sourcecode 1.68.0__tar.gz → 1.70.0__tar.gz

{sourcecode-1.68.0 → sourcecode-1.70.0}/CHANGELOG.md

@@ -1,5 +1,134 @@
 # Changelog
 
+## [1.70.0] — 2026-07-01
+
+### Fixed — reliability & internal-consistency on a large Spring 5 / Hibernate 5 repo (openmrs-core field test)
+
+A full migration audit of **openmrs-core** (`7c0144ad2`, branch `2.9.x`; ~866
+production files, Maven multi-module, Spring Framework 5 + Hibernate 5, classic
+WAR, **no Spring Boot**) surfaced four reproducible defects where a headline value
+was wrong or internally contradictory. Each fix targets the **root cause** and,
+where certainty is not achievable, degrades to an explicit low-confidence / `null`
+signal rather than asserting a concrete-but-false value. New regression coverage
+across four suites.
+
+- **`migrate-check` — Hibernate version confused a sibling artifact's version (BUG #1, CRITICAL).**
+  Hibernate ORM was resolved by scanning for *any* `<hibernate*version>` property
+  and keeping the **newest**, so on openmrs `${hibernateSearchVersion}=6.2.4.Final`
+  (Hibernate **Search**, a different artifact) beat `${hibernateVersion}=5.6.15.Final`
+  (Hibernate **ORM**). The tool declared the repo "already on Hibernate 6", set
+  `migration_applicable:false`, and silently **dropped the 28.9–95.6 person-day**
+  rewrite range from `estimated_effort_days` (under-reporting 1.5–2.6×). Resolution
+  is now **anchored to the `hibernate-core`/`hibernate-orm` dependency** — the
+  `<version>` on that coordinate, resolving a `${property}` to the *specific*
+  referenced property, and the Gradle coordinate. The property fallback (BOM-managed
+  repos) **excludes sibling artifacts** (Search/Validator/Envers/OGM/…). openmrs now
+  resolves `5.6.15.Final` / major 5 / `migration_applicable:true`, and
+  `estimated_effort_days` includes the Hibernate rewrite range via a new
+  `effort_breakdown` block. The same-name contradiction (`hibernate_readiness:100`
+  at root vs `0` nested) is removed: the nested field is renamed
+  **`rewrite_zone_readiness`** (raw rewrite-zone score, independent of applicability),
+  leaving the document-root `hibernate_readiness` as the single authoritative,
+  applicability-gated score.
+
+- **`impact-chain` — a class's own methods counted as "direct callers" (BUG #2, HIGH).**
+  For a class-level seed, the BFS folds in every method key of the class, so internal
+  method→method calls leaked into `direct_callers`. On `ConceptServiceImpl` this
+  reported **24 direct callers (22 of them own members)**, inflating `risk_score` to
+  `20.0`/`high` — ~12× the real blast radius. Callers whose owning class is a seed
+  class are now excluded (they are *members*, not external callers); the count is
+  surfaced as `self_referential_excluded` plus an `analysis_warnings` entry.
+  `ConceptServiceImpl` now reports **2 external callers**, `risk_score` recomputed to
+  `8.5`/`medium`.
+
+- **`export --integrations` — a user class classified as a JDK API by bare name (BUG #3, MEDIUM).**
+  `org.openmrs.util.HttpClient` (a thin wrapper over `java.net.HttpURLConnection`)
+  was labeled `jdk-httpclient` purely because its simple name matches
+  `java.net.http.HttpClient`. The client is now resolved by the **fully-qualified
+  import** — `jdk-httpclient` only when `java.net.http.HttpClient` is actually
+  imported and the file does not declare its own — otherwise it degrades to a
+  low-confidence **`custom-http-wrapper`**. Pure type-declaration sites (field,
+  parameter, return type such as `setImplementationIdHttpClient(HttpClient c)`) are
+  no longer emitted as network-invocation evidence; only constructions / static calls
+  count.
+
+- **`--compact` — "rest api" headline unsupported by the `endpoints` command (BUG #4, LOW).**
+  The `architecture_summary` label is driven by HTTP-framework **presence** (Spring
+  MVC on the classpath), so openmrs was headlined "Java rest api" while the
+  authoritative `endpoints` command found **only 3 endpoints** (one a test module,
+  one medium-confidence `router_dsl`). The summary now consults the same endpoint
+  extractor and, below a high-confidence-endpoint threshold, degrades to a qualified,
+  consistent phrasing ("HTTP framework present; only N endpoints detected — see
+  `endpoints`") instead of overclaiming (Java/Kotlin repos only).
+
+## [1.69.0] — 2026-06-30
+
+### Fixed — framing & symbol-graph fidelity on a non-framework Java library (JobRunr field test)
+
+A full architectural audit of **JobRunr** (Gradle multi-module, 707 classes, a
+background-job-processing **library** that is framework-agnostic at its core and
