sourcecode 2.6.3__py3-none-any.whl → 2.6.5__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.6.3"
+__version__ = "2.6.5"

sourcecode/cli.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import difflib
 import os
 import sys
 import threading
@@ -331,6 +332,54 @@ def _reject_path_before_subcommand(path_token: str, subcommand: str) -> "NoRetur
     raise SystemExit(2)
 
 
+def _reject_unknown_command(token: str) -> "NoReturn":
+    """Refuse a first positional that is neither a known subcommand nor a real path.
+
+    `ask` accepts a bare repository path (`ask ./repo`) as an implicit scan, so a
+    mistyped subcommand used to be swallowed as a path and then surfaced a
+    misleading error naming the *wrong* token — `ask spring-audi` complained the
+    directory 'spring-audi' did not exist, and `ask notacommand /tmp` complained
+    'No such command /tmp' (the path, not the typo). Name the token the user
+    actually got wrong, and suggest the closest real commands.
+    """
+    matches = difflib.get_close_matches(token, sorted(_SUBCOMMANDS), n=3, cutoff=0.6)
+    first = f"error: '{token}' is not a known command"
+    if matches:
+        first += f". Did you mean: {', '.join(matches)}?"
+    else:
+        first += " and is not an existing directory to scan."
+    print(
+        first + "\n       run 'ask --help' to list commands, or pass an existing "
+        "repository path.",
+        file=sys.stderr,
+    )
+    raise SystemExit(2)
+
+
+def _has_trailing_nonsubcommand_positional(args: list[str], after: int) -> bool:
+    """True when a bare positional that is NOT a subcommand appears after index
+    ``after`` (options and the values they consume are skipped).
+
+    The implicit scan (`ask <path>`) owns exactly one positional, and a valid
+    invocation with two positionals always starts with a subcommand. So a first
+    non-subcommand positional followed by another non-subcommand positional —
+    `ask notacommand /tmp` — is malformed: the user meant a command. A trailing
+    token that IS a subcommand is left for ``_reject_path_before_subcommand``."""
+    skip_next = False
+    for arg in args[after + 1:]:
+        if skip_next:
+            skip_next = False
+            continue
+        if arg.startswith("-"):
+            if arg.split("=")[0] in _OPTIONS_WITH_VALUE and "=" not in arg:
+                skip_next = True
+            continue
+        if arg in _SUBCOMMANDS:
+            return False  # wrong-order path/subcommand — handled elsewhere
+        return True
+    return False
+
+
 def _preprocess_args(args: list[str]) -> list[str]:
     """Extract a repository path token from an args list and store it in _detected_path.
 
@@ -363,7 +412,13 @@ def _preprocess_args(args: list[str]) -> list[str]:
             return result  # known subcommand — leave for Click to dispatch
         if _path_index >= 0:
             continue  # a later positional is the subcommand's own business
-        # First genuine positional: treat as repository path
+        # First genuine positional. `ask` treats it as the repository path to scan
+        # (existence is validated downstream, not here). But if it is followed by
+        # another non-subcommand positional, the one-path scan cannot own both —
+        # `ask notacommand /tmp` — so the user meant a command: name the token they
+        # got wrong instead of swallowing it and erroring on the next one.
+        if _has_trailing_nonsubcommand_positional(result, i):
+            _reject_unknown_command(arg)
         _set_detected_path(arg)
         _path_index = i
     if _path_index >= 0:
@@ -1278,11 +1333,23 @@ def main(
     _raw_path_input = _get_detected_path()
     target = Path(_raw_path_input).resolve()
     if not target.exists():
+        # A non-existent path that closely matches a command name is almost always a
+        # mistyped subcommand (`ask spring-audi`) swallowed as an implicit-scan path,
+        # not a real directory. Point at the likely command instead of only the path.
+        _cmd_matches = difflib.get_close_matches(
+            _raw_path_input, sorted(_SUBCOMMANDS), n=3, cutoff=0.6
+        )
+        _hint = "Pass an existing repository directory."
+        if _cmd_matches:
+            _hint = (
+                f"If you meant a command, try: {', '.join('ask ' + m for m in _cmd_matches)}. "
+                "Otherwise pass an existing repository directory."
+            )
         _emit_error_json(
             INVALID_INPUT_CODE,
             f"Directory '{_raw_path_input}' does not exist.",
             path=_raw_path_input,
-            hint="Pass an existing repository directory.",
+            hint=_hint,
             expected="An existing directory path.",
         )
         raise typer.Exit(code=1)
@@ -5528,7 +5595,7 @@ def spring_audit_cmd(
         help="Accepted for compatibility; this command always reads fresh source (no snapshot cache). No-op.",
     ),
 ) -> None:
-    """Spring semantic audit: TX anomalies (TX-001..005) + security surface (SEC-001..003).
+    """Spring semantic audit: TX anomalies (TX-001..006) + security surface (SEC-001..003).
 
