sourcecode 1.66.0__py3-none-any.whl → 1.68.0__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.66.0"
+__version__ = "1.68.0"

sourcecode/cli.py

@@ -4896,7 +4896,8 @@ def migrate_check_cmd(
         output, output_path, copy,
         success_msg=(
             f"Migration check written to {output_path} "
-            f"(score: {report.readiness_score}/100, {_total} findings)"
+            f"(score: {report.readiness_score if report.readiness_score is not None else 'N/A'}"
+            f"{'/100' if report.readiness_score is not None else ''}, {_total} findings)"
         ),
     )
 
@@ -5524,6 +5525,91 @@ def fix_bug_cmd(
     )
 
 
+# Method signatures that are almost always FRAMEWORK ENTRY POINTS, not dead code —
+# invoked by a dispatcher (reflection / XML / SPI), invisible to a static Java
+# call-graph. Generalizes beyond any one framework.
+_DYNAMIC_ENTRY_SIGNATURE_RE = __import__("re").compile(
+    r"\(\s*DispatchContext\b"                       # OFBiz Service Engine service
+    r"|HttpServletRequest\s+\w+\s*,\s*HttpServletResponse"  # OFBiz event / servlet handler
+    r"|@(?:Scheduled|PostConstruct|PreDestroy|EventListener|Bean|"
+    r"RequestMapping|GetMapping|PostMapping|Path|GET|POST|Provider|"
+    r"ApplicationScoped|Singleton)\b",              # annotation-dispatched entry
+)
+# Config file extensions where a framework wires classes by name (XML/props/yaml).
+_CONFIG_REF_EXTS: frozenset = frozenset({".xml", ".properties", ".yml", ".yaml", ".groovy"})
+_CONFIG_SCAN_MAX_FILES: int = 12000
+_CONFIG_SCAN_MAX_BYTES: int = 256 * 1024
+
+
+def _partition_static_unreferenced(nodes: list[dict], root: Path) -> tuple[list[dict], list[dict]]:
+    """Split zero-degree classes into (truly_unreferenced, framework_dispatched).
+
+    A class with no static callers is NOT necessarily dead: frameworks invoke
+    classes via reflection, XML/SPI config, or annotations that a static call-graph
+    cannot see (e.g. Apache OFBiz Service Engine services, JAX-RS resources,
+    ServiceLoader providers, scheduled beans). We exclude a candidate when EITHER:
+      1. its source declares a dynamic-entry method signature, OR
+      2. its simple name / FQN is referenced from a non-Java config file.
+    Whatever survives is reported as *statically_unreferenced* — never a confident
+    "dead zone".
+    """
+    import os
+    if not nodes:
+        return [], []
+    by_simple: dict[str, list[dict]] = {}
+    for n in nodes:
+        simple = (n.get("fqn") or "").rsplit(".", 1)[-1]
+        if simple:
+            by_simple.setdefault(simple, []).append(n)
+
+    dispatched_fqns: set[str] = set()
+
+    # 1. Source-signature allowlist (bounded — candidate set is small).
+    for n in nodes:
+        src = n.get("source_file")
+        if not src:
+            continue
+        try:
+            txt = (root / src).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if _DYNAMIC_ENTRY_SIGNATURE_RE.search(txt):
+            dispatched_fqns.add(n["fqn"])
+
+    # 2. Config-reference scan — find candidate names wired from XML/props/yaml.
+    unresolved_simple = {s for s, ns in by_simple.items()
+                         if any(x["fqn"] not in dispatched_fqns for x in ns)}
+    if unresolved_simple:
+        files_scanned = 0
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [d for d in dirnames
+                           if d not in {".git", "build", "out", "target", "node_modules", ".gradle"}]
+            for fname in filenames:
+                ext = os.path.splitext(fname)[1].lower()
+                if ext not in _CONFIG_REF_EXTS:
+                    continue
+                if files_scanned >= _CONFIG_SCAN_MAX_FILES or not unresolved_simple:
+                    break
+                fpath = os.path.join(dirpath, fname)
+                try:
+                    with open(fpath, "r", encoding="utf-8", errors="replace") as fh:
+                        text = fh.read(_CONFIG_SCAN_MAX_BYTES)
+                except OSError:
+                    continue
+                files_scanned += 1
+                for simple in list(unresolved_simple):
+                    if simple in text:
+                        for x in by_simple.get(simple, []):
+                            dispatched_fqns.add(x["fqn"])
+                        unresolved_simple.discard(simple)
+            if files_scanned >= _CONFIG_SCAN_MAX_FILES or not unresolved_simple:
+                break
+
+    unreferenced = [n for n in nodes if n["fqn"] not in dispatched_fqns]
+    dispatched = [n for n in nodes if n["fqn"] in dispatched_fqns]
+    return unreferenced, dispatched
+
+
 @app.command("modernize")
 def modernize_cmd(
     path: Path = typer.Argument(
@@ -5625,13 +5711,21 @@ def modernize_cmd(
         key=lambda n: (-n.get("in_degree", 0), n.get("fqn", "")),
     )[:20]
 
-    # Dead zones: symbols with zero in-degree AND zero out-degree (isolated)
-    dead_zones = sorted(
+    # Statically-unreferenced zones: classes with zero in-degree AND zero out-degree
+    # in the Java call-graph. These are NOT necessarily dead — framework dispatch
+    # (reflection / XML / SPI / annotations) is invisible to a static graph — so we
+    # partition out framework-dispatched entry points before reporting, and never
+    # call the survivors "dead". (Defect 5: OFBiz Service-Engine services and event
+    # handlers were false-positive "dead zones".)
+    _zero_degree = sorted(
         [n for n in graph_nodes
          if n.get("in_degree", 0) == 0 and n.get("out_degree", 0) == 0
          and n.get("type") in ("class", "interface")],
         key=lambda n: n.get("fqn", ""),
-    )[:20]
+    )
+    dead_zones, framework_dispatched = _partition_static_unreferenced(_zero_degree, root)
+    dead_zones = dead_zones[:20]
+    framework_dispatched = framework_dispatched[:20]
 
     # Hotspot candidates: high in-degree service/repository/controller nodes,
     # ranked by composite score (in_degree × 2 + git_churn) for volatility signal.
@@ -5680,16 +5774,35 @@ def modernize_cmd(
         "total_classes": len([n for n in graph_nodes if n.get("type") in ("class", "interface")]),
         "total_subsystems": len(subsystems),
         "high_coupling_nodes": len(coupling_nodes),
-        "dead_zone_candidates": len(dead_zones),
+        "statically_unreferenced": len(dead_zones),
+        "framework_dispatched": len(framework_dispatched),
     }
+    # BUG #6 (v1.68.0): `member_count` counts ALL graph members in the subsystem —
+    # classes, methods AND fields — so it runs ~5x higher than the class count and
+    # is not comparable to the repo-level `total_classes` (which counts only
+    # class/interface nodes). Surface an unambiguous `class_count` alongside it,
+    # computed against the same class/interface node set as total_classes, so a
+    # reader does not have to reverse-engineer the unit. `member_count` is retained
+    # for backward compatibility but is now documented as the graph-member tally.
+    _class_fqns = {n["fqn"] for n in graph_nodes if n.get("type") in ("class", "interface")}
+
+    def _class_count(members: list) -> int:
+        return sum(1 for m in members if m in _class_fqns)
+
     _subsystem_summary = [
         {
             "label": s.get("label") or s.get("name") or "",
             "package_prefix": s.get("package_prefix") or s.get("pkg") or "",
+            "class_count": _class_count(s.get("members") or []),
             "member_count": len(s.get("members") or []),
         }
         for s in subsystems[:15]
     ]
+    _subsystem_summary_note = (
+        "class_count = class/interface declarations only (comparable to "
+        "summary.total_classes). member_count = all graph members in the subsystem "
+        "including methods and fields, so it is larger and not a class tally."
+    )
 
