sourcecode 2.6.3__tar.gz → 2.6.10__tar.gz

{sourcecode-2.6.3 → sourcecode-2.6.10}/CHANGELOG.md

@@ -1,5 +1,182 @@
 # Changelog
 
+## [2.6.10] — 2026-07-25
+
+**Identical runs now produce identical output.** Found by a field battery across twelve
+real repositories.
+
+### Fixed
+
+- **Annotation `evidence` had an unstable order** in the agent view's `file_relevance`:
+  the list came out of a frozenset, so its order depended on `PYTHONHASHSEED` and changed
+  between processes — the same repository analysed twice differed byte-for-byte while
+  being identical as data. The values were never wrong; the ordering defeated byte-level
+  diffing and reproducible caching. Long-standing, not introduced by a recent release.
+
+## [2.6.9] — 2026-07-25
+
+**MCP tool usage is now counted, anonymously.** Which capabilities agents actually reach
+for was invisible: MCP calls run the CLI in-process, so their events were
+indistinguishable from direct CLI use.
+
+### Added
+
+- **`mcp_tool_invoked` telemetry event** recording the invoked tool's own name
+  (`get_compact_context`, `get_impact_context`, …), whether it succeeded, and the existing
+  duration bucket. Counted once per call at the single dispatch point, on every exit path.
+
+### Notes
+
+- The tool **arguments are never sent** — they carry repository paths — and neither is any
+  part of the result. The name is a fixed identifier from ASK Engine's own tool registry,
+  not user input, and the sanitization layer still shape-validates it before transmission.
+- Same opt-out as every other event (`ask telemetry disable`, `SOURCECODE_TELEMETRY=0`,
+  `DO_NOT_TRACK=1`); with telemetry off, nothing is recorded. `docs/privacy.md` and the
+  first-run notice document the new field.
+
+## [2.6.8] — 2026-07-25
+
+**One-click MCP setup now reaches Windsurf and VS Code.** `ask mcp init` / `status` /
+`remove` cover four clients instead of two.
+
+### Added
+
+- **Windsurf** (`--target windsurf`) and **VS Code** (`--target vscode`) as MCP onboarding
+  targets, detected from their standard per-platform config locations. VS Code keys its
+  servers under `servers` (not `mcpServers`) and receives an explicit `"type": "stdio"` on
+  the entry; the config shape is now a property of each client, so the other clients' files
+  are written exactly as before.
+
+### Fixed
+
+- **`mcp status` reported a built-in server as `EXTERNAL`** for configs registered under the
+  canonical `ask` entry name: the drift check still looked up the deprecated `sourcecode`
+  key, under a hardcoded `mcpServers`. It now reads through the client's own key and accepts
+  either entry name.
+- **The "no MCP clients found" hint printed the deprecated manual snippet** (`"sourcecode":
+  {"command": "sourcecode", ...}`). It now shows the canonical `ask` entry and notes VS
+  Code's different key.
+
+## [2.6.7] — 2026-07-25
+
+**The context layer now reports what it saves: `_meta.token_economy`.** Responses used to
+report only what ASK emits. They now also report the measured counterfactual — what reading
+the same files raw would have cost the agent. Additive; no existing output changes.
+
+### Added
+
+- **`_meta.token_economy` on the agent-facing responses** (`--compact`, `--agent`, and
+  `cold-start`, on both cache-hit and fresh paths; the MCP `get_compact_context` tool inherits
+  it). Fields: `emitted` (what this response costs), `baseline_raw_read` (what the agent would
+  have spent reading raw the files the response cites, plus the build manifests it derives
+  from), `saved`, `files_counted`, plus the declared `basis`, `token_model` and `estimate`
+  flag. Example on a small Spring repo: `--compact` emits ~1.1K tokens against a ~4.9K raw-read
+  baseline; `--agent` emits ~3.9K against ~16.3K over 22 cited files.
+- **`sourcecode.token_estimate`** — `estimate_tokens()` and `token_economy()`, the single
+  source of the token model (previously an inline `size // 4` in `cold-start`).
+
+### Notes
+
+- Honest by construction: the token model is `chars/4` — an approximation, declared on every
+  block, with no tokenizer dependency. A file counts toward the baseline only when the
+  response's own text resolves to a real file inside the repository, so fully-qualified names
+  and prose never inflate it; the baseline is the conservative cited-files-plus-manifests set,
+  never the whole repository; `saved` is clamped at zero; and the block is a pure function of
+  the response and the files on disk. It is an upper-bound estimate of tokens avoided, never a
+  monetary or ROI figure.
+- No "hallucinations avoided" counter is emitted. It is not measurable, so it is not claimed;
+  what the product does guarantee — every claim carrying its `source_file` and FQN — is
+  already visible in the responses themselves.
+- The cached view stored on disk never embeds the block; it is recomputed against the working
+  tree on every emission.
+
+## [2.6.6] — 2026-07-24
+
+**Migration readiness as a time series: `migrate-check --snapshot` / `--trend`.** The
+quantified, budgetable readiness figures can now be tracked across commits — the
+days-remaining line a migration lead reports to management. Additive; no existing output
+changes.
+
+### Added
+
+- **`migrate-check --snapshot`** persists the run's budgetable figures — `readiness_score`,
