sourcecode 1.71.0__tar.gz → 1.72.0__tar.gz

{sourcecode-1.71.0 → sourcecode-1.72.0}/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## [1.72.0] — 2026-07-01
+
+### Fixed — correctness on a large real-world Spring Boot 3 monolith (Broadleaf Commerce CE field test)
+
+A downstream architecture audit of **BroadleafCommerce** (`97705634ac`, branch
+`develop-7.0.x`; ~3,000 Java classes, 13 Maven poms, Spring Boot 3.5 / Spring 6.2 /
+Hibernate 5.6) hand-verified against source surfaced seven reproducible
+correctness defects across `modernize`, `spring-audit`, `migrate-check`, and
+`export --integrations`. Each fix targets the root cause and adds regression
+coverage; all were re-verified against the live repo.
+
+- **`spring-audit` TX-005 — 100% false-positive rate (4/4) on expected-exception idioms.**
+  The "swallowed exception in `@Transactional`" rule flagged the standard JPA
+  control-flow idiom (`Query.getSingleResult()` → `catch (NoResultException)` →
+  insert; tolerant insert → `catch (EntityExistsException)`) and catches carrying an
+  explicit `// do nothing — acceptable condition` intent comment. TX-005 now skips
+  catches whose caught type is a well-known expected-control-flow exception
+  (`NoResultException`, `NonUniqueResultException`, `EntityExistsException`,
+  `EmptyResultDataAccessException`, …) and catches whose body documents a deliberate
+  no-op, while still flagging a genuine unexpected-exception swallow.
+- **`modernize` `statically_unreferenced` — ~95% false positives on annotation-constant nested classes.**
+  Two compounding defects: (a) the pre-scan fast path emitted nested types as
+  `pkg.Inner`, dropping the enclosing class, so distinct nested types with the same
+  simple name (Broadleaf has 25 `GroupName`s) collapsed onto one colliding FQN;
+  (b) static-constant reads inside annotation arguments
+  (`@AdminPresentation(group = GroupName.General)`, incl. the fully-qualified
+  `Outer.Nested.CONST` form and class-level annotations) were never counted as
+  references, so the constant holders read as zero-caller dead code. Now: nested
+  symbols are binary-qualified (`Outer.Inner`); a new `references` edge pass resolves
+  annotation-value reads (bare, inherited-nested via supertypes, and qualified
+  chains) in both parsed and pre-scan-skipped files. Presentation-holder false
+  positives on Broadleaf went 11→0 (the survivors are genuinely-unused declarations).
+- **`modernize` `cross_module_tangles` — re-emitted the subsystem list instead of coupling.**
+  The field echoed `{label, class_count, member_count}` per subsystem with no edge
+  data. It now measures real directed inter-subsystem coupling from structural graph
+  edges, with `edge_count`, `reverse_edge_count`, and `mutual` (bidirectional/cyclic
+  = the actual tangle) — e.g. Broadleaf `profile↔common` is now correctly flagged
+  mutual.
+- **`migrate-check` MIG-031 — test-scope config counted as a production blocker + wrong explanation.**
+  A test-only `bl-applicationContext-test-security.xml` (under `src/main/resources`,
+  loaded only by test `@ContextConfiguration`) inflated `blocking_count`; XML config
+  with a `test` filename marker is now classified `code_context: "test"`
+  (blocking_count 1→0). The explanation was a static OR-template asserting both
+  triggers; it now reports only the sub-pattern that actually matched (auto-config
+  vs versioned legacy schema).
+- **`export --integrations` — missed in-code Spring Security LDAP (false negative).**
+  Subclassing `LdapUserDetailsMapper` and using `DirContextOperations` — the
+  idiomatic Spring Security LDAP auth mapper — was undetected (Broadleaf reported 0
+  LDAP). Added `LdapUserDetailsMapper` / `DirContextOperations` / context-source
+  tokens; Broadleaf now reports 5 LDAP integration points.
+- **`explain` vs `modernize` in-degree — silently contradictory numbers.**
+  The same class showed different fan-in in the two commands with no explanation.
+  Both metrics are now self-describing: `modernize.high_coupling_nodes` documents
+  `in_degree` as the raw all-edge-type incoming count; `explain` labels its value
+  as "N distinct caller classes".
+- **`spring-audit` vs `endpoints` — unreconcilable endpoint counts.**
+  The canonical IR (feeding `spring-audit`, `impact`, `validation`) did not apply the
+  `endpoints` command's filter for framework dynamic-admin FQN-shaped paths, so its
+  count was silently inflated. The filter is now shared; `endpoints_analyzed` is
+  documented as the deduplicated canonical count (≤ `endpoints` total, difference =
+  multi-prefix collapse), reconciling 225 vs 220 on Broadleaf.
+
 ## [1.71.0] — 2026-07-01
 
