sourcecode 2.5.0__tar.gz → 2.5.2__tar.gz

{sourcecode-2.5.0 → sourcecode-2.5.2}/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## [2.5.2] — 2026-07-14
+
+**impact-chain correctness + cold-scan performance.** Two fixes surfaced by an
+adversarial audit across 12 real repositories (alfresco, keycloak, neo4j, jenkins,
+openmrs, ofbiz, jobrunr, eureka, BroadleafCommerce, spring-petclinic, and torture
+fixtures).
+
+### Fixed
+
+- **impact-chain lost same-class method callers (P0)** (`spring_impact.py`): a method
+  whose only callers were sibling methods in the same class (e.g. a private helper
+  `doWork()` invoked by `callWork()`) came back with **0 direct callers** — a false
+  "isolated / safe" verdict that defeated the 2.5.1 intra-class caller feature. The
+  `calls` edge existed in the reverse graph but the caller BFS discarded it: the
+  whole-class self-exclusion (v1.70.0 BUG #2) was applied to *method*-scoped queries,
+  where a *different* method on the same class is a legitimate caller, not
+  self-reference. Fix threads the existing `_method_scoped` flag into `_bfs_callers`;
+  method-scoped queries now exclude only genuine self-recursion, class-scoped queries
+  keep the cohesion exclusion. Verified: `TxService#doPrivateWork` → `[callPrivate]`
+  (was `[]`); cross-class blast radius unchanged (petclinic 13 endpoints).
+
+- **Quadratic cold scan on method-dense classes (P1)** (`repository_ir.py`):
+  `_intra_class_call_edges` ran a fresh regex search *per sibling method name* over each
+  method body — O(methods × body_len) per class, i.e. quadratic in method count. Large,
+  method-dense classes (generated parsers, multi-thousand-line test classes) made cold
+  scans pathological. Rewritten to a single pass per body (`_INTRA_CALL_RE`) that
+  collects call-site names and intersects them with the sibling index — O(body_len),
+  byte-identical edge set. Cold-scan wins: openmrs 43s→19s (2.3×), alfresco 220s→126s
+  (1.75×), jenkins 43s→35s. `_build_relations` cumulative time dropped 36.6s→3.9s
+  (openmrs profile).
+
+## [2.5.1] — 2026-07-14
+
+**impact-chain correctness fix — field-injected callers are no longer lost.** A service
+method reached only through an injected sibling (`someService.doWork(...)`, a lowercase
+field receiver) was reported as an isolated, zero-caller *low-risk* change — a dangerous
+false negative. The static call-graph resolved intra-class and static (`Type.method()`)
+invocations but never an instance call through a typed field, so no `calls` edge reached
+the target and the blast radius came back empty at `confidence=high`.
+
+### Fixed
+
+- **Receiver-typed call edges (IC-RTC)** (`repository_ir.py`): a repo-wide post-pass
+  emits method-level `calls` edges for instance invocations through a typed field
+  receiver (`field.method(...)`), joining facts already extracted — the invocation atom
+  (`receiver`/`callee`), the field's declared type, and the target type's method index.
+  No new parse. Unresolved, ambiguous, local, or library receivers yield nothing (an
+  unresolved fact stays unresolved rather than being guessed). Recovers the injected
+  cross-service caller the reverse graph previously missed.
+- **Method-scoped impact expansion** (`spring_impact.py`): a method-level query
+  (`Impl#foo`) now expands impl↔interface (CH-001a/b) to the **same-named** member only,
+  not the entire interface — so a change to `foo` no longer inherits the callers of a
+  sibling method `bar`. Class-level (whole-service) queries stay broad. Now that precise
+  `field.method(...)` edges exist, this removes latent caller over-reporting (measured:
+  a petclinic-rest method query dropped from 9 whole-controller false callers to the 6
+  real handler methods that call it).
+- **Inline-annotation field types** (`repository_ir.py`): `_extract_field_types` skipped
+  any line beginning with `@`, dropping single-line declarations such as
+  `@Autowired private Foo foo;`. Leading inline annotations are now stripped before the
+  field is read (brace counting runs on the stripped residual, so annotation string args
+  like `@GetMapping("/a/{id}")` cannot skew class-body depth).
+
+No public JSON contract changes; output stays deterministic. Regression coverage added in
+`tests/test_impact_receiver_typed_calls.py` (cross-service recovery, self-call exclusion,
+method-scope precision, `this.field` receivers, no phantom edges).
+
 ## [2.5.0] — 2026-07-13
 