     if (not _mod_is_pro) and _mod_large(str(root)):
         # Large monolith, free tier: structural discovery preview only — no dead
@@ -5706,6 +5819,7 @@ def modernize_cmd(
             ),
             "summary": _summary,
             "subsystem_summary": _subsystem_summary,
+            "subsystem_summary_note": _subsystem_summary_note,
             "hotspot_candidates": hotspots[:3],
             "high_coupling_nodes": [
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
@@ -5723,14 +5837,26 @@ def modernize_cmd(
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
                 for n in coupling_nodes
             ],
-            "dead_zone_candidates": [
+            "statically_unreferenced": [
                 {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
                 for n in dead_zones
             ],
+            "statically_unreferenced_note": (
+                "Zero static callers in the Java call-graph. NOT confirmed dead: verify "
+                "no framework dispatch (reflection, XML/SPI config, annotations) before "
+                "removing. Classes detected as framework-dispatched are listed separately "
+                "under framework_dispatched and excluded from this list."
+            ),
+            "framework_dispatched": [
+                {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
+                for n in framework_dispatched
+            ],
             "subsystem_summary": _subsystem_summary,
+            "subsystem_summary_note": _subsystem_summary_note,
             "cross_module_tangles": [
                 {
                     "label": s.get("label") or s.get("name") or "",
+                    "class_count": _class_count(s.get("members") or []),
                     "member_count": len(s.get("members") or []),
                 }
                 for s in tangle_modules
@@ -5742,7 +5868,8 @@ def modernize_cmd(
                     if hotspots else
                     "high_coupling_nodes shows the most-referenced classes — start there. "
                 )
-                + "Dead zones are safe to remove or refactor. "
+                + "statically_unreferenced lists classes with no Java callers — review "
+                + "for framework dispatch (XML/reflection/SPI) before removing. "
                 + "Cross-module tangles indicate coupling worth decomposing."
             ),
         }

sourcecode/context_summarizer.py

@@ -28,7 +28,11 @@ _STACK_LABELS: dict[str, str] = {
 
 _TYPE_LABELS: dict[str, str] = {
     "api": "REST API",
-    "web_mvc": "Spring MVC web app",
+    # Vendor-neutral: web_mvc is triggered by server-side template engines
+    # (Thymeleaf/FreeMarker), which are NOT exclusive to Spring (e.g. Apache OFBiz
+    # uses FreeMarker with its own framework). The detected frameworks list carries
+    # the actual stack; the type label must not assert "Spring".
+    "web_mvc": "Server-side MVC web app",
     "webapp": "Web app",
     "fullstack": "Full-stack app",
     "cli": "CLI tool",

sourcecode/dependency_analyzer.py

@@ -1278,9 +1278,42 @@ class DependencyAnalyzer:
         return records, limitations
 
     def _strip_gradle_comments(self, content: str) -> str:
-        content = re.sub(r"/\*.*?\*/", "", content, flags=re.DOTALL)
-        content = re.sub(r"//[^\n]*", "", content)
-        return content
+        """Strip // and /* */ comments WITHOUT touching string literals.
+
+        A naive regex treats `/*` inside a string as a block-comment open. Gradle
+        build files routinely embed `/*` in Ant-style glob strings (e.g.
+        '**/*.java') and `//` in URL strings — a regex stripper then eats the entire
+        dependencies block up to the next literal `*/` (real defect on Apache OFBiz,
+        where ~100 deps vanished). This scanner skips quoted strings (single, double,
+        and triple-quoted, with backslash escapes) so only genuine comments are removed.
+        """
+        out: list[str] = []
+        i, n = 0, len(content)
+        quote: Optional[str] = None  # active string delimiter
+        while i < n:
+            if quote is not None:
+                # Inside a string literal — copy verbatim until the matching delimiter.
+                if len(quote) == 1 and content[i] == "\\" and i + 1 < n:
+                    out.append(content[i:i + 2]); i += 2; continue
+                if content.startswith(quote, i):
+                    out.append(quote); i += len(quote); quote = None; continue
+                out.append(content[i]); i += 1; continue
+            if content.startswith("//", i):
+                j = content.find("\n", i)
+                if j == -1:
+                    break
+                i = j; continue
+            if content.startswith("/*", i):
+                j = content.find("*/", i + 2)
+                if j == -1:
+                    break
+                i = j + 2; continue
+            for q in ('"""', "'''", '"', "'"):
+                if content.startswith(q, i):
+                    quote = q; out.append(q); i += len(q); break
+            else:
+                out.append(content[i]); i += 1
+        return "".join(out)
 
     def _analyze_gradle(self, root: Path) -> tuple[list[DependencyRecord], list[str]]:
         for filename in ("build.gradle", "build.gradle.kts"):
@@ -1307,7 +1340,20 @@ class DependencyAnalyzer:
                         except OSError:
                             pass
 
-                return self._dedupe(records), ["gradle: no compatible lockfile found; transitive dependencies unavailable"]
+                deduped = self._dedupe(records)
+                gradle_limitations = [
+                    "gradle: no compatible lockfile found; transitive dependencies unavailable"
+                ]
+                # Honest-zero guard: if the build file declares a dependencies block but
+                # nothing was resolved, report a GAP rather than a confident "0 deps".
+                if not deduped and re.search(r"\bdependencies\s*\{", content):
+                    jar_count = sum(1 for _ in root.glob("lib/**/*.jar"))
+                    gap = ("gradle: dependencies declared but none resolved by static "
+                           "parsing (non-standard declaration syntax)")
+                    if jar_count:
+                        gap += f"; {jar_count} jar(s) present under lib/ (not parsed)"
+                    gradle_limitations.append(gap)
+                return deduped, gradle_limitations
         return [], []
 
     def _parse_gradle_properties(self, root: Path, content: str) -> dict[str, str]:

sourcecode/integration_detector.py

@@ -7,8 +7,14 @@ deterministic source-text matching (same approach as the JNDI datasource scan in
 
 Covered clients:
 
-  * HTTP   — ``RestTemplate``, ``WebClient``, ``@FeignClient`` (declarative)
-  * LDAP   — ``LdapTemplate``
+  * HTTP   — ``RestTemplate``, ``WebClient``, ``@FeignClient`` (declarative),
+             JDK/Apache/OkHttp clients
+  * LDAP   — ``LdapTemplate``, JNDI ``InitialLdapContext``/``LdapContext``
+  * DNS    — JNDI ``DirContext`` configured with ``DnsContextFactory`` (BUG #2:
+             ``DirContext`` is protocol-agnostic and is classified by its
+             ``INITIAL_CONTEXT_FACTORY``, not assumed to be LDAP)
+  * SMTP   — JavaMail / Jakarta Mail (BUG #1: gated on a mail import so the bare
+             word "Transport" in a log string is not a false positive)
   * JMS    — ``JmsTemplate``, ActiveMQ connection factories
 
 Each hit is reported with a ``file:line`` evidence anchor and, when a literal URL
@@ -28,6 +34,24 @@ _URL_RE = re.compile(r'"((?:https?|ldaps?|tcp|amqp|jms|nio)://[^"]*)"')
 # First string literal on a line (fallback target, e.g. WebClient.create("x")).
 _STR_RE = re.compile(r'"([^"]+)"')
 
