sourcecode 2.5.12__py3-none-any.whl → 2.5.15__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.5.12"
+__version__ = "2.5.15"

sourcecode/canonical_ir.py

@@ -398,9 +398,17 @@ def ir_dict_to_canonical(
     # real REST surface. The CIR endpoint list feeds `spring-audit` (endpoints_analyzed),
     # `impact` and `validation`; it must apply the SAME filter so its count reconciles
     # with `endpoints` instead of being silently inflated by those pseudo-routes.
+    # Endpoints declared in a test-fixture / test-utility module are tagged
+    # scope="test_util" on route_surface by build_repo_ir. They are excluded from the
+    # canonical endpoint list for the same reason as the FQN filter above: the CIR
+    # surface feeds impact-chain, pr-impact, review-pr and spring-audit, and test
+    # scaffolding is not production HTTP exposure. route_surface itself keeps them
+    # (raw evidence); only this canonical projection drops them.
     _seen_ids: set[str] = set()
     raw_endpoints: list[CanonicalEndpoint] = []
     for r in route_surface:
+        if r.get("scope") == "test_util":
+            continue
         if _FQN_PATH_RE.search(r.get("path", "") or ""):
             continue
         ep = _route_to_canonical_endpoint(r)

sourcecode/classifier.py

@@ -37,6 +37,26 @@ _WEB_FRAMEWORKS = {"Next.js", "React", "Vue", "Svelte", "Vite", "Flutter", "Phoe
 _CLI_FRAMEWORKS = {"Typer", "Cobra", "Clap"}
 _API_STACKS = {"python", "go", "java", "php", "ruby", "dotnet", "kotlin", "scala"}
 
+# Source-file extensions per stack — single table shared by the confidence
+# enrichment (_count_extension_hits) and the primary-stack evidence tiebreaker
+# (select_primary_stack). Kept in one place so the two never diverge.
+_STACK_EXTENSIONS: dict[str, tuple[str, ...]] = {
+    "python": (".py",),
+    "nodejs": (".js", ".ts", ".tsx"),
+    "go": (".go",),
+    "rust": (".rs",),
+    "java": (".java",),
+    "php": (".php",),
+    "ruby": (".rb",),
+    "dart": (".dart",),
+    "dotnet": (".cs", ".fs"),
+    "elixir": (".ex", ".exs"),
+    "kotlin": (".kt", ".kts"),
+    "scala": (".scala",),
+    "terraform": (".tf",),
+    "cpp": (".c", ".cc", ".cpp", ".cxx", ".hpp", ".h"),
+}
+
 # Center-of-gravity gate for the "api" decision (neo4j field test).
 # The historical rule was pure PRESENCE: any API framework on the classpath →
 # project_type="api". That mislabels a large engine/platform that merely exposes a
@@ -63,6 +83,59 @@ _API_SURFACE_ENTRY_KINDS = frozenset({
 ConfidenceLevel = Literal["high", "medium", "low"]
 
 
+def _primary_ext_hits(stack_name: str, file_paths: Sequence[str]) -> int:
+    exts = _STACK_EXTENSIONS.get(stack_name, ())
+    if not exts:
+        return 0
+    return sum(1 for p in file_paths if p.endswith(exts))
+
+
+def select_primary_stack(
+    stacks: Sequence[StackDetection],
+    project_type: str | None,
+    file_paths: Sequence[str] | None = None,
+) -> list[StackDetection]:
+    """Single authority for which stack is primary.
+
+    Marks exactly ONE stack instance ``primary=True`` (all others ``False``) on the
+    FINAL assembled stack set (root + workspace stacks). Selection order:
+    ``(priority, confidence, manifest, source-file volume)``. The volume component is
+    a pure tiebreaker — it decides only when the prior three tie (e.g. a polyglot repo
+    where a Java and a .NET stack are both manifest-detected API stacks), so a 1-file
+    .NET example never outranks 86 Java files. Being last, it never reorders stacks
+    that already differ on the earlier components.
+
+    This is the ONLY place a primary decision is made. Every consumer must read
+    ``stack.primary`` — none may re-select or invent a ``stacks[0]`` fallback.
+    """
+    stack_list = list(stacks)
+    if not stack_list:
+        return stack_list
+    paths = list(file_paths or [])
+
+    def sort_key(stack: StackDetection) -> tuple[int, int, int, int]:
+        score = {"low": 0, "medium": 1, "high": 2}.get(stack.confidence, 0)
+        manifest_weight = 1 if stack.manifests else 0
+        priority = 0
+        # Backend server-side stacks with manifest evidence outrank frontend stacks
+        # in fullstack projects (e.g. Java+Spring wins over nodejs+Angular).
+        if (project_type in {"fullstack", "api"}
+                and stack.stack in _API_STACKS
+                and stack.manifests):
+            priority = 4
+        elif (project_type in {"webapp", "fullstack"} and stack.stack in {"nodejs", "elixir"}
+              or project_type == "api" and stack.stack in _API_STACKS
+              or project_type == "cli" and any(
+                  framework.name in _CLI_FRAMEWORKS for framework in stack.frameworks
+              )
+              or project_type == "cli" and stack.stack in {"cpp", "dotnet"}):
+            priority = 3
+        return (priority, score, manifest_weight, _primary_ext_hits(stack.stack, paths))
+
+    winner = max(stack_list, key=sort_key)
+    return [replace(s, primary=(s is winner)) for s in stack_list]
+
+
 class TypeClassifier:
     """Clasifica project_type y enriquece stacks con confianza/primary."""
 
