sourcecode 4.10.2__tar.gz → 4.10.4__tar.gz

{sourcecode-4.10.2 → sourcecode-4.10.4}/CHANGELOG.md

@@ -2,6 +2,87 @@
 
 ## [Unreleased]
 
+## [4.10.4] — 2026-08-07
+
+First release of the queue opened by field evaluation #13. Four of its rows close,
+one closes largely, and the suite goes green: `master` was carrying four failing
+tests before this release, none of them noticed by the release that shipped over
+them.
+
+### Fixed
+
+- **`baseline` no longer emits a JSON object keyed by symbol** (C3-62). PowerShell's
+  `ConvertFrom-Json` folds object keys case-insensitively, so two Java symbols
+  differing only by case — legal, Java is case-sensitive — collided and aborted
+  parsing of the *entire* baseline document on the default Windows consumer. `fan_in`
+  now serialises as a sorted array of `{symbol, fan_in}`, the shape `hotspots` already
+  used. Baselines captured before this release keep diffing and trending: the reader
+  accepts both shapes.
+- **`spring-audit` no longer prints `done` before the answer exists** (C3-54, part 1).
+  The completion line was emitted inside the `finally` around the analysis, so a
+  teardown landing between it and the write left 6.8 minutes of CPU and no output
+  file behind a reported success. It now prints after the write it describes. The
+  same reorder also stops `done` from being claimed on a run whose analysis *raised*.
+- **`ask cache model` answers in ~830 tokens instead of ~2 590** (C3-63). One line per
+  layer and per command by default; the per-command measured timings and notes move
+  behind `--full`. Every command and every layer is still named, and the invalidation
+  rule is still stated — the density fix is not a coverage cut. `--json` and
+  `--markdown` are unchanged.
+- **The evidence manifest publishes how many claims exist, not how many fitted**
+  (invariant I-2). The claim builder returned the moment it reached its 200-claim cap,
+  so the real total was never computed and the cap was published in its place, with no
+  field carrying the truth. `claims_cap` now reads `{total, total_indexed, capped}`
+  with `total` measured before truncation. `capped` is also corrected: exactly 200
+  claims reported a cut that had not happened.
+
+### Performance
+
+- **The `spring-audit` rule pass is 7.8× faster on a large repository** (C3-61):
+  42.1 s → 5.4 s measured on keycloak (5 486 non-test sources, 59 144 symbols), with
+  the finding set byte-identical before and after. The cost was not spread across the
+  file population — one rule was 94 % of it, and inside it `_proxy_bypass` scanned
+  every source for every inferred gate token before establishing that the source never
+  mentions the token: 98.9 % of the work was provably empty. The guard is an
+  equivalence, not a heuristic, and no threads or processes were added, so output
+  determinism is untouched. The rule pass is no longer the dominant phase.
+
+### Tests
+
+- The four batteries that were red on `master` before this release are green:
+  `test_flag_normalization` compared a wall-clock timestamp between two runs;
+  `test_path_admission` had no invocation row for `audit-report`; and
+  `test_invariant_counts_from_measurement` failed on `provenance.py` (a real defect,
+  fixed above) and on `audit_report.py` (a false positive from a hand-maintained key
+  catalogue, now a rule on the key's final token — the audit's anti-vacuous guard is
+  extended rather than trusted).
+- Every fix in this release ships a regression battery that was mutation-checked:
+  reverting the fix fails the new tests. Two of them were rewritten after the first
+  draft passed under that mutation — a summary that exists but is never reached by the
+  command, and an error path that exits before the spinner is created.
+
+## [4.10.3] — 2026-08-05
+
+### Fixed
+
+- **`GATE-001` no longer reads Java control keywords as method calls.** The regex
+  body scan behind the gated-endpoint audit treated `if(...)`, `for(...)`,
+  `while(...)`, `switch(...)`, `catch(...)` and `synchronized(...)` as same-class
+  invocations, so a handler could be reported as `Controller#if`. Those symbols
+  reached the `risk` critical band and `audit-report` top risks. Control keywords
+  are now excluded from method-name matches; the real private-method gate finding
+  stays covered.
+- **`SEC-007` reports JavaMelody descriptor credentials in their field shape.**
+  `authorized-users` is now read directly from the named descriptor parameter even
+  when the value carries a digest (`{SHA-256}…`), spans multiple lines, or is
+  wrapped in `CDATA`, and the generic descriptor-value fallback is deduplicated so
+  one credential yields exactly one finding. The evidence line stays redacted.
+
+### Tests
+
+- Regression coverage binds both fixes through the full `spring-audit` CLI path,
+  including a `options/DPA/WEB-INF/web.xml` descriptor and a controller whose
+  handler body contains the control constructs that produced the false positive.
+
 ## [4.10.2] — 2026-08-05
 
 ### Fixed

{sourcecode-4.10.2 → sourcecode-4.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.10.2
+Version: 4.10.4
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -18,7 +18,7 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
 Requires-Dist: defusedxml>=0.7
-Requires-Dist: mcp>=1.0.0
+Requires-Dist: mcp<2,>=1.2
 Requires-Dist: pathspec>=1.0
 Requires-Dist: ruamel-yaml>=0.18
 Requires-Dist: tomli>=2.0; python_version < '3.11'
@@ -28,12 +28,12 @@ Requires-Dist: tree-sitter-javascript>=0.21; extra == 'ast'
 Requires-Dist: tree-sitter-typescript>=0.21; extra == 'ast'
 Requires-Dist: tree-sitter>=0.21; extra == 'ast'
 Provides-Extra: dev
-Requires-Dist: mcp>=1.0.0; extra == 'dev'
+Requires-Dist: mcp<2,>=1.2; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest>=8; extra == 'dev'
 Requires-Dist: ruff>=0.15; extra == 'dev'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Requires-Dist: mcp<2,>=1.2; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # ASK Engine
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.2-blue)
+![Version](https://img.shields.io/badge/version-4.10.4-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -106,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.2 — and, on a build that has aged,
+ask version                    # ask 4.10.4 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.2 → sourcecode-4.10.4}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.2-blue)
+![Version](https://img.shields.io/badge/version-4.10.4-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -68,7 +68,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.2 — and, on a build that has aged,
+ask version                    # ask 4.10.4 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.2 → sourcecode-4.10.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.10.2"
+version = "4.10.4"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -30,7 +30,7 @@ dependencies = [
     "pathspec>=1.0",
     "ruamel.yaml>=0.18",
     "tomli>=2.0; python_version < '3.11'",
-    "mcp>=1.0.0",
+    "mcp>=1.2,<2",
     "defusedxml>=0.7",
 ]
 
@@ -43,7 +43,7 @@ dev = [
     "pytest>=8",
     "ruff>=0.15",
     "mypy>=1.10",
-    "mcp>=1.0.0",
+    "mcp>=1.2,<2",
 ]
 ast = [
     "tree-sitter>=0.21",
@@ -51,7 +51,7 @@ ast = [
     "tree-sitter-javascript>=0.21",
 ]
 mcp = [
-    "mcp>=1.0.0",
+    "mcp>=1.2,<2",
 ]
 
 [[tool.mypy.overrides]]

{sourcecode-4.10.2 → sourcecode-4.10.4}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.10.2"
+__version__ = "4.10.4"

{sourcecode-4.10.2 → sourcecode-4.10.4}/src/sourcecode/architectural_baseline.py

@@ -33,7 +33,7 @@ import json
 import subprocess
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Any
 
 from sourcecode import __version__ as TOOL_VERSION
 from sourcecode.architectural_delta import ArchMetrics, diff_metrics, extract_metrics
@@ -107,6 +107,35 @@ def _hotspots(fan_in: dict[str, int], top_n: int) -> list[dict]:
     return [{"symbol": s, "fan_in": c} for s, c in ranked[:top_n]]
 
 
+def _fan_in_to_list(fan_in: dict[str, int]) -> list[dict]:
+    """Serialise the full fan-in map as an array of ``{symbol, fan_in}`` objects,
+    sorted by symbol — never a JSON object keyed by symbol.
+
+    C3-62: PowerShell's `ConvertFrom-Json` folds object keys case-insensitively, so
+    two distinct Java symbols differing only by case (legal — Java is case-sensitive)
+    collapse into one key and abort parsing the *whole* baseline document. `hotspots`
+    already used this array shape (`_hotspots`); the full map stored beside it did
+    not. An array of objects has no such ceiling on any consumer."""
+    return [{"symbol": s, "fan_in": c} for s, c in sorted(fan_in.items())]
+
+
+def _fan_in_from_stored(value: Any) -> dict[str, int]:
+    """Read a stored ``fan_in`` field back into a symbol → count map.
+
+    Accepts both the array-of-objects shape (C3-62, current) and the legacy
+    object-keyed-by-symbol shape (baselines captured before this fix) so an older
+    baseline already committed to disk keeps diffing and trending correctly."""
+    if isinstance(value, list):
+        return {
+            str(item["symbol"]): int(item.get("fan_in", 0))
+            for item in value
+            if isinstance(item, dict) and "symbol" in item
+        }
+    if isinstance(value, dict):
+        return {str(k): int(v) for k, v in value.items()}
+    return {}
+
+
 def build_baseline(
     cir: "CanonicalRepositoryIR",
     *,
@@ -126,7 +155,6 @@ def build_baseline(
     that share them."""
     m = extract_metrics(cir)
     endpoints = sorted([meth, path] for (meth, path) in m.endpoints)
-    fan_in = dict(sorted(m.fan_in.items()))
     cycles = sorted((sorted(c) for c in m.cycles), key=lambda mm: (len(mm), mm))
     return {
         "schema": ARCH_BASELINE_SCHEMA,
@@ -145,7 +173,7 @@ def build_baseline(
         },
         "hotspots": _hotspots(m.fan_in, hotspot_n),
         "endpoint_surface": endpoints,
-        "fan_in": fan_in,
+        "fan_in": _fan_in_to_list(m.fan_in),
         "import_cycles": cycles,
         "env": env if env is not None else collect_env(),
         "provenance": (
@@ -209,7 +237,7 @@ def baseline_to_metrics(baseline: dict) -> ArchMetrics:
         endpoint_count=int(totals.get("endpoints", 0)),
         dependency_edge_count=int(totals.get("dependency_edges", 0)),
         endpoints=endpoints,
-        fan_in={str(k): int(v) for k, v in (baseline.get("fan_in") or {}).items()},
+        fan_in=_fan_in_from_stored(baseline.get("fan_in")),
         cycles=frozenset(
             frozenset(str(m) for m in members)
             for members in baseline.get("import_cycles", [])
@@ -397,9 +425,10 @@ def build_trend(baselines: list[dict]) -> dict:
             if isinstance(h, dict) and h.get("symbol"):
                 tracked.add(str(h["symbol"]))
 
+    fan_in_by_baseline = [_fan_in_from_stored(b.get("fan_in")) for b in baselines]
     hotspot_trends: list[dict] = []
     for sym in sorted(tracked):
-        series = [int((b.get("fan_in") or {}).get(sym, 0)) for b in baselines]
+        series = [fmap.get(sym, 0) for fmap in fan_in_by_baseline]
         first, last = series[0], series[-1]
         hotspot_trends.append({
             "symbol": sym,

{sourcecode-4.10.2 → sourcecode-4.10.4}/src/sourcecode/cache_model.py

@@ -302,8 +302,48 @@ def render_markdown() -> str:
     return "\n".join(out)
 
 
+def render_summary() -> str:
+    """The model as `ask cache model` prints it by default (C3-63).
+
+    One line per layer and one line per command — every command named (nothing
+    curated out, so the same completeness the battery checks against `render_text`
+    holds here too), but without the per-command prose (`note`) and timing
+    (`measured`) detail that made the default ~2 500 tokens of prose in a CLI whose
+    own selling argument is token economy. That detail is still one flag away.
+    """
+    lines: list[str] = []
+    lines.append(
+        "Invalidation: every layer keys on the exact tree state — any change to the "
+        "analysed files invalidates it, committed or not."
+    )
+    lines.append("")
+    lines.append("Layers")
+    id_width = max(len(lyr.id) for lyr in LAYERS)
+    for lyr in LAYERS:
+        lines.append(f"  {lyr.id.ljust(id_width)}  {lyr.stores}")
+    lines.append("")
+    lines.append(f"What a warm gives each command  ({REFERENCE_REPOSITORY})")
+    cmd_width = max(len(c.command) for c in COMMANDS)
+    warm_width = max(len(label) for label in _WARM_LABEL.values())
+    for cmd in COMMANDS:
+        repeat = "repeat cached" if cmd.repeat else "recomputes"
+        layers = ", ".join(cmd.reads) or "none"
+        lines.append(
+            f"  {cmd.command.ljust(cmd_width)}  {_WARM_LABEL[cmd.warm].ljust(warm_width)} "
+            f"({repeat})  [{layers}]"
+        )
+    lines.append("")
+    lines.append(
+        "Full detail (measured timings, per-command notes): ask cache model --full"
+    )
+    lines.append("Tables for docs: ask cache model --markdown   ·   machine-readable: --json")
+    return "\n".join(lines)
+
+
 def render_text() -> str:
-    """The model as `ask cache model` prints it."""
+    """The model in full: every layer and command with its measured timing and note.
+
+    `ask cache model --full`. See `render_summary` for the default."""
     lines: list[str] = []
     lines.append("Invalidation — one rule for every layer")
     lines.append("  Every layer keys on the exact tree state. Any change to the analysed files")

{sourcecode-4.10.2 → sourcecode-4.10.4}/src/sourcecode/cli.py

@@ -15,7 +15,7 @@ from typing import Any, NoReturn, Optional, cast
 import typer
 
 from sourcecode import __version__
-from sourcecode.error_schema import INVALID_INPUT_CODE, build_error_envelope
+from sourcecode.error_schema import EXECUTION_FAILED_CODE, INVALID_INPUT_CODE, build_error_envelope
 from sourcecode.entrypoint_classifier import is_production_entry_point, normalize_entry_point
 from sourcecode.progress import Progress
 from sourcecode import perf
@@ -7402,7 +7402,14 @@ def spring_audit_cmd(
             except Exception:
                 pass
         finally:
-            _prog.finish()
+            # C3-54: `done` must not claim the answer exists before it does. The
+            # field log showed `[ask] done (6.8m)` printed, then the process torn
+            # down before `-o` was written — a false success on 6.8 minutes of
+            # CPU. `stop()` here only clears the spinner (satisfies the standing
+            # rule that a raised error must never print under a live spinner
+            # frame); it prints no completion line. `_prog.finish()` runs below,
+            # after the render AND the write have actually happened.
+            _prog.stop()
     if table:
         output = _render_spring_audit_table(
             combined, rule_filter=rule_filter, top_n=top_n, min_severity=min_severity
@@ -7415,6 +7422,7 @@ def spring_audit_cmd(
     _total = combined.summary.get("total_findings", 0)
     _emit_command_output(output, output_path, copy,
                          success_msg=f"Spring audit written to {output_path} ({_total} findings)")
+    _prog.finish()
 
     if ci and combined.findings:
         raise typer.Exit(code=1)
@@ -11569,12 +11577,33 @@ def mcp_status(copy: bool = _copy_option()) -> None:
     _answer.say("")
 
     # Stage 1: Dependencies
+    # C3-57: check the symbol this CLI actually consumes (FastMCP), not just
+    # whether the root `mcp` package imports — `mcp>=2.0` imports cleanly but
+    # has no `mcp.server.fastmcp` module, so importing only the root package
+    # reports a green check for a build that will fail on `mcp serve`/`mcp list-tools`.
+    def _installed_mcp_version() -> str:
+        # The `mcp` package does not set `__version__`; read installed
+        # distribution metadata instead, and fall back gracefully off a
+        # normal install (editable installs, vendored copies, etc.).
+        try:
+            from importlib.metadata import version as _dist_version
+            return _dist_version("mcp")
+        except Exception:
+            return "unknown"
+
     try:
-        import mcp as _mcp_pkg  # noqa: F401
-        _answer.say("Dependencies  ✓ installed")
+        from mcp.server.fastmcp import FastMCP  # noqa: F401
+        _mcp_ver = _installed_mcp_version()
+        _answer.say(f"Dependencies  ✓ installed   (mcp {_mcp_ver})")
     except ImportError:
-        _answer.say("Dependencies  ✗ missing")
-        _answer.say("  Fix: pip install sourcecode[mcp]")
+        try:
+            import mcp as _mcp_pkg  # noqa: F401
+            _mcp_ver = _installed_mcp_version()
+            _answer.say(f"Dependencies  ✗ mcp {_mcp_ver} incompatible (requires mcp>=1.2,<2)")
+            _answer.say("  Fix: pip install 'sourcecode[mcp]' --upgrade")
+        except ImportError:
+            _answer.say("Dependencies  ✗ missing")
+            _answer.say("  Fix: pip install sourcecode[mcp]")
     _answer.say("")
 
     clients = detect_clients()
@@ -11789,9 +11818,32 @@ def mcp_list_tools(
     import asyncio
     import json as _json
 
-    from sourcecode.mcp.server import mcp as _mcp
+    # C3-57: this command previously let a raw Python traceback through when
+    # the installed `mcp` package was incompatible (e.g. mcp>=2.0, which has
+    # no mcp.server.fastmcp) — the only command in the catalogue to do so.
+    # Route failures through the same structured error contract as every
+    # other command instead.
+    try:
+        from sourcecode.mcp.server import mcp as _mcp
+        tools = asyncio.run(_mcp.list_tools())
+    except ImportError as exc:
+        _emit_error_json(
+            EXECUTION_FAILED_CODE,
+            f"MCP server dependencies are not importable: {exc}",
+            hint="Run 'ask mcp status' to check the installed mcp package version — "
+                 "this CLI requires mcp>=1.2,<2. Fix: pip install 'sourcecode[mcp]' --upgrade",
+            expected="mcp>=1.2,<2 installed with mcp.server.fastmcp.FastMCP importable.",
+        )
+        raise typer.Exit(code=1)
+    except Exception as exc:
+        _emit_error_json(
+            EXECUTION_FAILED_CODE,
+            f"Failed to list MCP tools: {type(exc).__name__}: {exc}",
+            hint="Run 'ask mcp status' to check MCP server health.",
+            expected="A list of registered MCP tools.",
+        )
+        raise typer.Exit(code=1)
 
-    tools = asyncio.run(_mcp.list_tools())
     tools_sorted = sorted(tools, key=lambda t: t.name)
 
     if json_output:
@@ -12057,6 +12109,11 @@ def cache_model_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path for CLI consistency (model is global)."),
     json_output: bool = typer.Option(False, "--json", help="Output as JSON."),
     markdown: bool = typer.Option(False, "--markdown", help="Output the tables published in the user guide."),
+    full: bool = typer.Option(
+        False, "--full",
+        help="Full prose: every command's measured timing and note (~2.5k tokens). "
+             "Default is a compact one-line-per-command summary.",
+    ),
     copy: bool = _copy_option(),
 ) -> None:
     """What each cache layer stores, what invalidates it, and what a warm helps.
@@ -12070,6 +12127,10 @@ def cache_model_cmd(
 
     One rule covers invalidation: every layer keys on the exact tree state, so any
     change to the analysed files invalidates it, committed or not.
+
+    \b
+    Default output is a compact summary (C3-63) — every command named, without the
+    per-command measured timing and note. Pass --full for that detail.
     """
     from sourcecode import cache_model as _cmodel
 
@@ -12089,7 +12150,8 @@ def cache_model_cmd(
             f"Scope: {Path(path).resolve()} (model is global; path accepted for "
             "cache command grammar consistency)\n\n"
         )
-        _emit_text_output(_prefix + _cmodel.render_text(), copy)
+        _body = _cmodel.render_text() if full else _cmodel.render_summary()
+        _emit_text_output(_prefix + _body, copy)
 
 
 @cache_app.command("freshness", short_help="RIS freshness relative to the current git HEAD")

{sourcecode-4.10.2 → sourcecode-4.10.4}/src/sourcecode/provenance.py

@@ -105,8 +105,6 @@ def _claims_from_rows(command: str, payload: dict[str, Any]) -> list[dict[str, A
                 if row.get("rule_ids"):
                     claim["rule_ids"] = row["rule_ids"]
                 claims.append(claim)
-            if len(claims) >= _MAX_CLAIMS:
-                return claims
     return claims
 