+integrates with Quarkus/Micronaut/Spring only through small optional adapter
+modules) surfaced four reproducible defects. Each fix targets the **root cause** so
+it generalizes to any equivalent repo, with new regression coverage across five
+suites.
+
+- **`migrate-check` MIG-011 — false positive on JDK-exported packages (BUG #1).**
+  The rule flagged *any* `sun.*` / `com.sun.*` import as a strongly-encapsulated
+  JDK internal on a pure prefix heuristic. On JobRunr this turned 14 benign
+  `com.sun.net.httpserver.*` imports into 14 `high`/`manual_migration` findings —
+  **100% of an inflated `blocking_count: 14`** on a healthy repo (the GO/NO-GO
+  metric). `com.sun.net.httpserver` is exported **unconditionally** by the
+  `jdk.httpserver` module (public since Java 6, basis of JEP 408) and needs no
+  `--add-exports`/`--add-opens`. MIG-011 now consults an allowlist of
+  unconditionally-exported JDK packages **generated from the running JDK** by
+  `scripts/generate_jdk_exports.py` (`src/sourcecode/jdk_exports.py`), never
+  hand-maintained. Genuinely-internal packages (`sun.misc.Unsafe`,
+  `com.sun.tools.*`, `com.sun.jdi.*`, `com.sun.source.*`) stay `high`.
+  `blocking_count` and `estimated_effort_days` recompute accordingly. JobRunr
+  `blocking_count` 14 → 0.
+- **Phantom symbols extracted from prose (BUG #2).** `modernize`'s
+  `statically_unreferenced` / `framework_dispatched` lists (and the shared symbol
+  graph behind `repo-ir` / `impact` / `export --c4`) contained FQNs that match no
+  real type — e.g. `org.jobrunr.configuration.provides` (from the Javadoc "This
+  class **provides** the entry point") and `…details.instead` (from an exception
+  string "…**instead** of an actual implementation"). The non-annotated fast-path
+  symbol scan ran `(?:class|interface|enum)\s+(\w+)` over **raw source**, tokenizing
+  words inside comments and string literals. It now strips comments + string
+  literals first and requires a capitalized type name, matching the precision of the
+  annotated-file extractor. Fixing the shared parser fixes every downstream command.
+- **`endpoints` — total false negative on imperative router DSLs (BUG #3).** JobRunr
+  exposes 12 live dashboard REST routes via `get("/jobs", handler)` /
+  `post(...)` / `delete(...)` calls; the annotation-only extractor returned **0
+  endpoints** (silently disabling `validation` downstream). A shape-based detector
+  now recognizes router-DSL registrations — an HTTP-verb method whose first argument
+  is a path literal **and** that has a second argument (the trailing comma
+  distinguishes a route from a 1-arg `Map.get`). Reported at `confidence: medium`
+  with `source: router_dsl`. Handles bare (Spark/static-import) and `app.get(...)`
+  (Javalin) forms. JobRunr `endpoints` 0 → 12.
+- **Stack/architecture classification biased to the most-recognizable framework (BUG #4).**
+  JobRunr (19 modules, framework only in 3 small adapters, `core` ≈ 85% of code) was
+  reported as `project_type: "api"` / `frameworks: ["Quarkus"]`. Two root causes:
+  (a) the Gradle detector substring-matched `"quarkus"` inside an **exclusion filter**
+  (`configure(subprojects.findAll { !it.name.contains('quarkus') })`) — framework
+  tokens are now matched only inside genuine dependency/plugin lines; and (b)
+  presence-based typing — a framework confined to a minority adapter module (its
+  dominant source module uses no framework) no longer drives the project type, and a
+  multi-module JVM repo with no defining web/API framework classifies as `library`,
+  never `unknown`. A monolithic framework app is unaffected. `explain` no longer
+  emits the misleading "No stereotype detected — may be a plain class or utility" for
+  a structurally central non-annotated class: it infers a low-confidence stereotype
+  from in-degree, lifecycle methods, and naming (e.g. `BackgroundJobServer` →
+  "Likely server/orchestrator … lifecycle methods detected (start/stop)"). Finally
+  the `architecture_summary` no longer prints a phantom "MVC pattern with
+  controller, model, view layers" for a non-web library: MVC now requires a real
+  View layer (it was inferred from a `handlers` dir + a `model` dir with no view),
+  a bundled SPA under `src/main/resources/.../frontend` is no longer counted as a
+  backend view layer, `testFixtures` source roots are excluded, and View detection
+  recognizes template files (`.html`/etc.) that the code-extension filter dropped.
+  JobRunr `project_type` "api" → "library", `frameworks` `["Quarkus"]` → `[]`,
+  architecture "MVC … controller, model, view" → "Layered … controller, repository,
+  infrastructure".
+
 ## [1.68.0] — 2026-06-30
 