+  `estimated_effort_days`, the per-dimension scores (jakarta / boot3 / hibernate / jdk),
+  and `blocking_count` — as a compact `readiness-snapshot-v1` artifact under `--history-dir`
+  (default `<repo>/.ask/readiness-history`). `--ref` labels the point (e.g. a sprint or
+  version). Capturing the same repo over successive commits builds the series.
+- **`migrate-check --trend`** reads the stored series and reports first→last movement per
+  track (score and days-remaining over time), ordered by capture time. Honest by design:
+  movement only, never an improving/degrading label; no delta is emitted across a missing
+  endpoint (a `None` readiness yields no delta); and the `readiness_score` is flagged
+  `comparable: false` when the applicable dimension set changed between endpoints (the score
+  is a min over dimensions, so a different set is not strictly comparable). The projection is
+  deterministic for a fixed snapshot set.
+
+## [2.6.5] — 2026-07-24
+
+**Mistyped-subcommand ergonomics: `ask` no longer swallows a typo'd command as a path
+and then blames the wrong token.** CLI-only; no analysis behaviour changes.
+
+### Fixed
+
+- **A mistyped command now names the token the user got wrong, and suggests the real
+  command.** `ask` accepts a bare repository path (`ask ./repo`) as an implicit scan, so
+  a misspelled subcommand used to be swallowed as a path and surface a misleading error
+  about the *next* token — `ask notacommand /tmp` complained `No such command '/tmp'` (the
+  path), and `ask spring-audi` complained the directory did not exist. Now:
+  - a first positional followed by another non-subcommand positional
+    (`ask notacommand /tmp`) is rejected as an unknown command (exit `2`), naming the
+    first token and — when it is close to a real command — suggesting it;
+  - a lone token that does not resolve to a directory but closely matches a command
+    (`ask spring-audi`) adds a *did you mean `ask spring-audit`* hint to the path error.
+
+  The implicit-scan contract is unchanged: a single positional is still treated as a
+  repository path with existence validated downstream, and the documented
+  `ask <subcommand> <path>` order (and the `ask <path> <subcommand>` rejection) are
+  untouched.
+
+## [2.6.4] — 2026-07-24
+
+**TX-006: self-invocation proxy-bypass detection — a new Spring transaction rule that
+also participates automatically in the `verify-edit` write-loop gate.** Plus a root-cause
+false-positive fix in body-fact extraction and one internal-id output leak removed. No
+change to any existing command's contract. Suite: **3742 passed, 5 skipped, 1 deselected**
+(the deselected chunker test is a pre-existing external-fixture flake).
+
+### Added
+
+- **TX-006 — self-invocation of a `@Transactional` sibling (Spring proxy bypass).** A
+  same-instance call — an unqualified `foo()` or an explicit `this.foo()` to a method of
+  the same class — does not pass through the Spring proxy, so the target's method-level
+  `@Transactional` is silently ignored at runtime (the Sonar S2229 class of bug). Detection
+  is structural and vendor-agnostic, reading the Semantic-IR `invocation` atoms already
+  produced by the pipeline: the receiver is `None`/`this` and the call resolves to an
+  unambiguous same-class sibling that carries a method-level `@Transactional`. False-positive
+  guards are built in — overloaded/ambiguous targets are skipped, class-level-only
+  `@Transactional` is not flagged (the proxy already covers the outer entry method), and the
+  legitimate self-injection escape hatch (`self.foo()` through an injected same-type field)
+  uses a field receiver and never resolves as a sibling. Severity is tiered: `high` only when
+  the callee propagation mandates a distinct boundary (`REQUIRES_NEW`/`NESTED`/`NOT_SUPPORTED`/
+  `NEVER`/`MANDATORY`); a plain `REQUIRED`/`SUPPORTS` callee or a `readOnly` getter is `medium`.
+  Surfaced by `ask spring-audit` and, with no additional wiring, by the `verify-edit`
+  `tx_boundary_changed` axis — an edit that *introduces* a self-invocation now breaks the
+  write-loop verdict before commit, while a pre-existing one never fails an unrelated change.
+
+### Fixed
+
+- **Chained-call receivers no longer read as self-calls (body-fact extraction).** A
+  method-chained invocation such as `Context.getBean().method()` left the receiver empty
+  because the receiver is an expression, not a bare identifier — causing it to be mistaken
+  for an unqualified self-call. A callee immediately preceded by `.` is now marked as a
+  non-self expression receiver. This is a general sibling-resolution correctness fix
+  (it also prevents a chained sibling-named call from being mis-resolved to a call edge);
+  `body_facts` is not a `cir_hash` input, so the fix is hash-neutral. It removed roughly
+  half of the raw TX-006 candidates on a real Spring codebase — all of them true bypass
+  false-positives, including a service that correctly routes `REQUIRES_NEW` through a
+  service-locator proxy.
+- **Internal bug id removed from user-facing output.** The self-referential-exclusion
+  warning in `impact` no longer prints the internal `(BUG #2)` tag; the explanation stays.
+
 ## [2.6.3] — 2026-07-24
 
