sourcecode 4.10.1__py3-none-any.whl → 4.10.3__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.10.1"
+__version__ = "4.10.3"

sourcecode/runs.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import hashlib
 import os
 import time
 import uuid
@@ -18,7 +19,17 @@ def _now() -> float:
 
 
 def _runs_dir(root: Path) -> Path:
-    return Path(root).resolve() / ".ask" / "runs"
+    override = os.environ.get("ASK_RUNS_DIR", "").strip()
+    if override:
+        return Path(override).expanduser().resolve()
+    if os.environ.get("ASK_RUNS_IN_REPO", "").lower() in ("1", "true", "yes", "on"):
+        return Path(root).resolve() / ".ask" / "runs"
+    try:
+        key_source = str(Path(root).resolve())
+    except Exception:
+        key_source = str(Path(root).absolute())
+    repo_key = hashlib.sha256(key_source.encode("utf-8", errors="replace")).hexdigest()[:16]
+    return Path.home() / ".sourcecode" / "runs" / repo_key
 
 
 @dataclass

sourcecode/security_config_scan.py

@@ -111,8 +111,8 @@ _IS_REFERENCE = re.compile(r"[$@]\{[^}]+\}|^\s*$|^\s*ENC\(|^\s*\*+\s*$")
 #: XML elements whose text is a configured VALUE. Servlet/JEE spec vocabulary.
 _DESCRIPTOR_VALUE = re.compile(
     r"<(?P<tag>param-value|env-entry-value|value|property|password)\b[^>]*>"
-    r"(?P<value>[^<]*)</(?P=tag)>",
-    re.IGNORECASE,
+    r"(?P<value>.*?)</(?P=tag)>",
+    re.IGNORECASE | re.DOTALL,
 )
 
 _DESCRIPTOR_INIT_PARAM = re.compile(
@@ -124,8 +124,8 @@ _DESCRIPTOR_PARAM_NAME = re.compile(
     re.IGNORECASE,
 )
 _DESCRIPTOR_PARAM_VALUE = re.compile(
-    r"<param-value\b[^>]*>(?P<value>[^<]*)</param-value>",
-    re.IGNORECASE,
+    r"<param-value\b[^>]*>(?P<value>.*?)</param-value>",
+    re.IGNORECASE | re.DOTALL,
 )
 _JAVAMELODY_CREDENTIAL_PARAMS: frozenset[str] = frozenset({
     "authorized-users",
@@ -212,6 +212,15 @@ _COMMENTED_CONFIG_CONTROLS: tuple[tuple[re.Pattern, str, str], ...] = (
     ),
 )
 
+_COMMENTED_JAVA_HINTS = (
+    "@PreAuthorize", "@PostAuthorize", "@Secured", "@RolesAllowed", "@DenyAll",
+    "@PermitAll", "FiltroSeguridad", "Security", "Authz", "Authorize",
+    "Authorized", "setSecure", "csrfTokenRepository", "csrf(",
+)
+_COMMENTED_XML_HINTS = (
+    "<transport-guarantee", "CONFIDENTIAL", "<security-constraint", "<intercept-url",
+)
+
 
 @dataclass(frozen=True)
 class SecurityConfigObservation:
@@ -355,7 +364,14 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
     holds a reference and is not reported; one that carries a digest literal
     holds the credential itself, in a file under version control.
     """
+    def _xml_value(raw: str) -> str:
+        value = raw.strip()
+        if value.startswith("<![CDATA[") and value.endswith("]]>"):
+            value = value[len("<![CDATA["):-len("]]>")]
+        return value.strip()
+
     out: "list[SecurityConfigObservation]" = []
+    javamelody_value_offsets: set[int] = set()
     for param in _DESCRIPTOR_INIT_PARAM.finditer(text):
         body = param.group("body")
         name_m = _DESCRIPTOR_PARAM_NAME.search(body)
@@ -363,22 +379,29 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
         if name_m is None or value_m is None:
             continue
         name = name_m.group("value").strip().lower()
-        value = value_m.group("value").strip()
+        value = _xml_value(value_m.group("value"))
         if name not in _JAVAMELODY_CREDENTIAL_PARAMS:
             continue
         if not value or _IS_REFERENCE.search(value):
             continue
         if ":" not in value:
             continue
-        if _DIGEST_LITERAL.search(value):
-            continue
         user = value.split(":", 1)[0].strip() or "user"
+        value_offset = param.start("body") + value_m.start("value")
+        javamelody_value_offsets.add(value_offset)
+        digest = _DIGEST_LITERAL.search(value)
+        evidence = (
+            f"<param-value>{user}:…{{{digest.group('algo')}}}"
+            f"{digest.group('digest')[:8]}…</param-value>"
+            if digest is not None
+            else f"<param-value>{user}:…</param-value>"
+        )
         out.append(SecurityConfigObservation(
             rule="SEC-007",
             file=rel,
-            line=_line_of(text, param.start() + value_m.start()),
+            line=_line_of(text, value_offset),
             symbol=rel,
-            evidence=f"<param-value>{user}:…</param-value>",
+            evidence=evidence,
             detail=(
                 "JavaMelody authorized-users stores a monitoring-console credential "
                 "directly in the deployment descriptor. The value is redacted here; "
@@ -386,7 +409,9 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
             ),
         ))
     for match in _DESCRIPTOR_VALUE.finditer(text):
-        value = match.group("value").strip()
+        if match.start("value") in javamelody_value_offsets:
+            continue
+        value = _xml_value(match.group("value"))
         if not value or _IS_REFERENCE.search(value):
             continue
         digest = _DIGEST_LITERAL.search(value)
@@ -456,6 +481,9 @@ def _scan_commented_controls(
     from sourcecode.source_text import commented_spans
 
     rules = _COMMENTED_XML_CONTROLS if xml else _COMMENTED_JAVA_CONTROLS
+    hints = _COMMENTED_XML_HINTS if xml else _COMMENTED_JAVA_HINTS
+    if not any(hint in source for hint in hints):
+        return []
     out: "list[SecurityConfigObservation]" = []
     seen: set[tuple[str, int]] = set()
     for start, end in commented_spans(source, xml=xml):

sourcecode/spring_security_audit.py

@@ -508,7 +508,8 @@ def _line_of(source: str, offset: int) -> int:
 _JAVA_METHOD_RE = re.compile(
     r"(?P<mods>(?:(?:public|protected|private|static|final|synchronized|abstract|native)\s+)*)"
     r"(?P<ret>[\w.$<>\[\], ?]+)\s+"
-    r"(?P<name>[a-zA-Z_][\w$]*)\s*\([^;{}]*\)\s*(?:throws\s+[^{]+)?\{",
+    r"(?P<name>(?!(?:if|for|while|switch|catch|synchronized|return|new|throw|try|else|do)\b)"
+    r"[a-zA-Z_][\w$]*)\s*\([^;{}]*\)\s*(?:throws\s+[^{]+)?\{",
     re.MULTILINE,
 )
 

{sourcecode-4.10.1.dist-info → sourcecode-4.10.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.10.1
+Version: 4.10.3
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.1-blue)
+![Version](https://img.shields.io/badge/version-4.10.3-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -73,7 +73,14 @@ These numbers are cache-layer benchmarks, not a promise for every command. Per-s
 
 With the right command class, ASK Engine becomes **constant infrastructure** inside agent loops — call the fast/context surfaces before edits and reserve deep compositions for the points where their evidence is worth the runtime.
 
