sourcecode 2.6.3__tar.gz → 2.6.5__tar.gz

{sourcecode-2.6.3 → sourcecode-2.6.5}/CHANGELOG.md

@@ -1,5 +1,70 @@
 # Changelog
 
+## [2.6.5] — 2026-07-24
+
+**Mistyped-subcommand ergonomics: `ask` no longer swallows a typo'd command as a path
+and then blames the wrong token.** CLI-only; no analysis behaviour changes.
+
+### Fixed
+
+- **A mistyped command now names the token the user got wrong, and suggests the real
+  command.** `ask` accepts a bare repository path (`ask ./repo`) as an implicit scan, so
+  a misspelled subcommand used to be swallowed as a path and surface a misleading error
+  about the *next* token — `ask notacommand /tmp` complained `No such command '/tmp'` (the
+  path), and `ask spring-audi` complained the directory did not exist. Now:
+  - a first positional followed by another non-subcommand positional
+    (`ask notacommand /tmp`) is rejected as an unknown command (exit `2`), naming the
+    first token and — when it is close to a real command — suggesting it;
+  - a lone token that does not resolve to a directory but closely matches a command
+    (`ask spring-audi`) adds a *did you mean `ask spring-audit`* hint to the path error.
+
+  The implicit-scan contract is unchanged: a single positional is still treated as a
+  repository path with existence validated downstream, and the documented
+  `ask <subcommand> <path>` order (and the `ask <path> <subcommand>` rejection) are
+  untouched.
+
+## [2.6.4] — 2026-07-24
+
+**TX-006: self-invocation proxy-bypass detection — a new Spring transaction rule that
+also participates automatically in the `verify-edit` write-loop gate.** Plus a root-cause
+false-positive fix in body-fact extraction and one internal-id output leak removed. No
+change to any existing command's contract. Suite: **3742 passed, 5 skipped, 1 deselected**
+(the deselected chunker test is a pre-existing external-fixture flake).
+
+### Added
+
+- **TX-006 — self-invocation of a `@Transactional` sibling (Spring proxy bypass).** A
+  same-instance call — an unqualified `foo()` or an explicit `this.foo()` to a method of
+  the same class — does not pass through the Spring proxy, so the target's method-level
+  `@Transactional` is silently ignored at runtime (the Sonar S2229 class of bug). Detection
+  is structural and vendor-agnostic, reading the Semantic-IR `invocation` atoms already
+  produced by the pipeline: the receiver is `None`/`this` and the call resolves to an
+  unambiguous same-class sibling that carries a method-level `@Transactional`. False-positive
+  guards are built in — overloaded/ambiguous targets are skipped, class-level-only
+  `@Transactional` is not flagged (the proxy already covers the outer entry method), and the
+  legitimate self-injection escape hatch (`self.foo()` through an injected same-type field)
+  uses a field receiver and never resolves as a sibling. Severity is tiered: `high` only when
+  the callee propagation mandates a distinct boundary (`REQUIRES_NEW`/`NESTED`/`NOT_SUPPORTED`/
+  `NEVER`/`MANDATORY`); a plain `REQUIRED`/`SUPPORTS` callee or a `readOnly` getter is `medium`.
+  Surfaced by `ask spring-audit` and, with no additional wiring, by the `verify-edit`
+  `tx_boundary_changed` axis — an edit that *introduces* a self-invocation now breaks the
+  write-loop verdict before commit, while a pre-existing one never fails an unrelated change.
+
+### Fixed
+
+- **Chained-call receivers no longer read as self-calls (body-fact extraction).** A
+  method-chained invocation such as `Context.getBean().method()` left the receiver empty
+  because the receiver is an expression, not a bare identifier — causing it to be mistaken
+  for an unqualified self-call. A callee immediately preceded by `.` is now marked as a
+  non-self expression receiver. This is a general sibling-resolution correctness fix
+  (it also prevents a chained sibling-named call from being mis-resolved to a call edge);
+  `body_facts` is not a `cir_hash` input, so the fix is hash-neutral. It removed roughly
+  half of the raw TX-006 candidates on a real Spring codebase — all of them true bypass
+  false-positives, including a service that correctly routes `REQUIRES_NEW` through a
+  service-locator proxy.
+- **Internal bug id removed from user-facing output.** The self-referential-exclusion
+  warning in `impact` no longer prints the internal `(BUG #2)` tag; the explanation stays.
+
 ## [2.6.3] — 2026-07-24
 
