sourcecode 4.10.4__tar.gz → 4.10.5__tar.gz

{sourcecode-4.10.4 → sourcecode-4.10.5}/CHANGELOG.md

@@ -2,6 +2,70 @@
 
 ## [Unreleased]
 
+## [4.10.5] — 2026-08-07
+
+Second release of the field-evaluation #13 queue. Three rows close and one closes
+in part; the suite is 6 691 tests green.
+
+⚠ **Two behaviour changes to read before upgrading a pipeline.** Both are the fix
+working, and both can move a gate:
+
+- On Windows, `pr-impact --files -` now resolves paths it previously mangled, so a
+  pipeline that was passing because its diff decoded to nothing can start failing —
+  with the verdict the diff always deserved (C3-58).
+- A security finding that existed only in build output (`target/classes`) is no
+  longer reported, so a repository audited mid-build can report fewer findings
+  (C3-64).
+
+### Performance
+
+- **The security configuration scan discovers its files 8.7× faster** (C3-64):
+  0.61 s → 0.07 s on keycloak, 0.45 s → 0.05 s on alfresco. Five `rglob` calls
+  became one pruned walk. `rglob` cannot skip a subtree, so the old cost was set by
+  the build output and the VCS metadata rather than by the source: 48.4 % of
+  openmrs-core's tree entries and 53.3 % of this repository's live under directories
+  that hold no source at all. On a clean checkout the end-to-end scan moves 1.73 s →
+  1.43 s (the rest is reading Java sources); the win grows with how built the tree
+  is, which is the state a developer's repository is normally in.
+
+### Fixed
+
+- **A path list is decoded by its bytes, never by the platform locale** (C3-58).
+  `ask pr-impact --files -` read stdin through Python's locale decoding, which on
+  Windows is the ANSI codepage: `git diff --name-only | ask pr-impact --files -`
+  returned `risk: UNKNOWN` and 0 endpoints where the same list without the shell's
+  default byte-order mark returned `CRITICAL` and 1 144 — a green pipeline on the
+  gating command. The BOM was the visible half; `AñoService.java` arriving as
+  `AñoService.java` was the cause. The new authority `sourcecode/text_input.py`
+  reads `sys.stdin.buffer` and lets the bytes name the encoding, and the list-file
+  shape goes through it too: PowerShell 5.1 writes UTF-16-LE by default, which the
+  previous UTF-8 read raised on. Undecodable bytes now yield an unusable path with
+  encoding named as a cause, never a traceback.
+- **No command claims `done` before its answer exists** (C3-54, part 2). The
+  completion line moved out of `Progress.finish()` entirely: `finish()` claims the
+  work is done, and the line is printed when the answer has actually been handed
+  over. A run killed in between prints nothing, and a run that raised prints
+  nothing — previously ~20 commands emitted `done (Xs)` while their `--output` file
+  did not exist yet, which in the field meant 6.8 minutes of analysis reported as
+  success over an absent file. Output files are also durable now: the shared writer
+  fsyncs data and directory entry before anything reports a write, and `repo-ir` —
+  the one `-o` path that bypassed that writer — goes through it.
+- **A rejected progress write no longer silences progress for the rest of the run**
+  (C3-56, part). The heartbeat treated any write failure as terminal; it now retries
+  and gives up only after five consecutive failures. The reported 393 s of silence
+  did not reproduce: the cadence is timer-driven and measured exact on a cold
+  29.9 s run (5.0 / 10.0 / 15.0 / 20.0 / 25.1 s). The progress denominator and ETA
+  the row also asks for are still open.
+- **A build copy is no longer a second security finding** (C3-64). The configuration
+  scan walked the whole tree five times and could not skip a subtree, so a compiled
+  copy of `application.properties` under `target/classes` was reported beside the
+  source file it came from. It now walks once, pruning build output and VCS metadata
+  with the same ignore set Java discovery uses.
+- **An unresolved changed file names the right thing to check** (C3-58). One message
+  covered both causes and pointed at the wrong one: a path that is *not on disk* is a
+  path problem (form and encoding), while a path that *is* there but maps to no class
+  is a fact about the file. They now say so separately.
+
 ## [4.10.4] — 2026-08-07
 