 **`ask verify-edit` — the in-loop semantic diff gate lands (the read-context → write-loop

{sourcecode-2.6.3 → sourcecode-2.6.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.6.3
+Version: 2.6.10
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.6.3 → sourcecode-2.6.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.6.3"
+version = "2.6.10"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.6.3 → sourcecode-2.6.10}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.6.3"
+__version__ = "2.6.10"

{sourcecode-2.6.3 → sourcecode-2.6.10}/src/sourcecode/cli.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import difflib
 import os
 import sys
 import threading
@@ -331,6 +332,54 @@ def _reject_path_before_subcommand(path_token: str, subcommand: str) -> "NoRetur
     raise SystemExit(2)
 
 
+def _reject_unknown_command(token: str) -> "NoReturn":
+    """Refuse a first positional that is neither a known subcommand nor a real path.
+
+    `ask` accepts a bare repository path (`ask ./repo`) as an implicit scan, so a
+    mistyped subcommand used to be swallowed as a path and then surfaced a
+    misleading error naming the *wrong* token — `ask spring-audi` complained the
+    directory 'spring-audi' did not exist, and `ask notacommand /tmp` complained
+    'No such command /tmp' (the path, not the typo). Name the token the user
+    actually got wrong, and suggest the closest real commands.
+    """
+    matches = difflib.get_close_matches(token, sorted(_SUBCOMMANDS), n=3, cutoff=0.6)
+    first = f"error: '{token}' is not a known command"
+    if matches:
+        first += f". Did you mean: {', '.join(matches)}?"
+    else:
+        first += " and is not an existing directory to scan."
+    print(
+        first + "\n       run 'ask --help' to list commands, or pass an existing "
+        "repository path.",
+        file=sys.stderr,
+    )
+    raise SystemExit(2)
+
+
+def _has_trailing_nonsubcommand_positional(args: list[str], after: int) -> bool:
+    """True when a bare positional that is NOT a subcommand appears after index
+    ``after`` (options and the values they consume are skipped).
+
+    The implicit scan (`ask <path>`) owns exactly one positional, and a valid
+    invocation with two positionals always starts with a subcommand. So a first
+    non-subcommand positional followed by another non-subcommand positional —
+    `ask notacommand /tmp` — is malformed: the user meant a command. A trailing
+    token that IS a subcommand is left for ``_reject_path_before_subcommand``."""
+    skip_next = False
+    for arg in args[after + 1:]:
+        if skip_next:
+            skip_next = False
+            continue
+        if arg.startswith("-"):
+            if arg.split("=")[0] in _OPTIONS_WITH_VALUE and "=" not in arg:
+                skip_next = True
+            continue
+        if arg in _SUBCOMMANDS:
+            return False  # wrong-order path/subcommand — handled elsewhere
+        return True
+    return False
+
+
 def _preprocess_args(args: list[str]) -> list[str]:
     """Extract a repository path token from an args list and store it in _detected_path.
 
@@ -363,7 +412,13 @@ def _preprocess_args(args: list[str]) -> list[str]:
             return result  # known subcommand — leave for Click to dispatch
         if _path_index >= 0:
             continue  # a later positional is the subcommand's own business
-        # First genuine positional: treat as repository path
+        # First genuine positional. `ask` treats it as the repository path to scan
+        # (existence is validated downstream, not here). But if it is followed by
+        # another non-subcommand positional, the one-path scan cannot own both —
+        # `ask notacommand /tmp` — so the user meant a command: name the token they
+        # got wrong instead of swallowing it and erroring on the next one.
+        if _has_trailing_nonsubcommand_positional(result, i):
+            _reject_unknown_command(arg)
         _set_detected_path(arg)
         _path_index = i
     if _path_index >= 0:
@@ -1278,11 +1333,23 @@ def main(
     _raw_path_input = _get_detected_path()
     target = Path(_raw_path_input).resolve()
     if not target.exists():
+        # A non-existent path that closely matches a command name is almost always a
+        # mistyped subcommand (`ask spring-audi`) swallowed as an implicit-scan path,
+        # not a real directory. Point at the likely command instead of only the path.
+        _cmd_matches = difflib.get_close_matches(
+            _raw_path_input, sorted(_SUBCOMMANDS), n=3, cutoff=0.6
+        )
+        _hint = "Pass an existing repository directory."
+        if _cmd_matches:
+            _hint = (
+                f"If you meant a command, try: {', '.join('ask ' + m for m in _cmd_matches)}. "
+                "Otherwise pass an existing repository directory."
+            )
         _emit_error_json(
             INVALID_INPUT_CODE,
             f"Directory '{_raw_path_input}' does not exist.",
             path=_raw_path_input,
-            hint="Pass an existing repository directory.",
+            hint=_hint,
             expected="An existing directory path.",
         )
         raise typer.Exit(code=1)
@@ -1784,6 +1851,10 @@ def main(
                             )
                     except Exception:
                         pass  # stale value better than crash
+            # C1: token economy on the agent-facing views (cache-hit path).
+            if format == "json" and (compact or agent):
+                from sourcecode.token_estimate import inject_token_economy as _inj_te
+                _cache_hit_content = _inj_te(_cache_hit_content, target)
             _emit_command_output(_cache_hit_content, output, copy)
             return
 
@@ -2632,7 +2703,14 @@ def main(
                 }, indent=2, ensure_ascii=False)
             except Exception:
                 pass
-    _emit_command_output(content, output, copy if not _pipeline_error else False)
+    # C1: token economy on the agent-facing views (fresh path).  Emit-only —
+    # `content` stays clean so the cached L2 view never embeds a stale block
+    # (the cache-hit path recomputes it against the working tree).
+    _emit_content = content
+    if format == "json" and (compact or agent):
+        from sourcecode.token_estimate import inject_token_economy as _inj_te
+        _emit_content = _inj_te(content, target)
+    _emit_command_output(_emit_content, output, copy if not _pipeline_error else False)
 
     # Persist to two-layer cache (git SHA unchanged → re-use on next run).
     #
@@ -5528,7 +5606,7 @@ def spring_audit_cmd(
         help="Accepted for compatibility; this command always reads fresh source (no snapshot cache). No-op.",
     ),
 ) -> None:
-    """Spring semantic audit: TX anomalies (TX-001..005) + security surface (SEC-001..003).
+    """Spring semantic audit: TX anomalies (TX-001..006) + security surface (SEC-001..003).
 
