sourcecode 1.66.0__tar.gz → 1.68.0__tar.gz

{sourcecode-1.66.0 → sourcecode-1.68.0}/.gitignore

@@ -36,4 +36,6 @@ Thumbs.db
 .planning
 
 # Supabase local temp
-supabase/.temp/
+supabase/.temp/
+# Internal agent playbook (not distributed)
+docs/PLAYBOOK_V2.md

{sourcecode-1.66.0 → sourcecode-1.68.0}/CHANGELOG.md

@@ -1,5 +1,99 @@
 # Changelog
 
+## [1.68.0] — 2026-06-30
+
+### Fixed — narrative/structured-data parity on non-Spring DI repos (Netflix Eureka field test)
+
+A real audit of **Netflix Eureka** (Gradle multi-module, JAX-RS/Jersey 1.x + Google
+Guice, **no Spring, no Hibernate, no persistence layer**) surfaced six reliability
+defects that share one root cause: **prose that assumed a Spring/Hibernate/persistence
+context even though the same JSON's own structured fields already knew it did not
+apply.** A consumer trusting the narrative over the structured fields would have read
+false conclusions. Guiding principle applied throughout: **a narrative term (Spring,
+Guice, persistence, …) may only appear when the corresponding structured signal
+confirms it.** New regression coverage across four suites.
+
+- **SMTP false positive on a log string (BUG #1).** `export --integrations` reported
+  `kind=smtp` for `logger.warn("Transport initialization failure", e)` — the bare word
+  "Transport" in a log literal. The detector now (a) skips any token matched inside a
+  string literal and (b) gates the JavaMail tokens (`Transport`, `MimeMessage`) on a
+  `javax.mail`/`jakarta.mail`/`org.springframework.mail` import. Eureka SMTP hits 3 → 0.
+- **JNDI DNS mislabeled as LDAP (BUG #2).** `javax.naming.directory.{Dir,Initial}Context`
+  is protocol-agnostic; it is now classified by its `INITIAL_CONTEXT_FACTORY` —
+  `DnsContextFactory` → `kind=dns` (`client=jndi-dns`), `LdapCtxFactory` → `ldap`, and an
+  unresolvable factory → `kind=naming-directory-unknown` with `confidence=low`, never an
+  assumed LDAP. Eureka `DnsResolver` now reports `dns`.
+- **"Spring Boot 3" narrative on a non-Spring repo (BUG #3).** When `spring_present` is
+  `False`, every `migrate-check` finding's `explanation` is rewritten from Spring-Boot
+  framing into framework-neutral Jakarta-EE / servlet-container framing (the javax→jakarta
+  finding itself is unchanged). Guarantee: no explanation contains "Spring Boot" unless
+  the report confirms runtime Spring.
+- **Inconsistent DI-framework label (BUG #4).** `impact` emitted "Spring/CDI DI pattern"
+  in the short `explanation` but "Spring/CDI/Guice" in `via_interface_note` of the *same*
+  JSON, while `direct_callers` proved the framework was Guice. Both strings now derive
+  from one label computed from caller evidence — a `*.guice.*` caller yields "Guice".
+- **"persistence paths" for non-persistence mappers (BUG #5).** Eureka's `AzToRegionMapper`
+  classes (AWS topology, no data layer) were counted as "4 persistence paths". Each
+  `mappers_affected` entry now carries `mapper_kind` (`persistence` only for a confirmed
+  `@Repository` role or MyBatis `mapper_interface`; otherwise `name_heuristic`). The
+  explanation says "persistence path" only for confirmed entries and neutral
+  "data-mapping class" otherwise — the word "persistence" never appears for a repo with no
+  confirmed persistence signal.
+- **Ambiguous `member_count` unit in `modernize` (BUG #6).** `subsystem_summary.member_count`
+  counts all graph members (classes + methods + fields), ~5× the class count and not
+  comparable to repo-level `total_classes`. Each entry now also carries an unambiguous