 **Semantic Retrieval Engine v1 — a declarative, agent-ready query layer over ASK's

{sourcecode-2.5.0 → sourcecode-2.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.5.0
+Version: 2.5.2
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.5.0-blue)
+![Version](https://img.shields.io/badge/version-2.5.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -84,7 +84,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.5.0
+ask version                    # ask 2.5.1
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release

{sourcecode-2.5.0 → sourcecode-2.5.2}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.5.0-blue)
+![Version](https://img.shields.io/badge/version-2.5.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -46,7 +46,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.5.0
+ask version                    # ask 2.5.1
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release

{sourcecode-2.5.0 → sourcecode-2.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.5.0"
+version = "2.5.2"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.5.0 → sourcecode-2.5.2}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.5.0"
+__version__ = "2.5.2"

{sourcecode-2.5.0 → sourcecode-2.5.2}/src/sourcecode/repository_ir.py

@@ -1489,6 +1489,16 @@ def _method_body(raw_lines: list[str], start_idx: int) -> str:
     return "\n".join(out)
 
 
+# Intra-class call-site matcher: a bare `name(` (not preceded by a word char or '.')
+# OR an explicit `this.name(`. Group 1 = bare callee, group 2 = this-qualified callee.
+# Encodes the SAME two match forms the old per-sibling regex used, so the derived edge
+# set is byte-identical — but as ONE alternation scanned once per body instead of once
+# per sibling name (see _intra_class_call_edges perf note).
+_INTRA_CALL_RE = re.compile(
+    r'(?<![\w.])([A-Za-z_]\w*)\s*\(' r'|\bthis\s*\.\s*([A-Za-z_]\w*)\s*\('
+)
+
+
 def _intra_class_call_edges(symbols: list[SymbolRecord], source: str) -> list[RelationEdge]:
     """Method-level `calls` edges for intra-class invocations.
 
@@ -1528,13 +1538,20 @@ def _intra_class_call_edges(symbols: list[SymbolRecord], source: str) -> list[Re
         if not body:
             continue
         body = _STRING_LITERAL_RE.sub('', _strip_java_comments(body))
-        for name, fqns in sib.items():
+        # PERF: one pass over the body collects every bare / this-qualified callee name,
+        # then intersect with the sibling index. The old code ran a fresh regex search
+        # per sibling name — O(siblings × body_len) per method, i.e. quadratic in method
+        # count, which made large method-dense classes (generated parsers, 4k-line test
+        # classes) pathological (alfresco cold scan ~220s). This is O(body_len). The
+        # edge set is identical: _INTRA_CALL_RE matches the same two call forms.
+        called: set[str] = set()
+        for m in _INTRA_CALL_RE.finditer(body):
+            called.add(m.group(1) or m.group(2))
+        for name in sorted(called):        # sorted → deterministic edge order
             if name in _CALL_KEYWORDS:
                 continue
-            # bare `name(` (not preceded by word char or '.') OR explicit `this.name(`
-            pat = (r'(?<![\w.])' + re.escape(name) + r'\s*\('
-                   + r'|\bthis\s*\.\s*' + re.escape(name) + r'\s*\(')
-            if not re.search(pat, body):
+            fqns = sib.get(name)
+            if not fqns:
                 continue
             for tgt in fqns:
                 if tgt == caller.symbol:
@@ -1967,6 +1984,22 @@ def _extract_class_type_refs(symbols: list[SymbolRecord]) -> dict[str, list[dict
     return out
 