 ### Fixed — narrative/structured-data parity on non-Spring DI repos (Netflix Eureka field test)

{sourcecode-1.68.0 → sourcecode-1.70.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.68.0
+Version: 1.70.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.68.0 → sourcecode-1.70.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.68.0"
+version = "1.70.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

sourcecode-1.70.0/scripts/generate_jdk_exports.py

@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""Generate the JDK unconditional-export allowlist used by migrate-check MIG-011.
+
+MIG-011 flags `sun.*` / `com.sun.*` imports as strongly-encapsulated JDK-internal
+APIs. That heuristic is *prefix-based* and produces false positives on packages
+that merely share the prefix but are in fact exported **unconditionally** by a
+JDK module (no `to` clause) and therefore require NO `--add-exports` /
+`--add-opens` on any classpath or module-path scenario. The canonical example is
+`com.sun.net.httpserver.*` (module `jdk.httpserver`) — public and documented
+since Java 6, the basis of JEP 408.
+
+This script derives the allowlist directly from the running JDK by parsing
+`java --describe-module` for every module, so the data tracks the real platform
+instead of a hand-maintained list that silently rots across releases.
+
+Two filters are applied:
+
+  1. Only `exports <pkg>` lines WITHOUT a `to <module>` qualifier are kept
+     (qualified exports still need `--add-exports` for arbitrary code).
+
+  2. Modules whose whole purpose is internal / tooling / deprecated access are
+     DENYLISTED — their `sun.*` / `com.sun.*` exports are genuine migration
+     concerns and must keep MIG-011's `high` severity:
+        - jdk.unsupported  → sun.misc.Unsafe, sun.reflect (deprecated for removal)
+        - jdk.compiler     → com.sun.source.*, com.sun.tools.javac (compiler internals)
+        - jdk.attach       → com.sun.tools.attach.* (tooling)
+        - jdk.jdi          → com.sun.jdi.* (debugger internals)
+        - jdk.jconsole / jdk.jdeps / jdk.javadoc / jdk.jshell → com.sun.tools.*
+
+Run with the OLDEST supported target JDK to stay conservative (a package
+exported in JDK 21 but not JDK 17 must not be allowlisted for a JDK 17 target).
+Re-run after a JDK bump and commit the regenerated module.
+
+Usage:
+    python scripts/generate_jdk_exports.py > src/sourcecode/jdk_exports.py
+"""
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+
+# Modules whose sun.*/com.sun.* exports are genuinely internal/tooling/deprecated.
+# Their packages must NOT be allowlisted — MIG-011 keeps firing `high` for them.
+_DENYLIST_MODULES: frozenset[str] = frozenset(
+    {
+        "jdk.unsupported",
+        "jdk.compiler",
+        "jdk.attach",
+        "jdk.jdi",
+        "jdk.jconsole",
+        "jdk.jdeps",
+        "jdk.javadoc",
+        "jdk.jshell",
+        "jdk.internal.ed",
+        "jdk.internal.le",
+        "jdk.internal.opt",
+        "jdk.internal.vm.ci",
+        "jdk.internal.vm.compiler",
+    }
+)
+
+_EXPORT_RE = re.compile(r"^exports\s+(\S+?)(?:\s+to\s+.*)?$")
+
+
+def _list_modules() -> list[str]:
+    out = subprocess.run(
+        ["java", "--list-modules"], capture_output=True, text=True, check=True
+    ).stdout
+    return [line.split("@", 1)[0].strip() for line in out.splitlines() if line.strip()]