 
@@ -166,9 +164,16 @@ def build_evidence_manifest(
 ) -> dict[str, Any]:
     """Build a machine-readable provenance index for an existing payload."""
     root = Path(root).resolve()
-    claims = _claims_from_rows(command, payload)
-    claims.extend(_claims_from_java_lts(command, payload))
-    claims = claims[:_MAX_CLAIMS]
+    # I-2: measure the whole population, THEN cut it. `_claims_from_rows` used to
+    # return the moment it reached the cap, so the number of claims the payload
+    # actually carries was never computed and could not be published — the manifest
+    # reported the cap itself as `total_indexed`, which is the exact shape ("the
+    # published count is the size of the rendering") this module exists to make
+    # auditable. Building every claim is arithmetic over rows already in memory.
+    all_claims = _claims_from_rows(command, payload)
+    all_claims.extend(_claims_from_java_lts(command, payload))
+    total_claims = len(all_claims)
+    claims = all_claims[:_MAX_CLAIMS]
     sources = sorted({
         str((claim.get("source") or {}).get("path"))
         for claim in claims
@@ -189,11 +194,14 @@ def build_evidence_manifest(
         "run": run,
         "claims": claims,
         "sources": [{"path": path} for path in sources],
-        "claims_cap": (
-            {"total_indexed": _MAX_CLAIMS, "capped": True}
-            if len(claims) >= _MAX_CLAIMS else
-            {"total_indexed": len(claims), "capped": False}
-        ),
+        # `total` is the measurement; `total_indexed` is the size of this manifest.
+        # `capped` is strictly `total > cap`: a payload with exactly `_MAX_CLAIMS`
+        # claims had nothing removed and must not report that it did.
+        "claims_cap": {
+            "total": total_claims,
+            "total_indexed": min(total_claims, _MAX_CLAIMS),
+            "capped": total_claims > _MAX_CLAIMS,
+        },
         "embedded_manifests": _embedded_manifests(payload),
         "limits": {
             "statement": (

{sourcecode-4.10.2 → sourcecode-4.10.4}/src/sourcecode/release_info.py

@@ -27,7 +27,7 @@ from typing import Any, Optional
 #: The date `__version__` was released, from that version's CHANGELOG entry.
 #: `tests/test_release_info.py` fails the build if the two disagree, so this is
 #: a copy of a fact rather than a second authority for it.
-RELEASE_DATE = "2026-08-05"
+RELEASE_DATE = "2026-08-07"
 
 #: Releases per day, measured over the 30 releases before this one (the same
 #: computation the test re-runs against the CHANGELOG). Stable across window

{sourcecode-4.10.2 → sourcecode-4.10.4}/src/sourcecode/security_config_scan.py

@@ -111,8 +111,8 @@ _IS_REFERENCE = re.compile(r"[$@]\{[^}]+\}|^\s*$|^\s*ENC\(|^\s*\*+\s*$")
 #: XML elements whose text is a configured VALUE. Servlet/JEE spec vocabulary.
 _DESCRIPTOR_VALUE = re.compile(
     r"<(?P<tag>param-value|env-entry-value|value|property|password)\b[^>]*>"
-    r"(?P<value>[^<]*)</(?P=tag)>",
-    re.IGNORECASE,
+    r"(?P<value>.*?)</(?P=tag)>",
+    re.IGNORECASE | re.DOTALL,
 )
 
