sourcecode 2.5.1__tar.gz → 2.5.2__tar.gz

{sourcecode-2.5.1 → sourcecode-2.5.2}/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [2.5.2] — 2026-07-14
+
+**impact-chain correctness + cold-scan performance.** Two fixes surfaced by an
+adversarial audit across 12 real repositories (alfresco, keycloak, neo4j, jenkins,
+openmrs, ofbiz, jobrunr, eureka, BroadleafCommerce, spring-petclinic, and torture
+fixtures).
+
+### Fixed
+
+- **impact-chain lost same-class method callers (P0)** (`spring_impact.py`): a method
+  whose only callers were sibling methods in the same class (e.g. a private helper
+  `doWork()` invoked by `callWork()`) came back with **0 direct callers** — a false
+  "isolated / safe" verdict that defeated the 2.5.1 intra-class caller feature. The
+  `calls` edge existed in the reverse graph but the caller BFS discarded it: the
+  whole-class self-exclusion (v1.70.0 BUG #2) was applied to *method*-scoped queries,
+  where a *different* method on the same class is a legitimate caller, not
+  self-reference. Fix threads the existing `_method_scoped` flag into `_bfs_callers`;
+  method-scoped queries now exclude only genuine self-recursion, class-scoped queries
+  keep the cohesion exclusion. Verified: `TxService#doPrivateWork` → `[callPrivate]`
+  (was `[]`); cross-class blast radius unchanged (petclinic 13 endpoints).
+
+- **Quadratic cold scan on method-dense classes (P1)** (`repository_ir.py`):
+  `_intra_class_call_edges` ran a fresh regex search *per sibling method name* over each
+  method body — O(methods × body_len) per class, i.e. quadratic in method count. Large,
+  method-dense classes (generated parsers, multi-thousand-line test classes) made cold
+  scans pathological. Rewritten to a single pass per body (`_INTRA_CALL_RE`) that
+  collects call-site names and intersects them with the sibling index — O(body_len),
+  byte-identical edge set. Cold-scan wins: openmrs 43s→19s (2.3×), alfresco 220s→126s
+  (1.75×), jenkins 43s→35s. `_build_relations` cumulative time dropped 36.6s→3.9s
+  (openmrs profile).
+
 ## [2.5.1] — 2026-07-14
 
 **impact-chain correctness fix — field-injected callers are no longer lost.** A service

{sourcecode-2.5.1 → sourcecode-2.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.5.1
+Version: 2.5.2
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.5.1 → sourcecode-2.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.5.1"
+version = "2.5.2"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.5.1 → sourcecode-2.5.2}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.5.1"
+__version__ = "2.5.2"

{sourcecode-2.5.1 → sourcecode-2.5.2}/src/sourcecode/repository_ir.py

@@ -1489,6 +1489,16 @@ def _method_body(raw_lines: list[str], start_idx: int) -> str:
     return "\n".join(out)
 
 
+# Intra-class call-site matcher: a bare `name(` (not preceded by a word char or '.')
+# OR an explicit `this.name(`. Group 1 = bare callee, group 2 = this-qualified callee.
+# Encodes the SAME two match forms the old per-sibling regex used, so the derived edge
+# set is byte-identical — but as ONE alternation scanned once per body instead of once
+# per sibling name (see _intra_class_call_edges perf note).
+_INTRA_CALL_RE = re.compile(
+    r'(?<![\w.])([A-Za-z_]\w*)\s*\(' r'|\bthis\s*\.\s*([A-Za-z_]\w*)\s*\('
+)
+
+
 def _intra_class_call_edges(symbols: list[SymbolRecord], source: str) -> list[RelationEdge]:
     """Method-level `calls` edges for intra-class invocations.
 
@@ -1528,13 +1538,20 @@ def _intra_class_call_edges(symbols: list[SymbolRecord], source: str) -> list[Re
         if not body:
             continue
         body = _STRING_LITERAL_RE.sub('', _strip_java_comments(body))
-        for name, fqns in sib.items():
+        # PERF: one pass over the body collects every bare / this-qualified callee name,
+        # then intersect with the sibling index. The old code ran a fresh regex search
+        # per sibling name — O(siblings × body_len) per method, i.e. quadratic in method
+        # count, which made large method-dense classes (generated parsers, 4k-line test
+        # classes) pathological (alfresco cold scan ~220s). This is O(body_len). The
+        # edge set is identical: _INTRA_CALL_RE matches the same two call forms.
+        called: set[str] = set()
+        for m in _INTRA_CALL_RE.finditer(body):
+            called.add(m.group(1) or m.group(2))
+        for name in sorted(called):        # sorted → deterministic edge order
             if name in _CALL_KEYWORDS:
                 continue
-            # bare `name(` (not preceded by word char or '.') OR explicit `this.name(`
-            pat = (r'(?<![\w.])' + re.escape(name) + r'\s*\('
-                   + r'|\bthis\s*\.\s*' + re.escape(name) + r'\s*\(')
-            if not re.search(pat, body):
+            fqns = sib.get(name)
+            if not fqns:
                 continue
             for tgt in fqns:
                 if tgt == caller.symbol: