sourcecode 4.10.3__py3-none-any.whl → 4.10.5__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.10.3"
+__version__ = "4.10.5"

sourcecode/architectural_baseline.py

@@ -33,7 +33,7 @@ import json
 import subprocess
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Any
 
 from sourcecode import __version__ as TOOL_VERSION
 from sourcecode.architectural_delta import ArchMetrics, diff_metrics, extract_metrics
@@ -107,6 +107,35 @@ def _hotspots(fan_in: dict[str, int], top_n: int) -> list[dict]:
     return [{"symbol": s, "fan_in": c} for s, c in ranked[:top_n]]
 
 
+def _fan_in_to_list(fan_in: dict[str, int]) -> list[dict]:
+    """Serialise the full fan-in map as an array of ``{symbol, fan_in}`` objects,
+    sorted by symbol — never a JSON object keyed by symbol.
+
+    C3-62: PowerShell's `ConvertFrom-Json` folds object keys case-insensitively, so
+    two distinct Java symbols differing only by case (legal — Java is case-sensitive)
+    collapse into one key and abort parsing the *whole* baseline document. `hotspots`
+    already used this array shape (`_hotspots`); the full map stored beside it did
+    not. An array of objects has no such ceiling on any consumer."""
+    return [{"symbol": s, "fan_in": c} for s, c in sorted(fan_in.items())]
+
+
+def _fan_in_from_stored(value: Any) -> dict[str, int]:
+    """Read a stored ``fan_in`` field back into a symbol → count map.
+
+    Accepts both the array-of-objects shape (C3-62, current) and the legacy
+    object-keyed-by-symbol shape (baselines captured before this fix) so an older
+    baseline already committed to disk keeps diffing and trending correctly."""
+    if isinstance(value, list):
+        return {
+            str(item["symbol"]): int(item.get("fan_in", 0))
+            for item in value
+            if isinstance(item, dict) and "symbol" in item
+        }
+    if isinstance(value, dict):
+        return {str(k): int(v) for k, v in value.items()}
+    return {}
+
+
 def build_baseline(
     cir: "CanonicalRepositoryIR",
     *,
@@ -126,7 +155,6 @@ def build_baseline(
     that share them."""
     m = extract_metrics(cir)
     endpoints = sorted([meth, path] for (meth, path) in m.endpoints)
-    fan_in = dict(sorted(m.fan_in.items()))
     cycles = sorted((sorted(c) for c in m.cycles), key=lambda mm: (len(mm), mm))
     return {
         "schema": ARCH_BASELINE_SCHEMA,
@@ -145,7 +173,7 @@ def build_baseline(
         },
         "hotspots": _hotspots(m.fan_in, hotspot_n),
         "endpoint_surface": endpoints,
-        "fan_in": fan_in,
+        "fan_in": _fan_in_to_list(m.fan_in),
         "import_cycles": cycles,
         "env": env if env is not None else collect_env(),
         "provenance": (
@@ -209,7 +237,7 @@ def baseline_to_metrics(baseline: dict) -> ArchMetrics:
         endpoint_count=int(totals.get("endpoints", 0)),
         dependency_edge_count=int(totals.get("dependency_edges", 0)),
         endpoints=endpoints,
-        fan_in={str(k): int(v) for k, v in (baseline.get("fan_in") or {}).items()},
+        fan_in=_fan_in_from_stored(baseline.get("fan_in")),
         cycles=frozenset(
             frozenset(str(m) for m in members)
             for members in baseline.get("import_cycles", [])
@@ -397,9 +425,10 @@ def build_trend(baselines: list[dict]) -> dict:
             if isinstance(h, dict) and h.get("symbol"):
                 tracked.add(str(h["symbol"]))
 
+    fan_in_by_baseline = [_fan_in_from_stored(b.get("fan_in")) for b in baselines]
     hotspot_trends: list[dict] = []
     for sym in sorted(tracked):
-        series = [int((b.get("fan_in") or {}).get(sym, 0)) for b in baselines]
+        series = [fmap.get(sym, 0) for fmap in fan_in_by_baseline]
         first, last = series[0], series[-1]
         hotspot_trends.append({
             "symbol": sym,

sourcecode/cache_model.py

@@ -302,8 +302,48 @@ def render_markdown() -> str:
     return "\n".join(out)
 
 
+def render_summary() -> str:
+    """The model as `ask cache model` prints it by default (C3-63).
+
+    One line per layer and one line per command — every command named (nothing
+    curated out, so the same completeness the battery checks against `render_text`
+    holds here too), but without the per-command prose (`note`) and timing
+    (`measured`) detail that made the default ~2 500 tokens of prose in a CLI whose
+    own selling argument is token economy. That detail is still one flag away.
+    """
+    lines: list[str] = []
+    lines.append(
+        "Invalidation: every layer keys on the exact tree state — any change to the "
+        "analysed files invalidates it, committed or not."
+    )
+    lines.append("")
+    lines.append("Layers")
+    id_width = max(len(lyr.id) for lyr in LAYERS)
+    for lyr in LAYERS:
+        lines.append(f"  {lyr.id.ljust(id_width)}  {lyr.stores}")
+    lines.append("")
+    lines.append(f"What a warm gives each command  ({REFERENCE_REPOSITORY})")
+    cmd_width = max(len(c.command) for c in COMMANDS)
+    warm_width = max(len(label) for label in _WARM_LABEL.values())
+    for cmd in COMMANDS:
+        repeat = "repeat cached" if cmd.repeat else "recomputes"
+        layers = ", ".join(cmd.reads) or "none"
+        lines.append(
+            f"  {cmd.command.ljust(cmd_width)}  {_WARM_LABEL[cmd.warm].ljust(warm_width)} "
+            f"({repeat})  [{layers}]"
+        )
+    lines.append("")
+    lines.append(
+        "Full detail (measured timings, per-command notes): ask cache model --full"
+    )
+    lines.append("Tables for docs: ask cache model --markdown   ·   machine-readable: --json")
+    return "\n".join(lines)
+
+
 def render_text() -> str:
-    """The model as `ask cache model` prints it."""
+    """The model in full: every layer and command with its measured timing and note.
+
+    `ask cache model --full`. See `render_summary` for the default."""
     lines: list[str] = []
     lines.append("Invalidation — one rule for every layer")
     lines.append("  Every layer keys on the exact tree state. Any change to the analysed files")

sourcecode/cli.py

@@ -15,9 +15,10 @@ from typing import Any, NoReturn, Optional, cast
 import typer
 