 _DESCRIPTOR_INIT_PARAM = re.compile(
@@ -124,8 +124,8 @@ _DESCRIPTOR_PARAM_NAME = re.compile(
     re.IGNORECASE,
 )
 _DESCRIPTOR_PARAM_VALUE = re.compile(
-    r"<param-value\b[^>]*>(?P<value>[^<]*)</param-value>",
-    re.IGNORECASE,
+    r"<param-value\b[^>]*>(?P<value>.*?)</param-value>",
+    re.IGNORECASE | re.DOTALL,
 )
 _JAVAMELODY_CREDENTIAL_PARAMS: frozenset[str] = frozenset({
     "authorized-users",
@@ -364,7 +364,14 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
     holds a reference and is not reported; one that carries a digest literal
     holds the credential itself, in a file under version control.
     """
+    def _xml_value(raw: str) -> str:
+        value = raw.strip()
+        if value.startswith("<![CDATA[") and value.endswith("]]>"):
+            value = value[len("<![CDATA["):-len("]]>")]
+        return value.strip()
+
     out: "list[SecurityConfigObservation]" = []
+    javamelody_value_offsets: set[int] = set()
     for param in _DESCRIPTOR_INIT_PARAM.finditer(text):
         body = param.group("body")
         name_m = _DESCRIPTOR_PARAM_NAME.search(body)
@@ -372,22 +379,29 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
         if name_m is None or value_m is None:
             continue
         name = name_m.group("value").strip().lower()
-        value = value_m.group("value").strip()
+        value = _xml_value(value_m.group("value"))
         if name not in _JAVAMELODY_CREDENTIAL_PARAMS:
             continue
         if not value or _IS_REFERENCE.search(value):
             continue
         if ":" not in value:
             continue
-        if _DIGEST_LITERAL.search(value):
-            continue
         user = value.split(":", 1)[0].strip() or "user"
+        value_offset = param.start("body") + value_m.start("value")
+        javamelody_value_offsets.add(value_offset)
+        digest = _DIGEST_LITERAL.search(value)
+        evidence = (
+            f"<param-value>{user}:…{{{digest.group('algo')}}}"
+            f"{digest.group('digest')[:8]}…</param-value>"
+            if digest is not None
+            else f"<param-value>{user}:…</param-value>"
+        )
         out.append(SecurityConfigObservation(
             rule="SEC-007",
             file=rel,
-            line=_line_of(text, param.start() + value_m.start()),
+            line=_line_of(text, value_offset),
             symbol=rel,
-            evidence=f"<param-value>{user}:…</param-value>",
+            evidence=evidence,
             detail=(
                 "JavaMelody authorized-users stores a monitoring-console credential "
                 "directly in the deployment descriptor. The value is redacted here; "
@@ -395,7 +409,9 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
             ),
         ))
     for match in _DESCRIPTOR_VALUE.finditer(text):
-        value = match.group("value").strip()
+        if match.start("value") in javamelody_value_offsets:
+            continue
+        value = _xml_value(match.group("value"))
         if not value or _IS_REFERENCE.search(value):
             continue
         digest = _DIGEST_LITERAL.search(value)

{sourcecode-4.10.2 → sourcecode-4.10.4}/src/sourcecode/spring_security_audit.py

@@ -508,7 +508,8 @@ def _line_of(source: str, offset: int) -> int:
 _JAVA_METHOD_RE = re.compile(
     r"(?P<mods>(?:(?:public|protected|private|static|final|synchronized|abstract|native)\s+)*)"
     r"(?P<ret>[\w.$<>\[\], ?]+)\s+"
-    r"(?P<name>[a-zA-Z_][\w$]*)\s*\([^;{}]*\)\s*(?:throws\s+[^{]+)?\{",
+    r"(?P<name>(?!(?:if|for|while|switch|catch|synchronized|return|new|throw|try|else|do)\b)"
+    r"[a-zA-Z_][\w$]*)\s*\([^;{}]*\)\s*(?:throws\s+[^{]+)?\{",
     re.MULTILINE,
 )
 
@@ -620,6 +621,14 @@ class _GATE00XCustomGateAudit:
         findings: list[SpringFinding] = []
         ann_re = _annotation_call_re(token)
         for rel, source in sources:
+            # C3-61: `ann_re` is `@<token>\b…`, so it cannot match a source that does
+            # not contain the literal token, and neither can any prefix slice of it.
+            # Without this line every source pays a full method `finditer` plus one
+            # prefix regex per method before proving it had nothing to find — 98,9 %
+            # of (source, token) pairs on the measured repository. Same guard
+            # `_advice_body_rules` already carries.
+            if token not in source:
+                continue
             class_fqn = _java_fqn(source)
             annotated_methods: dict[str, tuple[int, str]] = {}
             for method in _JAVA_METHOD_RE.finditer(source):
@@ -711,6 +720,8 @@ class _GATE00XCustomGateAudit:
         findings: list[SpringFinding] = []
         ann_re = _annotation_call_re(token)
         for rel, source in sources:
+            if token not in source:  # C3-61, same equivalence as `_proxy_bypass`
+                continue
             class_fqn = _java_fqn(source)
             for ann in ann_re.finditer(source):
                 args = (ann.group("args") or "").strip()