     \b
     Detects:
@@ -5537,6 +5615,7 @@ def spring_audit_cmd(
       TX-003  readOnly=true boundary propagating to write operation
       TX-004  NOT_SUPPORTED/NEVER within active TX chain
       TX-005  Exception swallowing inside @Transactional
+      TX-006  Self-invocation of @Transactional sibling (proxy bypass)
       SEC-001 Unsecured endpoint in annotation_based security model
       SEC-002 CVE-2025-41248: @PreAuthorize on inherited method from generic supertype
       SEC-003 @Transactional on @Controller/@RestController (TX in wrong layer)
@@ -5805,6 +5884,23 @@ def migrate_check_cmd(
         False, "--no-cache",
         help="Accepted for compatibility; this command always reads fresh source (no snapshot cache). No-op.",
     ),
+    snapshot: bool = typer.Option(
+        False, "--snapshot",
+        help="Persist this readiness result as a timeline snapshot under --history-dir.",
+    ),
+    trend: bool = typer.Option(
+        False, "--trend",
+        help="Report the readiness trend across stored snapshots (days-remaining over time) "
+             "instead of scanning. Reads --history-dir.",
+    ),
+    history_dir: Optional[Path] = typer.Option(
+        None, "--history-dir",
+        help="Directory of readiness snapshots (default: <repo>/.ask/readiness-history).",
+    ),
+    ref: Optional[str] = typer.Option(
+        None, "--ref",
+        help="Label for a --snapshot capture (e.g. a version or sprint tag).",
+    ),
 ) -> None:
     """Spring Boot 2→3 migration readiness: detect javax→jakarta namespace blockers.
 
@@ -5836,6 +5932,16 @@ def migrate_check_cmd(
       ask migrate-check /path/to/repo --format text
       ask migrate-check . --min-severity high
       ask migrate-check . --output migration.json
+      ask migrate-check . --snapshot --ref sprint-12   persist a readiness point
+      ask migrate-check . --trend                      days-remaining over time
+
+    \b
+    Readiness time series:
+      --snapshot persists this run's budgetable figures (readiness_score, effort
+      days, per-dimension scores, blocking_count) under --history-dir (default
+      <repo>/.ask/readiness-history). --trend reads that series and reports
+      first→last movement — no improving/degrading label, and readiness_score is
+      flagged not-comparable when the applicable dimension set changed.
     """
     from sourcecode.repository_ir import find_java_files
     from sourcecode.migrate_check import run_migrate_check
@@ -5862,6 +5968,29 @@ def migrate_check_cmd(
         )
         raise typer.Exit(code=1)
 
+    _history_dir = history_dir.resolve() if history_dir else (target / ".ask" / "readiness-history")
+
+    # --trend reads the stored series and reports movement over time; it does not scan.
+    if trend:
+        from sourcecode.readiness_timeline import build_readiness_trend, load_snapshots_dir
+
+        _snaps = load_snapshots_dir(_history_dir) if _history_dir.exists() else []
+        if not _snaps:
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                f"No readiness snapshots found in '{_history_dir}'.",
+                path=str(_history_dir),
+                hint="Capture points first: ask migrate-check <repo> --snapshot",
+                expected="A directory holding readiness-snapshot-v1 artifacts.",
+            )
+            raise typer.Exit(code=1)
+        _trend = build_readiness_trend(_snaps)
+        _emit_command_output(
+            _serialize_dict(_trend, "json"), output_path, copy,
+            success_msg=f"Readiness trend over {_trend['count']} snapshot(s) → {_history_dir}",
+        )
+        return
+
     _file_limitations: list[str] = []
     file_list = find_java_files(target, limitations=_file_limitations)
     _prog = Progress()
@@ -5882,6 +6011,14 @@ def migrate_check_cmd(
         payload = report.to_compact_dict() if compact else report.to_dict()
         output = _serialize_dict(payload, "json")
 
+    _snapshot_note = ""
+    if snapshot:
+        from sourcecode.readiness_timeline import build_snapshot, write_snapshot
+
+        _snap = build_snapshot(report.to_dict(), ref=ref)
+        _snap_path = write_snapshot(_snap, _history_dir)
+        _snapshot_note = f"; snapshot → {_snap_path}"
+
     _total = report.summary.get("total_findings", 0)
     _emit_command_output(
         output, output_path, copy,
@@ -5889,6 +6026,7 @@ def migrate_check_cmd(
             f"Migration check written to {output_path} "
             f"(score: {report.readiness_score if report.readiness_score is not None else 'N/A'}"
             f"{'/100' if report.readiness_score is not None else ''}, {_total} findings)"
+            f"{_snapshot_note}"
         ),
     )
 