 ### Fixed — framework-framing & migration reliability on a large non-Boot Spring repo (Jenkins core field test)

{sourcecode-1.71.0 → sourcecode-1.72.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.71.0
+Version: 1.72.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.71.0 → sourcecode-1.72.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.71.0"
+version = "1.72.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.71.0 → sourcecode-1.72.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.71.0"
+__version__ = "1.72.0"

{sourcecode-1.71.0 → sourcecode-1.72.0}/src/sourcecode/canonical_ir.py

@@ -16,6 +16,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import re
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Optional
@@ -37,6 +38,11 @@ IR_SCHEMA_VERSION = "1.0.0"
 # Edge types excluded from reverse graph (mirrors repository_ir._REVERSE_EXCLUDE)
 _REVERSE_EXCLUDE: frozenset[str] = frozenset({"annotated_with", "mapped_to"})
 
+# A route path that looks like a Java FQN is framework dynamic-admin routing, not a
+# real REST endpoint (mirrors the filter in repository_ir.extract_java_endpoints so
+# the CIR endpoint count reconciles with the `endpoints` command). See BUG #7.
+_FQN_PATH_RE: re.Pattern = re.compile(r"/(org|com|net|io|edu)\.[a-z][a-z0-9]*\.[a-zA-Z]")
+
 
 # ---------------------------------------------------------------------------
 # CanonicalSecurity
@@ -324,9 +330,17 @@ def ir_dict_to_canonical(
     # Build canonical endpoints from route_surface — stable ordering
     route_surface = ir.get("route_surface") or []
     # Deduplicate by endpoint id (route_surface can have duplicates from multi-prefix)
+    # BUG #7 (Broadleaf field test): the `endpoints` command (extract_java_endpoints)
+    # drops routes whose path looks like a Java FQN — framework dynamic-admin routing
+    # (Broadleaf @AdminSection registers entity class FQNs as URL segments) is not a
+    # real REST surface. The CIR endpoint list feeds `spring-audit` (endpoints_analyzed),
+    # `impact` and `validation`; it must apply the SAME filter so its count reconciles
+    # with `endpoints` instead of being silently inflated by those pseudo-routes.
     _seen_ids: set[str] = set()
     raw_endpoints: list[CanonicalEndpoint] = []
     for r in route_surface:
+        if _FQN_PATH_RE.search(r.get("path", "") or ""):
+            continue
         ep = _route_to_canonical_endpoint(r)
         if ep.id not in _seen_ids:
             _seen_ids.add(ep.id)

{sourcecode-1.71.0 → sourcecode-1.72.0}/src/sourcecode/cli.py

@@ -5764,11 +5764,63 @@ def modernize_cmd(
         key=lambda h: (-h["hotspot_score"], h["fqn"]),
     )[:15]
 