 from sourcecode import __version__
-from sourcecode.error_schema import INVALID_INPUT_CODE, build_error_envelope
+from sourcecode.error_schema import EXECUTION_FAILED_CODE, INVALID_INPUT_CODE, build_error_envelope
 from sourcecode.entrypoint_classifier import is_production_entry_point, normalize_entry_point
 from sourcecode.progress import Progress
+from sourcecode.progress import output_emitted as _progress_output_emitted
 from sourcecode import perf
 from sourcecode.caller_metrics import (
     CALLER_METRIC_RECONCILIATION,
@@ -888,8 +889,27 @@ def _safe_write_file(path: "Path", content: str) -> None:
         path = Path(path)
         path.parent.mkdir(parents=True, exist_ok=True)
         tmp = path.with_name(f".{path.name}.tmp-{os.getpid()}-{time.time_ns()}")
-        tmp.write_text(content, encoding="utf-8")
+        # C3-54 part 2: the rename is atomic, the bytes were not durable. A
+        # process torn down between `write_text` and the OS flushing its page
+        # cache leaves a file that exists at full length and holds nothing —
+        # the same total loss the false `done` line reported as success, one
+        # layer down. fsync the data before the rename, then the directory
+        # entry, so a run that reports an output file has one.
+        with open(tmp, "w", encoding="utf-8") as fh:
+            fh.write(content)
+            fh.flush()
+            os.fsync(fh.fileno())
         tmp.replace(path)
+        try:
+            dir_fd = os.open(str(path.parent), os.O_RDONLY)
+            try:
+                os.fsync(dir_fd)
+            finally:
+                os.close(dir_fd)
+        except (OSError, AttributeError):
+            # Directory fsync is POSIX-only; on Windows the rename is already
+            # ordered against the data write. Never fail a good run over it.
+            pass
         try:
             from sourcecode.runs import active_run
             run = active_run()
@@ -1213,6 +1233,9 @@ def _emit_command_output(
             # The payload is on stdout here, so this cannot join it; it is a
             # notice and takes the terminal gate rather than dirtying a capture.
             _notice("✓ copied to clipboard")
+    # The answer has been handed over. Any `done (Xs)` a command deferred is now
+    # a true claim and prints here — never before this line (C3-54).
+    _progress_output_emitted()
 
 
 def _emit_text_output(text: str, copy: bool) -> None:
@@ -1228,6 +1251,7 @@ def _emit_text_output(text: str, copy: bool) -> None:
     typer.echo(text)
     if copy and _copy_to_clipboard(text):
         _notice("✓ copied to clipboard")
+    _progress_output_emitted()
 
 
 class _TextAnswer:
@@ -1257,6 +1281,7 @@ class _TextAnswer:
     def done(self, copy: bool) -> None:
         if copy and self._lines and _copy_to_clipboard(self.text):
             _notice("✓ copied to clipboard")
+        _progress_output_emitted()
 
 
 # H-06: Intercept Click-level UsageError (unknown options, bad args) and emit JSON.
@@ -4825,8 +4850,15 @@ def repo_ir_cmd(
         size_bytes = len(raw_bytes)
         if gzip_output:
             import gzip as _gzip
+            # Same durability rule as `_safe_write_file`: the bytes are on disk
+            # before anything says they are (C3-54).
             with _gzip.open(output_path, "wb") as _gz:
                 _gz.write(raw_bytes)
+                _gz.flush()
+                try:
+                    os.fsync(_gz.fileno())
+                except (OSError, AttributeError):
+                    pass
             compressed_kb = output_path.stat().st_size // 1024
             size_kb = size_bytes // 1024
             # C3-26: when the payload went to a file, this confirmation IS the
@@ -4837,7 +4869,9 @@ def repo_ir_cmd(
                 f"IR written to {output_path} ({compressed_kb}KB gzip, {size_kb}KB uncompressed)"
             )
         else:
-            output_path.write_bytes(raw_bytes)
+            # Was a bare `write_bytes`: neither atomic nor durable, and the only
+            # `-o` write in the CLI that skipped the shared seam (C3-54).
+            _safe_write_file(output_path, output)
             size_kb = size_bytes // 1024
             if summary_only:
                 typer.echo(
@@ -4850,6 +4884,7 @@ def repo_ir_cmd(
                     f"IR written to {output_path} "
                     f"({size_kb}KB, {n_nodes} nodes, {n_edges} edges)"
                 )
+        _progress_output_emitted()
     else:
         if gzip_output:
             _emit_error_json(
@@ -7402,7 +7437,14 @@ def spring_audit_cmd(
             except Exception:
                 pass
         finally:
-            _prog.finish()
+            # C3-54: `done` must not claim the answer exists before it does. The
+            # field log showed `[ask] done (6.8m)` printed, then the process torn
+            # down before `-o` was written — a false success on 6.8 minutes of
+            # CPU. `stop()` here only clears the spinner (satisfies the standing
+            # rule that a raised error must never print under a live spinner
+            # frame); it prints no completion line. `_prog.finish()` runs below,
+            # after the render AND the write have actually happened.
+            _prog.stop()
     if table:
         output = _render_spring_audit_table(
             combined, rule_filter=rule_filter, top_n=top_n, min_severity=min_severity
@@ -7415,6 +7457,7 @@ def spring_audit_cmd(
     _total = combined.summary.get("total_findings", 0)
     _emit_command_output(output, output_path, copy,
                          success_msg=f"Spring audit written to {output_path} ({_total} findings)")
+    _prog.finish()
 
     if ci and combined.findings:
         raise typer.Exit(code=1)
@@ -9453,18 +9496,21 @@ def pr_impact_cmd(
     # --files accepts three shapes: a list file, '-' for stdin, or an inline
     # comma-separated list. The list-file shape was the only documented one and
     # the only one the error hint mentioned.
-    _files_raw = str(files).strip()
+    # Both byte-carrying shapes decode through `text_input`: stdin and list files
+    # arrive as somebody else's shell wrote them, and the locale codepage is not
+    # evidence of their encoding (C3-58).
+    from sourcecode import text_input as _text_input
+
+    _files_raw = str(files).replace(_text_input.BOM_CHAR, "").strip()
     if _files_raw == "-":
-        changed_files = [ln.strip() for ln in sys.stdin.read().splitlines() if ln.strip()]
+        changed_files = _text_input.parse_path_lines(_text_input.read_stdin_text())
         _files_desc = "stdin"
     else:
         _files_path = Path(_files_raw)
         if _files_path.is_file():
-            changed_files = [
-                line.strip()
-                for line in _files_path.read_text(encoding="utf-8").splitlines()
-                if line.strip()
-            ]
+            changed_files = _text_input.parse_path_lines(
+                _text_input.read_text_file(_files_path)
+            )
             _files_desc = str(_files_path)
         elif all(
             p.strip().lower().endswith(".java")
@@ -10301,6 +10347,9 @@ def modernize_cmd(
             sys.stdout.buffer.flush()
         except AttributeError:
             sys.stdout.write(output + "\n")
+    # This branch predates `_emit_command_output`, so it also has to release the
+    # deferred completion line itself (C3-54).
+    _progress_output_emitted()
 
     if copy:
         _copy_to_clipboard(output)
@@ -11569,12 +11618,33 @@ def mcp_status(copy: bool = _copy_option()) -> None:
     _answer.say("")
 
