sourcecode 3.2.0__py3-none-any.whl → 3.2.2__py3-none-any.whl

sourcecode/spring_profiles.py

@@ -153,18 +153,58 @@ _TYPE_AFTER_ANN_RE = re.compile(
     r"\b(?:class|interface|enum|record)\s+(?P<name>[A-Za-z_$][\w$]*)"
 )
 
+# What may stand between `@Profile(...)` and the type declaration it annotates:
+# further annotations and modifiers, nothing else. Anything beyond this means
+# the annotation belongs to a member, not to the type.
+_ANNOTATED_TYPE_RE = re.compile(
+    r"\A(?:\s|//[^\n]*\n|/\*.*?\*/"
+    r"|@[\w.]+(?:\s*\((?:[^()]|\([^()]*\))*\))?"
+    r"|public|protected|private|static|final|abstract|strictfp|sealed|non-sealed)*"
+    r"\s*(?:class|interface|enum|record)\s+(?P<name>[A-Za-z_$][\w$]*)",
+    re.DOTALL,
+)
 
-def conditional_beans_from_sources(
+# The member an annotation sits on, when it is not a type: the declared name of
+# the next method or field.
+_MEMBER_AFTER_ANN_RE = re.compile(
+    r"\A(?:\s|//[^\n]*\n|/\*.*?\*/"
+    r"|@[\w.]+(?:\s*\((?:[^()]|\([^()]*\))*\))?"
+    r"|public|protected|private|static|final|abstract|synchronized|native|transient|volatile|default"
+    r"|<[^<>]*>|[\w.$]+(?:\s*<[^<>]*>)?(?:\s*\[\s*\])*)*?"
+    r"\s(?P<name>[A-Za-z_$][\w$]*)\s*[(=;]",
+    re.DOTALL,
+)
+
+
+def _enclosing_type_name(text: str, pos: int, fallback: str) -> str:
+    """Name of the type declaration that encloses ``pos``."""
+    last = None
+    for m in _TYPE_AFTER_ANN_RE.finditer(text, 0, pos):
+        last = m
+    return last.group("name") if last else fallback
+
+
+def conditional_beans_from_sources_detailed(
     root: Path, file_paths: "Optional[list[str]]" = None
-) -> "dict[str, list[str]]":
-    """`{profile: [TypeName, …]}` for types carrying `@Profile`.
+) -> "list[ProfileConditionalBean]":
+    """`@Profile` symbols and the expression each one declares, from sources.
+
+    The single derivation of this fact for callers that hold no CIR;
+    :func:`profile_conditional_beans` is the same fact read from the IR, and
+    both must agree — a symbol this reports under a profile must be a symbol
+    `posture` resolves the same way.
 
-    Which beans a profile switches is the fact worth reporting — a profile list
-    alone does not tell a reader that one profile swaps the security filter
-    chain. Used where no CIR is in scope; `profile_conditional_beans` is the
-    exact, IR-based version.
+    **Attribution rule (the defect this exists to prevent):** a `@Profile` is
+    attributed to the declaration it actually annotates. Only annotations and
+    modifiers may stand between it and a type declaration; anything else means
+    the annotation sits on a member, which is then reported as ``Type#member``.
+    The previous scan searched for the *next* type declaration anywhere ahead
+    and fell back to the file name, so a `@Profile("m3")` on a `@Bean` method
+    inside `DevSecurityConfig` was reported as `DevSecurityConfig` being
+    conditional on `m3` — the exact opposite of its class-level
+    `@Profile("!m3")`, in the same document, contradicting `posture`.
     """
-    out: dict[str, set[str]] = {}
+    beans: list[ProfileConditionalBean] = []
     try:
         paths = (
             [Path(root) / p for p in file_paths if p.endswith(".java")]
@@ -172,7 +212,7 @@ def conditional_beans_from_sources(
             else list(Path(root).rglob("*.java"))
         )
     except Exception:
-        return {}
+        return []
     for path in paths[:20000]:
         try:
             text = path.read_text(encoding="utf-8", errors="ignore")
@@ -180,11 +220,51 @@ def conditional_beans_from_sources(
             continue
         if "@Profile" not in text:
             continue
+        try:
+            rel = str(path.relative_to(Path(root)))
+        except Exception:
+            rel = str(path)
         for match in _PROFILE_ANN_RE.finditer(text):
-            type_match = _TYPE_AFTER_ANN_RE.search(text, match.end())
-            name = type_match.group("name") if type_match else path.stem
-            for token in _split_profile_expression(match.group("args")):
-                out.setdefault(token.strip(), set()).add(name)
+            tail = text[match.end():match.end() + 4000]
+            type_match = _ANNOTATED_TYPE_RE.match(tail)
+            if type_match:
+                symbol = type_match.group("name")
+            else:
+                member_match = _MEMBER_AFTER_ANN_RE.match(tail)
+                if not member_match:
+                    # Neither a type nor a readable member: report nothing
+                    # rather than attribute the annotation to a guess.
+                    continue
+                owner = _enclosing_type_name(text, match.start(), path.stem)
+                symbol = f"{owner}#{member_match.group('name')}"
+            args = match.group("args")
+            names = _split_profile_expression(args)
+            if not names:
+                continue
+            beans.append(ProfileConditionalBean(
+                symbol=symbol,
+                profiles=tuple(names),
+                source_file=rel,
+                expression=args.strip(),
+            ))
+    beans.sort(key=lambda b: (b.symbol, b.profiles))
+    return beans
+
+
+def conditional_beans_from_sources(
+    root: Path, file_paths: "Optional[list[str]]" = None
+) -> "dict[str, list[str]]":
+    """`{profile: [symbol, …]}` — a projection of
+    :func:`conditional_beans_from_sources_detailed`.
+
+    Kept as the map shape published in the signals payload. It loses the
+    operators (`"a & !b"` appears under `a` and under `!b`), which is why the
+    detailed list carries `expression` and is what a reader should consume.
+    """
+    out: dict[str, set[str]] = {}
+    for bean in conditional_beans_from_sources_detailed(root, file_paths):
+        for token in bean.profiles:
+            out.setdefault(token.strip(), set()).add(bean.symbol)
     return {profile: sorted(names) for profile, names in sorted(out.items())}
 
 

sourcecode/telemetry/__init__.py

@@ -1,12 +1,13 @@
-"""sourcecode telemetry — anonymous usage metrics, on by default (opt-out).
+"""sourcecode telemetry — anonymous usage metrics, off until you turn them on (opt-in).
 
 Public API:
     is_enabled()          → bool
     record(event, **kw)   → None  (fire-and-forget)
     session_id()          → str   (ephemeral 8-char hex, new each process)
 
-Telemetry is enabled by default and stays anonymous. It can be disabled at any
-time via `sourcecode telemetry disable`, SOURCECODE_TELEMETRY=0, or DO_NOT_TRACK=1.
+Telemetry is opt-in and stays anonymous: nothing is collected until `ask telemetry
+enable` (or SOURCECODE_TELEMETRY=1). It was opt-out until 3.3.0 — see config.py for
+why the default moved.
 
 Nothing sensitive (code, paths, secrets, output) is ever collected.
 See docs/privacy.md for full details.

sourcecode/telemetry/config.py

@@ -1,11 +1,17 @@
 """Persistent telemetry configuration.
 
-Telemetry is enabled by default (opt-out). It stays anonymous and never
-collects source code, paths, secrets or repository content.
+Telemetry is **off until the user turns it on** (opt-in). It stays anonymous and
+never collects source code, paths, secrets or repository content.
+
+It was opt-out until 3.3.0. Field evaluation #3 was the first audit of regulated
+third-party code — public-sector health data — and there the default is not a
+preference but a procurement blocker: the reviewer had to disable telemetry
+*before the first run*, which the product gave them no way to do. Nothing is
+collected before an explicit choice, so there is nothing to disable in time.
 
 Config file: ~/.config/sourcecode/config.json
-Disable: `sourcecode telemetry disable`, SOURCECODE_TELEMETRY=0, or DO_NOT_TRACK=1
-Env override: SOURCECODE_TELEMETRY=0 (disable) or =1 (enable)
+Enable: `ask telemetry enable` or SOURCECODE_TELEMETRY=1
+Env override: SOURCECODE_TELEMETRY=1 (enable) or =0 (disable); DO_NOT_TRACK=1 disables
 """
 
 from __future__ import annotations
@@ -18,18 +24,6 @@ from typing import Any
 _ENV_VAR = "SOURCECODE_TELEMETRY"
 _CONFIG_FILE = Path.home() / ".config" / "sourcecode" / "config.json"
 
-# CI markers — when no explicit choice has been made, telemetry defaults OFF
-# in CI (no human to see the first-run notice), ON otherwise.
-_CI_VARS = (
-    "CI", "CONTINUOUS_INTEGRATION", "GITHUB_ACTIONS", "CIRCLECI",
-    "TRAVIS", "JENKINS_URL", "BUILDKITE", "GITLAB_CI", "TF_BUILD",
-    "TEAMCITY_VERSION", "DRONE", "SEMAPHORE",
-)
-
-
-def _in_ci() -> bool:
-    return any(os.environ.get(v) for v in _CI_VARS)
-
 
 def _load() -> dict[str, Any]:
     try:
@@ -46,14 +40,29 @@ def _save(data: dict[str, Any]) -> None:
         pass  # config write failure is non-fatal
 
 
+def stored_choice() -> "bool | None":
+    """The explicit choice on record, or None when the user has made none.
+
+    `None` is a state, not a synonym for `False`: "off because nobody has been
+    asked yet" and "off because you turned it off" are different answers, and
+    `telemetry status` prints them differently.
+    """
+    stored = _load().get("telemetry", {}).get("enabled")
+    return None if stored is None else bool(stored)
+
+
 def is_enabled() -> bool:
-    """True unless telemetry has been explicitly disabled.
+    """True only when telemetry has been explicitly turned on.
 
-    Telemetry is enabled by default (opt-out). Precedence, highest first:
+    Telemetry is **opt-in**: no choice on record means off, everywhere, CI or
+    not. Precedence, highest first:
       1. SOURCECODE_TELEMETRY env var (0 = off, 1 = on)
       2. DO_NOT_TRACK env var (any value other than ""/"0" turns it off)
       3. config file 'enabled' flag, if the user has made an explicit choice
-      4. default: True — except in CI, where it defaults to False
+      4. default: False
+
+    There is no CI special case any more, because there is nothing left for it
+    to protect against — the default it used to override is now off.
     """
     env = os.environ.get(_ENV_VAR, "").strip()
     if env == "0":
@@ -63,11 +72,10 @@ def is_enabled() -> bool:
     dnt = os.environ.get("DO_NOT_TRACK", "").strip()
     if dnt not in ("", "0"):
         return False
-    stored = _load().get("telemetry", {}).get("enabled")
+    stored = stored_choice()
     if stored is not None:
-        return bool(stored)
-    # No explicit choice yet: on by default, off under CI.
-    return not _in_ci()
+        return stored
+    return False
 
 
 def has_been_asked() -> bool:

sourcecode/telemetry/consent.py

@@ -1,9 +1,13 @@
 """First-run telemetry notice.
 
-Telemetry is enabled by default (opt-out) and stays anonymous. The notice is
-shown exactly once, only on interactive TTYs, to inform the user that
-telemetry is on and how to turn it off. It does not ask a question — it
-informs and respects the user's right to disable.
+Telemetry is **opt-in**: nothing has been collected when this notice appears, and
+nothing will be until the user runs `ask telemetry enable`. The notice is shown
+exactly once, only on interactive TTYs, and it is an invitation — it states what
+*would* be collected if they said yes, and it never changes the setting.
+
+The invitation is deliberately printed even though the answer is already "no":
+a user who never learns the option exists cannot choose to help, and a silent
+collector is the thing this release removed.
 