@@ -74,15 +147,12 @@ class TypeClassifier:
     ) -> tuple[list[StackDetection], str | None]:
         enriched = [self._enrich_stack(file_tree, stack, entry_points) for stack in stacks]
         project_type = self._classify_project_type(file_tree, enriched, entry_points)
-        primary_stack = self._select_primary_stack(enriched, project_type)
-
-        final_stacks: list[StackDetection] = []
-        primary_assigned = False
-        for stack in enriched:
-            is_primary = stack.stack == primary_stack and not primary_assigned
-            if is_primary:
-                primary_assigned = True
-            final_stacks.append(replace(stack, primary=is_primary))
+        # Delegate to the single primary-stack authority. enrich only ever sees the
+        # ROOT stacks; the authority runs again at model finalization over the full
+        # root+workspace set (that call is the one consumers read).
+        final_stacks = select_primary_stack(
+            enriched, project_type, flatten_file_tree(file_tree)
+        )
         return final_stacks, project_type
 
     def _enrich_stack(
@@ -371,50 +441,8 @@ class TypeClassifier:
                 has_api = True
         return has_web and has_api
 
-    def _select_primary_stack(
-        self, stacks: Sequence[StackDetection], project_type: str | None
-    ) -> str | None:
-        if not stacks:
-            return None
-
-        def sort_key(stack: StackDetection) -> tuple[int, int, int]:
-            score = {"low": 0, "medium": 1, "high": 2}.get(stack.confidence, 0)
-            manifest_weight = 1 if stack.manifests else 0
-            priority = 0
-            # Backend server-side stacks with manifest evidence outrank frontend stacks
-            # in fullstack projects (e.g. Java+Spring wins over nodejs+Angular).
-            if (project_type in {"fullstack", "api"}
-                    and stack.stack in _API_STACKS
-                    and stack.manifests):
-                priority = 4
-            elif (project_type in {"webapp", "fullstack"} and stack.stack in {"nodejs", "elixir"}
-                  or project_type == "api" and stack.stack in _API_STACKS
-                  or project_type == "cli" and any(
-                      framework.name in _CLI_FRAMEWORKS for framework in stack.frameworks
-                  )
-                  or project_type == "cli" and stack.stack in {"cpp", "dotnet"}):
-                priority = 3
-            return (priority, score, manifest_weight)
-
-        return max(stacks, key=sort_key).stack
-
     def _count_extension_hits(self, file_tree: dict[str, Any], stack: str) -> int:
-        extensions = {
-            "python": (".py",),
-            "nodejs": (".js", ".ts", ".tsx"),
-            "go": (".go",),
-            "rust": (".rs",),
-            "java": (".java",),
-            "php": (".php",),
-            "ruby": (".rb",),
-            "dart": (".dart",),
-            "dotnet": (".cs", ".fs"),
-            "elixir": (".ex", ".exs"),
-            "kotlin": (".kt", ".kts"),
-            "scala": (".scala",),
-            "terraform": (".tf",),
-            "cpp": (".c", ".cc", ".cpp", ".cxx", ".hpp", ".h"),
-        }.get(stack, ())
+        extensions = _STACK_EXTENSIONS.get(stack, ())
         return sum(1 for path in flatten_file_tree(file_tree) if path.endswith(extensions))
 
     def _score_to_confidence(self, score: int) -> ConfidenceLevel:

sourcecode/cli.py

@@ -1965,6 +1965,13 @@ def main(
         analyzer_fingerprints=_fingerprints,
         traversal_topology=_topology.as_dict(),
     )
+    # Single primary-stack authority over the FINAL assembled set (root + workspace
+    # stacks). enrich marked the root stacks; workspace stacks were appended after,
+    # so re-run the one authority here — idempotent — so every consumer of sm.stacks
+    # reads a coherent primary flag.
+    from sourcecode.classifier import select_primary_stack as _select_primary_stack
+    from sourcecode.tree_utils import flatten_file_tree as _flatten_ft
+    stacks = _select_primary_stack(stacks, project_type, _flatten_ft(file_tree))
     sm = SourceMap(
         metadata=metadata,
         file_tree=file_tree,

sourcecode/detectors/java.py

@@ -67,6 +67,16 @@ _BOOTSTRAP_ANNOTATION_RE = re.compile(
     r'EnableAutoConfiguration|SpringBootConfiguration)\b'
     r'|\bextends\s+SpringBootServletInitializer\b'
 )
+# Comment strippers — a main()/bootstrap annotation inside a javadoc example or a
+# comment is NOT an entry point (e.g. Broadleaf's *AutoConfiguration classes whose
+# javadoc shows `public static void main` and mentions @SpringBootApplication).
+# Detection of bootstrap entries must run on de-commented source.
+_BLOCK_COMMENT_RE = re.compile(r'/\*.*?\*/', re.DOTALL)
+_LINE_COMMENT_RE = re.compile(r'//[^\n]*')
+
+
+def _strip_java_comments(source: str) -> str:
+    return _LINE_COMMENT_RE.sub(' ', _BLOCK_COMMENT_RE.sub(' ', source))
 
 # --- Keycloak / Quarkus SPI ---
 # Matches "implements EventListenerProvider" or "implements Foo, EventListenerProvider, Bar"
@@ -533,12 +543,21 @@ class JavaDetector(AbstractDetector):
         _other_files = [p for p in _non_test if "Controller" not in p]
         scan_candidates = _ctrl_files + _other_files[:max(0, _MAX_JAVA_ENTRY_SCAN - len(_ctrl_files))]
 
+        # Paths already emitted as application entries by the name-gated step-1 scan,
+        # so the annotation scan (which now also recovers main()-bearing files) does
+        # not list the same bootstrap twice.
+        _app_paths = {ep.path for ep in entry_points if ep.kind == "application"}
         annotation_eps: list[EntryPoint] = []
         for rel_path in scan_candidates:
             if len(annotation_eps) >= _MAX_ANNOTATION_ENTRY_POINTS:
                 break
             abs_path = context.root / rel_path
-            annotation_eps.extend(self._scan_java_file_for_entry_points(abs_path, rel_path))
+            for _ep in self._scan_java_file_for_entry_points(abs_path, rel_path):
+                if _ep.kind == "application":
+                    if _ep.path in _app_paths:
+                        continue
+                    _app_paths.add(_ep.path)
+                annotation_eps.append(_ep)
         entry_points.extend(annotation_eps)
 
         # 3. web.xml servlet/filter declarations
@@ -611,6 +630,7 @@ class JavaDetector(AbstractDetector):
             content = abs_path.read_text(encoding="utf-8", errors="replace")
         except OSError:
             return None
+        content = _strip_java_comments(content)
         if _BOOTSTRAP_ANNOTATION_RE.search(content):
             return "bootstrap_annotation"
         if _MAIN_METHOD_RE.search(content):
@@ -678,6 +698,20 @@ class JavaDetector(AbstractDetector):
                 and "ControllerAdvice" not in content
                 and not any(ann in content for ann in _CUSTOM_SECURITY_ANNOTATIONS)
                 and not has_jax_rs and not has_cdi and not has_spi):
+            # Not a controller/security/DI file — but it may still be an application
+            # entry point. The name-gated step-1 scan only reads *Application.java /
+            # *Main.java, so a real main(String[]) in a differently-named class (e.g.
+            # neo4j's Neo4jCommunity.java server bootstrap) would otherwise be invisible,
+            # leaving a client CLI named Main.java as the sole reported bootstrap. Reuse
+            # the content already read here; strip comments first so a main()/annotation
+            # in a javadoc example is never mistaken for a real entry point.
+            _decommented = _strip_java_comments(content)
+            if _BOOTSTRAP_ANNOTATION_RE.search(_decommented):
+                return [EntryPoint(path=rel_path, stack="java", kind="application",
+                                   source="bootstrap_annotation")]
+            if _MAIN_METHOD_RE.search(_decommented):
+                return [EntryPoint(path=rel_path, stack="java", kind="application",
+                                   source="main_method")]
             return []
 
         if _REST_CONTROLLER_RE.search(content):

sourcecode/endpoint_metrics.py

@@ -30,7 +30,10 @@ ENDPOINT_SURFACE_RECONCILIATION: str = (
     "handler after inheritance projection and JAX-RS sub-resource-locator composition. "
     "It is NOT the canonical API surface — it still contains framework dynamic-admin "
     "routes whose path is a Java FQN (e.g. /org.broadleafcommerce...), which the "
-    "`endpoints` command excludes. Endpoint counts differ across commands BY DESIGN "
+    "`endpoints` command excludes, and endpoints from test-fixture / test-utility "
+    "modules (tagged scope=\"test_util\"), which the canonical CIR surface excludes so "
+    "impact-chain / pr-impact / spring-audit do not report test scaffolding as "
+    "production HTTP exposure. Endpoint counts differ across commands BY DESIGN "
     "and are not contradictory; expected ordering for one repo is "
     "repo-ir.route_surface (raw, includes FQN-shaped framework routes) >= "
     "endpoints.total (canonical REST/API surface, FQN-shaped routes filtered out) >= "

sourcecode/path_filters.py

@@ -120,6 +120,85 @@ def is_test_or_fixture_path(path: str) -> bool:
     return False
 
 
+# Infrastructure words that, combined with a delimited "test" token in the same
+# directory segment, identify a module whose code is test scaffolding even though
+# it lives under src/main (e.g. "server-test-utils", "foo-testkit"). Kept narrow
+# on purpose: the "test" token must be present in the SAME segment, so packages
+# named "utils"/"support"/"tools" alone never match.
+_TEST_INFRA_TOKENS = frozenset({
+    "util", "utils", "fixture", "fixtures", "support",
+    "framework", "kit", "harness", "tools", "tool",
+    "helper", "helpers", "mock", "mocks", "stub", "stubs", "dummy",
+})
+
+# Glued (non-hyphenated) test-fixture module suffixes.
+_TEST_INFRA_SUFFIXES = (
+    "testutils", "testutil", "testkit", "testfixtures", "testfixture",
+    "testsupport", "testframework", "testharness", "testtools",
+    "testhelpers", "testmocks", "teststubs",
+)
+
+
+def is_test_fixture_module_path(path: str) -> bool:
+    """Return True when *path* belongs to a test-fixture / test-utility MODULE.
+
+    Structural, name-agnostic: a directory segment must contain a hyphen/underscore
+    -delimited ``test`` token together with an infrastructure word (util(s),
+    fixture(s), support, framework, kit, harness, tools, helper(s), mock(s),
+    stub(s), dummy) — e.g. ``server-test-utils``, ``foo-testkit``,
+    ``bar-test-support`` — or match a known test-module segment outright.
+
+    This is deliberately NARROWER than :func:`is_test_or_fixture_path`: it targets
+    modules that ship HTTP resources, JAX-RS ``@Path`` fixtures, or dummy
+    controllers under ``src/main`` so they are not misreported as production API
+    surface. Requiring both tokens in one segment keeps legitimate ``utils`` /
+    ``support`` / ``tools`` packages from ever matching.
+    """
+    norm = path.replace("\\", "/").lower()
+    parts = norm.split("/")
+    for part in parts[:-1]:  # skip the filename
+        bare = part.rstrip("/")
+        if bare in _TEST_MODULE_SEGMENTS:
+            return True
+        if bare.endswith(_TEST_INFRA_SUFFIXES):
+            return True
+        toks = bare.replace("_", "-").split("-")
+        if "test" in toks and any(t in _TEST_INFRA_TOKENS for t in toks):
+            return True
+    return False
+
+
+_EXAMPLE_MODULE_TOKENS = frozenset({
+    "example", "examples", "demo", "demos", "sample", "samples", "showcase",
+})
+
+
+def is_example_module_path(path: str) -> bool:
+    """Return True when *path* is inside an example/demo MODULE directory.
+
+    Structural: a directory segment above the source root carries a hyphen/underscore
+    -delimited example/demo token (e.g. ``eureka-examples/src/main/java/...``). Package
+    components below the source root (``io/confluent/examples/...``) are NOT matched —
+    only a module directory is a functional role; a package of the same name is not.
+    """
+    norm = path.replace("\\", "/").lower()
+    # Prepend "/" so a relative path ("src/main/...") matches the same boundary as an
+    # absolute one; without this the head-truncation silently failed and package
+    # components below the source root (e.g. ".../samples/petclinic/...") false-matched.
+    probe = "/" + norm
+    head = norm
+    for root in ("/src/main/", "/src/test/", "/src/"):
+        idx = probe.find(root)
+        if idx >= 0:
+            head = probe[:idx]
+            break
+    for seg in head.split("/"):
+        toks = seg.replace("_", "-").split("-")
+        if any(t in _EXAMPLE_MODULE_TOKENS for t in toks):
+            return True
+    return False
+
+
 def is_vendor_path(path: str) -> bool:
     """Return True when *path* is inside a vendored / third-party directory.
 

sourcecode/repository_ir.py

@@ -25,7 +25,10 @@ from typing import Any, Iterable, Optional
 from sourcecode.caller_metrics import CALLER_METRIC_RECONCILIATION
 from sourcecode.endpoint_metrics import ENDPOINT_SURFACE_RECONCILIATION
 from sourcecode.fqn_utils import normalize_owner_fqn as _normalize_owner_fqn
-from sourcecode.path_filters import is_test_path as _is_test_path
+from sourcecode.path_filters import (
+    is_test_path as _is_test_path,
+    is_test_fixture_module_path as _is_test_fixture_module_path,
+)
 from sourcecode.security_config import (
     CustomSecuritySpec,
     capture_markers as _capture_markers,
@@ -4176,6 +4179,23 @@ def _assemble(
     _route_surface = _build_route_surface(
         sorted_syms, route_diffs, extends_map=_extends_map, custom_security=custom_security
     )
+    # Tag routes that originate in a test-fixture / test-utility module (dummy web
+    # services, JAX-RS @Path fixtures shipped under src/main of a *-test-utils /
+    # testsuite / test-framework module). route_surface stays RAW evidence — nothing
+    # is dropped here; the tag lets the CIR endpoint projection (ir_dict_to_canonical)
+    # exclude them so every CIR consumer (impact-chain, pr-impact, review-pr,
+    # spring-audit) shares one production-endpoint definition with the `endpoints`
+    # command, while repo-ir can still see the full surface. Mirrors the scope tag
+    # applied in extract_java_endpoints.
+    _rs_fqn_file = {
+        s.symbol: (s.source_file or s.declaring_file)
+        for s in sorted_syms
+        if s.type in ("class", "interface")
+    }
+    for _r in _route_surface:
+        _rf = _rs_fqn_file.get(_r.get("effective_class", ""), "")
+        if _rf and _is_test_fixture_module_path(_rf):
+            _r["scope"] = "test_util"
     _analysis_gaps = _compute_analysis_gaps(
         sorted_syms, spring_summary, _route_surface, sorted_rels,
         unparsed_type_files=unparsed_type_files,
@@ -5584,7 +5604,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     """
     import re as _re
     from typing import Any as _Any
-    from sourcecode.path_filters import is_test_path
+    from sourcecode.path_filters import is_test_path, is_test_fixture_module_path
 
     _EXTENDS_FROM_SIG = _re.compile(r'\bextends\s+(\w+)')
 
@@ -5753,6 +5773,16 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     endpoint_warnings = _recovery["warnings"]
     _openapi_spec_path = _recovery["spec_path"]
 
+    # Map each declared class/interface FQN to its source file so an endpoint can be
+    # traced back to the MODULE that ships it. Used to flag endpoints that originate
+    # in a test-fixture / test-utility module (dummy web services, JAX-RS @Path
+    # fixtures) living under src/main — these are not production API surface.
+    _fqn_to_file: dict[str, str] = {
+        s.symbol: (s.source_file or s.declaring_file)
+        for s in all_symbols
+        if s.type in ("class", "interface")
+    }
+
     endpoints: list[dict] = []
     for route in routes:
         handler = (
@@ -5769,6 +5799,9 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             "handler": handler,
             "return_type": route.get("return_type", "void"),
         }
+        _src = _fqn_to_file.get(route.get("effective_class", ""), "")
+        if _src and is_test_fixture_module_path(_src):
+            entry["scope"] = "test_util"
         # Use security_annotations already extracted by _build_route_surface
         # via the canonical _route_security_from_sym extractor.
         security_info = route.get("security_annotations")
@@ -5791,6 +5824,14 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     )
     endpoints = [e for e in endpoints if not _FQN_PATH_RE.search(e.get("path", ""))]
 
+    # Partition test-fixture/test-utility endpoints out of the production surface.
+    # They ship under src/main of a *-test-utils / *-testkit / test-framework module
+    # (dummy web services, JAX-RS @Path fixtures) and must not be reported as, or
+    # counted with, the real API surface — but they are preserved in their own bucket
+    # so nothing is silently dropped and the exclusion is auditable.
+    _test_util_endpoints = [e for e in endpoints if e.get("scope") == "test_util"]
+    endpoints = [e for e in endpoints if e.get("scope") != "test_util"]
+
     # "no_security_signal" = no recognized security annotation at method OR class level.
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
     # per-endpoint annotations — this count reflects annotation-based coverage only.
@@ -5919,6 +5960,16 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
         # Keep legacy field name for backward compat, now means same as no_security_signal
         "undocumented": no_security_signal,
     }
+    # Surface test-fixture endpoints excluded from the production surface above.
+    # Reported separately (not hidden) so the exclusion is transparent and auditable.
+    if _test_util_endpoints:
+        result["test_util_endpoints"] = _test_util_endpoints
+        result["test_util_excluded"] = len(_test_util_endpoints)
+        result.setdefault("notes", []).append(
+            f"{len(_test_util_endpoints)} endpoint(s) from test-fixture/test-utility "
+            f"module(s) under src/main were excluded from the production surface "
+            f"(see test_util_endpoints)."
+        )
     # Surface incomplete-endpoint warnings (interface-defined controllers) only when
     # present, to keep output backward-compatible for the common case.
     if endpoint_warnings:
@@ -6366,6 +6417,12 @@ def compute_blast_radius(
 