@@ -7897,11 +8035,15 @@ def cold_start_cmd(
             result["endpoints"] = result["endpoints"][:30]
         result["_meta"] = {**(result.get("_meta") or {}), "compact_mode": True,
                            "full_available": "ask cold-start (without --compact)"}
+    from sourcecode.token_estimate import estimate_tokens as _est_tokens, token_economy as _tok_econ
     _out = _json.dumps(result, indent=2, ensure_ascii=False)
     _size = len(_out.encode("utf-8"))
-    _tokens = _size // 4
+    _tokens = _est_tokens(_out)
     _out_with_meta = _json.loads(_out)
-    _out_with_meta.setdefault("_meta", {})["estimated_tokens"] = _tokens
+    _meta_cs = _out_with_meta.setdefault("_meta", {})
+    _meta_cs["estimated_tokens"] = _tokens
+    # C1: what this response costs vs. what reading the same files raw would.
+    _meta_cs["token_economy"] = _tok_econ(_out, _out_with_meta, target)
     _out = _json.dumps(_out_with_meta, indent=2, ensure_ascii=False)
     if not compact and _size > 400_000:
         sys.stderr.write(
@@ -8018,7 +8160,9 @@ def mcp_init(
         typer.echo("No MCP clients found on this system.")
         typer.echo("")
         typer.echo("Manual setup — add to your MCP client config:")
-        typer.echo('  "sourcecode": {"command": "sourcecode", "args": ["mcp", "serve"]}')
+        typer.echo('  "ask": {"command": "ask", "args": ["mcp", "serve"]}')
+        typer.echo('  (VS Code keys these under "servers" and wants "type": "stdio";')
+        typer.echo('   other clients use "mcpServers".)')
         raise typer.Exit(code=0)
 
     # Show detection results
@@ -8070,7 +8214,9 @@ def mcp_init(
             if a.client.config_path.exists():
                 bak = backup.create(a.client.config_path)
                 typer.echo(f"  ✓ Backup   {bak}")
-            updated = applier.apply_entry(config)
+            updated = applier.apply_entry(
+                config, a.client.servers_key, a.client.entry_extra
+            )
             applier.write_config(a.client.config_path, updated)
             if not applier.validate(a.client.config_path):
                 errors.append(f"{a.client.name}: JSON validation failed after write")
@@ -8154,16 +8300,18 @@ def mcp_status() -> None:
             typer.echo(f"    Fix:      ask mcp init --target {client.slug}")
             continue
         config = applier.read_config(client.config_path)
-        if applier.is_installed(config):
+        if applier.is_installed(config, client.servers_key):
             typer.echo(f"  {client.name:<20} ✓ configured   {client.config_path}")
             # FIX-P0-5: inspect registered command for external-server drift.
-            _registered = config.get("mcpServers", {}).get("sourcecode", {})
+            # Reads through the client's own servers key and entry name, so drift is
+            # still detected for clients that key their servers differently.
+            _registered = applier.registered_entry(config, client.servers_key)
             _reg_cmd = _registered.get("command", "")
             _reg_args = _registered.get("args", [])
             # Built-in form: command=sourcecode args=[mcp, serve] (or just the binary)
             _is_builtin = (
-                _reg_cmd == "sourcecode"
-                or (not _reg_args and _reg_cmd.endswith("/sourcecode"))
+                _reg_cmd in ("ask", "sourcecode")
+                or (not _reg_args and _reg_cmd.endswith(("/ask", "/sourcecode")))
                 or (_reg_args and _reg_args[:2] == ["mcp", "serve"])
             )
             if _is_builtin:
@@ -8224,7 +8372,7 @@ def mcp_status() -> None:
     for _c in clients:
         if _c.app_installed:
             _cfg = applier.read_config(_c.config_path)
-            if applier.is_installed(_cfg):
+            if applier.is_installed(_cfg, _c.servers_key):
                 _configured_clients.add(_c.slug)
 
     # Stage 3: Process liveness — is the client app currently running?
@@ -8304,7 +8452,7 @@ def mcp_remove(
             bak = backup.create(a.client.config_path)
             typer.echo(f"  ✓ Backup   {bak}")
             config = applier.read_config(a.client.config_path)
-            updated = applier.remove_entry(config)
+            updated = applier.remove_entry(config, a.client.servers_key)
             applier.write_config(a.client.config_path, updated)
             if not applier.validate(a.client.config_path):
                 errors.append(f"{a.client.name}: JSON validation failed — restoring backup")