-**Large-repo controls.** Set `ASK_PROGRESS=1` to get line heartbeats in non-TTY supervised runs. Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to fail before starting a repo-wide/deep command whose configured budget is below its safe floor. Use `ask audit-report --from-risk risk.json` to package an existing risk run instead of recomputing it.
+**Large-repo controls.** Set `ASK_PROGRESS=1` to get line heartbeats in non-TTY
+supervised runs. Long repo-wide/deep runs also write durable records under
+`~/.sourcecode/runs/<repo-hash>/` by default, not inside the audited repository;
+set `ASK_RUNS_IN_REPO=1` only when repo-local `.ask/runs` records are intentional.
+Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to fail before starting a repo-wide/deep
+command whose configured budget is below its safe floor. Use
+`ask audit-report --from-risk risk.json` to package an existing risk run instead
+of recomputing it.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -99,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.1 — and, on a build that has aged,
+ask version                    # ask 4.10.3 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.1.dist-info → sourcecode-4.10.3.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=bZfhB676iKPqbeqLZO21xhmWnrXFygsr1pQZ-4LbcWc,309
+sourcecode/__init__.py,sha256=kRwEKt8ufgmTyXFYrYP-5dM5o3eTQYMoUFRLOvoQ0as,309
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=CZvRLpkHot_D8D3JFQVorr-EHDJyh0BbS7RnSTqBigM,40499
 sourcecode/architectural_baseline.py,sha256=agDSwGEakdkgLLh5xnd3hiD_TC6pRujWt4klnuYF1wo,18689
@@ -97,13 +97,13 @@ sourcecode/repository_ir.py,sha256=UdA13zDUvhgZvdUt8BIbfHOXi40OkdvqtpMJG7hYkms,3
 sourcecode/ris.py,sha256=SjjDNMcc9Zr9us9G8ikBVkoPXKK3BpM-dBodSGMh_g4,24783
 sourcecode/risk.py,sha256=UgTVdMc8XBArO6D9e2Xx9I-kKqx-PW4W0hSe1Jy9qjU,54491
 sourcecode/rule_catalog.py,sha256=xmphuULUCtg_GWTbriwY25D-N2IaeMXXvB5CNU1xSuA,4925
-sourcecode/runs.py,sha256=Oq3vm0_KJGyYUe6Oi8H0DsTNXuWvHQ8tKZjET5i-f0E,4251
+sourcecode/runs.py,sha256=K1G7WjSLACZFNklRupFiHjmF5SJYtoo1OWjA0h8-q7Y,4761
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/sarif.py,sha256=3hQEegUxIZbojFdY59oB-yKsK-rnafHdTNmYsEP2--A,25984
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
-sourcecode/security_config_scan.py,sha256=HEzUOfJpHDnLslhtxnUcDPd3Ci_KCi-4JPTcD8mxjts,26079
+sourcecode/security_config_scan.py,sha256=RDxBNm7oVdAaY6gbQgeA2FjHy2pVc6MPRnrBwTnASqY,27247
 sourcecode/security_posture.py,sha256=CjJ2Qm87HhKXepnaWx1ncJLW-SxI18udCmUDIkCyAsY,50270
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
@@ -118,7 +118,7 @@ sourcecode/spring_impact.py,sha256=keWoE1tN5B_SzJx9F-53RKEL0b2edhJdZMTfocmJZLY,8
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=KKsJCKUI35KiI47E9ydsDsUuom20lz_OBbzyvyDBlKU,46172
+sourcecode/spring_security_audit.py,sha256=KkhIx1WhAD9ccw3P-CcHP3d8p0OAOivKT5CrX2Zuq8k,46257
 sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=_wqjRktqdPS6PiXXxtTkCD1t6BaE2uhqx6ioYY-ULAw,44153
 sourcecode/summarizer.py,sha256=0aD4x3vgPngqBCEBKGuES1J2Vk5f7mqCm_ZWErwm3js,27025
@@ -193,8 +193,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.10.1.dist-info/METADATA,sha256=C03K4BPIPgHtCgRNb8t39MBqlERAAQTfSEv75MGXYpg,36435
-sourcecode-4.10.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.10.1.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.10.1.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.10.1.dist-info/RECORD,,
+sourcecode-4.10.3.dist-info/METADATA,sha256=6_uj0P5A9uKdHBcaXMZQic-g9lTXCknIu4m9X9sYj1g,36657
+sourcecode-4.10.3.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.10.3.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.10.3.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.10.3.dist-info/RECORD,,