 
+_LEADING_ANNOT_RE = re.compile(r'^\s*@\w+(?:\s*\([^()]*\))?\s*')
+
+
+def _strip_leading_annotations(line: str) -> str:
+    """Strip leading inline annotations from a declaration line so the residual
+    declaration is still detected (`@Autowired private Foo f;` -> `private Foo f;`).
+    A pure annotation line (`@Override`, `@GetMapping("/x")`) strips to empty.
+    Nested-paren annotation args (rare on fields) are left intact — the residual
+    just won't match a decl regex, which is safe (a miss, never a wrong entry)."""
+    prev: Optional[str] = None
+    while line != prev:
+        prev = line
+        line = _LEADING_ANNOT_RE.sub('', line, count=1)
+    return line.strip()
+
+
 def _extract_field_types(source: str) -> dict[str, dict[str, str]]:
     """{class_fqn -> {field_name -> declared_type_simple_name}} for EVERY field
     (annotated or plain), the fact that binds an invocation receiver to a typed
@@ -1994,8 +2027,17 @@ def _extract_field_types(source: str) -> dict[str, dict[str, str]]:
             if "*/" not in stripped:
                 in_block = True
             continue
-        if not stripped or stripped.startswith("//") or stripped.startswith("*") or stripped.startswith("@"):
+        if not stripped or stripped.startswith("//") or stripped.startswith("*"):
             continue
+        if stripped.startswith("@"):
+            # A field/type decl may carry leading inline annotations
+            # (`@Autowired private Foo f;`). Strip them so the residual declaration is
+            # still detected; a pure annotation line strips to empty and is skipped as
+            # before. Brace counting below runs on the stripped residual, so annotation
+            # string args containing braces (`@GetMapping("/a/{id}")`) never skew depth.
+            stripped = _strip_leading_annotations(stripped)
+            if not stripped:
+                continue
         if stripped.startswith("package "):
             package = stripped[8:].rstrip(";").strip()
             continue
@@ -4351,6 +4393,84 @@ def extract_file_ir(
     return _assemble(symbols, relations, changed_symbols, spring_summary, route_diffs)
 
 
+def _receiver_typed_call_edges(
+    body_facts: dict[str, list[dict]],
+    field_types: dict[str, dict[str, str]],
+    symbols: list[SymbolRecord],
+) -> list[RelationEdge]:
+    """Method-level `calls` edges for instance invocations through a typed field
+    receiver (`field.method(...)`).
+
+    The per-file scans in `_build_relations` resolve intra-class (`m()`/`this.m()`)
+    and static (`Type.method()`, uppercase receiver) calls, but a call through a
+    field-injected or plainly-typed dependency goes through a lowercase receiver
+    variable (`nominasCalculoService.aplicarMejora(...)`) and matched none of them.
+    A service reached only via an injected sibling therefore had NO inbound `calls`
+    edge: impact-chain found 0 callers and reported a false-confident "no blast
+    radius / low risk isolated change" — a dangerous false negative.
+
+    Joins facts already extracted (no new parse — Prime Directive):
+      - invocation atom  (owner method → {receiver, callee})            [body_facts]
+      - declared type of `receiver` on the owner's class                [field_types]
+      - target type resolved to a SINGLE in-repo class FQN              [symbols]
+      - callee resolved to that class's method(s) of that name          [symbols]
+
+    Emits `owner_method --calls--> target_class#callee` (every overload of the name —
+    arity is not resolved by name alone, matching `_intra_class_call_edges`). Anything
+    unresolved — a local variable (no field entry), a JDK/library type, an ambiguous
+    simple name, or a callee the target class does not declare — yields nothing: an
+    unresolved fact stays unresolved rather than being guessed (INV honesty). Runs as
+    a repo-wide post-pass because the target type + its methods live in other files.
+    """
+    if not body_facts or not field_types:
+        return []
+
+    # type simple name → in-repo class FQN(s); class FQN → {method name → [method FQN]}
+    type_simple_to_fqn: dict[str, list[str]] = {}
+    class_methods: dict[str, dict[str, list[str]]] = {}
+    for s in symbols:
+        if s.type in ("class", "interface", "enum", "record") and "#" not in s.symbol:
+            type_simple_to_fqn.setdefault(s.symbol.rsplit(".", 1)[-1], []).append(s.symbol)
+        elif s.symbol_kind == "method" and "#" in s.symbol:
+            cls = _enclosing_class(s.symbol)
+            name = s.symbol.rsplit("#", 1)[1]
+            class_methods.setdefault(cls, {}).setdefault(name, []).append(s.symbol)
+
+    edges: list[RelationEdge] = []
+    for owner_fqn in sorted(body_facts):
+        owner_cls = _enclosing_class(owner_fqn)
+        fmap = field_types.get(owner_cls)
+        if not fmap:
+            continue
+        for atom in body_facts[owner_fqn]:
+            if atom.get("fact") != "invocation":
+                continue
+            receiver, callee = atom.get("receiver"), atom.get("callee")
+            if not receiver or receiver == "this" or not callee:
+                continue
+            tsimple = fmap.get(receiver)
+            if not tsimple:
+                continue                       # not a typed field (local / unknown)
+            tfqns = type_simple_to_fqn.get(tsimple)
+            if not tfqns or len(tfqns) != 1:
+                continue                       # unresolved / ambiguous type → skip (honest)
+            target_cls = tfqns[0]
+            if target_cls == owner_cls:
+                continue                       # intra-class handled by _intra_class_call_edges
+            target_methods = class_methods.get(target_cls, {}).get(callee)
+            if not target_methods:
+                continue                       # callee not declared on the target type
+            for mfqn in target_methods:
+                edges.append(RelationEdge(
+                    from_symbol=owner_fqn,
+                    to_symbol=mfqn,
+                    type="calls",
+                    confidence="medium",
+                    evidence={"type": "method_call", "value": f"{receiver}.{callee}(...)"},
+                ))
+    return edges
+
+
 def build_repo_ir(
     file_paths: list[str],
     root: Path,
@@ -4495,6 +4615,17 @@ def build_repo_ir(
         _annotation_reference_edges(_ann_ref_sources, all_symbols, all_relations, _same_pkg_map)
     )
 
