are unaffected.
 
+**Non-Spring REST frameworks (never "no API").** When the Spring-MVC surface is empty but the repo exposes REST another way — Alfresco WebScripts (`*.desc.xml` descriptors + classes extending `AbstractWebScript`/`DeclarativeWebScript`), JAX-RS, or mapped Servlets — `security_model` is reported as `"undetermined"` (never `"unknown"`, which downstream reads as "no security"), a `non_spring_rest_surface` block names the detected frameworks, and a warning states the surface is unmodeled. `total: 0` therefore can never be read as "this application exposes no API".
+
 **Custom security annotations.** Enterprise repos often guard endpoints with a bespoke annotation instead of `@PreAuthorize`/`@Secured`. Drop a `sourcecode.config.json` at the repo root to teach the scanner about it — otherwise those endpoints report `policy: "none_detected"`:
 
 ```json
@@ -619,6 +621,74 @@ Detects migration blockers across Java source files, Spring XML config files, an
 
 Each finding includes `severity`, `title`, `source_file`, `first_line`, `explanation`, `fix_hint`, `migration_target`, and `openrewrite_recipe` (when an automated recipe exists).
 
+#### Hibernate 5.x → 6.x stratification (the `hibernate` output section)
+
+A Hibernate major upgrade is **not** a single dependency bump for systems that use
+dynamic persistence. `migrate-check` stratifies Hibernate exposure into four
+independent migration domains — never one aggregated score — and emits **actionable,
+machine-readable rewrite targets** so a migration agent can consume the output
+directly instead of re-parsing the repo. Sub-`schema_version`: `2.1`.
+
+> **Evidence-gated (no false blockers).** Hibernate detection requires real proof —
+> an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+> parsed `import {jakarta,javax}.persistence.*`. Absent all three,
+> `hibernate.detected` is `false` (no `hibernate_rewrite` headline, no phantom
+> effort). Scanning runs on source with comments + string/char literals stripped, so
+> an `org.hibernate.*` substring in Javadoc or a classpath resource path never
+> triggers a verdict; bare-name SPI matches (`implements XInterceptor`) require an
+> `org.hibernate` import in the same file. The proof is recorded under
+> `hibernate.evidence{}` with a `confidence`.
+
+**Four layers** (each on its own risk axis):
+
+| Layer | Baseline | Escalates to |
+|-------|----------|--------------|
+| `jpa_annotations` | LOW (namespace handled by jakarta) | HIGH on deprecated `@Type(type=)` / `@TypeDef` / `@GenericGenerator` |
+| `criteria_api` | HIGH (JPA Criteria semantics changed; legacy `org.hibernate.Criteria` removed) | **CRITICAL** when built via reflection / abstraction DAOs (`DynamicEntityDao`, `GenericDao`, `BasicPersistenceModule`) |
+| `hql_string_queries` | MEDIUM (revalidate against H6 parser) | HIGH on string concatenation (SQL shape not statically inferable) |
+| `hibernate_spi_internal` | CRITICAL blocker | `UserType`, `CompositeUserType`, `Interceptor`, `EventListener`, `org.hibernate.engine.spi` |
+
+**Output keys (under `hibernate`):**
+
+- `classification` — `upgrade_zone` / `upgrade_with_care` / `rewrite_zone`. Any of
+  {dynamic Criteria, custom SPI, reflection-built queries, concatenated query
+  strings} forces **`rewrite_zone`** ("HIGH RISK REWRITE ZONE, NOT UPGRADE ZONE").
+- `risk_matrix[]` — per layer: `risk`, `reason`, `effort_range {low, high, confidence}`,
+  `file_count`, `occurrence_count`, migration-kind sub-counts (`manual_count`,
+  `assisted_count`, `mechanical_count`, `review_count`); Criteria adds
+  `static_count` vs `dynamic_count`; SPI adds `userType_rewrite_count` vs
+  `userType_resolvable_count`.
+- `rewrite_targets[]` — one actionable target per call site: `id`, `layer`,
+  `source_file`, `line_start`/`line_end`, `current_pattern`, `current_snippet`,
+  `target_api` (the Hibernate-6 destination), `migration_kind`
+  (`manual_rewrite` / `assisted` / `mechanical` / `review`), `auto_migratable`,
+  `blocking_reason`, `symbol` (enclosing `Class#method`), `module`, `dynamic`.
+- `module_exposure_map` — per Maven/Gradle module: `max_risk`, layers present, and
+  `dynamic-criteria` / `custom-SPI` / `reflection` tags.
+- `critical_call_chains[]` — dynamic query-generation paths (reflection-based DAOs).
+- `golden_sql_hotspots[]` — classes/methods ranked by dynamic-query volume — where
+  to pin golden-SQL behaviour tests before migrating.
+- `total_effort_range_days` + `effort_model` — aggregate range plus the auditable
+  formula (and the caveat that layers may share files, so the total is an upper bound).
+- `stop_conditions_triggered[]`, `risk_separation` (observable vs inferred runtime risk).
+
+The report also exposes **`hibernate_readiness`** (0–100) as a fourth readiness
+dimension alongside `jakarta_readiness` / `boot3_readiness` / `jdk_modernization`.
+Hibernate is an orthogonal rewrite axis, so it does not sink the headline
+`readiness_score`; instead, in a rewrite zone the top-level `headline_blocker` is set
+to `"hibernate_rewrite"` so a reader of the headline score is not misled.
+
+A dimension that does not apply (e.g. Hibernate on a repo with no Hibernate) is
+reported as **N/A** (`score: null`), never as `0`. The top-level
+`applicable_dimensions{}` records which dimensions apply and `readiness_note`
+states that `readiness_score` is a derived aggregate over applicable dimensions
+only — for decisions, read the per-dimension breakdown + `blocking_count`.
+
+```bash
+# inspect only the Hibernate rewrite targets
+sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'
+```
+
 ### `rename-class` — Java class rename
 
 ```bash

{sourcecode-1.62.0 → sourcecode-1.64.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.62.0"
+version = "1.64.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.62.0 → sourcecode-1.64.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.62.0"
+__version__ = "1.64.0"

{sourcecode-1.62.0 → sourcecode-1.64.0}/src/sourcecode/cli.py

@@ -4841,9 +4841,12 @@ def migrate_check_cmd(
     \b
     Hibernate 5→6 stratification (in the 'hibernate' output section):
       4 independent layers (JPA annotations / Criteria / HQL / SPI), a per-layer
-      risk matrix, a module exposure map, critical call-chain detection, and an
-      UPGRADE vs REWRITE verdict (dynamic Criteria, custom SPI, reflection-built
-      queries, or concatenated query strings force the REWRITE classification).
+      risk matrix with effort ranges, a module exposure map, critical call-chain
+      detection, golden-SQL hotspots, a hibernate_readiness score, and an UPGRADE
+      vs REWRITE verdict (dynamic Criteria, custom SPI, reflection-built queries,
+      or concatenated query strings force the REWRITE classification).
+      Emits actionable rewrite_targets[] (call-site line ranges → target_api +
+      migration_kind) so a migration agent can consume the output directly.
 
     \b
     Examples: