sourcecode 2.6.5__tar.gz → 2.7.0__tar.gz

{sourcecode-2.6.5 → sourcecode-2.7.0}/CHANGELOG.md

@@ -1,5 +1,209 @@
 # Changelog
 
+## [2.7.0] — 2026-07-26
+
+**The analyzer reads facts it had been walking past, and stops spending the context budget
+it exists to save.** Driven by an external audit of 2.6.10 and validated by a field battery
+across eleven real repositories plus an A/B against the previous release.
+
+### Added
+
+- **Deployment prefix.** Neither `server.servlet.context-path` nor `spring.mvc.servlet.path`
+  was read anywhere, so an app deployed under `/app-server/api` was inventoried as `/v1/x` —
+  every URL wrong by the same constant, which is what makes the error invisible. Endpoints
+  now carry `effective_path` alongside the mapping-relative `path`, plus a
+  `deployment_prefix` block with per-source provenance. A value carrying a placeholder, or
+  declared only under a profile, is recorded but never imposed on every route.
+- **Two unread profile signals.** Profile names came from one signal — the
+  `application-{profile}.yml` filename convention. Multi-document activation
+  (`spring.config.activate.on-profile`) and `@Profile` on beans are read now, and
+  `profile_conditional_beans` says WHICH beans each profile switches — routinely the
+  security filter chain.
+- **A repo's own authorization gate on the endpoint surface.** Custom-gate detection fed
+  only the `spring-audit` posture block; every other surface reported `policy: none_detected`
+  for each endpoint of a repo whose authorization runs entirely through its own annotation.
+  Such endpoints now carry `policy: custom_gate_inferred` with the annotation as evidence,
+  and the model becomes `custom_annotation_based`. Coverage and specificity alone were
+  measured to be insufficient for a per-endpoint claim — they select caching and
+  documentation annotations — so the claim additionally requires an in-repo `@interface`
+  declaration. Structural, no name matching.
+- **`explain --limit`** (default 50), capping the list sections with the truncation and the
+  exact total stated in `warnings`. `--limit 0` restores the full lists.
+
+### Fixed
+
+- **Cross-file `String` constants were not folded.** `@RequestMapping(Routes.BASE)` resolved
+  to nothing and "nothing" was emitted as the empty path, collapsing every handler of a
+  controller onto `GET /`. A repo-wide constant table is built from the pass the assembler
+  already runs; a name declared twice with different values is dropped, not guessed; what
+  still cannot be resolved is published as `path_resolution: "unresolved"` with the
+  expression, instead of a fabricated `/`. On keycloak this recovers three real endpoints
+  (`AuthZen.EVALUATION_PATH`, `AdapterConstants.K_LOGOUT`) with no route newly unresolved.
+- **Types whose name sits on the line after the keyword** (`public class\n  Name {`) were
+  not extracted.
+- **Hibernate rewrite snippets quoted literal-blanked source**, emitting
+  `em.createNamedQuery("")` — dropping the query name, the one datum that makes the target
+  actionable.
+- **Confidence described the lookup, not the answer.** `retrieve endpoint-security` graded
+  "high" whenever the reference resolved, so an endpoint with no policy and no finding came
+  back maximally confident about nothing. It is high only when evidence attaches, and an
+  explicit `evidence_absent` observation says which case it is.
+- **Archetype counted signal diversity by cardinality**, which one dominant signal satisfies
+  trivially. "High" now also requires the top signal to supply at most 80% of the label's
+  score.
+- **Cycle counts read as one command contradicting another** (`modernize` 15 tangles vs
+  `subsystem-coupling` 0 import cycles). Both are right and measure different graphs; a
+  shared reconciliation note now travels with both numbers.
+- **`auth status` reported `pro: false`** while every Pro command ran under the
+  early-adoption unlock. It now reports the gating in force (`pro_gating`, `pro_effective`,
+  `pro_reason`).
+- **`transaction-entrypoints` counted only `@Transactional` declared ON a controller**, so a
+  repo with 129 boundaries reported 1 entrypoint. Boundaries reachable from a controller
+  within 3 call hops are reported alongside, each labelled with its `entrypoint_basis`.
+  Rows that a signature-free FQN made indistinguishable (overloads) collapse with the count
+  kept as `occurrences`; rows that differ in any attribute stay separate.
+- **`integration-inventory` said nothing four times**: identity keyed on
+  (kind, target-or-client) produced byte-identical rows. Rows collapse with `occurrences`,
+  and a null target carries the reason it is null. On Broadleaf: 9 rows → 4.
+- **`cache warm <subdir>` warmed the whole monorepo**, populating a cache for a different
+  target than `ask <subdir>` reads. It warms exactly the path given and says so when that
+  differs from the git root.
+- **`migrate-check --compact` shipped an empty `headline_blocker`**, forcing the reader back
+  into the full report. It names the weakest applicable axis, or says "none" /
+  "none_applicable". The guard against asserting a framework blocker without version
+  evidence is preserved.
+- **`impact-chain` enumerations were unbounded.** Lists are capped; every total stays exact
+  in `metadata` and `truncated_lists`.
+- **The profile signal was gated on the env-var scan**: a repo that declares profiles but
+  reads no environment variable published nothing about them — the exact shape the profile
+  signals were added for.
+
+### Changed
+
+- **`export --c4` omits the code level (C4 level 4) by default.** It enumerates every symbol
+  per directory and dominated the export: keycloak 18.6 MB → 2.5 MB, Broadleaf 9.7 MB →
+  1.1 MB. The omission is explicit in the payload (`included: false` with the reason and the
+  directory count) and `--c4-code` restores it.
+
+### Notes
+
+- Validated before release: full suite (3,869 passed), eleven repositories × eight commands
+  with no crash and valid JSON throughout, output identical across `PYTHONHASHSEED` values
+  on cold caches, and an A/B against 2.6.10 in which every difference maps to a change listed