     endpoints_affected: list[dict] = []
     for ep in route_surface:
+        # Test-fixture routes (tagged by build_repo_ir) are not production HTTP
+        # exposure — skip them so the legacy `impact` command shares the single
+        # production-endpoint definition used by the CIR surfaces. Nothing else about
+        # blast-radius selection changes; FQN-admin routes are untouched.
+        if ep.get("scope") == "test_util":
+            continue
         ep_class = ep.get("effective_class") or ep.get("controller") or ep.get("class") or ""
         ep_symbol = ep.get("symbol") or ""
         ep_handler = (

sourcecode/serializer.py

@@ -700,7 +700,11 @@ def _security_surface_from_eps(
 def _bootstrap_structured(eps: list) -> "Optional[dict[str, Any]]":
     """Separate Java entry points into bootstrap / security / controllers groups."""
     from pathlib import Path as _Path
-    bootstrap: list[str] = []
+    from sourcecode.path_filters import (
+        is_example_module_path,
+        is_test_fixture_module_path,
+    )
+    bootstrap_entries: list[tuple[str, str]] = []  # (path, source)
     security: list[str] = []
     controllers: list[dict] = []
     seen_b: set[str] = set()
@@ -720,9 +724,19 @@ def _bootstrap_structured(eps: list) -> "Optional[dict[str, Any]]":
         # filename alone — XSD-generated Application.java model classes must not
         # appear here.
         if kind == "application":
+            # Benchmark/example/tool mains (classified auxiliary/development) are real
+            # entry points but not the app's deployment bootstrap — keep them out.
+            if getattr(ep, "classification", None) in ("auxiliary", "development"):
+                continue
+            # Same for mains that live in an example/demo or test-fixture MODULE. This
+            # filter runs here (not in the detector) because workspace sub-scans prefix
+            # the module name onto the path only after detection — the full path with
+            # the module dir is visible only at this serialization stage.
+            if is_example_module_path(path) or is_test_fixture_module_path(path):
+                continue
             if path not in seen_b:
                 seen_b.add(path)
-                bootstrap.append(path)
+                bootstrap_entries.append((path, getattr(ep, "source", "")))
         elif kind == "filter" or any(k in stem for k in ("Filter", "Security", "Auth", "Jwt", "WebSecurity")):
             if path not in seen_s:
                 seen_s.add(path)
@@ -736,12 +750,31 @@ def _bootstrap_structured(eps: list) -> "Optional[dict[str, Any]]":
                     item["http_path"] = http_path
                 controllers.append(item)
 
+    # Order deployment-annotation entries (@SpringBootApplication/@QuarkusMain/…) ahead
+    # of plain main() classes, so a repo's real bootstrap leads even when many main()
+    # methods exist; then cap for readability while reporting the true total. A
+    # multi-main repo (e.g. neo4j: cypher-shell CLI + Neo4jCommunity server + admin
+    # tools) surfaces its server entry and its multiplicity instead of one arbitrary pick.
+    bootstrap_entries.sort(key=lambda pe: 0 if pe[1] == "bootstrap_annotation" else 1)
+    _bootstrap_total = len(bootstrap_entries)
+    _BOOTSTRAP_CAP = 10
+    bootstrap = [p for p, _src in bootstrap_entries[:_BOOTSTRAP_CAP]]
+
     if not bootstrap and not security:
         return None
 
     result: dict[str, Any] = {}
     if bootstrap:
         result["bootstrap"] = bootstrap
+        if _bootstrap_total > len(bootstrap):
+            result["bootstrap_note"] = (
+                f"{_bootstrap_total} application entry points detected; showing "
+                f"{len(bootstrap)} (deployment-annotated entries first)."
+            )
+        elif _bootstrap_total > 1:
+            result["bootstrap_note"] = (
+                f"{_bootstrap_total} application entry points detected."
+            )
     if security:
         result["security"] = security
     if controllers:

sourcecode/summarizer.py

@@ -362,11 +362,16 @@ class ProjectSummarizer:
 
         parts = [lead]
 
-        # Stack with frameworks — keep brief, skip internal module listings
+        # Stack with frameworks — keep brief, skip internal module listings.
+        # Read the primary flag set by the single authority (classifier.select_primary_stack);
+        # never re-select here — a second selector would let the summary name a different
+        # stack than architecture_summary / stacks[].primary (the polyglot divergence).
         non_tooling_stacks = self._filter_non_tooling_stacks(sm)
         primary = None
         if non_tooling_stacks:
-            primary = self._select_summary_primary_stack(non_tooling_stacks)
+            primary = next(
+                (s for s in non_tooling_stacks if s.primary), non_tooling_stacks[0]
+            )
             frameworks = [fw.name for fw in primary.frameworks[:2]]
             if frameworks:
                 parts.append(f"Stack: {primary.stack.capitalize()} ({', '.join(frameworks)})")
@@ -580,21 +585,6 @@ class ProjectSummarizer:
         ]
         return filtered or sm.stacks
 