+  `class_count` (class/interface declarations only, comparable to `total_classes`), with a
+  `subsystem_summary_note` documenting both units.
+
+## [1.67.0] — 2026-06-30
+
+### Fixed — framing accuracy on non-Spring repos (Apache OFBiz field test)
+
+A real audit of **Apache OFBiz** (release18.12, ~326k LOC, own framework + Service
+Engine + widgets, **no Spring**) exposed seven defects where the tool collapsed
+"absence of evidence" into high-confidence false framings — a less-critical LLM
+consumer would have emitted a FALSE report (recommending a non-existent migration).
+Guiding principle applied throughout: **degrade to N/A, never to a manufactured 0 or
+100; declare gaps instead of inventing certainty.** New golden fixture:
+`tests/test_ofbiz_framing_regression.py`.
+
+- **`spring-test` no longer implies runtime Spring (BUG #1/#2).** Spring presence is
+  now scope- and artifact-aware: a test support library (`spring-test`,
+  `spring-boot-*-test`, `spring-security-test`) — even declared under a legacy
+  `compile` block — and test-tree `org.springframework.test` imports are classified
+  `spring_test_only`, never runtime Spring. `migrate-check` reports `spring_present`
+  (runtime) vs `spring_test_only` separately.
+- **No phantom `boot3 0/100` dimension (BUG #3).** The Boot 2→3 axis is `applicable`
+  only with runtime Spring; otherwise it is N/A (`score: null`) and excluded from the
+  aggregate — it can no longer drag the readiness headline to 0.
+- **Applicability gating + N/A readiness (BUG #4).** `jakarta` is applicable only with
+  positive evidence (migratable `javax.*` imports, or the `jakarta.*` namespace already
+  adopted); a repo with no Spring, no migratable `javax.*`, and no Hibernate 5 now
+  reports `readiness_score: null` ("N/A — no migration target detected") instead of a
+  manufactured 100. A valid `javax.servlet` surface is kept and scored on the **Jakarta
+  EE / Tomcat 10** axis, not mislabeled "Spring Boot 3".
+- **`modernize` no longer reports framework-dispatched classes as dead code (BUG #5).**
+  Zero-static-caller classes are renamed `statically_unreferenced` (never a confident
+  "dead zone") and partitioned: classes with a dynamic-entry signature (OFBiz Service
+  Engine `Map<String,Object> name(DispatchContext, Map<…>)`, servlet/event handlers,
+  annotation-dispatched beans) or referenced from XML/SPI/properties config are listed
+  under `framework_dispatched` and excluded.
+- **Gradle dependency parsing fixed for glob strings (BUG #6).** A string-aware comment
+  stripper no longer treats `/*` inside an Ant-style glob (`'**/*.java'`) as a block
+  comment — which had silently eaten OFBiz's entire `dependencies {}` block (0 → 59
+  deps). When a `dependencies {}` block resolves to nothing, a GAP is reported instead
+  of a confident "0 dependencies".
+- **Vendored web assets excluded from code notes (BUG #7).** `is_vendor_path` now flags
+  vendored JS/CSS libraries by file name (`jquery-3.5.1.js`, `bootstrap.bundle.js`, …),
+  so third-party comments are no longer reported as the project's own notes.
+- **Vendor-neutral project-type label (BUG #1, `--compact`).** `web_mvc` (triggered by
+  server-side template engines such as FreeMarker/Thymeleaf) is labeled "Server-side
+  MVC web app", not "Spring MVC web app" — OFBiz now reads "Java server-side mvc web
+  app using FreeMarker" with no false Spring claim.
+
+No-regression: a genuine Spring Boot 2 repo keeps `boot3` applicable and a computed
+readiness; Keycloak/Petclinic golden fixtures still pass.
+
 ## [1.66.0] — 2026-06-30
 