 **`ask verify-edit` — the in-loop semantic diff gate lands (the read-context → write-loop

{sourcecode-2.6.3 → sourcecode-2.6.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.6.3
+Version: 2.6.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.6.3 → sourcecode-2.6.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.6.3"
+version = "2.6.5"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.6.3 → sourcecode-2.6.5}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.6.3"
+__version__ = "2.6.5"

{sourcecode-2.6.3 → sourcecode-2.6.5}/src/sourcecode/cli.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import difflib
 import os
 import sys
 import threading
@@ -331,6 +332,54 @@ def _reject_path_before_subcommand(path_token: str, subcommand: str) -> "NoRetur
     raise SystemExit(2)
 
 
+def _reject_unknown_command(token: str) -> "NoReturn":
+    """Refuse a first positional that is neither a known subcommand nor a real path.
+
+    `ask` accepts a bare repository path (`ask ./repo`) as an implicit scan, so a
+    mistyped subcommand used to be swallowed as a path and then surfaced a
+    misleading error naming the *wrong* token — `ask spring-audi` complained the
+    directory 'spring-audi' did not exist, and `ask notacommand /tmp` complained
+    'No such command /tmp' (the path, not the typo). Name the token the user
+    actually got wrong, and suggest the closest real commands.
+    """
+    matches = difflib.get_close_matches(token, sorted(_SUBCOMMANDS), n=3, cutoff=0.6)
+    first = f"error: '{token}' is not a known command"
+    if matches:
+        first += f". Did you mean: {', '.join(matches)}?"
+    else:
+        first += " and is not an existing directory to scan."
+    print(
+        first + "\n       run 'ask --help' to list commands, or pass an existing "
+        "repository path.",
+        file=sys.stderr,
+    )
+    raise SystemExit(2)
+
+
+def _has_trailing_nonsubcommand_positional(args: list[str], after: int) -> bool:
+    """True when a bare positional that is NOT a subcommand appears after index
+    ``after`` (options and the values they consume are skipped).
+
+    The implicit scan (`ask <path>`) owns exactly one positional, and a valid
+    invocation with two positionals always starts with a subcommand. So a first
+    non-subcommand positional followed by another non-subcommand positional —
+    `ask notacommand /tmp` — is malformed: the user meant a command. A trailing
+    token that IS a subcommand is left for ``_reject_path_before_subcommand``."""
+    skip_next = False
+    for arg in args[after + 1:]:
+        if skip_next:
+            skip_next = False
+            continue
+        if arg.startswith("-"):
+            if arg.split("=")[0] in _OPTIONS_WITH_VALUE and "=" not in arg:
+                skip_next = True
+            continue
+        if arg in _SUBCOMMANDS:
+            return False  # wrong-order path/subcommand — handled elsewhere
+        return True
+    return False
+
+
 def _preprocess_args(args: list[str]) -> list[str]:
     """Extract a repository path token from an args list and store it in _detected_path.
 