+# BUG #1 (v1.68.0): a JavaMail/Jakarta-Mail import is required before an SMTP token
+# (Transport, MimeMessage) is trusted. The bare word "Transport" is also a common
+# English noun that appears in log strings ( logger.warn("Transport initialization
+# failure") in non-mail code), so a mail-import gate plus a string-literal skip
+# stops those false positives.
+_MAIL_IMPORT_RE = re.compile(
+    r"^\s*import\s+(?:(?:javax|jakarta)\.mail|org\.springframework\.mail)\b",
+    re.MULTILINE,
+)
+
+# BUG #2 (v1.68.0): javax.naming.directory.{DirContext,InitialDirContext} is NOT
+# LDAP-specific — the actual protocol is decided by the value bound to
+# Context.INITIAL_CONTEXT_FACTORY. com.sun.jndi.dns.DnsContextFactory means DNS
+# (SRV/A record lookups), com.sun.jndi.ldap.LdapCtxFactory means LDAP. Classify by
+# the factory class present in the file instead of defaulting to LDAP.
+_DNS_FACTORY_RE = re.compile(r"jndi\.dns|DnsContextFactory", re.IGNORECASE)
+_LDAP_FACTORY_RE = re.compile(r"jndi\.ldap|LdapCtxFactory", re.IGNORECASE)
+
 # Declarative HTTP client. Attrs may span multiple lines, so matched on full text.
 _FEIGN_RE = re.compile(r"@FeignClient\s*\(([^)]*)\)", re.DOTALL)
 _ATTR_URL_RE = re.compile(r'url\s*=\s*"([^"]*)"')
@@ -82,6 +106,39 @@ def _extract_target(line: str) -> Optional[str]:
     return None
 
 
+def _in_string_literal(line: str, idx: int) -> bool:
+    """True if char offset ``idx`` falls inside a double-quoted string on ``line``.
+
+    BUG #1 (v1.68.0): a Java type token never legitimately appears inside a string
+    literal, so a match there (e.g. the word "Transport" in a log message) is noise,
+    not a real client construct. Counts unescaped quotes before ``idx``.
+    """
+    quote_count = 0
+    i = 0
+    while i < idx and i < len(line):
+        ch = line[i]
+        if ch == "\\":
+            i += 2
+            continue
+        if ch == '"':
+            quote_count += 1
+        i += 1
+    return quote_count % 2 == 1
+
+
+def _classify_naming_factory(text: str) -> Optional[str]:
+    """Classify a javax.naming.directory usage by its INITIAL_CONTEXT_FACTORY.
+
+    Returns ``"dns"``, ``"ldap"``, or ``None`` (factory not statically resolvable).
+    See BUG #2 — DirContext alone does not imply LDAP.
+    """
+    if _DNS_FACTORY_RE.search(text):
+        return "dns"
+    if _LDAP_FACTORY_RE.search(text):
+        return "ldap"
+    return None
+
+
 def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     """Detect outbound integrations across ``file_paths`` (relative to ``root``).
 
@@ -93,18 +150,31 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     seen: "set[tuple[str, str, Optional[str], str]]" = set()
     records: "list[dict]" = []
 
-    def _add(kind: str, client: str, target: Optional[str], rel: str, line: int) -> None:
+    def _add(
+        kind: str,
+        client: str,
+        target: Optional[str],
+        rel: str,
+        line: int,
+        confidence: Optional[str] = None,
+    ) -> None:
         evidence = f"{rel}:{line}"
         key = (kind, client, target, evidence)
         if key in seen:
             return
         seen.add(key)
-        records.append({
+        rec = {
             "kind": kind,
             "client": client,
             "target": target,
             "evidence": evidence,
-        })
+        }
+        # Per-record confidence is emitted only when the classification is uncertain
+        # (e.g. a JNDI DirContext whose factory could not be resolved). Confident hits
+        # stay schema-clean without the field.
+        if confidence is not None:
+            rec["confidence"] = confidence
+        records.append(rec)
 
     for rel in file_paths:
         try:
@@ -126,6 +196,10 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
             )
             _add("http", "feign", target, rel, _line_of(text, m.start()))
 
+        # Per-file context used to disambiguate / gate uncertain tokens (BUG #1/#2).
+        has_mail_import = bool(_MAIL_IMPORT_RE.search(text))
+        naming_factory = _classify_naming_factory(text)
+
         # Token clients — per line, skipping imports/package/comment noise.
         # First pass records the declaration site and any variable name bound to
         # the client, so a later call site (where the URL literal usually lives)
@@ -146,7 +220,28 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
                 m = token_re.search(line)
                 if not m:
                     continue
-                _add(kind, client, _extract_target(line), rel, lineno)
+                # BUG #1: a token matched inside a string literal (log message, doc
+                # comment text) is never a real client construct — skip it.
+                if _in_string_literal(line, m.start()):
+                    continue
+                confidence: Optional[str] = None
+                # BUG #1: SMTP tokens require a JavaMail/Jakarta-Mail import to be
+                # trusted — "Transport" / "MimeMessage" are too generic otherwise.
+                if kind == "smtp" and not has_mail_import:
+                    continue
+                # BUG #2: javax.naming.directory.{Dir,Initial}Context is protocol-
+                # agnostic. Reclassify by the configured context factory; default to
+                # an explicit low-confidence "unknown" rather than assuming LDAP.
+                if client == "jndi-ldap" and "Dir" in token_re.pattern:
+                    if naming_factory == "dns":
+                        kind, client = "dns", "jndi-dns"
+                    elif naming_factory == "ldap":
+                        kind, client = "ldap", "jndi-ldap"
+                    else:
+                        kind, client, confidence = (
+                            "naming-directory-unknown", "jndi-dircontext", "low",
+                        )
+                _add(kind, client, _extract_target(line), rel, lineno, confidence)
                 tok = m.group(0)
                 # `Type name` (field/local decl) and `name = new Type(` forms.
                 decl = re.search(re.escape(tok) + r"\s+(\w+)\b", line)
@@ -186,9 +281,13 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
         "confidence": confidence,
         "coverage_note": (
             "Detects HTTP (RestTemplate/WebClient/JDK/Apache/OkHttp), LDAP (Spring "
-            "+ JNDI), SMTP (JavaMail), and JMS client constructs by source-text "
-            "matching. A count of 0 means no such construct was found, not that the "
-            "system has no outbound integrations — runtime/DI-wired clients are not "
-            "statically visible."
+            "+ JNDI), DNS (JNDI DirContext w/ DnsContextFactory), SMTP (JavaMail, "
+            "import-gated), and JMS client constructs by source-text matching. JNDI "
+            "DirContext usage is classified by its INITIAL_CONTEXT_FACTORY (dns vs "
+            "ldap); when the factory is not statically resolvable the kind is "
+            "'naming-directory-unknown' with confidence='low', never assumed LDAP. A "
+            "count of 0 means no such construct was found, not that the system has no "
+            "outbound integrations — runtime/DI-wired clients are not statically "
+            "visible."
         ),
     }

sourcecode/mcp/orchestrator.py

@@ -774,7 +774,7 @@ def run_migrate_flow_impl(repo_path: str, min_severity: str = "low") -> dict[str
     if not _is_java_repo(repo_path):
         quality_warnings.append(
             "not_a_java_repo: migration analysis targets Spring Boot / Java repos. "
-            "Result will be empty (readiness_score=100, no findings)."
+            "Result will be empty (readiness_score=null/N/A, no findings)."
         )
 
     report = _exec(["migrate-check", repo_path, "--min-severity", min_severity])

sourcecode/mcp/registry.py

@@ -798,7 +798,7 @@ depth: BFS depth for indirect caller traversal (1–8, default: 4).
 Analyzes codebase for modernization opportunities: dead zones, hotspot scores, upgrade candidates.
 