+
+
+def _module_exports(module: str) -> list[tuple[str, bool]]:
+    """Return (package, is_unconditional) for each `exports` line of a module."""
+    out = subprocess.run(
+        ["java", "--describe-module", module],
+        capture_output=True,
+        text=True,
+    ).stdout
+    results: list[tuple[str, bool]] = []
+    for line in out.splitlines():
+        line = line.strip()
+        m = _EXPORT_RE.match(line)
+        if not m:
+            continue
+        pkg = m.group(1)
+        unconditional = " to " not in line
+        results.append((pkg, unconditional))
+    return results
+
+
+def main() -> int:
+    java_version = subprocess.run(
+        ["java", "-version"], capture_output=True, text=True
+    ).stderr.splitlines()[0]
+
+    allowlist: set[str] = set()
+    for module in _list_modules():
+        if module in _DENYLIST_MODULES:
+            continue
+        for pkg, unconditional in _module_exports(module):
+            if not unconditional:
+                continue
+            if pkg.startswith("sun.") or pkg.startswith("com.sun."):
+                allowlist.add(pkg)
+
+    packages = sorted(allowlist)
+
+    print('"""GENERATED FILE — do not edit by hand.')
+    print()
+    print("Allowlist of sun.* / com.sun.* packages exported UNCONDITIONALLY by the")
+    print("JDK (no `--add-exports` / `--add-opens` required on classpath or module")
+    print("path). Consumed by migrate-check MIG-011 to suppress false positives.")
+    print()
+    print(f"Regenerate with:  python scripts/generate_jdk_exports.py > "
+          "src/sourcecode/jdk_exports.py")
+    print(f"Generated from:   {java_version}")
+    print('"""')
+    print("from __future__ import annotations")
+    print()
+    print()
+    print("JDK_UNCONDITIONAL_EXPORTS: frozenset[str] = frozenset(")
+    print("    {")
+    for pkg in packages:
+        print(f'        "{pkg}",')
+    print("    }")
+    print(")")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{sourcecode-1.68.0 → sourcecode-1.70.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.68.0"
+__version__ = "1.70.0"

{sourcecode-1.68.0 → sourcecode-1.70.0}/src/sourcecode/architecture_analyzer.py

@@ -38,7 +38,15 @@ _CODE_EXTENSIONS = {
 }
 _GENERIC_NAMES = {"utils", "helpers", "common", "shared", "misc", "core", "root", ""}
 
-_TEST_DIRS: frozenset[str] = frozenset({"tests", "test", "spec", "specs", "__tests__", "e2e"})
+_TEST_DIRS: frozenset[str] = frozenset({
+    "tests", "test", "spec", "specs", "__tests__", "e2e",
+    # Gradle/Maven test-fixture source roots are test code, not runtime architecture.
+    "testfixtures", "testfixture",
+})
+# Always-vendored asset trees — never a backend code layer at any depth.
+_ASSET_DIRS: frozenset[str] = frozenset({
+    "node_modules", "bower_components",
+})
 _BENCHMARK_DIRS: frozenset[str] = frozenset({
     "benchmark", "benchmarks", "bench",
     "example", "examples",
@@ -50,7 +58,7 @@ _BENCHMARK_DIRS: frozenset[str] = frozenset({
 _DOCS_DIRS: frozenset[str] = frozenset({"docs", "doc", "documentation", "wiki"})
 _TOOLING_DIRS: frozenset[str] = frozenset({"scripts", "script", "tools", "tool", "ci"})
 # All dirs that are not part of the runtime source architecture
-_NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS
+_NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS | _ASSET_DIRS
 