@@ -363,7 +412,13 @@ def _preprocess_args(args: list[str]) -> list[str]:
             return result  # known subcommand — leave for Click to dispatch
         if _path_index >= 0:
             continue  # a later positional is the subcommand's own business
-        # First genuine positional: treat as repository path
+        # First genuine positional. `ask` treats it as the repository path to scan
+        # (existence is validated downstream, not here). But if it is followed by
+        # another non-subcommand positional, the one-path scan cannot own both —
+        # `ask notacommand /tmp` — so the user meant a command: name the token they
+        # got wrong instead of swallowing it and erroring on the next one.
+        if _has_trailing_nonsubcommand_positional(result, i):
+            _reject_unknown_command(arg)
         _set_detected_path(arg)
         _path_index = i
     if _path_index >= 0:
@@ -1278,11 +1333,23 @@ def main(
     _raw_path_input = _get_detected_path()
     target = Path(_raw_path_input).resolve()
     if not target.exists():
+        # A non-existent path that closely matches a command name is almost always a
+        # mistyped subcommand (`ask spring-audi`) swallowed as an implicit-scan path,
+        # not a real directory. Point at the likely command instead of only the path.
+        _cmd_matches = difflib.get_close_matches(
+            _raw_path_input, sorted(_SUBCOMMANDS), n=3, cutoff=0.6
+        )
+        _hint = "Pass an existing repository directory."
+        if _cmd_matches:
+            _hint = (
+                f"If you meant a command, try: {', '.join('ask ' + m for m in _cmd_matches)}. "
+                "Otherwise pass an existing repository directory."
+            )
         _emit_error_json(
             INVALID_INPUT_CODE,
             f"Directory '{_raw_path_input}' does not exist.",
             path=_raw_path_input,
-            hint="Pass an existing repository directory.",
+            hint=_hint,
             expected="An existing directory path.",
         )
         raise typer.Exit(code=1)
@@ -5528,7 +5595,7 @@ def spring_audit_cmd(
         help="Accepted for compatibility; this command always reads fresh source (no snapshot cache). No-op.",
     ),
 ) -> None:
-    """Spring semantic audit: TX anomalies (TX-001..005) + security surface (SEC-001..003).
+    """Spring semantic audit: TX anomalies (TX-001..006) + security surface (SEC-001..003).
 
     \b
     Detects:
@@ -5537,6 +5604,7 @@ def spring_audit_cmd(
       TX-003  readOnly=true boundary propagating to write operation
       TX-004  NOT_SUPPORTED/NEVER within active TX chain
       TX-005  Exception swallowing inside @Transactional
+      TX-006  Self-invocation of @Transactional sibling (proxy bypass)
       SEC-001 Unsecured endpoint in annotation_based security model
       SEC-002 CVE-2025-41248: @PreAuthorize on inherited method from generic supertype
       SEC-003 @Transactional on @Controller/@RestController (TX in wrong layer)

{sourcecode-2.6.3 → sourcecode-2.6.5}/src/sourcecode/repository_ir.py

@@ -2098,6 +2098,21 @@ def _extract_body_facts(
             receiver, callee = m.group(1), m.group(2)
             if callee in _CALL_KEYWORDS:
                 continue
+            if receiver is None:
+                # A chained/qualified call — `expr().foo()`, `getBean().foo()`,
+                # `a.b().foo()` — leaves the receiver group empty because the
+                # receiver is not a bare identifier. It must NOT be mistaken for an
+                # unqualified self-call: if the callee is immediately preceded by '.'
+                # the call is qualified (goes through whatever the preceding
+                # expression returns, e.g. a Spring proxy), so mark it as a
+                # non-self expression receiver. (openmrs OrderServiceImpl routes
+                # REQUIRES_NEW through Context.getOrderService()....() precisely to
+                # keep the proxy — that is correct code, not a self-invocation.)
+                j = m.start() - 1
+                while j >= 0 and body[j] in " \t\r\n":
+                    j -= 1
+                if j >= 0 and body[j] == ".":
+                    receiver = "<expr>"
             resolved: Optional[str] = None
             if receiver in (None, "this") and callee in sib:
                 cands = [f for f in sib[callee] if f != caller.symbol]

{sourcecode-2.6.3 → sourcecode-2.6.5}/src/sourcecode/spring_impact.py

@@ -1036,7 +1036,7 @@ class ImpactOrchestrator:
                 )
             else:
                 warnings.append(
-                    f"Self-referential exclusion (BUG #2): {self_excluded} member(s) of the "
+                    f"Self-referential exclusion: {self_excluded} member(s) of the "
                     f"analyzed class were dropped from callers — a class's own methods are "
                     f"members, not external callers (they do not count toward blast radius)."
                 )

{sourcecode-2.6.3 → sourcecode-2.6.5}/src/sourcecode/spring_tx_analyzer.py

@@ -6,9 +6,8 @@ Patterns implemented (Phase 2):
   TX-003  readOnly=true boundary propagating into write-capable callee
   TX-004  NOT_SUPPORTED or NEVER invoked from transactional call chain
   TX-005  Exception swallowing inside @Transactional method (regex)
-
-Self-invocation via this.method() intentionally excluded from Phase 2:
-  requires AST-level analysis, regex produces too many false positives.
+  TX-006  Self-invocation of a @Transactional sibling — proxy bypass (Semantic-IR
+          invocation atoms; unambiguous same-class calls only)
 
 All patterns are deterministic and never raise.
 """
@@ -683,6 +682,142 @@ class _TX005ExceptionSwallowing:
         return blocks
 
 
+# ---------------------------------------------------------------------------
+# TX-006: self-invocation of a @Transactional sibling — proxy bypass
+# ---------------------------------------------------------------------------
+
+class _TX006SelfInvocation:
+    """Same-instance call to a @Transactional sibling method bypasses the proxy.
+
+    Spring TX advice is applied by a proxy that wraps the bean. A call that does
+    NOT go through that proxy — an unqualified `foo()` or an explicit `this.foo()`
+    to a method of the SAME class — reaches the target directly, so its
+    method-level @Transactional is silently ignored at runtime (Sonar S2229).
+
+    Detection is structural and VAI-clean, reading the Semantic-IR invocation
+    atoms already produced by build_canonical_ir (cir.body_facts):
+
+      - the atom's receiver is None (unqualified) or "this"          → not via a proxy
+      - resolved_fqn is set                                          → unambiguous sibling
+        (the IR only resolves a sibling when receiver∈{None,"this"} and exactly one
+         same-class method matches — overloaded/ambiguous targets stay None → skipped)
+      - the resolved sibling carries a METHOD-LEVEL @Transactional    → advice would apply
+
+    Class-level-only @Transactional is deliberately NOT flagged: the enclosing
+    proxy already applies it to the outer entry method, so the self-call runs in
+    that same transaction — no advice is lost. The self-injection workaround
+    (`self.foo()` where `self` is an injected same-type field) uses a named field
+    receiver, never None/"this", so it never resolves as a sibling → no false
+    positive on the legitimate escape hatch.
+    """
+    pattern_id = "TX-006"
+    severity = "high"   # nominal (Protocol); real severity is tiered per finding
+
+    # Propagations whose whole purpose is a distinct transaction boundary: a bypass
+    # demonstrably breaks them (a new/suspended/forbidden TX that never happens, or a
+    # runtime IllegalTransactionStateException). Everything else — a plain REQUIRED/
+    # SUPPORTS callee, or a readOnly getter (bypass loses only the read-only
+    # optimization, not correctness) — degrades to running in the caller's TX: a real
+    # bypass with lower blast radius → medium, matching TX-002/003 discipline.
+    _HIGH_IMPACT_PROPAGATION = frozenset({
+        "REQUIRES_NEW", "NESTED", "NOT_SUPPORTED", "NEVER", "MANDATORY",
+    })
+
+    def analyze(
+        self,
+        cir: "CanonicalRepositoryIR",
+        tx_index: TransactionBoundaryIndex,
+        root: Optional[Path],
+        *,
+        model: Optional[SpringSemanticModel] = None,
+    ) -> list[SpringFinding]:
+        findings: list[SpringFinding] = []
+        body_facts = getattr(cir, "body_facts", {}) or {}
+        _seen_ids: set[str] = set()
+
+        for caller_fqn, atoms in body_facts.items():
+            if not isinstance(atoms, list):
+                continue
+            for atom in atoms:
+                if not isinstance(atom, dict) or atom.get("fact") != "invocation":
+                    continue
+                # Only same-instance calls bypass the proxy: unqualified or `this.`.
+                if atom.get("receiver") not in (None, "this"):
+                    continue
+                target = atom.get("resolved_fqn")
+                if not target:
+                    continue  # ambiguous/overloaded/unresolved sibling — honest skip
+                # The bypass only matters when the sibling declares its OWN
+                # method-level @Transactional; class-level advice already covers
+                # the outer entry method and is not lost by the self-call.
+                tb = tx_index.by_symbol.get(target)