     # Stage 1: Dependencies
+    # C3-57: check the symbol this CLI actually consumes (FastMCP), not just
+    # whether the root `mcp` package imports — `mcp>=2.0` imports cleanly but
+    # has no `mcp.server.fastmcp` module, so importing only the root package
+    # reports a green check for a build that will fail on `mcp serve`/`mcp list-tools`.
+    def _installed_mcp_version() -> str:
+        # The `mcp` package does not set `__version__`; read installed
+        # distribution metadata instead, and fall back gracefully off a
+        # normal install (editable installs, vendored copies, etc.).
+        try:
+            from importlib.metadata import version as _dist_version
+            return _dist_version("mcp")
+        except Exception:
+            return "unknown"
+
     try:
-        import mcp as _mcp_pkg  # noqa: F401
-        _answer.say("Dependencies  ✓ installed")
+        from mcp.server.fastmcp import FastMCP  # noqa: F401
+        _mcp_ver = _installed_mcp_version()
+        _answer.say(f"Dependencies  ✓ installed   (mcp {_mcp_ver})")
     except ImportError:
-        _answer.say("Dependencies  ✗ missing")
-        _answer.say("  Fix: pip install sourcecode[mcp]")
+        try:
+            import mcp as _mcp_pkg  # noqa: F401
+            _mcp_ver = _installed_mcp_version()
+            _answer.say(f"Dependencies  ✗ mcp {_mcp_ver} incompatible (requires mcp>=1.2,<2)")
+            _answer.say("  Fix: pip install 'sourcecode[mcp]' --upgrade")
+        except ImportError:
+            _answer.say("Dependencies  ✗ missing")
+            _answer.say("  Fix: pip install sourcecode[mcp]")
     _answer.say("")
 
     clients = detect_clients()
@@ -11789,9 +11859,32 @@ def mcp_list_tools(
     import asyncio
     import json as _json
 
-    from sourcecode.mcp.server import mcp as _mcp
+    # C3-57: this command previously let a raw Python traceback through when
+    # the installed `mcp` package was incompatible (e.g. mcp>=2.0, which has
+    # no mcp.server.fastmcp) — the only command in the catalogue to do so.
+    # Route failures through the same structured error contract as every
+    # other command instead.
+    try:
+        from sourcecode.mcp.server import mcp as _mcp
+        tools = asyncio.run(_mcp.list_tools())
+    except ImportError as exc:
+        _emit_error_json(
+            EXECUTION_FAILED_CODE,
+            f"MCP server dependencies are not importable: {exc}",
+            hint="Run 'ask mcp status' to check the installed mcp package version — "
+                 "this CLI requires mcp>=1.2,<2. Fix: pip install 'sourcecode[mcp]' --upgrade",
+            expected="mcp>=1.2,<2 installed with mcp.server.fastmcp.FastMCP importable.",
+        )
+        raise typer.Exit(code=1)
+    except Exception as exc:
+        _emit_error_json(
+            EXECUTION_FAILED_CODE,
+            f"Failed to list MCP tools: {type(exc).__name__}: {exc}",
+            hint="Run 'ask mcp status' to check MCP server health.",
+            expected="A list of registered MCP tools.",
+        )
+        raise typer.Exit(code=1)
 
-    tools = asyncio.run(_mcp.list_tools())
     tools_sorted = sorted(tools, key=lambda t: t.name)
 
     if json_output:
@@ -12057,6 +12150,11 @@ def cache_model_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path for CLI consistency (model is global)."),
     json_output: bool = typer.Option(False, "--json", help="Output as JSON."),
     markdown: bool = typer.Option(False, "--markdown", help="Output the tables published in the user guide."),
+    full: bool = typer.Option(
+        False, "--full",
+        help="Full prose: every command's measured timing and note (~2.5k tokens). "
+             "Default is a compact one-line-per-command summary.",
+    ),
     copy: bool = _copy_option(),
 ) -> None:
     """What each cache layer stores, what invalidates it, and what a warm helps.
@@ -12070,6 +12168,10 @@ def cache_model_cmd(
 
     One rule covers invalidation: every layer keys on the exact tree state, so any
     change to the analysed files invalidates it, committed or not.
+
+    \b
+    Default output is a compact summary (C3-63) — every command named, without the
+    per-command measured timing and note. Pass --full for that detail.
     """
     from sourcecode import cache_model as _cmodel
 
@@ -12089,7 +12191,8 @@ def cache_model_cmd(
             f"Scope: {Path(path).resolve()} (model is global; path accepted for "
             "cache command grammar consistency)\n\n"
         )
-        _emit_text_output(_prefix + _cmodel.render_text(), copy)
+        _body = _cmodel.render_text() if full else _cmodel.render_summary()
+        _emit_text_output(_prefix + _body, copy)
 
 
 @cache_app.command("freshness", short_help="RIS freshness relative to the current git HEAD")

sourcecode/pr_impact.py

@@ -228,6 +228,43 @@ def _suffix_candidates(norm: str, file_class_index: dict[str, list[str]]) -> lis
     return shorter_given or longer_given
 
 
+def _exists_on_disk(norm: str, root: Path) -> bool:
+    """True when the given path names a file that is actually there."""
+    try:
+        candidate = Path(norm)
+        if candidate.is_absolute():
+            return candidate.is_file()
+        return (root / norm).is_file()
+    except OSError:
+        # A path the OS refuses to even stat (illegal characters after a bad
+        # decode, a name past MAX_PATH) is not on disk as far as we can tell.
+        return False
+
+
+def _unresolved_warning(path_str: str, norm: str, root: Path) -> str:
+    """Name the right thing to check for a changed file that mapped to nothing.
+
+    The two causes need opposite investigations and the single old message sent
+    every operator to the wrong one. A path that is *not there* is a path
+    problem — the field case was a BOM and cp1252 mojibake reaching us through
+    stdin (C3-58), and the message said "not in CIR", so the operator went
+    looking at analysis coverage. A path that *is* there carries no class
+    symbols, which is a fact about the file.
+    """
+    if _exists_on_disk(norm, root):
+        return (
+            f"No Spring classes found for '{path_str}' — the file exists but "
+            "contributes no class symbols to the CIR (interface-free package-info, "
+            "an empty file, or a file excluded from analysis)."
+        )
+    return (
+        f"No file at '{path_str}' under the analyzed repository — nothing was "
+        "matched, and this is a path problem, not an analysis gap. Check the path "
+        "form (relative to the repo root) and its encoding: a byte-order mark or a "
+        "non-UTF-8 pipe corrupts accented names."
+    )
+
+
 def _resolve_changed_files(
     file_list: list[str],
     file_class_index: dict[str, list[str]],
@@ -293,10 +330,7 @@ def _resolve_changed_files(
 
         if not candidates:
             unresolved_java.append(norm)
-            warnings.append(
-                f"No Spring classes found for '{path_str}' — "
-                "file not in CIR or has no class symbols."
-            )
+            warnings.append(_unresolved_warning(path_str, norm, root))
 
         for cls in candidates:
             if cls not in seen_classes:

sourcecode/progress.py

@@ -3,6 +3,18 @@
 Writes only to stderr. Zero-cost when stderr is not a TTY or CI is detected,
 unless ASK_PROGRESS=1 explicitly requests line heartbeats for supervised jobs.
 Thread-safe; stop() is idempotent.
+
+`done (Xs)` is a claim, and C3-54 is what happens when it is made early: the
+field log printed `[ask] done (6.8m)` and the output directory held no
+`f3-audit.json`, because the completion line was emitted when the *analysis*
+finished — before the render and the write — and the process was torn down in
+that window. 6.8 minutes of CPU, zero recoverable bytes, reported as success.
+
+So the line is not printed where `finish()` is called. `finish()` claims the
+work is done; the line is emitted when the **answer has actually been handed
+over**, which the CLI signals through `output_emitted()` at its output seams. A
+run that is killed between the two prints nothing, which is the honest outcome:
+no answer, no completion line.
 """
 from __future__ import annotations
 
@@ -14,6 +26,40 @@ from typing import Optional
 
 _FRAMES = ("⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏")
 
+#: Consecutive failed heartbeat writes before the loop gives up on the stream.
+_MAX_WRITE_FAILURES = 5
+
+# --- Completion registry ----------------------------------------------------
+# Module state, not per-instance: the emitter of the answer (the CLI output
+# seam) and the owner of the completion line (a Progress somewhere up the call
+# stack) never see each other.
+_registry_lock = threading.Lock()
+_output_events = 0
+_pending_done: "list[Progress]" = []
+
+
+def output_emitted() -> None:
+    """The command's answer has been written. Release any deferred `done` line.
+
+    Called from every CLI output seam. Safe to call when no Progress is running
+    and safe to call more than once per run.
+    """
+    global _output_events
+    with _registry_lock:
+        _output_events += 1
+        released = list(_pending_done)
+        _pending_done.clear()
+    for prog in released:
+        prog._print_done()
+
+
+def _reset_for_tests() -> None:
+    """Drop registry state between in-process test runs."""
+    global _output_events
+    with _registry_lock:
+        _output_events = 0
+        _pending_done.clear()
+
 
 def _terminal_capable() -> bool:
     if os.environ.get("ASK_PROGRESS", "").lower() in ("1", "true", "yes", "on"):
@@ -57,6 +103,10 @@ class Progress:
         self._stop_event = threading.Event()
         self._thread: Optional[threading.Thread] = None
         self._stopped = False
+        self._done_printed = False
+        self._outputs_at_start = 0
+        self._elapsed_at_finish = 0.0
+        self._write_failures = 0
 
     @property
     def elapsed(self) -> float:
@@ -67,6 +117,9 @@ class Progress:
         with self._lock:
             self._phase = phase
         self._stopped = False
+        self._done_printed = False
+        with _registry_lock:
+            self._outputs_at_start = _output_events
         if not self._enabled:
             return self
         self._stop_event.clear()
@@ -95,14 +148,41 @@ class Progress:
         return elapsed
 
     def finish(self) -> None:
-        """Stop spinner and print a completion line to stderr."""
-        elapsed = self.stop()
+        """Stop the spinner and claim completion — as soon as that is true.
+
+        If the command has already handed over its answer (the `spring-audit`
+        shape: `finish()` called after the write), the line prints here. If it
+        has not, the line waits for `output_emitted()`. It is never printed on a
+        run that dies in between, and never on a run that raised: `finally:
+        finish()` on an exception path leaves a claim pending that nothing
+        releases (C3-54).
+        """
+        self._elapsed_at_finish = self.stop()
         if not self._enabled:
             return
+        with _registry_lock:
+            if _output_events > self._outputs_at_start:
+                already_emitted = True
+            else:
+                already_emitted = False
+                if self not in _pending_done:
+                    _pending_done.append(self)
+        if already_emitted:
+            self._print_done()
+
+    def _print_done(self) -> None:
+        """Write the completion line once, for an answer that now exists."""
+        if self._done_printed or not self._enabled:
+            return
+        self._done_printed = True
+        elapsed = getattr(self, "_elapsed_at_finish", self.elapsed)
         t = f"{elapsed:.1f}s" if elapsed < 60 else f"{elapsed / 60:.1f}m"
         prefix = "[ask] " if self._line_mode else "✓ "
-        sys.stderr.write(f"{prefix}done ({t})\n")
-        sys.stderr.flush()
+        try:
+            sys.stderr.write(f"{prefix}done ({t})\n")
+            sys.stderr.flush()
+        except Exception:
+            pass
 
     def _loop(self) -> None:
         idx = 0
@@ -120,6 +200,19 @@ class Progress:
             try:
                 sys.stderr.write(line)
                 sys.stderr.flush()
-            except Exception:
+                self._write_failures = 0
+            except ValueError:
+                # The stream is closed — the run is ending. Nothing to retry.
                 break
+            except Exception:
+                # C3-56: a single failed write used to end the heartbeat for the
+                # rest of the run, and the operator's only remaining way to tell
+                # work from a hang was reading the worker's CPU time. One bad
+                # write is not evidence that the next one fails: on Windows a
+                # redirected stderr can reject a write transiently. Give up only
+                # when the stream refuses repeatedly.
+                self._write_failures += 1
+                if self._write_failures >= _MAX_WRITE_FAILURES:
+                    break
+                continue
             idx += 1

sourcecode/provenance.py

@@ -105,8 +105,6 @@ def _claims_from_rows(command: str, payload: dict[str, Any]) -> list[dict[str, A
                 if row.get("rule_ids"):
                     claim["rule_ids"] = row["rule_ids"]
                 claims.append(claim)
-            if len(claims) >= _MAX_CLAIMS:
-                return claims
     return claims
 
 
@@ -166,9 +164,16 @@ def build_evidence_manifest(
 ) -> dict[str, Any]:
     """Build a machine-readable provenance index for an existing payload."""
     root = Path(root).resolve()
-    claims = _claims_from_rows(command, payload)
-    claims.extend(_claims_from_java_lts(command, payload))
-    claims = claims[:_MAX_CLAIMS]
+    # I-2: measure the whole population, THEN cut it. `_claims_from_rows` used to
+    # return the moment it reached the cap, so the number of claims the payload
+    # actually carries was never computed and could not be published — the manifest
+    # reported the cap itself as `total_indexed`, which is the exact shape ("the
+    # published count is the size of the rendering") this module exists to make
+    # auditable. Building every claim is arithmetic over rows already in memory.
+    all_claims = _claims_from_rows(command, payload)
+    all_claims.extend(_claims_from_java_lts(command, payload))
+    total_claims = len(all_claims)
+    claims = all_claims[:_MAX_CLAIMS]
     sources = sorted({
         str((claim.get("source") or {}).get("path"))
         for claim in claims
@@ -189,11 +194,14 @@ def build_evidence_manifest(
         "run": run,
         "claims": claims,
         "sources": [{"path": path} for path in sources],
-        "claims_cap": (
-            {"total_indexed": _MAX_CLAIMS, "capped": True}
-            if len(claims) >= _MAX_CLAIMS else
-            {"total_indexed": len(claims), "capped": False}
-        ),
+        # `total` is the measurement; `total_indexed` is the size of this manifest.
+        # `capped` is strictly `total > cap`: a payload with exactly `_MAX_CLAIMS`
+        # claims had nothing removed and must not report that it did.
+        "claims_cap": {
+            "total": total_claims,
+            "total_indexed": min(total_claims, _MAX_CLAIMS),
+            "capped": total_claims > _MAX_CLAIMS,
+        },
         "embedded_manifests": _embedded_manifests(payload),
         "limits": {
             "statement": (

sourcecode/release_info.py

@@ -27,7 +27,7 @@ from typing import Any, Optional
 #: The date `__version__` was released, from that version's CHANGELOG entry.
 #: `tests/test_release_info.py` fails the build if the two disagree, so this is
 #: a copy of a fact rather than a second authority for it.
-RELEASE_DATE = "2026-08-05"
+RELEASE_DATE = "2026-08-07"
 
 #: Releases per day, measured over the 30 releases before this one (the same
 #: computation the test re-runs against the CHANGELOG). Stable across window

sourcecode/repository_ir.py

@@ -21,7 +21,7 @@ import subprocess
 from collections import deque
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Iterable, Optional
+from typing import Any, Iterable, Iterator, Optional
 
 from sourcecode.caller_metrics import CALLER_METRIC_RECONCILIATION, caller_classes
 from sourcecode.degradation import cap_effect as _cap_effect
@@ -5634,6 +5634,43 @@ _VENDOR_DIRS: frozenset[str] = frozenset({
     "generated-resources",
 })
 
+#: Metadata trees that hold no repository source at all. Kept apart from
+#: `_VENDOR_DIRS` because that set answers "is this file part of the product";
+#: this one answers "is there anything here worth opening". `.git` alone holds
+#: 5 542 loose objects in this repository, and every unpruned `rglob` visits
+#: every one of them.
+_METADATA_DIRS: frozenset[str] = frozenset({
+    ".git", ".hg", ".svn", ".idea", ".vscode", "__pycache__",
+})
+
+#: One ignore set for every tree walk that is looking for source (C3-64). A
+#: second, hand-kept list beside this one is how two surfaces come to disagree
+#: about what counts as source.
+PRUNED_TREE_DIRS: frozenset[str] = _VENDOR_DIRS | _METADATA_DIRS
+
+
+def walk_source_tree(
+    root: Path, *, prune: frozenset[str] = PRUNED_TREE_DIRS,
+) -> "Iterator[Path]":
+    """Yield every file under `root`, never descending into a pruned directory.
+
+    `Path.rglob` has no way to skip a subtree: it walks the build output and the
+    VCS metadata and then filters by name, so the cost of a scan is set by what
+    the build wrote rather than by what the developer did. Measured on
+    openmrs-core, 47 % of all tree entries live under directories in `prune`
+    (C3-64).
+
+    Yields absolute paths, and never raises: an unreadable directory is skipped
+    the same way the previous `rglob` calls swallowed `OSError`.
+    """
+    import os
+
+    for dirpath, dirnames, filenames in os.walk(root, onerror=lambda _e: None):
+        dirnames[:] = [d for d in dirnames if d not in prune]
+        base = Path(dirpath)
+        for name in filenames:
+            yield base / name
+
 
 def apply_ir_size_limits(
     ir: dict,

sourcecode/security_config_scan.py

@@ -609,13 +609,36 @@ def scan_security_configuration(
         out.extend(_scan_commented_controls(source, rel, xml=False))
         out.extend(_scan_java(blank_java_comments(source), rel))
 
+    # C3-64 — one pruned walk for all three populations. This used to be five
+    # `rglob` calls (one per config suffix, one for descriptors, one for
+    # mappers), none of which could skip a subtree: the cost was set by the size
+    # of `target/`, `node_modules/` and `.git` rather than by the source. The
+    # ignore set is the walker's own (`repository_ir.PRUNED_TREE_DIRS`), so this
+    # surface and Java discovery cannot disagree about what is source.
+    from sourcecode.repository_ir import walk_source_tree
+
+    _walked_config: "list[str]" = []
+    descriptors: "list[str]" = []
+    mappers: "list[str]" = []
+    for path in walk_source_tree(root):
+        name = path.name
+        lower = name.lower()
+        try:
+            rel_posix = path.relative_to(root).as_posix()
+        except ValueError:
+            continue
+        if name.startswith("application") and name.endswith(_CONFIG_SUFFIXES):
+            _walked_config.append(rel_posix)
+        elif lower.endswith(".xml"):
+            # A descriptor that also ends in `Mapper.xml` stays a descriptor —
+            # the old code took the same side by subtracting one set from the other.
+            if lower in _DESCRIPTOR_NAMES or lower.endswith(_DESCRIPTOR_SUFFIXES):
+                descriptors.append(rel_posix)
+            elif name.endswith("Mapper.xml"):
+                mappers.append(rel_posix)
+
     if config_files is None:
-        config_files = []
-        for suffix in _CONFIG_SUFFIXES:
-            config_files += [
-                p.relative_to(root).as_posix()
-                for p in root.rglob(f"application*{suffix}")
-            ]
+        config_files = _walked_config
     for rel in sorted(set(config_files)):
         try:
             text = (root / rel).read_text(encoding="utf-8", errors="replace")
@@ -624,18 +647,10 @@ def scan_security_configuration(
         out.extend(_scan_commented_config_controls(text, rel))
         out.extend(_scan_config(blank_hash_comments(text), rel))
 