-    # Cross-module tangles: subsystems with high member count
-    tangle_modules = sorted(
-        [s for s in subsystems if len(s.get("members") or []) >= 5],
-        key=lambda s: -len(s.get("members") or []),
-    )[:10]
+    # Cross-module tangles: actual inter-subsystem coupling measured from the
+    # dependency graph, NOT a re-labelled subsystem list. For every structural
+    # edge whose endpoints live in two different subsystems we tally a directed
+    # (from_subsystem → to_subsystem) coupling count; pairs coupled in BOTH
+    # directions are the real tangles (bidirectional/cyclic module coupling).
+    _graph_edges: list = (ir.get("graph") or {}).get("edges") or []
+    # Structural coupling edge types. annotated_with / mapped_to / event edges are
+    # excluded (metadata + separate topology, not module-decomposition coupling).
+    _TANGLE_EDGE_TYPES = frozenset({
+        "imports", "injects", "extends", "implements",
+        "references", "calls", "instantiates", "returns",
+    })
+    _fqn_to_pkg: dict[str, str] = {}
+    _pkg_to_label: dict[str, str] = {}
+    for _s in subsystems:
+        _pp = _s.get("package_prefix") or _s.get("pkg") or ""
+        if not _pp:
+            continue
+        _pkg_to_label[_pp] = _s.get("label") or _s.get("name") or _pp
+        for _m in (_s.get("members") or []):
+            _fqn_to_pkg[_m] = _pp
+
+    from collections import Counter as _Counter
+    _pair_counts: "_Counter[tuple[str, str]]" = _Counter()
+    _pair_example: dict[tuple[str, str], str] = {}
+    for _e in _graph_edges:
+        if _e.get("type") not in _TANGLE_EDGE_TYPES:
+            continue
+        _a = _fqn_to_pkg.get(_e.get("from"))
+        _b = _fqn_to_pkg.get(_e.get("to"))
+        if not _a or not _b or _a == _b:
+            continue
+        _pair_counts[(_a, _b)] += 1
+        _pair_example.setdefault((_a, _b), f"{_e.get('from')} → {_e.get('to')}")
+
+    _cross_module_tangles = []
+    for (_a, _b), _cnt in sorted(
+        _pair_counts.items(), key=lambda kv: (-kv[1], kv[0])
+    ):
+        _reverse = _pair_counts.get((_b, _a), 0)
+        _cross_module_tangles.append({
+            "from_subsystem": _pkg_to_label.get(_a, _a),
+            "to_subsystem": _pkg_to_label.get(_b, _b),
+            "from_package": _a,
+            "to_package": _b,
+            "edge_count": _cnt,
+            "reverse_edge_count": _reverse,
+            # A mutual (cyclic) dependency is the actual "tangle" — both modules
+            # reference each other, so neither can be extracted independently.
+            "mutual": _reverse > 0,
+            "example": _pair_example.get((_a, _b), ""),
+        })
+    # Surface mutual tangles first (highest decomposition risk), then by strength.
+    _cross_module_tangles.sort(
+        key=lambda t: (not t["mutual"], -t["edge_count"], t["from_package"])
+    )
+    _cross_module_tangles = _cross_module_tangles[:15]
 
     _summary = {
         "total_classes": len([n for n in graph_nodes if n.get("type") in ("class", "interface")]),
@@ -5837,6 +5889,17 @@ def modernize_cmd(
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
                 for n in coupling_nodes
             ],
+            # BUG #6 (Broadleaf field test): make the in_degree metric self-describing
+            # so it is not confused with `explain`'s caller count. They differ by design.
+            "high_coupling_nodes_note": (
+                "in_degree = raw count of incoming graph edges across ALL edge types "
+                "(imports, injects, extends/implements, references, annotations), "
+                "counted at symbol level. This is deliberately larger than and NOT "
+                "equal to `sourcecode explain`'s caller count, which reports DISTINCT "
+                "dependent classes (DI dependents + reverse-call-graph callers, "
+                "deduplicated to class level). Use in_degree for blast-radius ranking, "
+                "explain's caller list for the concrete dependents to inspect."
+            ),
             "statically_unreferenced": [
                 {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
                 for n in dead_zones
@@ -5853,14 +5916,15 @@ def modernize_cmd(
             ],
             "subsystem_summary": _subsystem_summary,
             "subsystem_summary_note": _subsystem_summary_note,
-            "cross_module_tangles": [
-                {
-                    "label": s.get("label") or s.get("name") or "",
-                    "class_count": _class_count(s.get("members") or []),
-                    "member_count": len(s.get("members") or []),
-                }
-                for s in tangle_modules
-            ],
+            "cross_module_tangles": _cross_module_tangles,
+            "cross_module_tangles_note": (
+                "Directed inter-subsystem coupling measured from structural graph "
+                "edges (imports/injects/extends/implements/references/calls). "
+                "edge_count = edges from_package→to_package; mutual=true marks a "
+                "bidirectional (cyclic) dependency — the actual tangle that blocks "
+                "independent module extraction. Empty means no cross-subsystem "
+                "structural coupling was detected."
+            ),
             # BUG-05 fix: don't recommend "Start with hotspot_candidates" when the list is empty.
             "recommendation": (
                 (

{sourcecode-1.71.0 → sourcecode-1.72.0}/src/sourcecode/explain.py

@@ -298,10 +298,15 @@ def _structural_purpose(
     head = f"Likely {role} (no DI annotations found)" if role else \
         "Likely a structurally significant class (no DI annotations found)"
     signals: list[str] = []
+    # BUG #6 (Broadleaf field test): this counts DISTINCT dependent classes (DI
+    # dependents + reverse-call-graph callers, deduped to class level), which is a
+    # different metric from modernize's node.in_degree (raw incoming-edge count
+    # across ALL edge types, symbol-level). Name it explicitly so the two numbers
+    # are not read as a contradiction when cross-referenced.
     if in_degree >= 3:
-        signals.append(f"high in-degree ({in_degree})")
+        signals.append(f"high fan-in ({in_degree} distinct caller classes)")
     elif in_degree:
-        signals.append(f"in-degree {in_degree}")
+        signals.append(f"{in_degree} distinct caller class{'es' if in_degree != 1 else ''}")
     if lifecycle:
         signals.append(f"lifecycle methods detected ({'/'.join(lifecycle)})")
     suffix = f" — {', '.join(signals)}" if signals else ""

{sourcecode-1.71.0 → sourcecode-1.72.0}/src/sourcecode/integration_detector.py

@@ -83,6 +83,17 @@ _TOKEN_CLIENTS: "tuple[tuple[str, str, str], ...]" = (
     ("InitialLdapContext", "ldap", "jndi-ldap"),
     ("InitialDirContext", "ldap", "jndi-ldap"),
     ("LdapContext", "ldap", "jndi-ldap"),
+    # Spring Security LDAP authentication (BUG #5, Broadleaf field test): the
+    # idiomatic auth integration is a UserDetails mapper that extends
+    # LdapUserDetailsMapper and consumes DirContextOperations — neither uses
+    # LdapTemplate/ContextSource directly, so the connection-type tokens above
+    # miss it entirely. These types come from spring-security-ldap / spring-ldap
+    # and are unambiguous LDAP integration points.
+    ("LdapUserDetailsMapper", "ldap", "spring-security-ldap"),
+    ("DirContextOperations", "ldap", "spring-ldap"),
+    ("LdapContextSource", "ldap", "spring-ldap"),
+    ("DefaultSpringSecurityContextSource", "ldap", "spring-security-ldap"),
+    ("BindAuthenticator", "ldap", "spring-security-ldap"),
     # Mail / SMTP (JavaMail / Jakarta Mail)
     ("JavaMailSender", "smtp", "spring-mail"),
     ("MimeMessage", "smtp", "javamail"),