 First release of the queue opened by field evaluation #13. Four of its rows close,

{sourcecode-4.10.4 → sourcecode-4.10.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.10.4
+Version: 4.10.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.4-blue)
+![Version](https://img.shields.io/badge/version-4.10.5-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -106,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.4 — and, on a build that has aged,
+ask version                    # ask 4.10.5 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.4 → sourcecode-4.10.5}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.4-blue)
+![Version](https://img.shields.io/badge/version-4.10.5-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -68,7 +68,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.4 — and, on a build that has aged,
+ask version                    # ask 4.10.5 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.4 → sourcecode-4.10.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.10.4"
+version = "4.10.5"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.10.4 → sourcecode-4.10.5}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.10.4"
+__version__ = "4.10.5"

{sourcecode-4.10.4 → sourcecode-4.10.5}/src/sourcecode/cli.py

@@ -18,6 +18,7 @@ from sourcecode import __version__
 from sourcecode.error_schema import EXECUTION_FAILED_CODE, INVALID_INPUT_CODE, build_error_envelope
 from sourcecode.entrypoint_classifier import is_production_entry_point, normalize_entry_point
 from sourcecode.progress import Progress
+from sourcecode.progress import output_emitted as _progress_output_emitted
 from sourcecode import perf
 from sourcecode.caller_metrics import (
     CALLER_METRIC_RECONCILIATION,
@@ -888,8 +889,27 @@ def _safe_write_file(path: "Path", content: str) -> None:
         path = Path(path)
         path.parent.mkdir(parents=True, exist_ok=True)
         tmp = path.with_name(f".{path.name}.tmp-{os.getpid()}-{time.time_ns()}")
-        tmp.write_text(content, encoding="utf-8")
+        # C3-54 part 2: the rename is atomic, the bytes were not durable. A
+        # process torn down between `write_text` and the OS flushing its page
+        # cache leaves a file that exists at full length and holds nothing —
+        # the same total loss the false `done` line reported as success, one
+        # layer down. fsync the data before the rename, then the directory
+        # entry, so a run that reports an output file has one.
+        with open(tmp, "w", encoding="utf-8") as fh:
+            fh.write(content)
+            fh.flush()
+            os.fsync(fh.fileno())
         tmp.replace(path)
+        try:
+            dir_fd = os.open(str(path.parent), os.O_RDONLY)
+            try:
+                os.fsync(dir_fd)
+            finally:
+                os.close(dir_fd)
+        except (OSError, AttributeError):
+            # Directory fsync is POSIX-only; on Windows the rename is already
+            # ordered against the data write. Never fail a good run over it.
+            pass
         try:
             from sourcecode.runs import active_run
             run = active_run()
@@ -1213,6 +1233,9 @@ def _emit_command_output(
             # The payload is on stdout here, so this cannot join it; it is a
             # notice and takes the terminal gate rather than dirtying a capture.
             _notice("✓ copied to clipboard")
+    # The answer has been handed over. Any `done (Xs)` a command deferred is now
+    # a true claim and prints here — never before this line (C3-54).
+    _progress_output_emitted()
 
 
 def _emit_text_output(text: str, copy: bool) -> None:
@@ -1228,6 +1251,7 @@ def _emit_text_output(text: str, copy: bool) -> None:
     typer.echo(text)
     if copy and _copy_to_clipboard(text):
         _notice("✓ copied to clipboard")
+    _progress_output_emitted()
 
 
 class _TextAnswer:
@@ -1257,6 +1281,7 @@ class _TextAnswer:
     def done(self, copy: bool) -> None:
         if copy and self._lines and _copy_to_clipboard(self.text):
             _notice("✓ copied to clipboard")
+        _progress_output_emitted()
 
 
 # H-06: Intercept Click-level UsageError (unknown options, bad args) and emit JSON.
@@ -4825,8 +4850,15 @@ def repo_ir_cmd(
         size_bytes = len(raw_bytes)
         if gzip_output:
             import gzip as _gzip
+            # Same durability rule as `_safe_write_file`: the bytes are on disk
+            # before anything says they are (C3-54).
             with _gzip.open(output_path, "wb") as _gz:
                 _gz.write(raw_bytes)
+                _gz.flush()
+                try:
+                    os.fsync(_gz.fileno())
+                except (OSError, AttributeError):
+                    pass
             compressed_kb = output_path.stat().st_size // 1024
             size_kb = size_bytes // 1024
             # C3-26: when the payload went to a file, this confirmation IS the
@@ -4837,7 +4869,9 @@ def repo_ir_cmd(
                 f"IR written to {output_path} ({compressed_kb}KB gzip, {size_kb}KB uncompressed)"
             )
         else:
-            output_path.write_bytes(raw_bytes)
+            # Was a bare `write_bytes`: neither atomic nor durable, and the only
+            # `-o` write in the CLI that skipped the shared seam (C3-54).
+            _safe_write_file(output_path, output)
             size_kb = size_bytes // 1024
             if summary_only:
                 typer.echo(
@@ -4850,6 +4884,7 @@ def repo_ir_cmd(
                     f"IR written to {output_path} "
                     f"({size_kb}KB, {n_nodes} nodes, {n_edges} edges)"
                 )
+        _progress_output_emitted()
     else:
         if gzip_output:
             _emit_error_json(
@@ -9461,18 +9496,21 @@ def pr_impact_cmd(
     # --files accepts three shapes: a list file, '-' for stdin, or an inline
     # comma-separated list. The list-file shape was the only documented one and
     # the only one the error hint mentioned.
-    _files_raw = str(files).strip()
+    # Both byte-carrying shapes decode through `text_input`: stdin and list files
+    # arrive as somebody else's shell wrote them, and the locale codepage is not
+    # evidence of their encoding (C3-58).
+    from sourcecode import text_input as _text_input
+
+    _files_raw = str(files).replace(_text_input.BOM_CHAR, "").strip()
     if _files_raw == "-":
-        changed_files = [ln.strip() for ln in sys.stdin.read().splitlines() if ln.strip()]
+        changed_files = _text_input.parse_path_lines(_text_input.read_stdin_text())
         _files_desc = "stdin"
     else:
         _files_path = Path(_files_raw)
         if _files_path.is_file():
-            changed_files = [
-                line.strip()
-                for line in _files_path.read_text(encoding="utf-8").splitlines()
-                if line.strip()
-            ]
+            changed_files = _text_input.parse_path_lines(
+                _text_input.read_text_file(_files_path)
+            )
             _files_desc = str(_files_path)
         elif all(
             p.strip().lower().endswith(".java")
@@ -10309,6 +10347,9 @@ def modernize_cmd(
             sys.stdout.buffer.flush()
         except AttributeError:
             sys.stdout.write(output + "\n")
+    # This branch predates `_emit_command_output`, so it also has to release the
+    # deferred completion line itself (C3-54).
+    _progress_output_emitted()
 
     if copy:
         _copy_to_clipboard(output)

{sourcecode-4.10.4 → sourcecode-4.10.5}/src/sourcecode/pr_impact.py

@@ -228,6 +228,43 @@ def _suffix_candidates(norm: str, file_class_index: dict[str, list[str]]) -> lis
     return shorter_given or longer_given
 
 
+def _exists_on_disk(norm: str, root: Path) -> bool:
+    """True when the given path names a file that is actually there."""
+    try:
+        candidate = Path(norm)
+        if candidate.is_absolute():
+            return candidate.is_file()
+        return (root / norm).is_file()
+    except OSError:
+        # A path the OS refuses to even stat (illegal characters after a bad
+        # decode, a name past MAX_PATH) is not on disk as far as we can tell.
+        return False
+
+
+def _unresolved_warning(path_str: str, norm: str, root: Path) -> str:
+    """Name the right thing to check for a changed file that mapped to nothing.
+
+    The two causes need opposite investigations and the single old message sent
+    every operator to the wrong one. A path that is *not there* is a path
+    problem — the field case was a BOM and cp1252 mojibake reaching us through
+    stdin (C3-58), and the message said "not in CIR", so the operator went
+    looking at analysis coverage. A path that *is* there carries no class
+    symbols, which is a fact about the file.
+    """
+    if _exists_on_disk(norm, root):
+        return (
+            f"No Spring classes found for '{path_str}' — the file exists but "
+            "contributes no class symbols to the CIR (interface-free package-info, "
+            "an empty file, or a file excluded from analysis)."
+        )
+    return (
+        f"No file at '{path_str}' under the analyzed repository — nothing was "
+        "matched, and this is a path problem, not an analysis gap. Check the path "
+        "form (relative to the repo root) and its encoding: a byte-order mark or a "
+        "non-UTF-8 pipe corrupts accented names."
+    )
+
+
 def _resolve_changed_files(
     file_list: list[str],
     file_class_index: dict[str, list[str]],
@@ -293,10 +330,7 @@ def _resolve_changed_files(
 
         if not candidates:
             unresolved_java.append(norm)
-            warnings.append(
-                f"No Spring classes found for '{path_str}' — "
-                "file not in CIR or has no class symbols."
-            )
+            warnings.append(_unresolved_warning(path_str, norm, root))
 
         for cls in candidates:
             if cls not in seen_classes:

sourcecode-4.10.5/src/sourcecode/progress.py

@@ -0,0 +1,218 @@
+"""Lightweight progress indicator for long-running commands.
+
+Writes only to stderr. Zero-cost when stderr is not a TTY or CI is detected,
+unless ASK_PROGRESS=1 explicitly requests line heartbeats for supervised jobs.
+Thread-safe; stop() is idempotent.
+
+`done (Xs)` is a claim, and C3-54 is what happens when it is made early: the
+field log printed `[ask] done (6.8m)` and the output directory held no
+`f3-audit.json`, because the completion line was emitted when the *analysis*
+finished — before the render and the write — and the process was torn down in
+that window. 6.8 minutes of CPU, zero recoverable bytes, reported as success.
+
+So the line is not printed where `finish()` is called. `finish()` claims the
+work is done; the line is emitted when the **answer has actually been handed
+over**, which the CLI signals through `output_emitted()` at its output seams. A
+run that is killed between the two prints nothing, which is the honest outcome:
+no answer, no completion line.
+"""
+from __future__ import annotations
+
+import os
+import sys
+import threading
+import time
+from typing import Optional
+
+_FRAMES = ("⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏")
+
+#: Consecutive failed heartbeat writes before the loop gives up on the stream.
+_MAX_WRITE_FAILURES = 5
+
+# --- Completion registry ----------------------------------------------------
+# Module state, not per-instance: the emitter of the answer (the CLI output
+# seam) and the owner of the completion line (a Progress somewhere up the call
+# stack) never see each other.
+_registry_lock = threading.Lock()
+_output_events = 0
+_pending_done: "list[Progress]" = []
+
+
+def output_emitted() -> None:
+    """The command's answer has been written. Release any deferred `done` line.
+
+    Called from every CLI output seam. Safe to call when no Progress is running
+    and safe to call more than once per run.
+    """
+    global _output_events
+    with _registry_lock:
+        _output_events += 1
+        released = list(_pending_done)
+        _pending_done.clear()
+    for prog in released:
+        prog._print_done()
+
+
+def _reset_for_tests() -> None:
+    """Drop registry state between in-process test runs."""
+    global _output_events
+    with _registry_lock:
+        _output_events = 0
+        _pending_done.clear()
+
+
+def _terminal_capable() -> bool:
+    if os.environ.get("ASK_PROGRESS", "").lower() in ("1", "true", "yes", "on"):
+        return True
+    if not sys.stderr.isatty():
+        return False
+    if os.environ.get("TERM") in ("dumb", ""):
+        return False
+    if os.environ.get("NO_COLOR"):
+        return False
+    if os.environ.get("CI"):
+        return False
+    return True
+
+
+class Progress:
+    """In-place spinner on stderr.
+
+    Usage::
+
+        p = Progress()
+        p.start("scanning files")
+        ...
+        p.update("extracting contracts")
+        ...
+        p.finish()          # clears line, prints "✓ done (3.2s)"
+
+    Always call stop() or finish() — both are idempotent.
+    """
+
+    def __init__(self) -> None:
+        self._enabled = _terminal_capable()
+        self._line_mode = self._enabled and not sys.stderr.isatty()
+        try:
+            self._interval = max(0.5, float(os.environ.get("ASK_PROGRESS_INTERVAL", "5")))
+        except ValueError:
+            self._interval = 5.0
+        self._phase = ""
+        self._t0 = time.monotonic()
+        self._lock = threading.Lock()
+        self._stop_event = threading.Event()
+        self._thread: Optional[threading.Thread] = None
+        self._stopped = False
+        self._done_printed = False
+        self._outputs_at_start = 0
+        self._elapsed_at_finish = 0.0
+        self._write_failures = 0
+
+    @property
+    def elapsed(self) -> float:
+        return time.monotonic() - self._t0
+
+    def start(self, phase: str = "initializing") -> "Progress":
+        self._t0 = time.monotonic()
+        with self._lock:
+            self._phase = phase
+        self._stopped = False
+        self._done_printed = False
+        with _registry_lock:
+            self._outputs_at_start = _output_events
+        if not self._enabled:
+            return self
+        self._stop_event.clear()
+        self._thread = threading.Thread(target=self._loop, daemon=True)
+        self._thread.start()
+        return self
+
+    def update(self, phase: str) -> None:
+        with self._lock:
+            self._phase = phase
+
+    def stop(self) -> float:
+        """Stop and clear spinner. Returns elapsed seconds. Idempotent."""
+        elapsed = self.elapsed
+        if self._stopped:
+            return elapsed
+        self._stopped = True
+        if not self._enabled:
+            return elapsed
+        self._stop_event.set()
+        if self._thread:
+            self._thread.join(timeout=1.0)
+        if not self._line_mode:
+            sys.stderr.write("\r\033[K")
+        sys.stderr.flush()
+        return elapsed
+
+    def finish(self) -> None:
+        """Stop the spinner and claim completion — as soon as that is true.
+
+        If the command has already handed over its answer (the `spring-audit`
+        shape: `finish()` called after the write), the line prints here. If it
+        has not, the line waits for `output_emitted()`. It is never printed on a
+        run that dies in between, and never on a run that raised: `finally:
+        finish()` on an exception path leaves a claim pending that nothing
+        releases (C3-54).
+        """
+        self._elapsed_at_finish = self.stop()
+        if not self._enabled:
+            return
+        with _registry_lock:
+            if _output_events > self._outputs_at_start:
+                already_emitted = True
+            else:
+                already_emitted = False
+                if self not in _pending_done:
+                    _pending_done.append(self)
+        if already_emitted:
+            self._print_done()
+
+    def _print_done(self) -> None:
+        """Write the completion line once, for an answer that now exists."""
+        if self._done_printed or not self._enabled:
+            return
+        self._done_printed = True
+        elapsed = getattr(self, "_elapsed_at_finish", self.elapsed)
+        t = f"{elapsed:.1f}s" if elapsed < 60 else f"{elapsed / 60:.1f}m"
+        prefix = "[ask] " if self._line_mode else "✓ "
+        try:
+            sys.stderr.write(f"{prefix}done ({t})\n")
+            sys.stderr.flush()
+        except Exception:
+            pass
+
+    def _loop(self) -> None:
+        idx = 0
+        interval = self._interval if self._line_mode else 0.08
+        while not self._stop_event.wait(timeout=interval):
+            frame = _FRAMES[idx % len(_FRAMES)]
+            elapsed = time.monotonic() - self._t0
+            with self._lock:
+                phase = self._phase
+            if self._line_mode:
+                t = f"{elapsed:.1f}s" if elapsed < 60 else f"{elapsed / 60:.1f}m"
+                line = f"[ask] progress phase={phase} elapsed={t}\n"
+            else:
+                line = f"\r{frame} {phase} ({elapsed:.1f}s)"
+            try:
+                sys.stderr.write(line)
+                sys.stderr.flush()
+                self._write_failures = 0
+            except ValueError:
+                # The stream is closed — the run is ending. Nothing to retry.
+                break
+            except Exception:
+                # C3-56: a single failed write used to end the heartbeat for the
+                # rest of the run, and the operator's only remaining way to tell
+                # work from a hang was reading the worker's CPU time. One bad
+                # write is not evidence that the next one fails: on Windows a
+                # redirected stderr can reject a write transiently. Give up only
+                # when the stream refuses repeatedly.
+                self._write_failures += 1
+                if self._write_failures >= _MAX_WRITE_FAILURES:
+                    break
+                continue
+            idx += 1