 # Exact file stems that signal a specific architectural layer
 _LAYER_STEM_EXACT: dict[str, str] = {
@@ -150,6 +158,15 @@ LAYER_PATTERNS: dict[str, dict[str, list[str]]] = {
     },
 }
 
+# Layer keys a pattern MUST match to qualify, regardless of score. BUG (JobRunr
+# field test): "mvc" was inferred from a controller-ish dir (`handlers`) plus a
+# `model` dir, with NO view layer — that is not MVC (a library with no templates/
+# pages/components is at most layered). MVC's defining trait is the View, so require
+# it; without it the pattern falls through to layered / a weaker match.
+_PATTERN_REQUIRED_KEYS: dict[str, frozenset[str]] = {
+    "mvc": frozenset({"view"}),
+}
+
 # Higher value = wins when score ties
 _PATTERN_PRIORITY: dict[str, int] = {
     "cqrs":               8,
@@ -245,8 +262,12 @@ class ArchitectureAnalyzer:
         # Step 2: domain clustering
         domains = self._cluster_domains(filtered)
 
-        # Step 3: layer detection
-        pattern, layers = self._detect_layers(filtered)
+        # Step 3: layer detection. Feed the FULL path list (not the code-extension
+        # `filtered` set): a View layer is template files (.html/.jinja/.ejs…) that
+        # `filtered` would drop, hiding the very layer that distinguishes MVC.
+        # _detect_layers applies its own non-source/asset/test dir filtering, so
+        # bundled frontend trees and test fixtures are still excluded.
+        pattern, layers = self._detect_layers(sm.file_paths)
         if pattern in (None, "flat", "unknown"):
             if pattern == "flat":
                 limitations.append("Layer pattern not detected: project has a flat directory structure")
@@ -518,10 +539,18 @@ class ArchitectureAnalyzer:
         return domains
 
     def _detect_layers(self, paths: list[str]) -> tuple[str, list[ArchitectureLayer]]:
-        # Exclude non-source paths (tests, benchmarks, docs, tooling) from layer scoring
+        # Exclude non-source paths (tests, benchmarks, docs, tooling, vendored assets)
+        # from layer scoring. Also exclude anything under a `resources/` segment: in
+        # Maven/Gradle layouts `src/main/resources/**` is bundled config/assets — e.g.
+        # JobRunr ships a React dashboard SPA at
+        # `core/src/main/resources/org/jobrunr/dashboard/frontend/src/components`, whose
+        # `components` dir would otherwise be miscounted as a backend MVC "view" layer.
         source_paths = [
             p for p in paths
-            if not any(part.lower() in _NON_SOURCE_DIRS for part in p.replace("\\", "/").split("/"))
+            if not any(
+                part.lower() in _NON_SOURCE_DIRS or part.lower() == "resources"
+                for part in p.replace("\\", "/").split("/")
+            )
         ]
         if not source_paths:
             return "unknown", []
@@ -544,6 +573,10 @@ class ArchitectureAnalyzer:
                 matched_dirs = [d for d in dir_names if d in keywords]
                 if matched_dirs:
                     matched[layer_key] = matched_dirs
+            # A pattern with unmet required keys cannot qualify (e.g. mvc needs a view).
+            required = _PATTERN_REQUIRED_KEYS.get(pattern_name)
+            if required and not required.issubset(matched.keys()):
+                continue
             score = len(matched)
             priority = _PATTERN_PRIORITY.get(pattern_name, 0)
             if (score, priority) > (best_score, best_priority):