 Maps to: sourcecode modernize <repo_path>
-Returns: hotspot_candidates (high fan-in + git churn), dead_zone_candidates (isolated classes),
+Returns: hotspot_candidates (high fan-in + git churn), statically_unreferenced (zero-caller classes — NOT confirmed dead; verify no framework dispatch) + framework_dispatched,
          high_coupling_nodes, subsystem_summary, cross_module_tangles, recommendation.
 
 Best for: refactor planning, identifying where to start, finding safe removal candidates.
@@ -1403,7 +1403,7 @@ Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA
 When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
 or upgrading from Spring Boot 2.x to 3.x. Use BEFORE get_spring_audit when the goal
 is migration planning rather than ongoing Spring semantic audit.
-Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+Do NOT call on non-Java repositories — returns readiness_score=null (N/A) with no findings.
 
 Rules detected:
   MIG-001 critical — javax.persistence imports (JPA; will not compile after migration)
@@ -1415,7 +1415,7 @@ Rules detected:
   MIG-007 medium   — javax.inject imports (DI annotations)
   MIG-008 medium   — javax.ws.rs imports (JAX-RS API)
 
-Returns: schema_version, readiness_score (0–100; 100=ready to migrate),
+Returns: schema_version, readiness_score (0–100, or null=N/A when no migration target applies; 100=ready to migrate),
   jakarta_readiness / boot3_readiness / jdk_modernization (per-dimension 0–100),
   blocking_count, estimated_effort_days, spring_boot_2_detected (true|false|null —
   null=undetermined, never assumed true), spring_boot_version_detected,

sourcecode/mcp/server.py

@@ -517,7 +517,7 @@ def run_migrate_flow(repo_path: str = ".", min_severity: str = "low") -> dict:
     Primary high-value entry point for migration planning. Wraps migrate-check and
     lifts the headline numbers to the top level so the agent can plan a 2→3 upgrade
     without parsing the full report:
-      - readiness_score (0–100; 100 = ready), blocking_count, estimated_effort_days
+      - readiness_score (0–100, or null=N/A when no migration target applies; 100 = ready), blocking_count, estimated_effort_days
       - by_severity and by_target breakdown (jakarta / spring_security_6 / java_11)
 
     Use this instead of calling get_migration_readiness and interpreting it by hand.
@@ -788,10 +788,10 @@ def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") ->
     When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
     or upgrading from Spring Boot 2.x to 3.x. Call this BEFORE get_spring_audit when
     the goal is migration planning — not ongoing audit.
-    Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+    Do NOT call on non-Java repositories — returns readiness_score=null (N/A) with no findings.
 
     Maps to: sourcecode migrate-check <repo_path> --min-severity <min_severity>
-    Returns: MigrationReport with schema_version, readiness_score (0–100; 100=ready to migrate),
+    Returns: MigrationReport with schema_version, readiness_score (0–100, or null=N/A when no migration target applies; 100=ready to migrate),
              jakarta_readiness / boot3_readiness / jdk_modernization / hibernate_readiness
              (per-dimension 0–100), headline_blocker (e.g. "hibernate_rewrite" or null),
              hibernate (Hibernate 5→6 stratified model: 4-layer risk_matrix, rewrite_targets[]
@@ -1335,7 +1335,7 @@ def modernize_context(repo_path: str = ".", format: str = "json") -> dict:
     """Analyzes codebase for modernization opportunities: dead zones, hotspot scores, upgrade candidates.
 
     Maps to: sourcecode modernize <repo_path>
-    Returns: hotspot_candidates (high fan-in + git churn), dead_zone_candidates (isolated classes),
+    Returns: hotspot_candidates (high fan-in + git churn), statically_unreferenced (zero-caller classes — NOT confirmed dead; verify no framework dispatch) + framework_dispatched,
              high_coupling_nodes, subsystem_summary, cross_module_tangles, recommendation.
 
     Best for: refactor planning, identifying where to start, finding safe removal candidates.

sourcecode/migrate_check.py

@@ -608,29 +608,79 @@ def _classify_code_context(finding: "MigrationFinding") -> str:
     return "main"
 
 
-# BUG #2: Spring presence signal. The Boot3 dimension only applies to repos that
-# actually use Spring — a Quarkus/Micronaut/Helidon/Jakarta-pure repo has no
-# Spring Boot 2→3 axis. Detected from build coordinates or framework imports.
-_SPRING_BUILD_RE: re.Pattern = re.compile(
-    r"org\.springframework(?:\.boot)?\b|spring-boot-starter", re.IGNORECASE
+# BUG #1/#2: Spring presence must be SCOPE- and ARTIFACT-aware. The Boot 2→3 axis
+# only applies to repos that use Spring AT RUNTIME — a Quarkus/Micronaut/Jakarta-pure
+# repo (or one like Apache OFBiz whose ONLY Spring coordinate is spring-test, a TEST
+# support library declared under a legacy `compile` block) has no Spring Boot axis.
+# We therefore split Spring usage into runtime vs test-only and NEVER let a test
+# artifact poison spring_present (which gates the boot3 readiness dimension).
+
+# Test-only Spring artifacts: their presence — even when declared in a compile/
+# implementation block — never implies Spring at runtime. The ARTIFACT itself is a
+# test library, regardless of the declared scope.
+_SPRING_TEST_ARTIFACT_RE: re.Pattern = re.compile(
+    r"\bspring-(?:test|boot-test(?:-autoconfigure)?|boot-starter-test|security-test)\b",
+    re.IGNORECASE,
 )
+# Any `spring-<artifact>` coordinate token (matches both Gradle `org.springframework:
+# spring-core:…` strings and Maven `<artifactId>spring-core</artifactId>` text).
+_SPRING_ARTIFACT_TOKEN_RE: re.Pattern = re.compile(
+    r"\bspring-[a-z][a-z0-9]*(?:-[a-z0-9]+)*\b", re.IGNORECASE
+)
+# Spring Boot Gradle plugin / BOM group — an unambiguous runtime signal.
+_SPRING_BOOT_PLUGIN_RE: re.Pattern = re.compile(
+    r"""(?:id\s*['"]\s*org\.springframework\.boot|"""
+    r"""org\.springframework\.boot\s*[:'"])""",
+    re.IGNORECASE,
+)
+# Import-side split: a Spring import in a TEST package (org.springframework.*.test
+# or org.springframework.test / .boot.test) is a test-only signal; any other
+# org.springframework import in MAIN sources is a runtime signal.
 _SPRING_IMPORT_RE: re.Pattern = re.compile(
-    r"^[ \t]*import\s+org\.springframework\.", re.MULTILINE
+    r"^[ \t]*import\s+(?:static\s+)?org\.springframework\.([\w.]+)", re.MULTILINE
 )
 
 
-def _detect_spring_present(root: Path, spring_import_seen: bool) -> bool:
-    """True when Spring is actually used (build coordinate or org.springframework import)."""
-    if spring_import_seen:
-        return True
+def _build_text_spring_signals(text: str) -> tuple[bool, bool]:
+    """(runtime, any_spring) for one build-file's text — artifact/scope aware.
+
+    A `spring-*` artifact token that is not a test library, or the Spring Boot
+    plugin/BOM group, counts as runtime. spring-test (and friends) alone count as
+    "spring present but test-only" — never runtime.
+    """
+    runtime = False
+    any_spring = False
+    if _SPRING_BOOT_PLUGIN_RE.search(text):
+        runtime = True
+        any_spring = True
+    for m in _SPRING_ARTIFACT_TOKEN_RE.finditer(text):
+        any_spring = True
+        if not _SPRING_TEST_ARTIFACT_RE.match(m.group(0)):
+            runtime = True
+    return runtime, any_spring
+
+
+def _detect_spring_usage(
+    root: Path, runtime_import_seen: bool, test_import_seen: bool
+) -> tuple[bool, bool]:
+    """Return (runtime_present, test_only).
+
+    runtime_present  — Spring is on the runtime/compile path (build coordinate or a
+                       MAIN-source org.springframework import that is not a test pkg).
+    test_only        — Spring appears ONLY as a test dependency (e.g. spring-test);
+                       the Boot 2→3 migration axis is N/A.
+    """
+    runtime = runtime_import_seen
+    any_spring = runtime_import_seen or test_import_seen
     for abs_path, _rel in _find_build_files(root):
         try:
             text = abs_path.read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
-        if _SPRING_BUILD_RE.search(text):
-            return True
-    return False
+        r, s = _build_text_spring_signals(text)
+        runtime = runtime or r
+        any_spring = any_spring or s
+    return runtime, (any_spring and not runtime)
 
 # G-1: cap on total readiness deduction from low-severity (advisory, non-blocking)
 # findings, so optional modernization cleanups cannot collapse the migration-readiness
@@ -1165,7 +1215,9 @@ class MigrationReport:
     repo_id: str = ""
     git_head: str = ""
 
-    readiness_score: int = 100
+    # Optional[int]: None == N/A (no applicable migration dimension), never a
+    # manufactured 100 on a repo with nothing to migrate.
+    readiness_score: Optional[int] = 100
     # Per-dimension readiness (0-100). javax→jakarta namespace, full Boot 2→3
     # migration, and orthogonal JDK modernization are scored independently so
     # JDK debt (java.util.Date, reflection) does not sink a jakarta-ready repo.
@@ -1192,8 +1244,16 @@ class MigrationReport:
     # None = could not determine. Absence of evidence is never reported as True.
     spring_boot_2_detected: Optional[bool] = None
     spring_boot_version_detected: Optional[str] = None
-    # BUG #2: whether Spring is used at all. The Boot3 dimension is N/A without it.
+    # BUG #2: whether Spring is used AT RUNTIME. The Boot3 dimension is N/A without it.
     spring_present: bool = True
+    # BUG #1/#2: Spring appears ONLY as a test dependency (e.g. spring-test). Reported
+    # so a consumer can see WHY boot3 is N/A despite an org.springframework coordinate.
+    spring_test_only: bool = False
+    # BUG #3/#4: the repo imports the jakarta.* namespace (already on Jakarta EE 9+).
+    # Evidence that the namespace axis is RELEVANT (and complete) — distinguishes an
+    # already-migrated Jakarta repo (jakarta applicable, 100) from a repo that was
+    # never Java EE at all (jakarta N/A).
+    jakarta_namespace_adopted: bool = False
     # BUG #6 / #8: findings that do NOT count toward blocking_count or readiness —
     # best-practice hygiene (java.util.Date…) and test/fixture/generated buckets,
     # surfaced separately so the headline reflects real product migration risk.
@@ -1261,6 +1321,16 @@ class MigrationReport:
         if not self.spring_present:
             self.boot3_readiness = 100
 
+        # BUG #3/#4: the jakarta dimension is applicable ONLY with POSITIVE evidence the
+        # namespace axis is relevant — either migratable javax.* code (a javax→jakarta
+        # finding, axis in-progress) OR the jakarta.* namespace already adopted (axis
+        # complete → 100). A repo with neither was never Java EE: jakarta is N/A, never a
+        # manufactured 100 folded into the headline.
+        _jakarta_applies = (
+            any(f.migration_target in _JAKARTA_TARGETS for f in main_findings)
+            or self.jakarta_namespace_adopted
+        )
+
         # ── BUG #2: Hibernate applicability — version-driven, never heuristic ────
         # The 5→6 axis is applicable ONLY when the repo is actually on Hibernate < 6.
         #   resolved < 6        → applicable (rewrite score is a measurement)
@@ -1316,14 +1386,22 @@ class MigrationReport:
         # cannot sink a framework-complete repo. N/A dimensions carry score=None and
         # never enter the aggregate.
         self.applicable_dimensions = {
-            "jakarta": {"applicable": True, "score": self.jakarta_readiness,
-                        "reason": "javax→jakarta namespace migration"},
+            "jakarta": {
+                "applicable": _jakarta_applies,
+                "score": self.jakarta_readiness if _jakarta_applies else None,
+                "reason": ("javax→jakarta namespace migration"
+                           if _jakarta_applies
+                           else "N/A — no migratable javax.* imports detected"),
+            },
             "boot3": {
                 "applicable": self.spring_present,
                 "score": self.boot3_readiness if self.spring_present else None,
                 "reason": ("Spring Boot 2→3 / Security 6 migration"
                            if self.spring_present
-                           else "N/A — no Spring usage detected (non-Spring stack)"),
+                           else ("N/A — Spring present only as a TEST dependency "
+                                 "(spring-test); no runtime Spring"
+                                 if self.spring_test_only
+                                 else "N/A — no Spring usage detected (non-Spring stack)")),
             },
             "jdk_modernization": {"applicable": True, "score": self.jdk_modernization,
                                   "reason": "orthogonal JDK modernization debt (excluded from "
@@ -1347,14 +1425,22 @@ class MigrationReport:
             for name in _MIGRATION_DIMENSIONS
             if self.applicable_dimensions[name]["applicable"]
         }
-        self.readiness_score = min(agg_inputs.values()) if agg_inputs else 100
+        # BUG #4: when NO migration dimension applies (non-Spring repo, no migratable
+        # javax.*, no Hibernate 5), readiness is N/A (None) — NOT a manufactured 100.
+        # Absence of a migration target is "not applicable", never "100% ready".
+        self.readiness_score = min(agg_inputs.values()) if agg_inputs else None
         self.readiness_aggregate = {
             "method": "min",
             "inputs": agg_inputs,
             "excluded": ["jdk_modernization"],
+            "applicable": bool(agg_inputs),
             "note": ("readiness_score = min over applicable migration dimensions "
                      "(jakarta / boot3 / hibernate). jdk_modernization is an orthogonal "
-                     "upkeep axis and is intentionally excluded."),
+                     "upkeep axis and is intentionally excluded."
+                     if agg_inputs else
+                     "N/A — no migration target detected (no migratable javax.*, no "
+                     "runtime Spring, no Hibernate 5). JDK-modernization findings, if "
+                     "any, are reported on their own axis."),
         }
         # Internal consistency guard — the headline cannot diverge from the dimensions
         # it claims to summarize (catches a future scorer change that breaks the model).
@@ -1431,6 +1517,7 @@ class MigrationReport:
             "hygiene_findings": self.hygiene_findings,
             "non_blocking": self.non_blocking,
             "spring_present": self.spring_present,
+            "spring_test_only": self.spring_test_only,
             "spring_boot_2_detected": self.spring_boot_2_detected,
             "spring_boot_version_detected": self.spring_boot_version_detected,
             "summary": self.summary,
@@ -1464,8 +1551,10 @@ class MigrationReport:
         main_high = sum(1 for f in self.findings
                         if f.code_context == "main" and f.severity == "high")
         nb = self.non_blocking.get("count", 0)
+        _headline = (f"{self.readiness_score}/100" if self.readiness_score is not None
+                     else "N/A (no migration target detected)")
         lines: list[str] = [
-            f"Migration Readiness: {self.readiness_score}/100",
+            f"Migration Readiness: {_headline}",
             f"  {_dim('jakarta')}  {_dim('boot3')}  "
             f"{_dim('jdk_modernization')}  {_dim('hibernate')}",
             *([f"  ⚠ Headline blocker: {self.headline_blocker} "
@@ -1542,6 +1631,53 @@ def _refine_mig006(matched_imports: list[str]) -> tuple[str, str]:
     )
 