{sourcecode-1.71.0 → sourcecode-1.72.0}/src/sourcecode/migrate_check.py

@@ -645,6 +645,18 @@ def _classify_code_context(finding: "MigrationFinding") -> str:
     if is_test_or_fixture_path(path):
         return "test"
     norm = path.replace("\\", "/").lower()
+    # BUG #4 (Broadleaf field test): a Spring XML config file can live under
+    # src/main/resources yet be test-only scaffolding loaded exclusively by
+    # test @ContextConfiguration (e.g. bl-applicationContext-test-security.xml).
+    # is_test_or_fixture_path deliberately ignores the filename, so a `test`
+    # marker in the config file's own name is not seen. For XML config, a `test`
+    # token in the base filename is a strong, low-FP test-scope signal —
+    # production context files are not named `-test-`. Keep it out of
+    # blocking_count so test scaffolding never inflates the headline blocker.
+    if norm.endswith(".xml"):
+        base = norm.rsplit("/", 1)[-1]
+        if re.search(r"(?:^|[-_.])test(?:[-_.]|$)", base):
+            return "test"
     if any(frag in norm for frag in _GENERATED_PATH_FRAGMENTS):
         return "generated"
     # javax.annotation.Generated is the marker emitted into autogenerated code.
@@ -936,6 +948,42 @@ def _find_non_java_files(
     return xml_files, build_files
 
 
+def _xml_explanation_for(rule: "_XmlRule", matches: list) -> str:
+    """Return an explanation reflecting the sub-pattern that actually matched.
+
+    BUG #4 (Broadleaf field test): MIG-031's pattern is an OR of two independent
+    triggers — old-style `<http auto-config="true">` and a versioned legacy schema
+    (spring-security-[2-5].x.xsd). The static template asserted BOTH, so a file
+    that only used auto-config (its schema line already being the unversioned
+    spring-security.xsd) got a factually wrong explanation claiming a versioned
+    schema. Emit only the condition(s) present in this file.
+    """
+    if rule.id != "MIG-031":
+        return rule.explanation
+    matched_text = " ".join(m.group(0).lower() for m in matches)
+    has_autoconfig = "auto-config" in matched_text
+    has_versioned_schema = bool(re.search(r"spring-security-[2345]\.", matched_text))
+    triggers: list[str] = []
+    if has_autoconfig:
+        triggers.append(
+            "uses the old-style <http auto-config='true'> shortcut, which was "
+            "removed in Spring Security 6"
+        )
+    if has_versioned_schema:
+        triggers.append(
+            "references a versioned legacy schema (spring-security-[2-5].x.xsd) "
+            "whose namespace attributes changed in Spring Security 6"
+        )
+    if not triggers:  # defensive — pattern matched but neither branch classified
+        return rule.explanation
+    return (
+        "XML-based Spring Security configuration in this file "
+        + " and ".join(triggers)
+        + ". Spring Security 6 (Spring Boot 3) requires migrating this to "
+        "Java-based @Configuration with a SecurityFilterChain @Bean."
+    )
+
+
 def _scan_xml_file(text: str, rel_path: str) -> list["MigrationFinding"]:
     """Apply XML rules to raw XML text. Returns one finding per matched rule."""
     findings: list[MigrationFinding] = []
@@ -947,6 +995,7 @@ def _scan_xml_file(text: str, rel_path: str) -> list["MigrationFinding"]:
             continue
         first_line = text[: matches[0].start()].count("\n") + 1
         snippets = [m.group(0)[:120].strip() for m in matches[:5]]
+        explanation = _xml_explanation_for(rule, matches)
         findings.append(
             MigrationFinding(
                 id=MigrationFinding.make_id(rule.id, rel_path),
@@ -956,7 +1005,7 @@ def _scan_xml_file(text: str, rel_path: str) -> list["MigrationFinding"]:
                 source_file=rel_path,
                 first_line=first_line,
                 imports_found=snippets,
-                explanation=rule.explanation,
+                explanation=explanation,
                 fix_hint=rule.fix_hint,
                 migration_target=rule.migration_target,
                 openrewrite_recipe=rule.openrewrite_recipe,