{sourcecode-1.68.0 → sourcecode-1.70.0}/src/sourcecode/architecture_summary.py

@@ -23,6 +23,14 @@ _JAVA_EXTENSIONS = {".java", ".kt", ".scala"}
 
 _CORE_DETECTION_MODULES = {"scanner", "detectors", "classifier", "workspace"}
 
+# BUG #4 (v1.70.0): the "REST API" project-type label is driven by HTTP-framework
+# PRESENCE (Spring MVC / JAX-RS on the classpath), not by an actual endpoint count.
+# The `--compact` summary is the first (often only) thing an agent reads, so it must
+# not assert "rest api" when the authoritative `endpoints` command finds almost no
+# high-confidence surface. Below this many high-confidence endpoints we degrade the
+# headline to a qualified, consistent phrasing instead of overclaiming.
+_MIN_REST_ENDPOINTS_FOR_LABEL = 5
+
 _OPTIONAL_LABEL_MAP: dict[str, str] = {
     "DependencyAnalyzer": "dependencias",
     "GraphAnalyzer": "grafo de módulos",
@@ -41,6 +49,7 @@ class ArchitectureSummarizer:
 
     def __init__(self, root: Path) -> None:
         self.root = root
+        self._endpoint_support_cache: tuple[int, int] | None = None
 
     def generate(self, sm: SourceMap) -> str | None:
         try:
@@ -185,9 +194,39 @@ class ArchitectureSummarizer:
 
         fw_str = f" using {', '.join(fw_names)}" if fw_names else ""
         if runtime:
+            # BUG #4: never assert "rest api" in the headline unless the endpoints
+            # command actually backs it (Java/Kotlin only — that is where we have an
+            # authoritative extractor). Degrade to a qualified, consistent phrasing.
+            if sm.project_type == "api" and primary.stack in {"java", "kotlin"}:
+                total, high = self._endpoint_support()
+                if high < _MIN_REST_ENDPOINTS_FOR_LABEL:
+                    plural = "s" if total != 1 else ""
+                    return (
+                        f"{stack_label} application{fw_str} "
+                        f"(HTTP framework present; only {total} endpoint{plural} "
+                        f"detected — see `endpoints`)."
+                    )
             return f"{stack_label} {runtime.lower()}{fw_str}."
         return f"{stack_label} project{fw_str}."
 
+    def _endpoint_support(self) -> tuple[int, int]:
+        """Return (total, high_confidence) endpoint counts from the canonical
+        Java endpoint extractor — the same source the `endpoints` command uses,
+        so the summary cannot diverge from it. Cached; failure degrades to (0, 0)."""
+        if self._endpoint_support_cache is not None:
+            return self._endpoint_support_cache
+        total, high = 0, 0
+        try:
+            from sourcecode.repository_ir import extract_java_endpoints
+            data = extract_java_endpoints(self.root)
+            eps = data.get("endpoints", [])
+            total = data.get("total", len(eps))
+            high = sum(1 for e in eps if (e.get("confidence") or "high") == "high")
+        except Exception:
+            total, high = 0, 0
+        self._endpoint_support_cache = (total, high)
+        return self._endpoint_support_cache
+
     def _describe_arch_pattern(self, arch: Any) -> str:
         pattern_labels = {
             "clean": "Clean Architecture",

{sourcecode-1.68.0 → sourcecode-1.70.0}/src/sourcecode/classifier.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from collections.abc import Iterable, Sequence
 from dataclasses import replace
 from typing import Any, Literal
@@ -104,6 +105,21 @@ class TypeClassifier:
         stack_names = {stack.stack for stack in stacks}
         framework_names = {framework.name for stack in stacks for framework in stack.frameworks}
 
+        # BUG #4 (JobRunr field test): a framework present only in a small optional
+        # integration/adapter submodule must NOT label the whole repo as that
+        # framework's app type. JobRunr is a framework-agnostic background-job
+        # LIBRARY whose `core` module holds ~85% of the code; Quarkus/Micronaut/Spring
+        # appear only in tiny per-framework adapter modules — yet presence-based
+        # classification returned project_type="api"+Quarkus. We weight by code
+        # locality: if the DOMINANT source module (the one with the most source files)
+        # contains no evidence of the app-defining framework, the framework is an
+        # optional adapter and the repo is a library. A monolithic Spring app is
+        # unaffected — its dominant module *does* use the framework. Drop such
+        # localized frameworks from the set that drives the app-type decision below.
+        _app_frameworks = framework_names & (_WEB_FRAMEWORKS | _API_FRAMEWORKS)
+        _localized = self._localized_adapter_frameworks(file_tree, stacks, _app_frameworks)
+        framework_names = framework_names - _localized
+
         if len(stack_names) >= 2 and self._is_fullstack(stacks):
             return "fullstack"
 