 
+# ---------------------------------------------------------------------------
+# BUG #3 (v1.68.0): framework-gated narrative.
+# MIG-* explanations are written assuming a Spring Boot 2→3 upgrade because that is
+# the overwhelmingly common Jakarta-migration context. On a repo where the tool has
+# already determined spring_present=False (plain Jakarta EE, JAX-RS/Jersey, Quarkus,
+# Guice, ...), the underlying javax→jakarta finding is still valid, but prose that
+# says "Spring Boot 3 requires ..." is factually wrong for that repo and misleads any
+# reader who trusts the narrative over the structured spring_present field.
+#
+# Treat the narrative as a pure function of the structured data: when spring_present
+# is False, rewrite Spring-specific framing into framework-neutral Jakarta-EE /
+# servlet-container framing. Ordered phrase map first (keeps nice sentences for the
+# common phrasings), then a catch-all so no "Spring Boot" string can survive.
+# ---------------------------------------------------------------------------
+_NON_SPRING_EXPLANATION_SUBS: tuple[tuple[str, str], ...] = (
+    ("Spring Boot 3 bundles Jakarta Servlet 6.0.",
+     "Modern servlet containers (Jetty 12+, Tomcat 11+) require Jakarta Servlet 6.0."),
+    ("Spring Boot 3 requires Jakarta Servlet 5.0+",
+     "Jakarta EE 9+ servlet containers require Jakarta Servlet 5.0+"),
+    ("Spring Boot 3 uses Jakarta EE 9 which moved",
+     "Jakarta EE 9 moved"),
+    ("Spring Boot 3 uses Hibernate Validator 8.x which implements jakarta.validation.",
+     "Jakarta EE 9+ uses Hibernate Validator 8.x which implements jakarta.validation."),
+    ("Spring Boot 3 depends on Jakarta Transactions (jakarta.transaction).",
+     "Jakarta EE 9+ uses Jakarta Transactions (jakarta.transaction)."),
+    ("Spring Boot 3 requires Hibernate 6",
+     "Jakarta Persistence (JPA 3.x) requires Hibernate 6"),
+    ("Spring Boot 3 cache abstraction. Spring Boot 3 requires EhCache 3.x",
+     "Jakarta-EE cache abstraction. The modern JCache provider requires EhCache 3.x"),
+    # Catch-all: any remaining Spring-Boot framing → generic Jakarta EE 9+.
+    ("Spring Boot 3", "Jakarta EE 9+"),
+    ("Spring Boot 2", "the pre-Jakarta (javax) baseline"),
+)
+
+
+def _neutralize_non_spring_explanation(text: str) -> str:
+    """Rewrite Spring-specific migration prose into framework-neutral Jakarta framing.
+
+    Applied only when the report's spring_present is False. Deterministic phrase
+    substitution — no model, no guess. Guarantees the returned text contains no
+    "Spring Boot" framing that the structured data does not support.
+    """
+    for needle, repl in _NON_SPRING_EXPLANATION_SUBS:
+        text = text.replace(needle, repl)
+    return text
+
+
 def _scan_file(
     source: str,
     rel_path: str,
@@ -1643,7 +1779,12 @@ def run_migrate_check(
     limitations: list[str] = []
     read_errors = 0
     jakarta_import_count = 0
-    spring_import_seen = False
+    # BUG #1/#2: split Spring imports into runtime vs test. A test-tree file, or a
+    # test-only Spring package (org.springframework.test / .boot.test), is a
+    # test-only signal and must NOT mark the repo as runtime-Spring.
+    spring_runtime_import_seen = False
+    spring_test_import_seen = False
+    from sourcecode.path_filters import is_test_path as _is_test_path
 
     # ── Java source scan ────────────────────────────────────────────────────
     for rel_path in file_paths:
@@ -1656,8 +1797,14 @@ def run_migrate_check(
 
         # Jakarta EE 9+ namespace adoption signal (vetoes a false Boot-2 verdict).
         jakarta_import_count += len(_JAKARTA_IMPORT_RE.findall(source))
-        if not spring_import_seen and _SPRING_IMPORT_RE.search(source):
-            spring_import_seen = True
+        _in_test = _is_test_path(rel_path)
+        for _m in _SPRING_IMPORT_RE.finditer(source):
+            _sub = _m.group(1)
+            _is_test_pkg = _sub.startswith(("test.", "boot.test.")) or _sub in ("test", "boot.test")
+            if _in_test or _is_test_pkg:
+                spring_test_import_seen = True
+            else:
+                spring_runtime_import_seen = True
 
         file_findings = _scan_file(source, rel_path, _ALL_RULES)
         filtered = [f for f in file_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
@@ -1713,13 +1860,24 @@ def run_migrate_check(
     limitations.extend(_STATIC_LIMITATIONS)
 
     spring_boot_2, spring_boot_version = _detect_spring_boot(root, jakarta_import_count)
-    spring_present = _detect_spring_present(root, spring_import_seen)
+    spring_present, spring_test_only = _detect_spring_usage(
+        root, spring_runtime_import_seen, spring_test_import_seen
+    )
 
     # BUG #8: classify each finding's code context (main / test / generated) so the
     # report can keep test fixtures and autogenerated sources out of blocking_count.
     for f in all_findings:
         f.code_context = _classify_code_context(f)
 
+    # BUG #3 (v1.68.0): on a non-Spring repo, rewrite Spring-Boot-specific framing in
+    # every finding's explanation into framework-neutral Jakarta-EE framing. The
+    # finding itself (javax→jakarta) stays; only the prose is corrected so it matches
+    # the structured spring_present=False signal in the same report.
+    if not spring_present:
+        for f in all_findings:
+            if f.explanation:
+                f.explanation = _neutralize_non_spring_explanation(f.explanation)
+
     # Hibernate 5→6 stratification (independent of min_severity — it is its own
     # risk model, not a severity-filtered finding stream).
     from sourcecode.hibernate_strat import analyze_hibernate
@@ -1729,6 +1887,8 @@ def run_migrate_check(
         spring_boot_2_detected=spring_boot_2,
         spring_boot_version_detected=spring_boot_version,
         spring_present=spring_present,
+        spring_test_only=spring_test_only,
+        jakarta_namespace_adopted=jakarta_import_count > 0,
         findings=all_findings,
         hibernate=hibernate_strat,
         limitations=limitations,

sourcecode/path_filters.py

@@ -154,5 +154,36 @@ def is_vendor_path(path: str) -> bool:
         for part in dir_parts:
             if part in _LIB_SEGMENTS:
                 return True
+        # Vendored web libraries shipped into a theme/webapp by file name, e.g.
+        # jquery-3.5.1.js, jquery-migrate-1.2.1.js, bootstrap.bundle.js. These carry
+        # third-party comments (jQuery's own "BUG:" notes) that must not be reported
+        # as the project's own code notes.
+        if _is_vendored_web_lib(filename) or any(part in _VENDOR_WEB_LIB_DIRS for part in dir_parts):
+            return True
+
+    return False
+
 