+  above.
+
+## [2.6.10] — 2026-07-25
+
+**Identical runs now produce identical output.** Found by a field battery across twelve
+real repositories.
+
+### Fixed
+
+- **Annotation `evidence` had an unstable order** in the agent view's `file_relevance`:
+  the list came out of a frozenset, so its order depended on `PYTHONHASHSEED` and changed
+  between processes — the same repository analysed twice differed byte-for-byte while
+  being identical as data. The values were never wrong; the ordering defeated byte-level
+  diffing and reproducible caching. Long-standing, not introduced by a recent release.
+
+## [2.6.9] — 2026-07-25
+
+**MCP tool usage is now counted, anonymously.** Which capabilities agents actually reach
+for was invisible: MCP calls run the CLI in-process, so their events were
+indistinguishable from direct CLI use.
+
+### Added
+
+- **`mcp_tool_invoked` telemetry event** recording the invoked tool's own name
+  (`get_compact_context`, `get_impact_context`, …), whether it succeeded, and the existing
+  duration bucket. Counted once per call at the single dispatch point, on every exit path.
+
+### Notes
+
+- The tool **arguments are never sent** — they carry repository paths — and neither is any
+  part of the result. The name is a fixed identifier from ASK Engine's own tool registry,
+  not user input, and the sanitization layer still shape-validates it before transmission.
+- Same opt-out as every other event (`ask telemetry disable`, `SOURCECODE_TELEMETRY=0`,
+  `DO_NOT_TRACK=1`); with telemetry off, nothing is recorded. `docs/privacy.md` and the
+  first-run notice document the new field.
+
+## [2.6.8] — 2026-07-25
+
+**One-click MCP setup now reaches Windsurf and VS Code.** `ask mcp init` / `status` /
+`remove` cover four clients instead of two.
+
+### Added
+
+- **Windsurf** (`--target windsurf`) and **VS Code** (`--target vscode`) as MCP onboarding
+  targets, detected from their standard per-platform config locations. VS Code keys its
+  servers under `servers` (not `mcpServers`) and receives an explicit `"type": "stdio"` on
+  the entry; the config shape is now a property of each client, so the other clients' files
+  are written exactly as before.
+
+### Fixed
+
+- **`mcp status` reported a built-in server as `EXTERNAL`** for configs registered under the
+  canonical `ask` entry name: the drift check still looked up the deprecated `sourcecode`
+  key, under a hardcoded `mcpServers`. It now reads through the client's own key and accepts
+  either entry name.
+- **The "no MCP clients found" hint printed the deprecated manual snippet** (`"sourcecode":
+  {"command": "sourcecode", ...}`). It now shows the canonical `ask` entry and notes VS
+  Code's different key.
+
+## [2.6.7] — 2026-07-25
+
+**The context layer now reports what it saves: `_meta.token_economy`.** Responses used to
+report only what ASK emits. They now also report the measured counterfactual — what reading
+the same files raw would have cost the agent. Additive; no existing output changes.
+
+### Added
+
+- **`_meta.token_economy` on the agent-facing responses** (`--compact`, `--agent`, and
+  `cold-start`, on both cache-hit and fresh paths; the MCP `get_compact_context` tool inherits
+  it). Fields: `emitted` (what this response costs), `baseline_raw_read` (what the agent would
+  have spent reading raw the files the response cites, plus the build manifests it derives
+  from), `saved`, `files_counted`, plus the declared `basis`, `token_model` and `estimate`
+  flag. Example on a small Spring repo: `--compact` emits ~1.1K tokens against a ~4.9K raw-read
+  baseline; `--agent` emits ~3.9K against ~16.3K over 22 cited files.
+- **`sourcecode.token_estimate`** — `estimate_tokens()` and `token_economy()`, the single
+  source of the token model (previously an inline `size // 4` in `cold-start`).
+
+### Notes
+
+- Honest by construction: the token model is `chars/4` — an approximation, declared on every
+  block, with no tokenizer dependency. A file counts toward the baseline only when the
+  response's own text resolves to a real file inside the repository, so fully-qualified names
+  and prose never inflate it; the baseline is the conservative cited-files-plus-manifests set,
+  never the whole repository; `saved` is clamped at zero; and the block is a pure function of
+  the response and the files on disk. It is an upper-bound estimate of tokens avoided, never a
+  monetary or ROI figure.
+- No "hallucinations avoided" counter is emitted. It is not measurable, so it is not claimed;
+  what the product does guarantee — every claim carrying its `source_file` and FQN — is
+  already visible in the responses themselves.
+- The cached view stored on disk never embeds the block; it is recomputed against the working
+  tree on every emission.
+
+## [2.6.6] — 2026-07-24
+
+**Migration readiness as a time series: `migrate-check --snapshot` / `--trend`.** The
+quantified, budgetable readiness figures can now be tracked across commits — the
+days-remaining line a migration lead reports to management. Additive; no existing output
+changes.
+
+### Added
+
+- **`migrate-check --snapshot`** persists the run's budgetable figures — `readiness_score`,
+  `estimated_effort_days`, the per-dimension scores (jakarta / boot3 / hibernate / jdk),
+  and `blocking_count` — as a compact `readiness-snapshot-v1` artifact under `--history-dir`
+  (default `<repo>/.ask/readiness-history`). `--ref` labels the point (e.g. a sprint or
+  version). Capturing the same repo over successive commits builds the series.
+- **`migrate-check --trend`** reads the stored series and reports first→last movement per
+  track (score and days-remaining over time), ordered by capture time. Honest by design:
+  movement only, never an improving/degrading label; no delta is emitted across a missing
+  endpoint (a `None` readiness yields no delta); and the `readiness_score` is flagged
+  `comparable: false` when the applicable dimension set changed between endpoints (the score
+  is a min over dimensions, so a different set is not strictly comparable). The projection is
+  deterministic for a fixed snapshot set.
+
 ## [2.6.5] — 2026-07-24
 