@@ -129,9 +145,16 @@ class TypeClassifier:
         if framework_names & _API_FRAMEWORKS:
             return "api"
 
+        # All app-defining frameworks were localized to optional adapter submodules
+        # (multi-module library with per-framework integrations) — report library,
+        # never "unknown", when there is clearly source code present.
+        if _localized and not (framework_names & (_WEB_FRAMEWORKS | _API_FRAMEWORKS)):
+            return "library"
+
+        # Strong CLI signals: a CLI framework or an explicit cli entry point.
         if framework_names & _CLI_FRAMEWORKS or any(
             entry.kind == "cli" for entry in entry_points
-        ) or any(path.startswith("bin/") for path in flat_paths):
+        ):
             return "cli"
 
         if stack_names:
@@ -141,8 +164,105 @@ class TypeClassifier:
             if single in {"cpp", "dotnet"} and any(entry.kind == "cli" for entry in entry_points):
                 return "cli"
 
+        # BUG #4 (JobRunr field test): a multi-module JVM repo with no app-defining
+        # web/API framework is a library/toolkit, not an "unknown" — never let the
+        # first command of an audit emit a vacuous classification for a clearly
+        # structured codebase (e.g. JobRunr: core + per-framework adapter modules).
+        # This is checked BEFORE the weak `bin/`-directory CLI heuristic so a build
+        # output / wrapper `bin/` dir does not mislabel a library as a CLI.
+        if stack_names & {"java", "kotlin", "scala"} and self._is_multi_module(file_tree):
+            return "library"
+
+        # Weak CLI heuristic: a top-level bin/ directory (only when nothing stronger).
+        if any(path.startswith("bin/") for path in flat_paths):
+            return "cli"
+
         return "unknown" if stacks else None
 
+    def _is_multi_module(self, file_tree: dict[str, Any]) -> bool:
+        """True when the repo has >1 source module (distinct `*/src/...` roots)."""
+        _CODE_EXTS = (".java", ".kt", ".kts", ".scala", ".groovy")
+        modules = {
+            self._module_of(p)
+            for p in flatten_file_tree(file_tree)
+            if p.endswith(_CODE_EXTS)
+        }
+        modules.discard("")
+        return len(modules) >= 2
+
+    @staticmethod
+    def _module_of(path: str) -> str:
+        """Group a source path into its module root.
+
+        For Maven/Gradle layouts the module is everything before `/src/`
+        (e.g. `framework-support/jobrunr-quarkus/src/main/java/...` →
+        `framework-support/jobrunr-quarkus`). Otherwise the top-level directory.
+        """
+        norm = path.replace("\\", "/")
+        idx = norm.find("/src/")
+        if idx > 0:
+            return norm[:idx]
+        head, _, tail = norm.partition("/")
+        return head if tail else ""
+
+    _EVIDENCE_PATH_RE = re.compile(r"\(([^()]+)\)\s*$")
+
+    def _localized_adapter_frameworks(
+        self,
+        file_tree: dict[str, Any],
+        stacks: Sequence[StackDetection],
+        candidate_frameworks: set[str],
+    ) -> set[str]:
+        """Frameworks confined to a minority module while a framework-agnostic
+        module dominates the codebase (library + per-framework adapters).
+
+        Returns the subset of ``candidate_frameworks`` that should NOT drive the
+        project-type decision. A framework qualifies only when (a) the repo is
+        multi-module, (b) the framework's evidence files are all outside the
+        dominant source module, and (c) the framework has located evidence files
+        (a manifest-only/root detection applies repo-wide and never localizes).
+        """
+        if not candidate_frameworks:
+            return set()
+
+        _CODE_EXTS = (".java", ".kt", ".kts", ".scala", ".groovy")
+        module_file_counts: dict[str, int] = {}
+        for p in flatten_file_tree(file_tree):
+            if not p.endswith(_CODE_EXTS):
+                continue
+            mod = self._module_of(p)
+            module_file_counts[mod] = module_file_counts.get(mod, 0) + 1
+
+        # Need a genuine multi-module repo to reason about locality.
+        if len(module_file_counts) < 2:
+            return set()
+        dominant_module = max(module_file_counts, key=lambda m: module_file_counts[m])
+
+        # Collect evidence file paths per framework from detected_via.
+        evidence: dict[str, set[str]] = {}
+        for stack in stacks:
+            for fw in stack.frameworks:
+                if fw.name not in candidate_frameworks:
+                    continue
+                paths = evidence.setdefault(fw.name, set())
+                for ev in fw.detected_via:
+                    if ev.startswith("manifest:"):
+                        continue
+                    m = self._EVIDENCE_PATH_RE.search(ev)
+                    if m:
+                        paths.add(m.group(1).strip())
+
+        localized: set[str] = set()
+        for fw_name in candidate_frameworks:
+            files = evidence.get(fw_name) or set()
+            if not files:
+                # No locatable evidence (manifest-only) → applies repo-wide.
+                continue
+            modules = {self._module_of(f) for f in files}
+            if dominant_module not in modules:
+                localized.add(fw_name)
+        return localized
+
     def _is_fullstack(self, stacks: Sequence[StackDetection]) -> bool:
         has_web = False
         has_api = False