     \b
     Detects:
@@ -5537,6 +5604,7 @@ def spring_audit_cmd(
       TX-003  readOnly=true boundary propagating to write operation
       TX-004  NOT_SUPPORTED/NEVER within active TX chain
       TX-005  Exception swallowing inside @Transactional
+      TX-006  Self-invocation of @Transactional sibling (proxy bypass)
       SEC-001 Unsecured endpoint in annotation_based security model
       SEC-002 CVE-2025-41248: @PreAuthorize on inherited method from generic supertype
       SEC-003 @Transactional on @Controller/@RestController (TX in wrong layer)

sourcecode/repository_ir.py

@@ -2098,6 +2098,21 @@ def _extract_body_facts(
             receiver, callee = m.group(1), m.group(2)
             if callee in _CALL_KEYWORDS:
                 continue
+            if receiver is None:
+                # A chained/qualified call — `expr().foo()`, `getBean().foo()`,
+                # `a.b().foo()` — leaves the receiver group empty because the
+                # receiver is not a bare identifier. It must NOT be mistaken for an
+                # unqualified self-call: if the callee is immediately preceded by '.'
+                # the call is qualified (goes through whatever the preceding
+                # expression returns, e.g. a Spring proxy), so mark it as a
+                # non-self expression receiver. (openmrs OrderServiceImpl routes
+                # REQUIRES_NEW through Context.getOrderService()....() precisely to
+                # keep the proxy — that is correct code, not a self-invocation.)
+                j = m.start() - 1
+                while j >= 0 and body[j] in " \t\r\n":
+                    j -= 1
+                if j >= 0 and body[j] == ".":
+                    receiver = "<expr>"
             resolved: Optional[str] = None
             if receiver in (None, "this") and callee in sib:
                 cands = [f for f in sib[callee] if f != caller.symbol]

sourcecode/spring_impact.py

@@ -1036,7 +1036,7 @@ class ImpactOrchestrator:
                 )
             else:
                 warnings.append(
-                    f"Self-referential exclusion (BUG #2): {self_excluded} member(s) of the "
+                    f"Self-referential exclusion: {self_excluded} member(s) of the "
                     f"analyzed class were dropped from callers — a class's own methods are "
                     f"members, not external callers (they do not count toward blast radius)."
                 )

sourcecode/spring_tx_analyzer.py

@@ -6,9 +6,8 @@ Patterns implemented (Phase 2):
   TX-003  readOnly=true boundary propagating into write-capable callee
   TX-004  NOT_SUPPORTED or NEVER invoked from transactional call chain
   TX-005  Exception swallowing inside @Transactional method (regex)
-
-Self-invocation via this.method() intentionally excluded from Phase 2:
-  requires AST-level analysis, regex produces too many false positives.
+  TX-006  Self-invocation of a @Transactional sibling — proxy bypass (Semantic-IR
+          invocation atoms; unambiguous same-class calls only)
 