+                if tb is None or tb.scope != "method":
+                    continue
+
+                _fid = SpringFinding.make_id(self.pattern_id, f"{caller_fqn}→{target}")
+                if _fid in _seen_ids:
+                    continue
+                _seen_ids.add(_fid)
+
+                caller_simple = caller_fqn.rsplit(".", 1)[-1].replace("#", ".")
+                callee_simple = target.rsplit(".", 1)[-1].replace("#", ".")
+
+                # Tier severity by what the bypass demonstrably breaks. A propagation
+                # that mandates a distinct boundary (or forbids an active TX) is
+                # high; a plain REQUIRED/SUPPORTS/readOnly callee degrades to the
+                # caller's TX — still a real bypass, lower blast radius → medium.
+                if tb.propagation in self._HIGH_IMPACT_PROPAGATION:
+                    sev = "high"
+                else:
+                    sev = "medium"
+
+                findings.append(SpringFinding(
+                    id=_fid,
+                    pattern_id=self.pattern_id,
+                    category="tx",
+                    severity=sev,
+                    confidence="high",
+                    title="Self-invocation of @Transactional method — Spring proxy bypass",
+                    symbol=target,
+                    source_file=tb.source_file,
+                    evidence={
+                        "caller": caller_fqn,
+                        "callee": target,
+                        "receiver": atom.get("receiver") or "(unqualified)",
+                        "annotation": "@Transactional",
+                        "callee_propagation": tb.propagation,
+                        "callee_read_only": tb.read_only,
+                        "proxy_mechanism": "proxy self-invocation",
+                        "reason": (
+                            "same-instance call does not pass through the Spring proxy"
+                        ),
+                    },
+                    explanation=(
+                        f"{caller_simple} calls sibling {callee_simple} on the same "
+                        "instance (unqualified / this.). The call does not pass through "
+                        f"the Spring proxy, so the @Transactional on {callee_simple} "
+                        f"(propagation={tb.propagation}"
+                        f"{', readOnly=true' if tb.read_only else ''}) is silently "
+                        "ignored — it executes in the caller's transaction context "
+                        "(or none at all), not the one its annotation declares. "
+                        "No new/independent transaction, propagation, or rollback boundary is applied."
+                    ),
+                    fix_hint=(
+                        "Move the @Transactional method to a separate Spring bean and "
+                        "call it through the injected dependency, or inject the bean into "
+                        "itself and call via the injected proxy reference, or use "
+                        "TransactionTemplate for programmatic transaction control."
+                    ),
+                    limitations=[
+                        "Only unambiguous sibling calls are analyzed — overloaded targets "
+                        "are reported as unresolved and skipped",
+                    ],
+                    related_symbols=[target.split("#")[0]],
+                ))
+
+        return findings
+
+
 # ---------------------------------------------------------------------------
 # Default pattern registry
 # ---------------------------------------------------------------------------
@@ -693,6 +828,7 @@ _DEFAULT_TX_PATTERNS: list[TxPattern] = [
     _TX003ReadOnlyWritePropagation(),  # type: ignore[list-item]
     _TX004TxSuspensionRisk(),   # type: ignore[list-item]
     _TX005ExceptionSwallowing(),  # type: ignore[list-item]
+    _TX006SelfInvocation(),     # type: ignore[list-item]
 ]
 
 
@@ -777,7 +913,8 @@ def run_tx_audit(
     _spring_detected = tx_index.stats()["total"] > 0 or model.bean_graph.has_spring_beans()
 
     _tx_limitations = [
-        "Self-invocation via this.method() not detected — requires AST-level analysis",
+        "Self-invocation (this.method()) detected for unambiguous same-class calls "
+        "(TX-006); overloaded targets are reported as unresolved and skipped",
         "Dynamic dispatch (interface/polymorphic calls) may produce incomplete call chains",
     ]
     for _err in getattr(engine, "_last_analysis_errors", []):