+# Stems of common vendored JS/CSS libraries. A web-asset file whose name starts with
+# one of these (optionally followed by a version/qualifier) is third-party, not the
+# project's own source — wherever it physically sits in the tree.
+_VENDOR_WEB_LIB_STEMS: tuple[str, ...] = (
+    "jquery", "bootstrap", "angular", "react", "vue", "svelte", "ember",
+    "lodash", "underscore", "moment", "d3", "three", "chart", "popper",
+    "modernizr", "select2", "datatables", "ckeditor", "tinymce", "fontawesome",
+    "font-awesome", "backbone", "knockout", "prototype", "scriptaculous",
+    "highcharts", "leaflet", "axios", "polyfill", "babel", "require", "requirejs",
+    "handlebars", "mustache", "dojo", "extjs", "swiper", "slick", "fullcalendar",
+)
+# Directory names that hold only vendored web assets.
+_VENDOR_WEB_LIB_DIRS: frozenset[str] = frozenset({"jquery", "bootstrap", "webjars"})
+
+
+def _is_vendored_web_lib(filename: str) -> bool:
+    base = filename.lower()
+    for stem in _VENDOR_WEB_LIB_STEMS:
+        s = stem.strip()
+        # match "jquery.js", "jquery-3.5.1.js", "jquery.min.js", "jquery-ui.js"
+        if base == f"{s}.js" or base == f"{s}.css" or base.startswith((f"{s}-", f"{s}.")):
+            return True
     return False

sourcecode/repository_ir.py

@@ -20,7 +20,7 @@ import subprocess
 from collections import deque
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Iterable, Optional
 
 from sourcecode.fqn_utils import normalize_owner_fqn as _normalize_owner_fqn
 from sourcecode.path_filters import is_test_path as _is_test_path
@@ -4700,9 +4700,16 @@ def compute_blast_radius(
         )
         if is_mapper and fqn not in _seen_mapper_fqns:
             _seen_mapper_fqns.add(fqn)
+            # BUG #5 (v1.68.0): distinguish a CONFIRMED persistence mapper (a
+            # @Repository/DAO role or a MyBatis @Mapper interface) from a class that
+            # only matched the name pattern (e.g. AzToRegionMapper — an AWS topology
+            # mapper with no data layer). Only confirmed entries may be described as
+            # "persistence" in the narrative.
+            _is_persistence = role in _MAPPER_ROLES or symbol_kind == "mapper_interface"
             _mapper_entry: dict = {
                 "fqn": fqn,
                 "role": role or ("mapper" if symbol_kind == "mapper_interface" else "repository"),
+                "mapper_kind": "persistence" if _is_persistence else "name_heuristic",
                 "source_file": node_dict.get("source_file") or "",
             }
             if canonical != fqn:
@@ -4841,18 +4848,33 @@ def compute_blast_radius(
         _parts.append(f"{n_ep} endpoint{'s' if n_ep != 1 else ''} exposed")
     if n_txn:
         _parts.append(f"{n_txn} transactional boundary{'s' if n_txn != 1 else ''} touched")
-    if n_mappers:
-        _parts.append(f"{n_mappers} persistence path{'s' if n_mappers != 1 else ''} in blast cone")
+    # BUG #5 (v1.68.0): only confirmed persistence mappers earn the word "persistence".
+    # Name-heuristic matches (e.g. *Mapper utility classes with no data layer) are
+    # surfaced as neutral "data-mapping class(es)" so the prose never invents a
+    # persistence tier the repo does not have.
+    _n_persist = sum(1 for m in mappers_affected if m.get("mapper_kind") == "persistence")
+    _n_heur = n_mappers - _n_persist
+    if _n_persist:
+        _parts.append(f"{_n_persist} persistence path{'s' if _n_persist != 1 else ''} in blast cone")
+    if _n_heur:
+        _parts.append(f"{_n_heur} data-mapping class{'es' if _n_heur != 1 else ''} in blast cone")
     if n_sec:
         _parts.append(f"{n_sec} security-gated endpoint{'s' if n_sec != 1 else ''} affected")
     if n_modules > 1:
         _parts.append(f"impact crosses {n_modules} modules")
 
+    # BUG #4 (v1.68.0): derive the DI-framework label ONCE from caller evidence and
+    # reuse it for both the short explanation and the long via_interface_note, so the
+    # two never disagree (the old code hardcoded "Spring/CDI" in one and "Spring/CDI/
+    # Guice" in the other). When the actual framework is identifiable from the caller
+    # FQNs (e.g. *.guice.* packages on a Guice repo), name it specifically instead of
+    # a generic guess.
+    _di_label = _detect_di_framework_label(direct_callers)
     if _iface_bridging:
         _iface_names = [b["interface"].split(".")[-1] for b in _iface_bridging]
         _parts.append(
             f"callers resolved via interface{'s' if len(_iface_names) > 1 else ''} "
-            f"({', '.join(_iface_names)}) — Spring/CDI DI pattern"
+            f"({', '.join(_iface_names)}) — {_di_label} DI pattern"
         )
 
     # Transparency: hub-class BFS truncation must appear in explanation so the
@@ -4924,9 +4946,9 @@ def compute_blast_radius(
     if _iface_bridging:
         out["via_interface_resolution"] = _iface_bridging
         out["via_interface_note"] = (
-            "Target is a concrete class injected via interface(s) in DI frameworks "
-            "(Spring/CDI/Guice). direct_callers includes callers of the implemented "
-            "interface(s) — these are the real production dependents."
+            "Target is a concrete class injected via interface(s) in a "
+            f"{_di_label} DI framework. direct_callers includes callers of the "
+            "implemented interface(s) — these are the real production dependents."
         )
     if _bfs_truncated:
         out["bfs_truncation_reason"] = "hub_class_depth_cap"
@@ -5106,3 +5128,31 @@ def _all_callers_from_rg(fqn: str, reverse_graph: dict[str, dict[str, list[str]]
 def _simple_name(fqn: str) -> str:
     """Extract the simple class name from a fully-qualified name."""
     return fqn.split(".")[-1].split("#")[0]
+
+
+def _detect_di_framework_label(caller_fqns: "Iterable[str]") -> str:
+    """Name the DI framework(s) evidenced by the caller FQNs (BUG #4, v1.68.0).
+
+    Returns a "/"-joined label of the frameworks actually identifiable from the
+    callers' package names (e.g. "Guice" when callers live under a ``*.guice.*``
+    package, "Spring" under ``org.springframework``). When nothing is identifiable
+    the label degrades to the generic "Spring/CDI/Guice" rather than asserting a
+    framework the evidence does not support. The same label feeds both the short
+    explanation and the long via_interface_note so they cannot disagree.
+    """
+    frameworks: set[str] = set()
+    for fqn in caller_fqns:
+        low = fqn.lower()
+        if "guice" in low or "com.google.inject" in low:
+            frameworks.add("Guice")
+        if "springframework" in low or ".spring." in low:
+            frameworks.add("Spring")
+        if "jakarta.enterprise" in low or "javax.enterprise" in low or ".cdi." in low:
+            frameworks.add("CDI")
+        if "micronaut" in low:
+            frameworks.add("Micronaut")
+        if "dagger" in low:
+            frameworks.add("Dagger")
+    if frameworks:
+        return "/".join(sorted(frameworks))
+    return "Spring/CDI/Guice"

sourcecode/summarizer.py

@@ -296,7 +296,7 @@ class ProjectSummarizer:
     _TYPE_LABELS: dict[str, str] = {
         "cli": "CLI",
         "api": "API",
-        "web_mvc": "Spring MVC web app",
+        "web_mvc": "Server-side MVC web app",
         "webapp": "Web application",
         "library": "Library",
         "monorepo": "Monorepo",

{sourcecode-1.66.0.dist-info → sourcecode-1.68.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.66.0
+Version: 1.68.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.66.0.dist-info → sourcecode-1.68.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=_rKEwisXr1IeFjMbYXGSfdRcelQmOHaAB0XR84P9tsk,103
+sourcecode/__init__.py,sha256=gp3XLYiUZaatdehs90NAezSd-3vDxmo0g-OIVUqEBmg,103
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=liCwQmLgb5vplohy8arjYxs_HOIv5C9MjLh_gY6bc5Q,44115
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -7,15 +7,15 @@ sourcecode/cache.py,sha256=1V3vsaODAa2UBJAC0xpvxpmRdriCezQx5Q8JCcfgziE,31892
 sourcecode/canonical_ir.py,sha256=DEwucOPJguLsVtg5cV8mWXNi112l5jmBhv73KGGebVk,24849
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=hKzg-nQ47htqqIUzSGvYxv15cXrA3KgICTwJmdqal0o,8095
-sourcecode/cli.py,sha256=PwLLelj1ACLkWQBCEThD6vhn4sGMn5kEg-6gRX1IAb8,276536
+sourcecode/cli.py,sha256=VqAiGRauTO-s8yBJh2JMldha3VKx0jTXC0tOvRpWQkI,283297
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
-sourcecode/context_summarizer.py,sha256=zlbm8ytdvJToohU108-dwBmEl52xl0gXpf6PZBOW_2A,6540
+sourcecode/context_summarizer.py,sha256=cI2TZMvEhl0BEma12VtPaX6z03ZVBAetVzuK5GaCOvg,6852
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=bNn9SYtwfI1CGKlYGxewexlp7_IWhpwSCae-BMuuVwQ,28895
 sourcecode/coverage_parser.py,sha256=q0LeZJaX1bnntLu-ImksdBsMlpsVmk_iUfSaB4eaJGo,19702
-sourcecode/dependency_analyzer.py,sha256=qEnRiKFkleZJyLf_DyznJbWD1GJ881iG4RRDqH9oGQ4,61524
+sourcecode/dependency_analyzer.py,sha256=fQCaWQ7_BNcVgZv8gweJCwJ1CGlXsz8nw_tqN3aHJNE,63952
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=aNTyYgQk5noJDfJU6FmasmESOHfiomyJw5EvZqjy6qc,22213
@@ -29,14 +29,14 @@ sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
 sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,62403
 sourcecode/hibernate_strat.py,sha256=ZyI0sikxh7IemU8uqn1Z73z-tHeFeCJuYhJnyQL8pzU,57765
-sourcecode/integration_detector.py,sha256=mQulsXN1P-4V_3ueh3xy_N9x3Aqlvm7GQ-3YGqlBEYM,8223
+sourcecode/integration_detector.py,sha256=ygZwXHJXJ4QM6oiqKb5S6WIfElByDYdz9moyuFlZpYI,12997
 sourcecode/license.py,sha256=wckiLuiwaE35KMCStUf1gYzleJuFe6qsSyxUQJvit3s,23500
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=daZLA7KaeoWoUPSMN8cYqHYD6HBflzc-z_N4bCGVPak,82993
+sourcecode/migrate_check.py,sha256=Z0AZhWuZWfGuG3dsQugJn92FRpId5-SFAoyMc1RBZHk,91908
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
-sourcecode/path_filters.py,sha256=DMea0KIlmj2pzTkuy-3YYFF4ktP0q5zP9mH4v4uXh84,5237
+sourcecode/path_filters.py,sha256=VnaD9jxZVNzluackNSTCdIddwzAqIseuSCs_A-gpCDM,6898
 sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrfjz2o,14423
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
 sourcecode/prepare_context.py,sha256=PsRaKeABMh964niCS578WRgcccW9bajnm2yHS9zcKuM,222655
@@ -46,7 +46,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=iwSE9JewlBkLuAFNDF5GgBPMKXPvf_hAxnLQrgeQX9Y,222027
+sourcecode/repository_ir.py,sha256=Blo4rTCkY7EppwunxqlvI-1b9wU3EPLuHlZik3Ksz7c,224908
 sourcecode/ris.py,sha256=RcqLVwC-doFcKKViYDkCjZLBqf_wzLES7-F6vHEeWzE,20419
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -61,7 +61,7 @@ sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16
 sourcecode/spring_security_audit.py,sha256=XtPJ1SXlZJ8k6VYmaWuAp7Bbir4UmreAL7doIGQ5I7o,20595
 sourcecode/spring_semantic.py,sha256=O1nKSGVzlukuxLHQVuCPxc-XrcrMFxwlHA20_dmEGgM,13307
 sourcecode/spring_tx_analyzer.py,sha256=FdFcyqPp3aT9oJ-PKrnXcTA6s69wdvzG-NBm0GMGPTU,30717
-sourcecode/summarizer.py,sha256=zgdps7yS2IktAbWe7IWz0oUcr3QIuNPRGrsScbZ4R1g,21797
+sourcecode/summarizer.py,sha256=hV-kPFXXh15GnIvmLZnmVWTEbmr35C-yKVtPiR25U2g,21802
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/validation_surface.py,sha256=2Ojfzhw9R4XpemAFqb9RXf4FKyI3DYjGo4Dp0AHZMQo,22600
 sourcecode/version_check.py,sha256=CHp6ZxTIfo8kyHPCBgJA1uFC0xQCoXMuuOfrW8QTL8o,4942
@@ -88,10 +88,10 @@ sourcecode/detectors/systems.py,sha256=nYaKbGDFu0EOXFcd_1doWFT3tTUdkbxc2DjHUF5Tc
 sourcecode/detectors/terraform.py,sha256=cxORPR_zVLOJpHlh4e9JnFpkQsn_UnqMMom5yG65hZ4,1693
 sourcecode/detectors/tooling.py,sha256=8CKbtxwQoABP-WyBRNmdAmHDOvAH57AR1cF4UKuWEdQ,2074
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
-sourcecode/mcp/orchestrator.py,sha256=kT7IssYNyQXVtDf2Q69qrMSTuyJlJ1Rhkp6_EHqc_38,36520
-sourcecode/mcp/registry.py,sha256=8ot8A9_ccPNUvHgFkUO8lIlbp4XT_UcHR101nc71Gjc,65840
+sourcecode/mcp/orchestrator.py,sha256=diVoQgn24QmgPL3Ev8Sp6hsvh02OqY3MktHXOzrlodo,36525
+sourcecode/mcp/registry.py,sha256=jLCUG7-m53Fbxqjzpt_OWu6NUp7b46S2ixTDixsTRyo,65975
 sourcecode/mcp/runner.py,sha256=-Dp2qPGRkfNTVen6bKh7WtzQqpcEtsrXoiuajvshlKk,2866
-sourcecode/mcp/server.py,sha256=DV7aiUObBGekShSDc7Iu67ISdesByutto3JOFbcYBFk,63693
+sourcecode/mcp/server.py,sha256=1jwMR0OwJcLi1GoAKT300RSQAhfd_nYLrvABG7s0pUU,63874
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=B9CneieWTpaDSDIyW3S5nrlRlBpvfqUcgi93-mm_ApQ,2135
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -103,8 +103,8 @@ sourcecode/telemetry/consent.py,sha256=H5z2Wu63pZqbaKucRPoJQJ0zCo4cke9ZlBrJC-MaW
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-1.66.0.dist-info/METADATA,sha256=PVY4maYclqHt2AKj_bcGmDzF7xmKhD0i7k2MrQepPKo,47341
-sourcecode-1.66.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.66.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.66.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.66.0.dist-info/RECORD,,
+sourcecode-1.68.0.dist-info/METADATA,sha256=_4nRHRSnFFBpmv9OJqSFf30pGcWo7XpOC0gyAJgoT4c,47341
+sourcecode-1.68.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.68.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.68.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.68.0.dist-info/RECORD,,