 ### Fixed — Spring Petclinic (Boot 4.0.3 / Java 17) false positives + aggregate consistency

{sourcecode-1.66.0 → sourcecode-1.68.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.66.0
+Version: 1.68.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.66.0 → sourcecode-1.68.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.66.0"
+version = "1.68.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.66.0 → sourcecode-1.68.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.66.0"
+__version__ = "1.68.0"

{sourcecode-1.66.0 → sourcecode-1.68.0}/src/sourcecode/cli.py

@@ -4896,7 +4896,8 @@ def migrate_check_cmd(
         output, output_path, copy,
         success_msg=(
             f"Migration check written to {output_path} "
-            f"(score: {report.readiness_score}/100, {_total} findings)"
+            f"(score: {report.readiness_score if report.readiness_score is not None else 'N/A'}"
+            f"{'/100' if report.readiness_score is not None else ''}, {_total} findings)"
         ),
     )
 
@@ -5524,6 +5525,91 @@ def fix_bug_cmd(
     )
 
 
+# Method signatures that are almost always FRAMEWORK ENTRY POINTS, not dead code —
+# invoked by a dispatcher (reflection / XML / SPI), invisible to a static Java
+# call-graph. Generalizes beyond any one framework.
+_DYNAMIC_ENTRY_SIGNATURE_RE = __import__("re").compile(
+    r"\(\s*DispatchContext\b"                       # OFBiz Service Engine service
+    r"|HttpServletRequest\s+\w+\s*,\s*HttpServletResponse"  # OFBiz event / servlet handler
+    r"|@(?:Scheduled|PostConstruct|PreDestroy|EventListener|Bean|"
+    r"RequestMapping|GetMapping|PostMapping|Path|GET|POST|Provider|"
+    r"ApplicationScoped|Singleton)\b",              # annotation-dispatched entry
+)
+# Config file extensions where a framework wires classes by name (XML/props/yaml).
+_CONFIG_REF_EXTS: frozenset = frozenset({".xml", ".properties", ".yml", ".yaml", ".groovy"})
+_CONFIG_SCAN_MAX_FILES: int = 12000
+_CONFIG_SCAN_MAX_BYTES: int = 256 * 1024
+
+
+def _partition_static_unreferenced(nodes: list[dict], root: Path) -> tuple[list[dict], list[dict]]:
+    """Split zero-degree classes into (truly_unreferenced, framework_dispatched).
+
+    A class with no static callers is NOT necessarily dead: frameworks invoke
+    classes via reflection, XML/SPI config, or annotations that a static call-graph
+    cannot see (e.g. Apache OFBiz Service Engine services, JAX-RS resources,
+    ServiceLoader providers, scheduled beans). We exclude a candidate when EITHER:
+      1. its source declares a dynamic-entry method signature, OR
+      2. its simple name / FQN is referenced from a non-Java config file.
+    Whatever survives is reported as *statically_unreferenced* — never a confident
+    "dead zone".
+    """
+    import os
+    if not nodes:
+        return [], []
+    by_simple: dict[str, list[dict]] = {}
+    for n in nodes:
+        simple = (n.get("fqn") or "").rsplit(".", 1)[-1]
+        if simple:
+            by_simple.setdefault(simple, []).append(n)
+
+    dispatched_fqns: set[str] = set()
+
+    # 1. Source-signature allowlist (bounded — candidate set is small).
+    for n in nodes:
+        src = n.get("source_file")
+        if not src:
+            continue
+        try:
+            txt = (root / src).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if _DYNAMIC_ENTRY_SIGNATURE_RE.search(txt):
+            dispatched_fqns.add(n["fqn"])
+
+    # 2. Config-reference scan — find candidate names wired from XML/props/yaml.
+    unresolved_simple = {s for s, ns in by_simple.items()
+                         if any(x["fqn"] not in dispatched_fqns for x in ns)}
+    if unresolved_simple:
+        files_scanned = 0
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [d for d in dirnames
+                           if d not in {".git", "build", "out", "target", "node_modules", ".gradle"}]
+            for fname in filenames:
+                ext = os.path.splitext(fname)[1].lower()
+                if ext not in _CONFIG_REF_EXTS:
+                    continue
+                if files_scanned >= _CONFIG_SCAN_MAX_FILES or not unresolved_simple:
+                    break
+                fpath = os.path.join(dirpath, fname)
+                try:
+                    with open(fpath, "r", encoding="utf-8", errors="replace") as fh:
+                        text = fh.read(_CONFIG_SCAN_MAX_BYTES)
+                except OSError:
+                    continue
+                files_scanned += 1
+                for simple in list(unresolved_simple):
+                    if simple in text:
+                        for x in by_simple.get(simple, []):
+                            dispatched_fqns.add(x["fqn"])
+                        unresolved_simple.discard(simple)
+            if files_scanned >= _CONFIG_SCAN_MAX_FILES or not unresolved_simple:
+                break
+
+    unreferenced = [n for n in nodes if n["fqn"] not in dispatched_fqns]
+    dispatched = [n for n in nodes if n["fqn"] in dispatched_fqns]
+    return unreferenced, dispatched
+
+
 @app.command("modernize")
 def modernize_cmd(
     path: Path = typer.Argument(
@@ -5625,13 +5711,21 @@ def modernize_cmd(
         key=lambda n: (-n.get("in_degree", 0), n.get("fqn", "")),
     )[:20]
 