{sourcecode-2.6.3 → sourcecode-2.6.10}/src/sourcecode/file_classifier.py

@@ -300,14 +300,18 @@ class FileClassifier:
         found = frozenset(m.group(1) for m in _JAVA_ANNOTATION_RE.finditer(content))
         if not found:
             return None
+        # Sorted, not set order: this list is emitted as `evidence` in the agent view,
+        # and frozenset iteration order varies with PYTHONHASHSEED — the same repo
+        # analysed twice produced the same evidence in a different order.
+        evidence = sorted(found)
         for required_annotations, category, relevance, why in _JAVA_STEREOTYPE_RULES:
             # For @Data DTO: must have @Data but NOT @Entity
             if required_annotations == frozenset({"Data"}):
                 if "Data" in found and "Entity" not in found:
-                    return FileClassification(path, category, "high", relevance, why, list(found))
+                    return FileClassification(path, category, "high", relevance, why, evidence)
                 continue
             # For compound rules (Service+Transactional, Controller+RequestMapping): all required
             if required_annotations <= found:
-                return FileClassification(path, category, "high", relevance, why, list(found))
+                return FileClassification(path, category, "high", relevance, why, evidence)
         return None
 

{sourcecode-2.6.3 → sourcecode-2.6.10}/src/sourcecode/mcp/onboarding/applier.py

@@ -25,36 +25,50 @@ def read_config(path: Path) -> dict:
         return {}
 
 
-def is_installed(config: dict) -> bool:
+def is_installed(config: dict, servers_key: str = _MCP_SERVERS_KEY) -> bool:
     """True if the ASK Engine entry (canonical `ask` or legacy `sourcecode`) is
-    already present in mcpServers."""
-    servers = config.get(_MCP_SERVERS_KEY, {})
+    already present in the client's servers map."""
+    servers = config.get(servers_key, {})
     return _ENTRY_NAME in servers or _LEGACY_ENTRY_NAME in servers
 
 
-def apply_entry(config: dict) -> dict:
-    """Return new config dict with the canonical `ask` entry merged into mcpServers.
-    Any legacy `sourcecode` entry is migrated away (removed) so the client launches
-    a single server."""
+def registered_entry(config: dict, servers_key: str = _MCP_SERVERS_KEY) -> dict:
+    """The ASK Engine server entry as currently registered, or an empty dict."""
+    servers = config.get(servers_key, {})
+    if not isinstance(servers, dict):
+        return {}
+    entry = servers.get(_ENTRY_NAME) or servers.get(_LEGACY_ENTRY_NAME) or {}
+    return entry if isinstance(entry, dict) else {}
+
+
+def apply_entry(
+    config: dict,
+    servers_key: str = _MCP_SERVERS_KEY,
+    entry_extra: tuple[tuple[str, str], ...] = (),
+) -> dict:
+    """Return new config dict with the canonical `ask` entry merged into the client's
+    servers map. Any legacy `sourcecode` entry is migrated away (removed) so the client
+    launches a single server. *entry_extra* carries per-client fields (e.g. VS Code's
+    explicit `type: stdio`)."""
     config = dict(config)
-    servers: dict = dict(config.get(_MCP_SERVERS_KEY, {}))
+    servers: dict = dict(config.get(servers_key, {}))
     servers.pop(_LEGACY_ENTRY_NAME, None)
-    servers[_ENTRY_NAME] = _ENTRY_VALUE
-    config[_MCP_SERVERS_KEY] = servers
+    servers[_ENTRY_NAME] = {**_ENTRY_VALUE, **dict(entry_extra)}
+    config[servers_key] = servers
     return config
 
 
-def remove_entry(config: dict) -> dict:
+def remove_entry(config: dict, servers_key: str = _MCP_SERVERS_KEY) -> dict:
     """Return new config dict with the ASK Engine entry removed — both the canonical
     `ask` key and any legacy `sourcecode` key."""
     config = dict(config)
-    servers: dict = dict(config.get(_MCP_SERVERS_KEY, {}))
+    servers: dict = dict(config.get(servers_key, {}))
     servers.pop(_ENTRY_NAME, None)
     servers.pop(_LEGACY_ENTRY_NAME, None)
     if servers:
-        config[_MCP_SERVERS_KEY] = servers
-    elif _MCP_SERVERS_KEY in config:
-        del config[_MCP_SERVERS_KEY]
+        config[servers_key] = servers
+    elif servers_key in config:
+        del config[servers_key]
     return config