sourcecode 4.10.0__tar.gz → 4.10.2__tar.gz

{sourcecode-4.10.0 → sourcecode-4.10.2}/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 ## [Unreleased]
 
+## [4.10.2] — 2026-08-05
+
+### Fixed
+
+- **Durable run records are read-only by default.** Long repo-wide/deep commands
+  now write run records under `~/.sourcecode/runs/<repo-hash>/` instead of
+  `<repo>/.ask/runs`, with `ASK_RUNS_IN_REPO=1` as the explicit repo-local opt-in.
+- **`DEAD-001` comment scanning avoids ordinary files.** The commented-security
+  control pass now prefilters by security-control vocabulary before extracting
+  comment spans, preserving `DEAD-001` positives while reducing the cost added to
+  large `spring-audit` runs.
+- **Field regression guards for `spring-audit`.** End-to-end tests now lock that
+  reserved-keyword handler symbols such as `#if` cannot reach security findings,
+  and that JavaMelody `authorized-users` credentials in `web.xml` emit `SEC-007`.
+
+### Documentation
+
+- README, user guide, roadmap and defect ledger now record the 4.10.0 field
+  confirmation queue, the supervised heartbeat contract and the external run-record
+  location.
+
+## [4.10.1] — 2026-08-05
+
+### Fixed
+
+- **`cache model` now includes `audit-report`.** Warm-cache documentation and
+  machine output now agree that `audit-report` reuses the same structural layers
+  as the other deep analysis/reporting commands.
+- **`migrate-check --blast-radius` no longer changes unrelated provenance.**
+  The optional blast-radius flag now adds only the blast-radius block; the shared
+  evidence manifest stays deterministic for shape-comparison consumers.
+- **`impact` expands class/interface seeds to in-repository subtypes.** A base
+  class or interface query now reaches callers of subtype members, matching the
+  endpoint-reach behavior already expected from `impact-chain`.
+- **Severity fields are locked to named units.** Tests now preserve the contract
+  that declared scanner severity, composed effective severity and risk band are
+  separate fields rather than contradictory values for the same claim.
+
+### Documentation
+
+- README, user guide, roadmap and defect ledger now reflect the 4.10.1 patch
+  status and close stale rows that were already fixed by measured tests.
+
 ## [4.10.0] — 2026-08-05
 
 ### Fixed

{sourcecode-4.10.0 → sourcecode-4.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.10.0
+Version: 4.10.2
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.0-blue)
+![Version](https://img.shields.io/badge/version-4.10.2-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -73,7 +73,14 @@ These numbers are cache-layer benchmarks, not a promise for every command. Per-s
 
 With the right command class, ASK Engine becomes **constant infrastructure** inside agent loops — call the fast/context surfaces before edits and reserve deep compositions for the points where their evidence is worth the runtime.
 
-**Large-repo controls.** Set `ASK_PROGRESS=1` to get line heartbeats in non-TTY supervised runs. Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to fail before starting a repo-wide/deep command whose configured budget is below its safe floor. Use `ask audit-report --from-risk risk.json` to package an existing risk run instead of recomputing it.
+**Large-repo controls.** Set `ASK_PROGRESS=1` to get line heartbeats in non-TTY
+supervised runs. Long repo-wide/deep runs also write durable records under
+`~/.sourcecode/runs/<repo-hash>/` by default, not inside the audited repository;
+set `ASK_RUNS_IN_REPO=1` only when repo-local `.ask/runs` records are intentional.
+Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to fail before starting a repo-wide/deep
+command whose configured budget is below its safe floor. Use
+`ask audit-report --from-risk risk.json` to package an existing risk run instead
+of recomputing it.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -99,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.0 — and, on a build that has aged,
+ask version                    # ask 4.10.2 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.0 → sourcecode-4.10.2}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.0-blue)
+![Version](https://img.shields.io/badge/version-4.10.2-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -35,7 +35,14 @@ These numbers are cache-layer benchmarks, not a promise for every command. Per-s
 
 With the right command class, ASK Engine becomes **constant infrastructure** inside agent loops — call the fast/context surfaces before edits and reserve deep compositions for the points where their evidence is worth the runtime.
 
-**Large-repo controls.** Set `ASK_PROGRESS=1` to get line heartbeats in non-TTY supervised runs. Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to fail before starting a repo-wide/deep command whose configured budget is below its safe floor. Use `ask audit-report --from-risk risk.json` to package an existing risk run instead of recomputing it.
+**Large-repo controls.** Set `ASK_PROGRESS=1` to get line heartbeats in non-TTY
+supervised runs. Long repo-wide/deep runs also write durable records under
+`~/.sourcecode/runs/<repo-hash>/` by default, not inside the audited repository;
+set `ASK_RUNS_IN_REPO=1` only when repo-local `.ask/runs` records are intentional.
+Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to fail before starting a repo-wide/deep
+command whose configured budget is below its safe floor. Use
+`ask audit-report --from-risk risk.json` to package an existing risk run instead
+of recomputing it.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -61,7 +68,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.0 — and, on a build that has aged,
+ask version                    # ask 4.10.2 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.0 → sourcecode-4.10.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.10.0"
+version = "4.10.2"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.10.0 → sourcecode-4.10.2}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.10.0"
+__version__ = "4.10.2"

{sourcecode-4.10.0 → sourcecode-4.10.2}/src/sourcecode/migrate_check.py

@@ -3008,6 +3008,7 @@ def run_migrate_check(
             "target_jdk": target_jdk,
             "keep_boot": keep_boot,
         },
+        include_generated_at=False,
     )
     return report
 

{sourcecode-4.10.0 → sourcecode-4.10.2}/src/sourcecode/provenance.py

@@ -162,6 +162,7 @@ def build_evidence_manifest(
     command: str,
     root: Path,
     inputs: Optional[dict[str, Any]] = None,
+    include_generated_at: bool = True,
 ) -> dict[str, Any]:
     """Build a machine-readable provenance index for an existing payload."""
     root = Path(root).resolve()
@@ -173,17 +174,19 @@ def build_evidence_manifest(
         for claim in claims
         if (claim.get("source") or {}).get("path")
     })
+    run: dict[str, Any] = {
+        "command": command,
+        "tool": "ask",
+        "tool_version": __version__,
+        "repository": str(root),
+        "git_head": _git_head(root),
+        "inputs": inputs or {},
+    }
+    if include_generated_at:
+        run["generated_at"] = datetime.now(timezone.utc).isoformat()
     return {
         "schema_version": PROVENANCE_SCHEMA,
-        "run": {
-            "command": command,
-            "tool": "ask",
-            "tool_version": __version__,
-            "repository": str(root),
-            "git_head": _git_head(root),
-            "generated_at": datetime.now(timezone.utc).isoformat(),
-            "inputs": inputs or {},
-        },
+        "run": run,
         "claims": claims,
         "sources": [{"path": path} for path in sources],
         "claims_cap": (

{sourcecode-4.10.0 → sourcecode-4.10.2}/src/sourcecode/repository_ir.py

@@ -6975,6 +6975,27 @@ def compute_blast_radius(
         )
     except Exception:
         _impl_graph = None
+    if _impl_graph is not None:
+        _class_fqns = {
+            n.get("fqn") or ""
+            for n in graph_nodes
+            if (n.get("symbol_kind") or n.get("type"))
+            in {"class", "interface", "enum", "record", "annotation"}
+        }
+
+        def _seed_class(_sym: str) -> str:
+            return _sym if _sym in _class_fqns else _enclosing_class(_sym)
+
+        _seed_set = set(matched_fqns)
+        _expanded = set(matched_fqns)
+        _symbols_by_class: dict[str, list[str]] = {}
+        for _sym in reverse_graph:
+            _symbols_by_class.setdefault(_seed_class(_sym), []).append(_sym)
+        for _seed in sorted(_seed_set):
+            for _subtype in getattr(_impl_graph, "all_subtypes_of")(_seed_class(_seed)):
+                for _sym in _symbols_by_class.get(_subtype, ()):
+                    _expanded.add(_sym)
+        matched_fqns = _expanded
     for seed in matched_fqns:
         _seed_callers = _all_callers_from_rg(seed, reverse_graph, _rg_index, _impl_graph)
         if len(_seed_callers) > _HUB_CALLER_THRESHOLD and max_depth > 1:

{sourcecode-4.10.0 → sourcecode-4.10.2}/src/sourcecode/runs.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import hashlib
 import os
 import time
 import uuid
@@ -18,7 +19,17 @@ def _now() -> float:
 
 
 def _runs_dir(root: Path) -> Path:
-    return Path(root).resolve() / ".ask" / "runs"
+    override = os.environ.get("ASK_RUNS_DIR", "").strip()
+    if override:
+        return Path(override).expanduser().resolve()
+    if os.environ.get("ASK_RUNS_IN_REPO", "").lower() in ("1", "true", "yes", "on"):
+        return Path(root).resolve() / ".ask" / "runs"
+    try:
+        key_source = str(Path(root).resolve())
+    except Exception:
+        key_source = str(Path(root).absolute())
+    repo_key = hashlib.sha256(key_source.encode("utf-8", errors="replace")).hexdigest()[:16]
+    return Path.home() / ".sourcecode" / "runs" / repo_key
 
 
 @dataclass

{sourcecode-4.10.0 → sourcecode-4.10.2}/src/sourcecode/security_config_scan.py

@@ -212,6 +212,15 @@ _COMMENTED_CONFIG_CONTROLS: tuple[tuple[re.Pattern, str, str], ...] = (
     ),
 )
 
+_COMMENTED_JAVA_HINTS = (
+    "@PreAuthorize", "@PostAuthorize", "@Secured", "@RolesAllowed", "@DenyAll",
+    "@PermitAll", "FiltroSeguridad", "Security", "Authz", "Authorize",
+    "Authorized", "setSecure", "csrfTokenRepository", "csrf(",
+)
+_COMMENTED_XML_HINTS = (
+    "<transport-guarantee", "CONFIDENTIAL", "<security-constraint", "<intercept-url",
+)
+
 
 @dataclass(frozen=True)
 class SecurityConfigObservation:
@@ -456,6 +465,9 @@ def _scan_commented_controls(
     from sourcecode.source_text import commented_spans
 
     rules = _COMMENTED_XML_CONTROLS if xml else _COMMENTED_JAVA_CONTROLS
+    hints = _COMMENTED_XML_HINTS if xml else _COMMENTED_JAVA_HINTS
+    if not any(hint in source for hint in hints):
+        return []
     out: "list[SecurityConfigObservation]" = []
     seen: set[tuple[str, int]] = set()
     for start, end in commented_spans(source, xml=xml):