-    def _select_summary_primary_stack(self, stacks: list) -> Any:
-        def score(stack: Any) -> tuple[int, int, int, int]:
-            root_manifest_hits = 0
-            if self.root is not None:
-                root_manifest_hits = sum(
-                    1 for manifest in stack.manifests
-                    if (self.root / manifest).is_file()
-                )
-            framework_hits = len(stack.frameworks)
-            primary_hint = 1 if stack.primary else 0
-            confidence = {"low": 0, "medium": 1, "high": 2}.get(stack.confidence, 0)
-            return (root_manifest_hits, framework_hits, primary_hint, confidence)
-
-        return max(stacks, key=score)
-
     def _is_tooling_path(self, path: str | None) -> bool:
         if not path:
             return False

{sourcecode-2.5.12.dist-info → sourcecode-2.5.15.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.5.12
+Version: 2.5.15
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.5.12.dist-info → sourcecode-2.5.15.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=OYjcfmD8BAbYO_oviKYCufYRUQmu9cFURHhQC4BEofc,309
+sourcecode/__init__.py,sha256=TA67wvVQzG1GVLowfrLngK0bKQZu-eJyvWrAm5PiAdg,309
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/archetype.py,sha256=d7yoN6Tj4OBj-VgSMPEKg4WF9H8FypnZ5A6AkUh5oIE,34484
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
@@ -7,10 +7,10 @@ sourcecode/ast_extractor.py,sha256=FEsYTsMCXbJfSYQZRk1k-I-PjUNGnKqO1IxMftsgA5U,5
 sourcecode/cache.py,sha256=1V3vsaODAa2UBJAC0xpvxpmRdriCezQx5Q8JCcfgziE,31892
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=HG8RCOkpzzsEGdnMRob6byrwjoj5__t0TEsBj4yR7ks,2574
-sourcecode/canonical_ir.py,sha256=5hLAhhSpXNOdZAvPt-J-rXccJE6M3A6gVhmhU0Tym6Y,29269
+sourcecode/canonical_ir.py,sha256=LdP_Ri3rl0M5p-MY0ypVvQwhq1WuUF1FmaHid7zyzEg,29807
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
-sourcecode/classifier.py,sha256=rkMapdklDuIv3rXrNEwwL65UldkvTn8VuKa73GPoSDo,18849
-sourcecode/cli.py,sha256=mlMgyRukRoHXYdAYHBN4z06LszwdRo0QLdhs0KYtup8,323804
+sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
+sourcecode/cli.py,sha256=LKK4czUeENVlcxHpSd5xao2HnAgtbRSYo8OoSwcZeZg,324334
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=vnbPI-20FnHdjO6STxHW8fbaxmB4A7y58io63ibFZjc,21586
 sourcecode/context_cache.py,sha256=maws79rLKDwyZ7c9Q2LwlIxqZHRFlaKzErtO3mglWoA,25036
@@ -24,7 +24,7 @@ sourcecode/dependency_analyzer.py,sha256=fQCaWQ7_BNcVgZv8gweJCwJ1CGlXsz8nw_tqN3a
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/dynamic_argument_surface.py,sha256=iRzrJhs57UXrGvLhNPiTA-e_sdO6ka-wNqc0wIiegiM,2554
 sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOaXc,3263
-sourcecode/endpoint_metrics.py,sha256=wkAonXe34ItHlvlGur3YRFUrcZfg6GdiiwiE4bMa21Y,2590
+sourcecode/endpoint_metrics.py,sha256=sLSLUIgiIyvNdOynaxVgHd9SjRF_DbN3QxevaquykaU,2840
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=aNTyYgQk5noJDfJU6FmasmESOHfiomyJw5EvZqjy6qc,22213
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
@@ -45,7 +45,7 @@ sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7
 sourcecode/migrate_check.py,sha256=HJhvHuvXDGTJSRQU9_AMx0L94h2TImC1DCGs3m3RTu0,108199
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
-sourcecode/path_filters.py,sha256=T1y0SJsmUJBju2Hh_-z40kURAowUEq42FpPgWLbOaY0,6931
+sourcecode/path_filters.py,sha256=qPKO7kRmVp2y9zjLNSuAVCbcpZrIInHE4QulLUlzPFI,10412