 **Mistyped-subcommand ergonomics: `ask` no longer swallows a typo'd command as a path

{sourcecode-2.6.5 → sourcecode-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.6.5
+Version: 2.7.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.6.5 → sourcecode-2.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.6.5"
+version = "2.7.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.6.5 → sourcecode-2.7.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.6.5"
+__version__ = "2.7.0"

{sourcecode-2.6.5 → sourcecode-2.7.0}/src/sourcecode/archetype.py

@@ -604,12 +604,23 @@ class ArchetypeClassifier:
             # Gini alone labeling a REST API an "engine") — is a single point of view and
             # must not read as high confidence (field-eval Fase 0).
             distinct_signals = len({e.signal for e in top.evidence if e.contribution > 0})
+            # Diversity by COUNT is satisfiable while one signal carries the
+            # verdict: an audited repo was labelled "engine" at high confidence on
+            # 1.500 of a 1.504 score — a fan-in Gini alone, with the second signal
+            # contributing 0.3%. Counting it as two views is a fiction, so a label
+            # whose top signal supplies almost all of its score cannot be "high"
+            # however many other signals nominally touch it.
+            _contributions = sorted(
+                (e.contribution for e in top.evidence if e.contribution > 0), reverse=True
+            )
+            top_signal_share = (_contributions[0] / top.score) if _contributions else 1.0
             if (
                 confident_enough
                 and rel_margin >= 0.4
                 and mass_backed
                 and graph_backed
                 and distinct_signals >= 2
+                and top_signal_share <= 0.8
             ):
                 confidence = "high"
             elif confident_enough and rel_margin >= 0.25 and mass_backed:

{sourcecode-2.6.5 → sourcecode-2.7.0}/src/sourcecode/caller_metrics.py

@@ -40,3 +40,22 @@ CALLER_METRIC_RECONCILIATION: str = (
     "references or DI-interface resolution). The top-level impact.direct_callers array "
     "may be truncated for output size — use stats.direct_caller_count for the true total."
 )
+
+
+# Cycle / tangle metrics come from TWO different graphs. Both are correct; they
+# answer different questions, and without saying so the pair reads as one command
+# contradicting another (external audit 2026-07-25: modernize reported 15 cyclic
+# tangles while retrieve subsystem-coupling reported import_cycles: 0).
+CYCLE_METRIC_RECONCILIATION: str = (
+    "Cycle metrics differ across commands BY DESIGN. modernize.cross_module_tangles "
+    "is computed over the SYMBOL dependency graph, aggregated to subsystem packages: "
+    "coupling_type=cyclic means two subsystems reference each other (a 2-cycle "
+    "between package groups). The module-graph metrics (import_cycles, cyclic_density, "
+    "scc_mass — used by archetype and the subsystem-coupling retrieval intent) are "
+    "computed over the MODULE/DIRECTORY graph, are bounded for cost (node/edge caps), "
+    "and count strongly-connected components among modules. A repo can therefore "
+    "show mutual package-level coupling (tangles > 0) with no module-level SCC "
+    "(import_cycles = 0): the coupling exists between package groups inside the same "
+    "module. Neither number invalidates the other — read tangles for decomposition "
+    "risk and import_cycles for module-graph topology."
+)