-    # Dead zones: symbols with zero in-degree AND zero out-degree (isolated)
-    dead_zones = sorted(
+    # Statically-unreferenced zones: classes with zero in-degree AND zero out-degree
+    # in the Java call-graph. These are NOT necessarily dead — framework dispatch
+    # (reflection / XML / SPI / annotations) is invisible to a static graph — so we
+    # partition out framework-dispatched entry points before reporting, and never
+    # call the survivors "dead". (Defect 5: OFBiz Service-Engine services and event
+    # handlers were false-positive "dead zones".)
+    _zero_degree = sorted(
         [n for n in graph_nodes
          if n.get("in_degree", 0) == 0 and n.get("out_degree", 0) == 0
          and n.get("type") in ("class", "interface")],
         key=lambda n: n.get("fqn", ""),
-    )[:20]
+    )
+    dead_zones, framework_dispatched = _partition_static_unreferenced(_zero_degree, root)
+    dead_zones = dead_zones[:20]
+    framework_dispatched = framework_dispatched[:20]
 
     # Hotspot candidates: high in-degree service/repository/controller nodes,
     # ranked by composite score (in_degree × 2 + git_churn) for volatility signal.
@@ -5680,16 +5774,35 @@ def modernize_cmd(
         "total_classes": len([n for n in graph_nodes if n.get("type") in ("class", "interface")]),
         "total_subsystems": len(subsystems),
         "high_coupling_nodes": len(coupling_nodes),
-        "dead_zone_candidates": len(dead_zones),
+        "statically_unreferenced": len(dead_zones),
+        "framework_dispatched": len(framework_dispatched),
     }
+    # BUG #6 (v1.68.0): `member_count` counts ALL graph members in the subsystem —
+    # classes, methods AND fields — so it runs ~5x higher than the class count and
+    # is not comparable to the repo-level `total_classes` (which counts only
+    # class/interface nodes). Surface an unambiguous `class_count` alongside it,
+    # computed against the same class/interface node set as total_classes, so a
+    # reader does not have to reverse-engineer the unit. `member_count` is retained
+    # for backward compatibility but is now documented as the graph-member tally.
+    _class_fqns = {n["fqn"] for n in graph_nodes if n.get("type") in ("class", "interface")}
+
+    def _class_count(members: list) -> int:
+        return sum(1 for m in members if m in _class_fqns)
+
     _subsystem_summary = [
         {
             "label": s.get("label") or s.get("name") or "",
             "package_prefix": s.get("package_prefix") or s.get("pkg") or "",
+            "class_count": _class_count(s.get("members") or []),
             "member_count": len(s.get("members") or []),
         }
         for s in subsystems[:15]
     ]
+    _subsystem_summary_note = (
+        "class_count = class/interface declarations only (comparable to "
+        "summary.total_classes). member_count = all graph members in the subsystem "
+        "including methods and fields, so it is larger and not a class tally."
+    )
 