 All patterns are deterministic and never raise.
 """
@@ -683,6 +682,142 @@ class _TX005ExceptionSwallowing:
         return blocks
 
 
+# ---------------------------------------------------------------------------
+# TX-006: self-invocation of a @Transactional sibling — proxy bypass
+# ---------------------------------------------------------------------------
+
+class _TX006SelfInvocation:
+    """Same-instance call to a @Transactional sibling method bypasses the proxy.
+
+    Spring TX advice is applied by a proxy that wraps the bean. A call that does
+    NOT go through that proxy — an unqualified `foo()` or an explicit `this.foo()`
+    to a method of the SAME class — reaches the target directly, so its
+    method-level @Transactional is silently ignored at runtime (Sonar S2229).
+
+    Detection is structural and VAI-clean, reading the Semantic-IR invocation
+    atoms already produced by build_canonical_ir (cir.body_facts):
+
+      - the atom's receiver is None (unqualified) or "this"          → not via a proxy
+      - resolved_fqn is set                                          → unambiguous sibling
+        (the IR only resolves a sibling when receiver∈{None,"this"} and exactly one
+         same-class method matches — overloaded/ambiguous targets stay None → skipped)
+      - the resolved sibling carries a METHOD-LEVEL @Transactional    → advice would apply
+
+    Class-level-only @Transactional is deliberately NOT flagged: the enclosing
+    proxy already applies it to the outer entry method, so the self-call runs in
+    that same transaction — no advice is lost. The self-injection workaround
+    (`self.foo()` where `self` is an injected same-type field) uses a named field
+    receiver, never None/"this", so it never resolves as a sibling → no false
+    positive on the legitimate escape hatch.
+    """
+    pattern_id = "TX-006"
+    severity = "high"   # nominal (Protocol); real severity is tiered per finding
+
+    # Propagations whose whole purpose is a distinct transaction boundary: a bypass
+    # demonstrably breaks them (a new/suspended/forbidden TX that never happens, or a
+    # runtime IllegalTransactionStateException). Everything else — a plain REQUIRED/
+    # SUPPORTS callee, or a readOnly getter (bypass loses only the read-only
+    # optimization, not correctness) — degrades to running in the caller's TX: a real
+    # bypass with lower blast radius → medium, matching TX-002/003 discipline.
+    _HIGH_IMPACT_PROPAGATION = frozenset({
+        "REQUIRES_NEW", "NESTED", "NOT_SUPPORTED", "NEVER", "MANDATORY",
+    })
+
+    def analyze(
+        self,
+        cir: "CanonicalRepositoryIR",
+        tx_index: TransactionBoundaryIndex,
+        root: Optional[Path],
+        *,
+        model: Optional[SpringSemanticModel] = None,
+    ) -> list[SpringFinding]:
+        findings: list[SpringFinding] = []
+        body_facts = getattr(cir, "body_facts", {}) or {}
+        _seen_ids: set[str] = set()
+
+        for caller_fqn, atoms in body_facts.items():
+            if not isinstance(atoms, list):
+                continue
+            for atom in atoms:
+                if not isinstance(atom, dict) or atom.get("fact") != "invocation":
+                    continue
+                # Only same-instance calls bypass the proxy: unqualified or `this.`.
+                if atom.get("receiver") not in (None, "this"):
+                    continue
+                target = atom.get("resolved_fqn")
+                if not target:
+                    continue  # ambiguous/overloaded/unresolved sibling — honest skip
+                # The bypass only matters when the sibling declares its OWN
+                # method-level @Transactional; class-level advice already covers
+                # the outer entry method and is not lost by the self-call.
+                tb = tx_index.by_symbol.get(target)
+                if tb is None or tb.scope != "method":