{sourcecode-1.68.0 → sourcecode-1.70.0}/src/sourcecode/detectors/java.py

@@ -90,6 +90,19 @@ _GRADLE_JAVA_VERSION_RE = re.compile(
 _GRADLE_JAVA_ENUM_RE = re.compile(
     r"""(?:sourceCompatibility|targetCompatibility)\s*=\s*JavaVersion\.VERSION_(\d+)"""
 )
+# BUG #4: a gradle line that genuinely declares a dependency or plugin. Matches a
+# quoted Maven coordinate (group:artifact, requires the colon), a plugins-block
+# `id '...'`, an `apply plugin:`, or a `classpath`/`platform(`/`enforcedPlatform(`
+# declaration. Deliberately does NOT match `it.name.contains('quarkus')`-style
+# subproject filters (a bare quoted name with no colon and no plugin/dep keyword).
+_GRADLE_DEP_LINE_RE = re.compile(
+    r"""['"][\w.\-]+:[\w.\-]+"""          # maven coordinate "group:artifact..."
+    r"""|\bclasspath\b"""
+    r"""|\b(?:enforced)?platform\s*\("""
+    r"""|\bapply\s+plugin\s*:"""
+    r"""|\bid\s*[('"]""",
+    re.IGNORECASE,
+)
 
 
 class JavaDetector(AbstractDetector):
@@ -279,7 +292,29 @@ class JavaDetector(AbstractDetector):
         original = "\n".join(read_text_lines(path))
         content = original.lower()
         sb_version = self._extract_gradle_sb_version(original)
-        return self._detect_jvm_frameworks(content, "build.gradle", sb_version=sb_version)
+        # BUG #4 (JobRunr field test): framework tokens must be matched only inside
+        # genuine dependency / plugin declarations, never anywhere in the file. A
+        # multi-module root build.gradle that EXCLUDES a subproject by name —
+        # `configure(subprojects.findAll { !it.name.contains('quarkus') })` — must
+        # not be read as "this project uses Quarkus". Restrict the scan to lines
+        # carrying a Maven coordinate / plugin id; the exclusion filter has neither.
+        dep_text = self._gradle_dependency_text(content)
+        return self._detect_jvm_frameworks(dep_text, "build.gradle", sb_version=sb_version)
+
+    @staticmethod
+    def _gradle_dependency_text(content: str) -> str:
+        """Keep only gradle lines that declare a dependency or plugin.
+
+        A real dependency carries a Maven coordinate (`group:artifact`...) and a
+        plugin carries an `id`/`plugin`/`classpath` token. Subproject-name filters
+        and arbitrary prose are dropped, so a framework substring there cannot
+        manufacture a phantom framework detection.
+        """
+        kept: list[str] = []
+        for line in content.splitlines():
+            if _GRADLE_DEP_LINE_RE.search(line):
+                kept.append(line)
+        return "\n".join(kept)
 
     def _extract_gradle_sb_version(self, content: str) -> str | None:
         m = _GRADLE_SB_PLUGIN_RE.search(content)