     if (not _mod_is_pro) and _mod_large(str(root)):
         # Large monolith, free tier: structural discovery preview only — no dead
@@ -5706,6 +5819,7 @@ def modernize_cmd(
             ),
             "summary": _summary,
             "subsystem_summary": _subsystem_summary,
+            "subsystem_summary_note": _subsystem_summary_note,
             "hotspot_candidates": hotspots[:3],
             "high_coupling_nodes": [
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
@@ -5723,14 +5837,26 @@ def modernize_cmd(
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
                 for n in coupling_nodes
             ],
-            "dead_zone_candidates": [
+            "statically_unreferenced": [
                 {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
                 for n in dead_zones
             ],
+            "statically_unreferenced_note": (
+                "Zero static callers in the Java call-graph. NOT confirmed dead: verify "
+                "no framework dispatch (reflection, XML/SPI config, annotations) before "
+                "removing. Classes detected as framework-dispatched are listed separately "
+                "under framework_dispatched and excluded from this list."
+            ),
+            "framework_dispatched": [
+                {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
+                for n in framework_dispatched
+            ],
             "subsystem_summary": _subsystem_summary,
+            "subsystem_summary_note": _subsystem_summary_note,
             "cross_module_tangles": [
                 {
                     "label": s.get("label") or s.get("name") or "",
+                    "class_count": _class_count(s.get("members") or []),
                     "member_count": len(s.get("members") or []),
                 }
                 for s in tangle_modules
@@ -5742,7 +5868,8 @@ def modernize_cmd(
                     if hotspots else
                     "high_coupling_nodes shows the most-referenced classes — start there. "
                 )
-                + "Dead zones are safe to remove or refactor. "
+                + "statically_unreferenced lists classes with no Java callers — review "
+                + "for framework dispatch (XML/reflection/SPI) before removing. "
                 + "Cross-module tangles indicate coupling worth decomposing."
             ),
         }

{sourcecode-1.66.0 → sourcecode-1.68.0}/src/sourcecode/context_summarizer.py

@@ -28,7 +28,11 @@ _STACK_LABELS: dict[str, str] = {
 
 _TYPE_LABELS: dict[str, str] = {
     "api": "REST API",
-    "web_mvc": "Spring MVC web app",
+    # Vendor-neutral: web_mvc is triggered by server-side template engines
+    # (Thymeleaf/FreeMarker), which are NOT exclusive to Spring (e.g. Apache OFBiz
+    # uses FreeMarker with its own framework). The detected frameworks list carries
+    # the actual stack; the type label must not assert "Spring".
+    "web_mvc": "Server-side MVC web app",
     "webapp": "Web app",
     "fullstack": "Full-stack app",
     "cli": "CLI tool",

{sourcecode-1.66.0 → sourcecode-1.68.0}/src/sourcecode/dependency_analyzer.py

@@ -1278,9 +1278,42 @@ class DependencyAnalyzer:
         return records, limitations
 
     def _strip_gradle_comments(self, content: str) -> str:
-        content = re.sub(r"/\*.*?\*/", "", content, flags=re.DOTALL)
-        content = re.sub(r"//[^\n]*", "", content)
-        return content
+        """Strip // and /* */ comments WITHOUT touching string literals.
+
+        A naive regex treats `/*` inside a string as a block-comment open. Gradle
+        build files routinely embed `/*` in Ant-style glob strings (e.g.
+        '**/*.java') and `//` in URL strings — a regex stripper then eats the entire
+        dependencies block up to the next literal `*/` (real defect on Apache OFBiz,
+        where ~100 deps vanished). This scanner skips quoted strings (single, double,
+        and triple-quoted, with backslash escapes) so only genuine comments are removed.
+        """
+        out: list[str] = []
+        i, n = 0, len(content)
+        quote: Optional[str] = None  # active string delimiter
+        while i < n:
+            if quote is not None:
+                # Inside a string literal — copy verbatim until the matching delimiter.
+                if len(quote) == 1 and content[i] == "\\" and i + 1 < n:
+                    out.append(content[i:i + 2]); i += 2; continue
+                if content.startswith(quote, i):
+                    out.append(quote); i += len(quote); quote = None; continue
+                out.append(content[i]); i += 1; continue
+            if content.startswith("//", i):
+                j = content.find("\n", i)
+                if j == -1:
+                    break
+                i = j; continue
+            if content.startswith("/*", i):
+                j = content.find("*/", i + 2)
+                if j == -1:
+                    break
+                i = j + 2; continue
+            for q in ('"""', "'''", '"', "'"):
+                if content.startswith(q, i):
+                    quote = q; out.append(q); i += len(q); break
+            else:
+                out.append(content[i]); i += 1
+        return "".join(out)
 
     def _analyze_gradle(self, root: Path) -> tuple[list[DependencyRecord], list[str]]:
         for filename in ("build.gradle", "build.gradle.kts"):
@@ -1307,7 +1340,20 @@ class DependencyAnalyzer:
                         except OSError:
                             pass
 