+                    continue
+
+                _fid = SpringFinding.make_id(self.pattern_id, f"{caller_fqn}→{target}")
+                if _fid in _seen_ids:
+                    continue
+                _seen_ids.add(_fid)
+
+                caller_simple = caller_fqn.rsplit(".", 1)[-1].replace("#", ".")
+                callee_simple = target.rsplit(".", 1)[-1].replace("#", ".")
+
+                # Tier severity by what the bypass demonstrably breaks. A propagation
+                # that mandates a distinct boundary (or forbids an active TX) is
+                # high; a plain REQUIRED/SUPPORTS/readOnly callee degrades to the
+                # caller's TX — still a real bypass, lower blast radius → medium.
+                if tb.propagation in self._HIGH_IMPACT_PROPAGATION:
+                    sev = "high"
+                else:
+                    sev = "medium"
+
+                findings.append(SpringFinding(
+                    id=_fid,
+                    pattern_id=self.pattern_id,
+                    category="tx",
+                    severity=sev,
+                    confidence="high",
+                    title="Self-invocation of @Transactional method — Spring proxy bypass",
+                    symbol=target,
+                    source_file=tb.source_file,
+                    evidence={
+                        "caller": caller_fqn,
+                        "callee": target,
+                        "receiver": atom.get("receiver") or "(unqualified)",
+                        "annotation": "@Transactional",
+                        "callee_propagation": tb.propagation,
+                        "callee_read_only": tb.read_only,
+                        "proxy_mechanism": "proxy self-invocation",
+                        "reason": (
+                            "same-instance call does not pass through the Spring proxy"
+                        ),
+                    },
+                    explanation=(
+                        f"{caller_simple} calls sibling {callee_simple} on the same "
+                        "instance (unqualified / this.). The call does not pass through "
+                        f"the Spring proxy, so the @Transactional on {callee_simple} "
+                        f"(propagation={tb.propagation}"
+                        f"{', readOnly=true' if tb.read_only else ''}) is silently "
+                        "ignored — it executes in the caller's transaction context "
+                        "(or none at all), not the one its annotation declares. "
+                        "No new/independent transaction, propagation, or rollback boundary is applied."
+                    ),
+                    fix_hint=(
+                        "Move the @Transactional method to a separate Spring bean and "
+                        "call it through the injected dependency, or inject the bean into "
+                        "itself and call via the injected proxy reference, or use "
+                        "TransactionTemplate for programmatic transaction control."
+                    ),
+                    limitations=[
+                        "Only unambiguous sibling calls are analyzed — overloaded targets "
+                        "are reported as unresolved and skipped",
+                    ],
+                    related_symbols=[target.split("#")[0]],
+                ))
+
+        return findings
+
+
 # ---------------------------------------------------------------------------
 # Default pattern registry
 # ---------------------------------------------------------------------------
@@ -693,6 +828,7 @@ _DEFAULT_TX_PATTERNS: list[TxPattern] = [
     _TX003ReadOnlyWritePropagation(),  # type: ignore[list-item]
     _TX004TxSuspensionRisk(),   # type: ignore[list-item]
     _TX005ExceptionSwallowing(),  # type: ignore[list-item]
+    _TX006SelfInvocation(),     # type: ignore[list-item]
 ]
 