 Notice is written to stderr so it doesn't pollute stdout output.
 """
@@ -15,20 +19,20 @@ import sys
 
 _NOTICE = """\
 \033[2m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  sourcecode — anonymous telemetry is ON by default
+  ask — anonymous telemetry is OFF
 
-  Anonymous usage metrics help improve sourcecode.
+  Nothing has been collected, and nothing will be unless you
+  turn it on. If you would like to help:
 
-  Collected: tool version, Python version, OS, commands used,
-  flags used, MCP tool names invoked, approximate repo size,
-  execution duration, errors.
+    ask telemetry enable
 
-  Never collected: source code, file paths, file names, secrets,
-  tokens, environment variables, or any repository content.
+  If you do, this is collected: tool version, Python version,
+  OS, commands used, flags used, MCP tool names invoked,
+  approximate repo size, execution duration, errors.
 
-  Disable at any time:
-    ask telemetry disable
-    export SOURCECODE_TELEMETRY=0   (or DO_NOT_TRACK=1)
+  Never collected, on or off: source code, file paths, file
+  names, secrets, tokens, environment variables, or any
+  repository content.
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\033[0m
 """
 
@@ -47,10 +51,10 @@ def _is_interactive() -> bool:
 
 
 def show_first_run_notice() -> None:
-    """Print the one-time telemetry notice on interactive terminals.
+    """Print the one-time telemetry invitation on interactive terminals.
 
     Never raises. Does nothing on non-interactive / CI environments.
-    Telemetry stays enabled regardless — this only informs the user.
+    Telemetry stays off regardless — this only tells the user the option exists.
     """
     if not _is_interactive():
         return