 sourcecode/pr_comment_renderer.py,sha256=KmcjMruhR44gjzMDJwjBSkWP9QEvh8xWBLyxzxoRbj0,14542
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
 sourcecode/prepare_context.py,sha256=-Xu33qCETuqw-OFfT3ukvAtxde7krCjQpn7wR3pbdOg,224290
@@ -56,7 +56,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=F6lRgPoP8oTtnGpRgjoLw-dlxZRXH7XOcehtcNwufEY,309550
+sourcecode/repository_ir.py,sha256=3hpxzOrudflSteYDLMQHK7KWdXg6mhhVwG94JSn7FHY,312825
 sourcecode/ris.py,sha256=Hw8TakTQ6hku-Abf2k8954NwkrH_sP73_8wVH8x5khc,22079
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -67,7 +67,7 @@ sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4Bb
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
 sourcecode/semantic_integration_engine.py,sha256=rxoCuP-uM_Y4-ELeBN0sz1a88e2eI1XTJDgsS57IOLI,15513
 sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_pd4,10782
-sourcecode/serializer.py,sha256=FmQo7eojA_z3ptLW-Vgze5mrEJ6FabcZqiwbQWWTgFI,130056
+sourcecode/serializer.py,sha256=UCGwxPZw9jS_amhU4om9a4Z6VOGOpttNuPpLuhGnuuU,132052
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=EX7kLZLN74CFyR9iZPm3CI115BfFKNd4WRPuErNljZM,5729
 sourcecode/spring_impact.py,sha256=MkUI27OCOhkjvBoA4f9X1eDBIY0SmyPuLVCWIfZgOcE,72430
@@ -75,7 +75,7 @@ sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16
 sourcecode/spring_security_audit.py,sha256=Rk-aSohezdc7YDYbSoJquVnwpkDB8ty1BCD-4Hc4R5A,22832
 sourcecode/spring_semantic.py,sha256=jteQ1PkY9ArFJv0embg_jBIdbOxqrk9mQ2Xz8OF_FKA,14214
 sourcecode/spring_tx_analyzer.py,sha256=QMXkxa_hrqDVN3D8WJsd0nT7vfdZCT1E8ZWNoFFbvgU,34692
-sourcecode/summarizer.py,sha256=SWj-y5BJ_Qw89ljLg-KXaLsvU87usOw-raTckPutCk4,26976
+sourcecode/summarizer.py,sha256=sr0-tfecFKCr-fSkPPWbl-t9HC7SY2ZxkjnnXX8DB2A,26621
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
 sourcecode/validation_inference.py,sha256=UtmYv-d4TEzT1ihGEipAhtXDrwq0XtVtjMpb3i7NsNc,10815
@@ -91,7 +91,7 @@ sourcecode/detectors/elixir.py,sha256=jCpvt5Yi6jvplc80ovRtWh17q-11ZGo9qX7o8b57TJ
 sourcecode/detectors/go.py,sha256=2r66uRQfeTWsqxr4HDhT6vExZErby0t46QXLHVBRv9w,2782
 sourcecode/detectors/heuristic.py,sha256=7cRxrip4yIaggYzZJB6ef8yHKh-gHgiH_pXMFcjlyFU,3723
 sourcecode/detectors/hybrid.py,sha256=IGFRUVsAZ1ooRlFdznCeJAV6vy1yVDx-VyghvLtddXc,9101
-sourcecode/detectors/java.py,sha256=ut8czxGzhFUxRAS5LeG78wev8kJolC7LG8IESDJZTNk,42349
+sourcecode/detectors/java.py,sha256=t6uDee_4pTmkbCQ5aXXqtVfoPLnvVBhnxYYVrv5qrdk,44499
 sourcecode/detectors/jvm_ext.py,sha256=EgHJ5W8EE-ZTN9V607mVzohyKgZE8Mc2jCi-DF8RAZU,2616
 sourcecode/detectors/nodejs.py,sha256=Hg3Gmr7yIMJFiLoDwOTk2wtu00wxIs6kZf-oQujTFUA,13187
 sourcecode/detectors/parsers.py,sha256=ug9K31tyHqinmv0HkIVQVjdTZpBv67FYKAEf52YXOSM,3178
@@ -137,8 +137,8 @@ sourcecode/telemetry/consent.py,sha256=LIAO9ohJZF8OuZwM4u1VWtALlYfTCCKq4wV3Vwc7i
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-2.5.12.dist-info/METADATA,sha256=_ZdJavgYcJbSneqocYtK_QZUZ7nsYc9aJkKevISBgO8,10852
-sourcecode-2.5.12.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-2.5.12.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-2.5.12.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-2.5.12.dist-info/RECORD,,
+sourcecode-2.5.15.dist-info/METADATA,sha256=lClKdlUiQRzl134vAQzx_Nvdk0pfm5mGK0pfIT0FIxs,10852
+sourcecode-2.5.15.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-2.5.15.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-2.5.15.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-2.5.15.dist-info/RECORD,,