-                return self._dedupe(records), ["gradle: no compatible lockfile found; transitive dependencies unavailable"]
+                deduped = self._dedupe(records)
+                gradle_limitations = [
+                    "gradle: no compatible lockfile found; transitive dependencies unavailable"
+                ]
+                # Honest-zero guard: if the build file declares a dependencies block but
+                # nothing was resolved, report a GAP rather than a confident "0 deps".
+                if not deduped and re.search(r"\bdependencies\s*\{", content):
+                    jar_count = sum(1 for _ in root.glob("lib/**/*.jar"))
+                    gap = ("gradle: dependencies declared but none resolved by static "
+                           "parsing (non-standard declaration syntax)")
+                    if jar_count:
+                        gap += f"; {jar_count} jar(s) present under lib/ (not parsed)"
+                    gradle_limitations.append(gap)
+                return deduped, gradle_limitations
         return [], []
 
     def _parse_gradle_properties(self, root: Path, content: str) -> dict[str, str]:

{sourcecode-1.66.0 → sourcecode-1.68.0}/src/sourcecode/integration_detector.py

@@ -7,8 +7,14 @@ deterministic source-text matching (same approach as the JNDI datasource scan in
 
 Covered clients:
 
-  * HTTP   — ``RestTemplate``, ``WebClient``, ``@FeignClient`` (declarative)
-  * LDAP   — ``LdapTemplate``
+  * HTTP   — ``RestTemplate``, ``WebClient``, ``@FeignClient`` (declarative),
+             JDK/Apache/OkHttp clients
+  * LDAP   — ``LdapTemplate``, JNDI ``InitialLdapContext``/``LdapContext``
+  * DNS    — JNDI ``DirContext`` configured with ``DnsContextFactory`` (BUG #2:
+             ``DirContext`` is protocol-agnostic and is classified by its
+             ``INITIAL_CONTEXT_FACTORY``, not assumed to be LDAP)
+  * SMTP   — JavaMail / Jakarta Mail (BUG #1: gated on a mail import so the bare
+             word "Transport" in a log string is not a false positive)
   * JMS    — ``JmsTemplate``, ActiveMQ connection factories
 
 Each hit is reported with a ``file:line`` evidence anchor and, when a literal URL
@@ -28,6 +34,24 @@ _URL_RE = re.compile(r'"((?:https?|ldaps?|tcp|amqp|jms|nio)://[^"]*)"')
 # First string literal on a line (fallback target, e.g. WebClient.create("x")).
 _STR_RE = re.compile(r'"([^"]+)"')
 
+# BUG #1 (v1.68.0): a JavaMail/Jakarta-Mail import is required before an SMTP token
+# (Transport, MimeMessage) is trusted. The bare word "Transport" is also a common
+# English noun that appears in log strings ( logger.warn("Transport initialization
+# failure") in non-mail code), so a mail-import gate plus a string-literal skip
+# stops those false positives.
+_MAIL_IMPORT_RE = re.compile(
+    r"^\s*import\s+(?:(?:javax|jakarta)\.mail|org\.springframework\.mail)\b",
+    re.MULTILINE,
+)
+
+# BUG #2 (v1.68.0): javax.naming.directory.{DirContext,InitialDirContext} is NOT
+# LDAP-specific — the actual protocol is decided by the value bound to
+# Context.INITIAL_CONTEXT_FACTORY. com.sun.jndi.dns.DnsContextFactory means DNS
+# (SRV/A record lookups), com.sun.jndi.ldap.LdapCtxFactory means LDAP. Classify by
+# the factory class present in the file instead of defaulting to LDAP.
+_DNS_FACTORY_RE = re.compile(r"jndi\.dns|DnsContextFactory", re.IGNORECASE)
+_LDAP_FACTORY_RE = re.compile(r"jndi\.ldap|LdapCtxFactory", re.IGNORECASE)
+
 # Declarative HTTP client. Attrs may span multiple lines, so matched on full text.
 _FEIGN_RE = re.compile(r"@FeignClient\s*\(([^)]*)\)", re.DOTALL)
 _ATTR_URL_RE = re.compile(r'url\s*=\s*"([^"]*)"')
@@ -82,6 +106,39 @@ def _extract_target(line: str) -> Optional[str]:
     return None
 