sourcecode/test_sources.py

@@ -0,0 +1,178 @@
+"""test_sources.py — one answer to "is this file a test, and does this repo have any".
+
+Four surfaces answered this independently: `signals.has_tests` by substring
+(`"/test" in path`), the `analysis_gaps` testing check by a second substring rule,
+`metrics_analyzer.is_test_file` by ecosystem naming patterns, and the review-pr
+coverage risk by a third. On a repository whose *production* code lives in a
+package called `test` — `com.example.saint.test.PruebaCreaBD` — the substring
+rules reported "2 test files" and `has_tests: true` for a repository containing
+**no tests at all**, and the same document's `analysis_gaps` said otherwise.
+
+The fact this module owns:
+
+    Which files are test sources, which roots hold them, and whether the
+    repository has any.
+
+Two signals decide it, in this order:
+
+1. **A test source root.** `src/test/java`, `src/it/…`, `src/androidTest/…`,
+   `src/testFixtures/…`, or a repository-level `test/`, `tests/`, `spec/`,
+   `__tests__/` directory. A build tool that separates test sources says so with
+   a directory, and that statement outranks any name.
+2. **A naming convention**, per ecosystem — `FooTest.java`, `test_foo.py`,
+   `foo.spec.ts`, `foo_test.go`.
+
+What is deliberately *not* a signal: a package or directory named `test` that
+sits **inside a main source root**. `src/main/java/com/ex/test/Helper.java` is
+production code, and calling it a test inflates coverage in the one direction a
+reader must never be misled about.
+
+VAI: only published, tool-neutral conventions appear here — Maven/Gradle source
+layout and the standard test naming patterns of each ecosystem.
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from pathlib import PurePosixPath
+
+# Directory layouts that *declare* a test source set. Matched as path prefixes
+# after normalization, so `module-a/src/test/java/...` counts too.
+_TEST_ROOT_SEGMENTS: tuple[tuple[str, ...], ...] = (
+    ("src", "test"),
+    ("src", "it"),
+    ("src", "integration-test"),
+    ("src", "integrationTest"),
+    ("src", "androidTest"),
+    ("src", "testFixtures"),
+)
+
+# Repository-level test directories, for ecosystems with no src/main split.
+_TEST_DIR_NAMES: frozenset[str] = frozenset(
+    {"test", "tests", "spec", "specs", "__tests__"}
+)
+
+# A directory named `test` under one of these is production code, not a test.
+_MAIN_ROOT_SEGMENTS: tuple[tuple[str, ...], ...] = (
+    ("src", "main"),
+)
+
+# Naming conventions, per ecosystem. Anchored to avoid `testdata/`, `_tested.py`.
+_TEST_NAME_PATTERNS: tuple[re.Pattern[str], ...] = tuple(
+    re.compile(p) for p in (
+        r"(?:^|/)test_[^/]*\.py$",
+        r"[^/]*_test\.py$",
+        r"[^/]*_test\.go$",
+        r"[^/]*\.(spec|test)\.(js|jsx|ts|tsx|mjs|cjs)$",
+        r"[^/]*(Test|Tests|Spec|IT)\.(java|kt|scala)$",
+        r"[^/]*_test\.rb$",
+        r"[^/]*_spec\.rb$",
+        r"[^/]*_test\.dart$",
+        r"[^/]*(Test|test)\.(c|cpp|cc|h|hpp)$",
+        r"[^/]*Test\.php$",
+    )
+)
+
+
+def _norm(path: str) -> str:
+    return path.replace("\\", "/").lstrip("./")
+
+
+def _parts(path: str) -> list[str]:
+    return [p for p in _norm(path).split("/") if p]
+
+
+def _under_main_root(parts: list[str]) -> bool:
+    for i in range(len(parts) - 1):
+        if tuple(parts[i:i + 2]) in _MAIN_ROOT_SEGMENTS:
+            return True
+    return False
+
+
+def declared_test_root(path: str) -> "str | None":
+    """The declared test source root containing ``path``, if any."""
+    parts = _parts(path)
+    for i in range(len(parts) - 1):
+        if tuple(parts[i:i + 2]) in _TEST_ROOT_SEGMENTS:
+            return "/".join(parts[:i + 2])
+    if _under_main_root(parts):
+        # A `test` package inside a main source root is production code.
+        return None
+    for i, part in enumerate(parts[:-1]):
+        if part in _TEST_DIR_NAMES:
+            return "/".join(parts[:i + 1])
+    return None
+
+
+def is_test_path(path: str) -> bool:
+    """Whether ``path`` is a test source.
+
+    The single derivation of this fact. A file under a declared test source root
+    is a test whatever it is named; a file named by convention is a test wherever
+    it sits; a `test` package inside a main source root is neither.
+    """
+    if declared_test_root(path) is not None:
+        return True
+    normalized = _norm(path)
+    return any(p.search(normalized) for p in _TEST_NAME_PATTERNS)
+
+
+@dataclass(frozen=True)
+class SourceTestFacts:
+    """What a repository's file list says about its tests."""
+
+    test_files: tuple[str, ...] = ()
+    roots: tuple[str, ...] = ()
+    basis: str = ""
+    extensions: tuple[str, ...] = field(default=())
+
+    @property
+    def count(self) -> int:
+        return len(self.test_files)
+
+    @property
+    def has_tests(self) -> bool:
+        return bool(self.test_files)
+
+    def to_dict(self) -> dict:
+        return {
+            "test_file_count": self.count,
+            "test_source_roots": list(self.roots),
+            "has_tests": self.has_tests,
+            "basis": self.basis,
+        }
+
+
+def analyze_test_sources(
+    file_paths: "list[str] | tuple[str, ...]",
+    *,
+    extensions: "tuple[str, ...] | None" = None,
+) -> SourceTestFacts:
+    """Test sources in ``file_paths``, optionally restricted to ``extensions``.
+
+    ``extensions`` scopes the question to one language (``(".java",)`` for the
+    backend coverage gap) without changing the rule that answers it.
+    """
+    paths = [
+        p for p in file_paths
+        if not extensions or _norm(p).endswith(extensions)
+    ]
+    tests = tuple(sorted(p for p in paths if is_test_path(p)))
+    roots = tuple(sorted({r for p in tests if (r := declared_test_root(p))}))
+    if tests:
+        basis = (
+            f"{len(tests)} file(s) under a declared test source root "
+            f"or matching a test naming convention"
+            + (f"; roots: {', '.join(roots)}" if roots else "")
+        )
+    else:
+        basis = (
+            "no declared test source root (src/test, src/it, tests/) and no file "
+            "matching a test naming convention"
+        )
+    return SourceTestFacts(
+        test_files=tests,
+        roots=roots,
+        basis=basis,
+        extensions=tuple(extensions or ()),
+    )