{sourcecode-4.10.4 → sourcecode-4.10.5}/src/sourcecode/repository_ir.py

@@ -21,7 +21,7 @@ import subprocess
 from collections import deque
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Iterable, Optional
+from typing import Any, Iterable, Iterator, Optional
 
 from sourcecode.caller_metrics import CALLER_METRIC_RECONCILIATION, caller_classes
 from sourcecode.degradation import cap_effect as _cap_effect
@@ -5634,6 +5634,43 @@ _VENDOR_DIRS: frozenset[str] = frozenset({
     "generated-resources",
 })
 
+#: Metadata trees that hold no repository source at all. Kept apart from
+#: `_VENDOR_DIRS` because that set answers "is this file part of the product";
+#: this one answers "is there anything here worth opening". `.git` alone holds
+#: 5 542 loose objects in this repository, and every unpruned `rglob` visits
+#: every one of them.
+_METADATA_DIRS: frozenset[str] = frozenset({
+    ".git", ".hg", ".svn", ".idea", ".vscode", "__pycache__",
+})
+
+#: One ignore set for every tree walk that is looking for source (C3-64). A
+#: second, hand-kept list beside this one is how two surfaces come to disagree
+#: about what counts as source.
+PRUNED_TREE_DIRS: frozenset[str] = _VENDOR_DIRS | _METADATA_DIRS
+
+
+def walk_source_tree(
+    root: Path, *, prune: frozenset[str] = PRUNED_TREE_DIRS,
+) -> "Iterator[Path]":
+    """Yield every file under `root`, never descending into a pruned directory.
+
+    `Path.rglob` has no way to skip a subtree: it walks the build output and the
+    VCS metadata and then filters by name, so the cost of a scan is set by what
+    the build wrote rather than by what the developer did. Measured on
+    openmrs-core, 47 % of all tree entries live under directories in `prune`
+    (C3-64).
+
+    Yields absolute paths, and never raises: an unreadable directory is skipped
+    the same way the previous `rglob` calls swallowed `OSError`.
+    """
+    import os
+
+    for dirpath, dirnames, filenames in os.walk(root, onerror=lambda _e: None):
+        dirnames[:] = [d for d in dirnames if d not in prune]
+        base = Path(dirpath)
+        for name in filenames:
+            yield base / name
+
 
 def apply_ir_size_limits(
     ir: dict,

{sourcecode-4.10.4 → sourcecode-4.10.5}/src/sourcecode/security_config_scan.py

@@ -609,13 +609,36 @@ def scan_security_configuration(
         out.extend(_scan_commented_controls(source, rel, xml=False))
         out.extend(_scan_java(blank_java_comments(source), rel))
 