+    # Instance calls through a typed field receiver (`field.method(...)`). The per-file
+    # scans resolve intra-class and static (`Type.method()`) calls but never a call
+    # through a lowercase field-injected dependency, so a service reached only via an
+    # injected sibling had 0 inbound `calls` edges and impact-chain reported a
+    # false-confident "no blast radius". Repo-wide post-pass (target type + methods are
+    # cross-file). Gated on body facts + field types being present (emit_body_facts).
+    if emit_body_facts:
+        all_relations.extend(
+            _receiver_typed_call_edges(_all_body_facts, _all_field_types, all_symbols)
+        )
+
     spring_summary = _build_spring_summary(all_symbols)
 
     # Deduplicate relations

{sourcecode-2.5.0 → sourcecode-2.5.2}/src/sourcecode/spring_impact.py

@@ -443,6 +443,7 @@ def _bfs_callers(
     reverse_graph: dict[str, dict[str, list[str]]],
     max_depth: int,
     impl_graph: object | None = None,
+    method_scoped: bool = False,
 ) -> tuple[list[str], list[str], bool]:
     """BFS from seed FQNs through reverse_graph.
 
@@ -481,8 +482,22 @@ def _bfs_callers(
     # into direct_callers and inflating the blast radius ~12×. Exclude any caller
     # whose owning class is one of the seed classes.
     seed_classes: set[str] = {normalize_owner_fqn(s) for s in seed_fqns}
+    seed_set: set[str] = set(seed_fqns)
     self_excluded: int = 0
 
+    # P0-IMPACT-01 fix: distinguish self-recursion from same-class sibling calls.
+    # For a METHOD-scoped query ("Foo#doWork"), a *different* method on the same class
+    # (e.g. Foo#callWork → Foo#doWork) is a legitimate caller — the only true
+    # "self-reference" is the seed method invoking itself (recursion). The v1.70.0
+    # whole-class exclusion is correct ONLY for CLASS-scoped queries, where a class's
+    # own members are members, not external callers. Applying it to method queries
+    # silently discarded the intra-class caller edges built by _intra_class_call_edges,
+    # producing a false "0 callers / isolated" for private helpers.
+    def _is_self_reference(caller: str) -> bool:
+        if method_scoped:
+            return caller in seed_set          # only genuine recursion of a seed method
+        return normalize_owner_fqn(caller) in seed_classes
+
     # BUG-004: index class FQN → list of method-level keys in reverse_graph.
     # Callers of Foo#doWork are stored under reverse_graph["Foo#doWork"], never
     # under reverse_graph["Foo"].  Without this index, BFS silently terminates
@@ -519,7 +534,7 @@ def _bfs_callers(
         for etype, fqn_list in _edges_for(seed):
             if etype not in _SKIP_EDGE_TYPES:
                 unique_direct_callers.update(
-                    c for c in fqn_list if normalize_owner_fqn(c) not in seed_classes
+                    c for c in fqn_list if not _is_self_reference(c)
                 )
 
     effective_depth = 1 if len(unique_direct_callers) > _BFS_CALLER_CAP else max_depth
@@ -534,7 +549,8 @@ def _bfs_callers(
         if caller in visited:
             return
         # BUG #2: a member of a seed class is not an external caller — drop it.
-        if normalize_owner_fqn(caller) in seed_classes:
+        # (Method-scoped queries drop only true self-recursion; see _is_self_reference.)
+        if _is_self_reference(caller):
             visited.add(caller)
             self_excluded += 1
             return
@@ -855,6 +871,22 @@ class ImpactOrchestrator:
         original_seed_classes: set[str] = {_class_of(s) for s in seed_fqns}
         # Subtype classes surfaced to the caller as the impacted implementation set.
         subtype_classes_added: set[str] = set()
+
+        # Method-scoped query (e.g. "Impl#foo"): impl/interface expansion must preserve
+        # the queried method's identity. A change to `foo` does not affect callers of a
+        # sibling method `bar`, so the expanded SEED symbols are restricted to the same
+        # method name(s). Class-level queries (a class node with no '#' in the seed)
+        # expand to all members, as before. This bound became observable once precise
+        # `field.method(...)` call edges exist: without it a method query inherited the
+        # callers of every sibling method on the interface (blast-radius inflation).
+        _queried_methods: set[str] = {s.rsplit("#", 1)[1] for s in seed_fqns if "#" in s}
+        _method_scoped = bool(_queried_methods) and all("#" in s for s in seed_fqns)
+
+        def _member_in_scope(sym: str) -> bool:
+            if not _method_scoped:
+                return True
+            return "#" in sym and sym.rsplit("#", 1)[1] in _queried_methods
+
         if impl_graph is not None:
             seed_classes_ch001 = {_class_of(s) for s in seed_fqns}
             impl_seeds: list[str] = []
@@ -867,7 +899,8 @@ class ImpactOrchestrator:
                         continue
                     subtype_classes_added.add(impl_class)
                     for sym in cir.symbols:
-                        if _class_of(sym) == impl_class and sym not in set(seed_fqns):
+                        if (_class_of(sym) == impl_class and sym not in set(seed_fqns)
+                                and _member_in_scope(sym)):
                             impl_seeds.append(sym)
             if impl_seeds:
                 seed_fqns = list(dict.fromkeys(seed_fqns + impl_seeds))
@@ -896,7 +929,8 @@ class ImpactOrchestrator:
                         continue
                     iface_classes_added.add(iface_class)
                     for sym in cir.symbols:
-                        if _class_of(sym) == iface_class and sym not in set(seed_fqns):
+                        if (_class_of(sym) == iface_class and sym not in set(seed_fqns)
+                                and _member_in_scope(sym)):
                             iface_seeds.append(sym)
             if iface_seeds:
                 seed_fqns = list(dict.fromkeys(seed_fqns + iface_seeds))
@@ -909,14 +943,22 @@ class ImpactOrchestrator:
 
         # ── 2. BFS through reverse graph ─────────────────────────────────
         direct_callers, indirect_callers, truncated, self_excluded = _bfs_callers(
-            seed_fqns, cir.reverse_graph, depth, impl_graph=impl_graph
+            seed_fqns, cir.reverse_graph, depth, impl_graph=impl_graph,
+            method_scoped=_method_scoped,
         )
         if self_excluded:
-            warnings.append(
-                f"Self-referential exclusion (BUG #2): {self_excluded} member(s) of the "
-                f"analyzed class were dropped from callers — a class's own methods are "
-                f"members, not external callers (they do not count toward blast radius)."
-            )
+            if _method_scoped:
+                warnings.append(
+                    f"Self-recursion excluded: {self_excluded} recursive self-call(s) of the "
+                    f"queried method were dropped from callers (a method is not its own "
+                    f"caller). Same-class sibling methods ARE counted as callers."
+                )
+            else:
+                warnings.append(
+                    f"Self-referential exclusion (BUG #2): {self_excluded} member(s) of the "
+                    f"analyzed class were dropped from callers — a class's own methods are "
+                    f"members, not external callers (they do not count toward blast radius)."
+                )
         if truncated:
             warnings.append(
                 "Hub-class guard active: symbol has > 500 direct callers — "