 
+def _in_string_literal(line: str, idx: int) -> bool:
+    """True if char offset ``idx`` falls inside a double-quoted string on ``line``.
+
+    BUG #1 (v1.68.0): a Java type token never legitimately appears inside a string
+    literal, so a match there (e.g. the word "Transport" in a log message) is noise,
+    not a real client construct. Counts unescaped quotes before ``idx``.
+    """
+    quote_count = 0
+    i = 0
+    while i < idx and i < len(line):
+        ch = line[i]
+        if ch == "\\":
+            i += 2
+            continue
+        if ch == '"':
+            quote_count += 1
+        i += 1
+    return quote_count % 2 == 1
+
+
+def _classify_naming_factory(text: str) -> Optional[str]:
+    """Classify a javax.naming.directory usage by its INITIAL_CONTEXT_FACTORY.
+
+    Returns ``"dns"``, ``"ldap"``, or ``None`` (factory not statically resolvable).
+    See BUG #2 — DirContext alone does not imply LDAP.
+    """
+    if _DNS_FACTORY_RE.search(text):
+        return "dns"
+    if _LDAP_FACTORY_RE.search(text):
+        return "ldap"
+    return None
+
+
 def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     """Detect outbound integrations across ``file_paths`` (relative to ``root``).
 
@@ -93,18 +150,31 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     seen: "set[tuple[str, str, Optional[str], str]]" = set()
     records: "list[dict]" = []
 
-    def _add(kind: str, client: str, target: Optional[str], rel: str, line: int) -> None:
+    def _add(
+        kind: str,
+        client: str,
+        target: Optional[str],
+        rel: str,
+        line: int,
+        confidence: Optional[str] = None,
+    ) -> None:
         evidence = f"{rel}:{line}"
         key = (kind, client, target, evidence)
         if key in seen:
             return
         seen.add(key)
-        records.append({
+        rec = {
             "kind": kind,
             "client": client,
             "target": target,
             "evidence": evidence,
-        })
+        }
+        # Per-record confidence is emitted only when the classification is uncertain
+        # (e.g. a JNDI DirContext whose factory could not be resolved). Confident hits
+        # stay schema-clean without the field.
+        if confidence is not None:
+            rec["confidence"] = confidence
+        records.append(rec)
 
     for rel in file_paths:
         try:
@@ -126,6 +196,10 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
             )
             _add("http", "feign", target, rel, _line_of(text, m.start()))
 