+    # C3-64 — one pruned walk for all three populations. This used to be five
+    # `rglob` calls (one per config suffix, one for descriptors, one for
+    # mappers), none of which could skip a subtree: the cost was set by the size
+    # of `target/`, `node_modules/` and `.git` rather than by the source. The
+    # ignore set is the walker's own (`repository_ir.PRUNED_TREE_DIRS`), so this
+    # surface and Java discovery cannot disagree about what is source.
+    from sourcecode.repository_ir import walk_source_tree
+
+    _walked_config: "list[str]" = []
+    descriptors: "list[str]" = []
+    mappers: "list[str]" = []
+    for path in walk_source_tree(root):
+        name = path.name
+        lower = name.lower()
+        try:
+            rel_posix = path.relative_to(root).as_posix()
+        except ValueError:
+            continue
+        if name.startswith("application") and name.endswith(_CONFIG_SUFFIXES):
+            _walked_config.append(rel_posix)
+        elif lower.endswith(".xml"):
+            # A descriptor that also ends in `Mapper.xml` stays a descriptor —
+            # the old code took the same side by subtracting one set from the other.
+            if lower in _DESCRIPTOR_NAMES or lower.endswith(_DESCRIPTOR_SUFFIXES):
+                descriptors.append(rel_posix)
+            elif name.endswith("Mapper.xml"):
+                mappers.append(rel_posix)
+
     if config_files is None:
-        config_files = []
-        for suffix in _CONFIG_SUFFIXES:
-            config_files += [
-                p.relative_to(root).as_posix()
-                for p in root.rglob(f"application*{suffix}")
-            ]
+        config_files = _walked_config
     for rel in sorted(set(config_files)):
         try:
             text = (root / rel).read_text(encoding="utf-8", errors="replace")
@@ -624,18 +647,10 @@ def scan_security_configuration(
         out.extend(_scan_commented_config_controls(text, rel))
         out.extend(_scan_config(blank_hash_comments(text), rel))
 
-    # CL-10 — the descriptors. Discovered the same way `environment_resolution`
+    # CL-10 — the descriptors. Classified the same way `environment_resolution`
     # classifies them, so the two surfaces cannot disagree about which files are
     # deployment descriptors, and a per-environment overlay tree is covered
     # because the walk finds the file wherever the build put it.
-    descriptors: "list[str]" = []
-    try:
-        for path in root.rglob("*.xml"):
-            name = path.name.lower()
-            if name in _DESCRIPTOR_NAMES or name.endswith(_DESCRIPTOR_SUFFIXES):
-                descriptors.append(path.relative_to(root).as_posix())
-    except OSError:
-        pass
     for rel in sorted(set(descriptors)):
         try:
             text = (root / rel).read_text(encoding="utf-8", errors="replace")
@@ -644,13 +659,6 @@ def scan_security_configuration(
         out.extend(_scan_commented_controls(text, rel, xml=True))
         out.extend(_scan_descriptor(blank_xml_comments(text), rel))
 
-    mappers: "list[str]" = []
-    try:
-        for path in root.rglob("*.xml"):
-            if path.name.endswith("Mapper.xml"):
-                mappers.append(path.relative_to(root).as_posix())
-    except OSError:
-        pass
     for rel in sorted(set(mappers) - set(descriptors)):
         try:
             text = (root / rel).read_text(encoding="utf-8", errors="replace")