-    # CL-10 — the descriptors. Discovered the same way `environment_resolution`
+    # CL-10 — the descriptors. Classified the same way `environment_resolution`
     # classifies them, so the two surfaces cannot disagree about which files are
     # deployment descriptors, and a per-environment overlay tree is covered
     # because the walk finds the file wherever the build put it.
-    descriptors: "list[str]" = []
-    try:
-        for path in root.rglob("*.xml"):
-            name = path.name.lower()
-            if name in _DESCRIPTOR_NAMES or name.endswith(_DESCRIPTOR_SUFFIXES):
-                descriptors.append(path.relative_to(root).as_posix())
-    except OSError:
-        pass
     for rel in sorted(set(descriptors)):
         try:
             text = (root / rel).read_text(encoding="utf-8", errors="replace")
@@ -644,13 +659,6 @@ def scan_security_configuration(
         out.extend(_scan_commented_controls(text, rel, xml=True))
         out.extend(_scan_descriptor(blank_xml_comments(text), rel))
 
-    mappers: "list[str]" = []
-    try:
-        for path in root.rglob("*.xml"):
-            if path.name.endswith("Mapper.xml"):
-                mappers.append(path.relative_to(root).as_posix())
-    except OSError:
-        pass
     for rel in sorted(set(mappers) - set(descriptors)):
         try:
             text = (root / rel).read_text(encoding="utf-8", errors="replace")

sourcecode/spring_security_audit.py

@@ -621,6 +621,14 @@ class _GATE00XCustomGateAudit:
         findings: list[SpringFinding] = []
         ann_re = _annotation_call_re(token)
         for rel, source in sources:
+            # C3-61: `ann_re` is `@<token>\b…`, so it cannot match a source that does
+            # not contain the literal token, and neither can any prefix slice of it.
+            # Without this line every source pays a full method `finditer` plus one
+            # prefix regex per method before proving it had nothing to find — 98,9 %
+            # of (source, token) pairs on the measured repository. Same guard
+            # `_advice_body_rules` already carries.
+            if token not in source:
+                continue
             class_fqn = _java_fqn(source)
             annotated_methods: dict[str, tuple[int, str]] = {}
             for method in _JAVA_METHOD_RE.finditer(source):
@@ -712,6 +720,8 @@ class _GATE00XCustomGateAudit:
         findings: list[SpringFinding] = []
         ann_re = _annotation_call_re(token)
         for rel, source in sources:
+            if token not in source:  # C3-61, same equivalence as `_proxy_bypass`
+                continue
             class_fqn = _java_fqn(source)
             for ann in ann_re.finditer(source):
                 args = (ann.group("args") or "").strip()

sourcecode/text_input.py

@@ -0,0 +1,93 @@
+"""text_input.py — one authority for decoding text that arrives from outside.
+
+Every path list this CLI accepts (stdin, a list file) is bytes written by
+somebody else's shell. Python decodes stdin with the *locale* encoding, which on
+Windows is the ANSI codepage (cp1252), not UTF-8 — so a path piped from
+PowerShell came back mojibake and resolved to nothing:
+
+    Año…java  ->  Año…java        (UTF-8 bytes read as cp1252)
+    src/…  ->  src/…      (the UTF-8 BOM read as three cp1252 chars)
+
+Both forms silently produced an empty blast radius on `pr-impact --files -`,
+which is the gating command: `CRITICAL` became a green pipeline (C3-58).
+
+The rule here is that the *bytes* decide the encoding, never the platform
+locale: a BOM is authoritative when present, UTF-8 otherwise. A byte sequence
+that is not valid UTF-8 (a genuinely cp1252-encoded list) decodes with
+replacement characters rather than raising — the path then fails to resolve and
+the consumer's diagnostic names encoding as a cause, which beats a traceback.
+
+Pure module: no I/O policy, no CLI imports.
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+#: Byte-order marks, longest first — UTF-32-LE starts with the UTF-16-LE mark.
+#: The codec named here is the one that *consumes* the mark: `utf-16-le` leaves a
+#: U+FEFF at the head of the text, `utf-16` reads the mark and drops it.
+_BOMS: tuple[tuple[bytes, str], ...] = (
+    (b"\x00\x00\xfe\xff", "utf-32"),
+    (b"\xff\xfe\x00\x00", "utf-32"),
+    (b"\xef\xbb\xbf", "utf-8-sig"),
+    (b"\xfe\xff", "utf-16"),
+    (b"\xff\xfe", "utf-16"),
+)
+
+#: The BOM as a character. `utf-16`/`utf-32` decoding consumes the mark, but a
+#: BOM in the *middle* of a stream (PowerShell writing one per redirection) and
+#: a stream already handed to us as `str` both leave it in the text.
+BOM_CHAR = ""
+
+
+def sniff_encoding(data: bytes) -> str:
+    """Return the encoding named by `data`'s byte-order mark, else `utf-8`."""
+    for mark, encoding in _BOMS:
+        if data.startswith(mark):
+            return encoding
+    return "utf-8"
+
+
+def decode_bytes(data: bytes) -> str:
+    """Decode externally supplied bytes. BOM decides; UTF-8 is the default.
+
+    Never raises: undecodable bytes become U+FFFD so the caller can report an
+    unusable path instead of dying on it.
+    """
+    return data.decode(sniff_encoding(data), errors="replace")
+
+
+def read_stdin_text() -> str:
+    """Read all of stdin as text, decoded by the bytes rather than the locale.
+
+    Falls back to `sys.stdin.read()` when the stream has no binary buffer —
+    Click's `CliRunner` and test doubles replace `sys.stdin` with a `StringIO`.
+    """
+    buffer = getattr(sys.stdin, "buffer", None)
+    if buffer is None:
+        return sys.stdin.read()
+    return decode_bytes(buffer.read())
+
+
+def read_text_file(path: Path) -> str:
+    """Read a file supplied by the user as text, BOM-aware.
+
+    `Path.read_text(encoding="utf-8")` raised on the file PowerShell 5.1 writes
+    by default: `git diff --name-only > changed.txt` there is UTF-16-LE.
+    """
+    return decode_bytes(path.read_bytes())
+
+
+def parse_path_lines(text: str) -> list[str]:
+    """Split a path listing into clean entries.
+
+    Strips the BOM character wherever it survived decoding, normalises CRLF, and
+    drops blank lines. Order is preserved; duplicates are the caller's business.
+    """
+    entries: list[str] = []
+    for line in text.splitlines():
+        cleaned = line.replace(BOM_CHAR, "").strip()
+        if cleaned:
+            entries.append(cleaned)
+    return entries

sourcecode/verify_edit.py

@@ -685,6 +685,37 @@ def verdict(hvw: HeadVsWorking, root: Path) -> VerifyVerdict:
     exit code: 0=pass, 1=break (a blocking axis proved a regression), 2=unverified
     (a blocking axis could not be computed — honest, never a silent pass)."""
     root = _resolve_repo_root(Path(root))
+
+    # C3-60: an empty change set has one correct answer and it needs none of the
+    # six full-repository analyzers below. `working_cir_reused` is only True when
+    # `head_vs_working` positively confirmed nothing changed (C3-32's
+    # `git_answered and not all_changed`) — never a guess — in which case
+    # `cir_working IS cir_head` (the same object) and `changed_files` /
+    # `changed_build_files` are both empty by construction. Every axis diffs
+    # cir_head against cir_working, so diffing an object against itself can only
+    # ever prove "no change"; running the tx/security audits (and everything
+    # else) twice over the whole tree to demonstrate that took 8+ minutes on a
+    # clean 3 342-file monolith while `cache freshness` already had the answer
+    # in under a second. Short-circuit to the answer every axis would compute.
+    if hvw.working_cir_reused:
+        clean_axes = {
+            name: AxisResult(False)
+            for name in (
+                "contract_broken", "tx_boundary_changed", "security_delta",
+                "new_orphan_bean", "custom_rule_violated", "build_config_changed",
+            )
+        }
+        return VerifyVerdict(
+            verdict="pass",
+            axes=clean_axes,
+            changed_files=hvw.changed_files,
+            changed_build_files=hvw.changed_build_files,
+            blast_radius={"affected_entry_points": 0, "confidence": "high", "note": "no changed files"},
+            reasons=(),
+            exit_code=0,
+            head_sha=hvw.head_sha,
+        )
+
     axes: dict[str, AxisResult] = {
         "contract_broken": _contract_axis(hvw.cir_head, hvw.cir_working),
         "tx_boundary_changed": _tx_axis(hvw.cir_head, hvw.cir_working, root),

{sourcecode-4.10.3.dist-info → sourcecode-4.10.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.10.3
+Version: 4.10.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -18,7 +18,7 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
 Requires-Dist: defusedxml>=0.7
-Requires-Dist: mcp>=1.0.0
+Requires-Dist: mcp<2,>=1.2
 Requires-Dist: pathspec>=1.0
 Requires-Dist: ruamel-yaml>=0.18
 Requires-Dist: tomli>=2.0; python_version < '3.11'
@@ -28,12 +28,12 @@ Requires-Dist: tree-sitter-javascript>=0.21; extra == 'ast'
 Requires-Dist: tree-sitter-typescript>=0.21; extra == 'ast'
 Requires-Dist: tree-sitter>=0.21; extra == 'ast'
 Provides-Extra: dev
-Requires-Dist: mcp>=1.0.0; extra == 'dev'
+Requires-Dist: mcp<2,>=1.2; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest>=8; extra == 'dev'
 Requires-Dist: ruff>=0.15; extra == 'dev'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Requires-Dist: mcp<2,>=1.2; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # ASK Engine
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.3-blue)
+![Version](https://img.shields.io/badge/version-4.10.5-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -106,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.3 — and, on a build that has aged,
+ask version                    # ask 4.10.5 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.3.dist-info → sourcecode-4.10.5.dist-info}/RECORD

@@ -1,7 +1,7 @@
-sourcecode/__init__.py,sha256=kRwEKt8ufgmTyXFYrYP-5dM5o3eTQYMoUFRLOvoQ0as,309
+sourcecode/__init__.py,sha256=N-KHrUXD6ch30-2odxw2VCquK5xEfMXbG2ZoDVLuWQU,309
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=CZvRLpkHot_D8D3JFQVorr-EHDJyh0BbS7RnSTqBigM,40499
-sourcecode/architectural_baseline.py,sha256=agDSwGEakdkgLLh5xnd3hiD_TC6pRujWt4klnuYF1wo,18689
+sourcecode/architectural_baseline.py,sha256=ihbYyVgR9MJ2RBuEfayY3rWfubS27MT7m0JPc2NpSWU,20087
 sourcecode/architectural_delta.py,sha256=E6MkyjWl-1ZgR4KSKnI785gUAfc8nq-lK-jd_rupQBU,12496
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
 sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
@@ -9,7 +9,7 @@ sourcecode/ast_extractor.py,sha256=aXJjZ7XjAdxa99hWNm4SyzPqx4gNWiTbUYjNWGNl-Vc,5
 sourcecode/audit_report.py,sha256=SwFTJAk76Rew9YWpE3s8sHpi6VY-TN2nlLTCdjpUzDk,6031
 sourcecode/baseline_autocapture.py,sha256=tmMLexQSeaQRRbqxAd7walvGQqnF0mdpxQmkL40rlhI,15623
 sourcecode/cache.py,sha256=9XJUNSGzqM6DNWy4erUO-OcZY9qkrTCCcOJ-OANVrw8,41409
-sourcecode/cache_model.py,sha256=pHUUxg3Eg9kS6vX8kBBB-SCVddIOH-g4alfbBppX25M,17863
+sourcecode/cache_model.py,sha256=fFxq5bmDkqmQ-Bcb5TEyCWDb5VO8UGpd_FV3CsYDlvs,19635
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,7904
 sourcecode/caller_reach.py,sha256=RRF49tv4-QswraJ2vsZ89VAMOj7BmYXlAdXr-tLP_CA,9483
@@ -18,7 +18,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=kFjjp16XYbupgkv1CPkfqo39_SiZPMRQ8OOfC-Vy9eg,7929
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=XU1sIXuItcNEHm0F3ZbI7hiDXcAtFXIOEg4swDrtFoM,524880
+sourcecode/cli.py,sha256=yUCVp8xLvSIieX417jnIPJq-Tc_W5ThDle6V3El_Gxk,530346
 sourcecode/client_calls.py,sha256=daRTgbXNUOfkzGXJpVb6A737R_Thhka8vw1_YgxCaLg,13548
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=xq3zsqAOAw4AWkoD9khb9xDP_O3KvwqO9k-pf8sbi3g,10951
@@ -79,21 +79,21 @@ sourcecode/perf.py,sha256=2YlJTXjyur1S7hecOMz_joUHAXE5bkcZ85a_LXBEcHQ,13931
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
 sourcecode/posture.py,sha256=VWnUjqmWp4Koa43dzhonaSvAgMqbOwqaMKCg4ITbgIc,76194
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
-sourcecode/pr_impact.py,sha256=eaFgcPMDsjaF8VZvcitFWCPCabMTi-khtGdxpK0wXTQ,22461
+sourcecode/pr_impact.py,sha256=b315e2ZCRihuw23EXxHIJll1hDs7M2CZTczrZwAxGFQ,24044
 sourcecode/prepare_context.py,sha256=B8TiBQbazxUOz6D37Dt9zqbOtD5b2S_fR3MB15P9DrI,237206
-sourcecode/progress.py,sha256=hbOPMSNMfoHYS-BL1HAH0VAQFR4u3TzWq0oJdeAPdjM,3921
-sourcecode/provenance.py,sha256=1_EGgBtJA3f8dOA_XKuENr0mQLnIJw87lXWdlkgFgqY,6661
+sourcecode/progress.py,sha256=In9yXx-WOXLVkj_jxu_ae2_4bABHnhj4nWg4KvetfHM,7921
+sourcecode/provenance.py,sha256=gLbsLv0gze7k7ChM4i5M3MwKfFPzs8wzM72rUd2C5sM,7342
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
 sourcecode/readiness_timeline.py,sha256=qqc14vL9nj9E4qw4bVZpGhfMLaVaYr9s6Pak_VUIwt0,8008
 sourcecode/reconciliation.py,sha256=GU-1PTcVr8zcbtC7BASfpHcZndP9AdboXPNQiBc0fzo,34251
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/reference_facts.py,sha256=Ns495c6eTmq2SrqPkcUrJUJru4_wj_yRWm4YDeJwves,13440
-sourcecode/release_info.py,sha256=GUKwjfYAFVJQ233rVuZ0kB5gCBctSQD7NAgCUc_2WMQ,5378
+sourcecode/release_info.py,sha256=6FePTGL0ZSSV_KCYfMUlwT10m7uR0JelH6y1Y-0dPqk,5378
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/remedies.py,sha256=8lgvKkW1WuBG-QfTnA0uBhEKnwWGSvgSMWCfTjzYhEY,6516
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=UdA13zDUvhgZvdUt8BIbfHOXi40OkdvqtpMJG7hYkms,358320
+sourcecode/repository_ir.py,sha256=zCQAZ-SfkbXcgNJJGX5Tv-Z5c2DFTE4GoyzAUitBx48,359936
 sourcecode/ris.py,sha256=SjjDNMcc9Zr9us9G8ikBVkoPXKK3BpM-dBodSGMh_g4,24783
 sourcecode/risk.py,sha256=UgTVdMc8XBArO6D9e2Xx9I-kKqx-PW4W0hSe1Jy9qjU,54491
 sourcecode/rule_catalog.py,sha256=xmphuULUCtg_GWTbriwY25D-N2IaeMXXvB5CNU1xSuA,4925
@@ -103,7 +103,7 @@ sourcecode/sarif.py,sha256=3hQEegUxIZbojFdY59oB-yKsK-rnafHdTNmYsEP2--A,25984
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
-sourcecode/security_config_scan.py,sha256=RDxBNm7oVdAaY6gbQgeA2FjHy2pVc6MPRnrBwTnASqY,27247
+sourcecode/security_config_scan.py,sha256=m146K51cA9g9wPRwloLSalHAk0qaEybGj_h0bSO4acQ,27916
 sourcecode/security_posture.py,sha256=CjJ2Qm87HhKXepnaWx1ncJLW-SxI18udCmUDIkCyAsY,50270
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
@@ -118,19 +118,20 @@ sourcecode/spring_impact.py,sha256=keWoE1tN5B_SzJx9F-53RKEL0b2edhJdZMTfocmJZLY,8
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=KkhIx1WhAD9ccw3P-CcHP3d8p0OAOivKT5CrX2Zuq8k,46257
+sourcecode/spring_security_audit.py,sha256=8IFHdouvurxyK2n60PPxflhJjJ9u-hl8EC7iFns2ST0,46899
 sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=_wqjRktqdPS6PiXXxtTkCD1t6BaE2uhqx6ioYY-ULAw,44153
 sourcecode/summarizer.py,sha256=0aD4x3vgPngqBCEBKGuES1J2Vk5f7mqCm_ZWErwm3js,27025
 sourcecode/target_admission.py,sha256=wFZ4pzlxhiF6Q6s2lEAZEzcCfj1Y6xNvujjt8MdO0Qo,7154
 sourcecode/test_gap_ranking.py,sha256=hl-tTyQUXZGJycG1b6npbLeE_DaVHaOsvPwG9qqC5y8,15711
 sourcecode/test_sources.py,sha256=6qXI47rVt_DFEbziFUyU-_KIUIGt8YQ5Uf4-sdiAhKU,9277
+sourcecode/text_input.py,sha256=3pL8DxR_DMI3ece-B70DnppvrEaLh4R17Pp8dK9G_hc,3596
 sourcecode/token_estimate.py,sha256=G-ivzIJfVq5TLQN04dC0WK4LZJjWVYL54Ebcxe4fJ7M,9268
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
 sourcecode/validation_inference.py,sha256=-oWJqE6PqkqcZbCFDJeWCQHgI9Dbuv5ggJWD3LE_2IU,20817
 sourcecode/validation_surface.py,sha256=jYL-hkDjaaRKkAt7ZUcbxm3Dydl8o6KVRhTkuPXKPVc,31460
-sourcecode/verify_edit.py,sha256=Toqx4z47gLUmcj5F673eTFq1dE_6e4T3mXVesjkPx6g,35955
+sourcecode/verify_edit.py,sha256=IN-cmLxz-gIosbw6jfxKLDE7d5CdXocNAFkEnln806c,37499
 sourcecode/verify_repo.py,sha256=ltSP1nFc726k2aTHCu5dfhxQgxQwz3nrUNDMDN-aDa8,12158
 sourcecode/verify_rules.py,sha256=YxG5JkDXBVpwbU1_tIKVtU8_eaF3zjpsq05tjpN4Z7Y,19401
 sourcecode/version_check.py,sha256=CHp6ZxTIfo8kyHPCBgJA1uFC0xQCoXMuuOfrW8QTL8o,4942
@@ -193,8 +194,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.10.3.dist-info/METADATA,sha256=6_uj0P5A9uKdHBcaXMZQic-g9lTXCknIu4m9X9sYj1g,36657
-sourcecode-4.10.3.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.10.3.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.10.3.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.10.3.dist-info/RECORD,,
+sourcecode-4.10.5.dist-info/METADATA,sha256=YVaP0d14yBclh0t3bccUj_lbJOuaI7cFJbWzotlts7g,36660
+sourcecode-4.10.5.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.10.5.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.10.5.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.10.5.dist-info/RECORD,,