 
@@ -777,7 +913,8 @@ def run_tx_audit(
     _spring_detected = tx_index.stats()["total"] > 0 or model.bean_graph.has_spring_beans()
 
     _tx_limitations = [
-        "Self-invocation via this.method() not detected — requires AST-level analysis",
+        "Self-invocation (this.method()) detected for unambiguous same-class calls "
+        "(TX-006); overloaded targets are reported as unresolved and skipped",
         "Dynamic dispatch (interface/polymorphic calls) may produce incomplete call chains",
     ]
     for _err in getattr(engine, "_last_analysis_errors", []):

{sourcecode-2.6.3.dist-info → sourcecode-2.6.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.6.3
+Version: 2.6.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.6.3.dist-info → sourcecode-2.6.5.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=inJYWLATw0hWFueMieZTLMVFkMV-j2YjHCR5sz3Dlh0,308
+sourcecode/__init__.py,sha256=P9Q5ycRTxeFZymRbTTRJpWf5WptRYL1ZBeI0mayU4iI,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=UrmiONHfqLl7UfGzjECoQBO28hcM_1rvzn0hCt0EtjU,35033
 sourcecode/architectural_baseline.py,sha256=7QzJri4pbL3nzAn9gNutZW6mZR8HHD6H2C2H1EEwYPE,17904
@@ -13,7 +13,7 @@ sourcecode/canonical_ir.py,sha256=LdP_Ri3rl0M5p-MY0ypVvQwhq1WuUF1FmaHid7zyzEg,29
 sourcecode/change_plan.py,sha256=MNgNyu4zrLGvBBaXPwyCh-T2ZGaUQX3Hm4W87uuhZ3w,7750
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=vlr2fQDesPFaSGa6qLhG6GP7xWU6F-u0U_qjc03r14M,362994
+sourcecode/cli.py,sha256=UZzhlXAHXT0saZcnhr0QQ2LXUIkP2qfB-V_hlf9tDJ4,366305
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=jdePg0dNCxFpysiTGMsROL5XABLjy_zVUgVeySvdb0o,7514
 sourcecode/confidence_analyzer.py,sha256=vnbPI-20FnHdjO6STxHW8fbaxmB4A7y58io63ibFZjc,21586
@@ -65,7 +65,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=wD6ODf8nNijDIh01FWyPoY1jplpPLWvfKl_5rAvLVMQ,322680
+sourcecode/repository_ir.py,sha256=HilsZiTt-WkEWuKPWJDB9vtR3WELTYsB2FsNXdEUuEE,323648
 sourcecode/ris.py,sha256=Hw8TakTQ6hku-Abf2k8954NwkrH_sP73_8wVH8x5khc,22079
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
@@ -79,11 +79,11 @@ sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_p
 sourcecode/serializer.py,sha256=zmN3pOcfxaQdxCE-jKoKudFjof9Sc_q7jpcBzNIA0EY,129493
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=EX7kLZLN74CFyR9iZPm3CI115BfFKNd4WRPuErNljZM,5729
-sourcecode/spring_impact.py,sha256=ATOa7jOg7kL78vW0uZiGBvtB-ph9bCiEGH0kRtABHxg,73108
+sourcecode/spring_impact.py,sha256=09t29l4bKhA-F6GXwC7kAzWfsWBOs095OmDNasEy1Og,73099
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_security_audit.py,sha256=Rk-aSohezdc7YDYbSoJquVnwpkDB8ty1BCD-4Hc4R5A,22832
 sourcecode/spring_semantic.py,sha256=jteQ1PkY9ArFJv0embg_jBIdbOxqrk9mQ2Xz8OF_FKA,14214
-sourcecode/spring_tx_analyzer.py,sha256=7qXwQR9QbpVxbxJC-mawBMXM9xzydtZeq5L18cP_6GE,33884
+sourcecode/spring_tx_analyzer.py,sha256=lp0h5Pzzd3fPxHAAagMmG8PqR1-v2uVpFIG1o7tCWQs,41148
 sourcecode/summarizer.py,sha256=sr0-tfecFKCr-fSkPPWbl-t9HC7SY2ZxkjnnXX8DB2A,26621
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
@@ -148,8 +148,8 @@ sourcecode/telemetry/consent.py,sha256=LIAO9ohJZF8OuZwM4u1VWtALlYfTCCKq4wV3Vwc7i
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-2.6.3.dist-info/METADATA,sha256=83aYwUnc4szlY7QK1pyjw5suiM3HMkRKeRznWyPzd20,10851
-sourcecode-2.6.3.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-2.6.3.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-2.6.3.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-2.6.3.dist-info/RECORD,,
+sourcecode-2.6.5.dist-info/METADATA,sha256=Sxx6ytWQ8YgF4odFcMnh42AC-_r5zj1mqkoSFb9Cmyo,10851
+sourcecode-2.6.5.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-2.6.5.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-2.6.5.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-2.6.5.dist-info/RECORD,,