+        # Per-file context used to disambiguate / gate uncertain tokens (BUG #1/#2).
+        has_mail_import = bool(_MAIL_IMPORT_RE.search(text))
+        naming_factory = _classify_naming_factory(text)
+
         # Token clients — per line, skipping imports/package/comment noise.
         # First pass records the declaration site and any variable name bound to
         # the client, so a later call site (where the URL literal usually lives)
@@ -146,7 +220,28 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
                 m = token_re.search(line)
                 if not m:
                     continue
-                _add(kind, client, _extract_target(line), rel, lineno)
+                # BUG #1: a token matched inside a string literal (log message, doc
+                # comment text) is never a real client construct — skip it.
+                if _in_string_literal(line, m.start()):
+                    continue
+                confidence: Optional[str] = None
+                # BUG #1: SMTP tokens require a JavaMail/Jakarta-Mail import to be
+                # trusted — "Transport" / "MimeMessage" are too generic otherwise.
+                if kind == "smtp" and not has_mail_import:
+                    continue
+                # BUG #2: javax.naming.directory.{Dir,Initial}Context is protocol-
+                # agnostic. Reclassify by the configured context factory; default to
+                # an explicit low-confidence "unknown" rather than assuming LDAP.
+                if client == "jndi-ldap" and "Dir" in token_re.pattern:
+                    if naming_factory == "dns":
+                        kind, client = "dns", "jndi-dns"
+                    elif naming_factory == "ldap":
+                        kind, client = "ldap", "jndi-ldap"
+                    else:
+                        kind, client, confidence = (
+                            "naming-directory-unknown", "jndi-dircontext", "low",
+                        )
+                _add(kind, client, _extract_target(line), rel, lineno, confidence)
                 tok = m.group(0)
                 # `Type name` (field/local decl) and `name = new Type(` forms.
                 decl = re.search(re.escape(tok) + r"\s+(\w+)\b", line)
@@ -186,9 +281,13 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
         "confidence": confidence,
         "coverage_note": (
             "Detects HTTP (RestTemplate/WebClient/JDK/Apache/OkHttp), LDAP (Spring "
-            "+ JNDI), SMTP (JavaMail), and JMS client constructs by source-text "
-            "matching. A count of 0 means no such construct was found, not that the "
-            "system has no outbound integrations — runtime/DI-wired clients are not "
-            "statically visible."
+            "+ JNDI), DNS (JNDI DirContext w/ DnsContextFactory), SMTP (JavaMail, "
+            "import-gated), and JMS client constructs by source-text matching. JNDI "
+            "DirContext usage is classified by its INITIAL_CONTEXT_FACTORY (dns vs "
+            "ldap); when the factory is not statically resolvable the kind is "
+            "'naming-directory-unknown' with confidence='low', never assumed LDAP. A "
+            "count of 0 means no such construct was found, not that the system has no "
+            "outbound integrations — runtime/DI-wired clients are not statically "
+            "visible."
         ),
     }

{sourcecode-1.66.0 → sourcecode-1.68.0}/src/sourcecode/mcp/orchestrator.py

@@ -774,7 +774,7 @@ def run_migrate_flow_impl(repo_path: str, min_severity: str = "low") -> dict[str
     if not _is_java_repo(repo_path):
         quality_warnings.append(
             "not_a_java_repo: migration analysis targets Spring Boot / Java repos. "
-            "Result will be empty (readiness_score=100, no findings)."
+            "Result will be empty (readiness_score=null/N/A, no findings)."
         )
 
     report = _exec(["migrate-check", repo_path, "--min-severity", min_severity])

{sourcecode-1.66.0 → sourcecode-1.68.0}/src/sourcecode/mcp/registry.py

@@ -798,7 +798,7 @@ depth: BFS depth for indirect caller traversal (1–8, default: 4).
 Analyzes codebase for modernization opportunities: dead zones, hotspot scores, upgrade candidates.
 
 Maps to: sourcecode modernize <repo_path>
-Returns: hotspot_candidates (high fan-in + git churn), dead_zone_candidates (isolated classes),
+Returns: hotspot_candidates (high fan-in + git churn), statically_unreferenced (zero-caller classes — NOT confirmed dead; verify no framework dispatch) + framework_dispatched,
          high_coupling_nodes, subsystem_summary, cross_module_tangles, recommendation.
 
 Best for: refactor planning, identifying where to start, finding safe removal candidates.
@@ -1403,7 +1403,7 @@ Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA
 When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
 or upgrading from Spring Boot 2.x to 3.x. Use BEFORE get_spring_audit when the goal
 is migration planning rather than ongoing Spring semantic audit.
-Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+Do NOT call on non-Java repositories — returns readiness_score=null (N/A) with no findings.
 
 Rules detected:
   MIG-001 critical — javax.persistence imports (JPA; will not compile after migration)
@@ -1415,7 +1415,7 @@ Rules detected:
   MIG-007 medium   — javax.inject imports (DI annotations)
   MIG-008 medium   — javax.ws.rs imports (JAX-RS API)
 
-Returns: schema_version, readiness_score (0–100; 100=ready to migrate),
+Returns: schema_version, readiness_score (0–100, or null=N/A when no migration target applies; 100=ready to migrate),
   jakarta_readiness / boot3_readiness / jdk_modernization (per-dimension 0–100),
   blocking_count, estimated_effort_days, spring_boot_2_detected (true|false|null —
   null=undetermined, never assumed true), spring_boot_version_detected,