sourcecode 4.6.0__tar.gz → 4.8.0__tar.gz

{sourcecode-4.6.0 → sourcecode-4.8.0}/CHANGELOG.md

@@ -2,6 +2,68 @@
 
 ## [Unreleased]
 
+## [4.8.0] — 2026-08-04
+
+### Fixed
+
+- **`risk` now gives MyBatis XML findings real reach.** `SEC-008` mapper XML
+  binds to the Java mapper interface named by the XML namespace, then walks that
+  interface's callers instead of publishing manufactured zero reach.
+- **`risk` now maps deployment descriptor controls to endpoint reach.**
+  `DEAD-001` in `web.xml` reads descriptor URL patterns and reports the
+  endpoint population they cover, or an explicit unknown reach reason when the
+  descriptor scope cannot be parsed.
+- **`migrate-check` no longer scores unresolved transitive Hibernate as ready.**
+  `spring-boot-starter-data-jpa` without a resolved Hibernate version now
+  degrades to unresolved transitive evidence instead of `hibernate_readiness:
+  100`.
+- **`impact-chain` names caller-count units.** List entries, distinct symbols and
+  distinct classes are published separately so truncation warnings and metadata
+  no longer reuse one ambiguous "direct callers" phrase.
+- **Expensive semantic passes warn about repository contention.** `spring-audit`,
+  `risk`, `migrate-check` and `verify` register an advisory analysis scope and
+  warn interactive users when another expensive `ask` process is already running
+  against the same repository.
+- **Cache context stats publish lookup distributions.** `cache context-stats`
+  now includes lookup/build p50/p95 and context-layer payload sizes so cache-hit
+  cost can be budgeted instead of inferred.
+- **Cache command grammar is consistent.** `ask cache model [path]` accepts a
+  repository path like sibling cache commands.
+
+### Added
+
+- **Human-scale table triage for large audits.** `spring-audit`, `risk` and
+  `migrate-check` now support table renderers with direct filtering:
+  `--table`, `--rule`/`--only`, `--band` where applicable, and `--top-n`.
+
+### Documentation
+
+- README and user guide examples now report `4.8.0`.
+- The development roadmap records the saint-server field-evaluation fixes and
+  future feature queue.
+
+## [4.7.0] — 2026-08-04
+
+### Fixed
+
+- **`impact-chain` no longer pays a repository-wide TX + security audit by default.**
+  `impact_findings` is now opt-in with `--with-findings`, so the common query cost
+  follows the queried subgraph instead of the whole repository.
+- **`migrate-check` now separates migration blockers from broad blockers.**
+  The payload publishes `migration_blocking_count` while keeping the legacy
+  `blocking_count` for compatibility.
+- **Disabled security controls are reported explicitly.** Commented-out
+  framework security annotations now emit `DEAD-001`, and security catalog/help
+  output includes disabled-control findings.
+- **MyBatis SQL interpolation is classified as SQL-injection risk.** Mapper
+  `${...}` interpolation emits `SEC-008` instead of being treated as a generic
+  raw SQL smell.
+- **Performance claims now have endpoint-scale coverage.** The battery includes
+  a high-endpoint fixture, publishes scale dimensions, and gates unexplained
+  performance regressions against prior measurements.
+- **Framework detection covers Jersey and Governator.** Migration/readiness
+  output no longer misses those stacks when scanning mixed Java repositories.
+
 ## [4.6.0] — 2026-08-04
 
 Field evaluation #11 (7,5/10), by the evaluator who measured 4.5.2 twelve hours

{sourcecode-4.6.0 → sourcecode-4.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.6.0
+Version: 4.8.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.6.0-blue)
+![Version](https://img.shields.io/badge/version-4.8.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -97,7 +97,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.6.0 — and, on a build that has aged,
+ask version                    # ask 4.8.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -211,7 +211,7 @@ Bounded, noise-free repo context designed to drop straight into an agent's conte
 
 ### 2 · Impact Analysis
 Blast radius from a class or interface — reverse dependencies, through Spring DI, to the HTTP endpoints a change reaches.
-`ask impact` · `ask impact-chain` (TX/SEC-enriched) · `ask pr-impact`
+`ask impact` · `ask impact-chain` (blast radius; `--with-findings` for TX/SEC audit findings) · `ask pr-impact`
 → [reference](docs/USER_GUIDE.md#core-commands)
 
 ### 3 · Architecture Intelligence
@@ -306,13 +306,13 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
-| `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority |
+| `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; the same composition as `risk`, with the scanner as the severity authority |
 | `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
 | `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls |
-| `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
-| `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |
+| `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment`; `--table --rule SEC-008 --top-n 20` for human-scale review |
+| `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
 | `impact` / `impact-chain` | core | blast radius of a change, to the endpoints it reaches | target the **interface**, not the `Impl` |
 | `pr-impact` | core | the same, scoped to a PR diff | gating command: `--fail-on`, exit codes |
 | `verify` | core | does the repo satisfy its declared contracts, **relative to a baseline** | `.ask/contracts.yml`; exit 0/1/2 |
@@ -328,7 +328,7 @@ from it.
 | `retrieve` | parked | typed knowledge queries over the model | |
 | `archetype` | experimental | evidence-based architectural archetype | |
 | `rename-class` / `chunk-file` | supported | word-boundary Java rename; split a large file for an agent | |
-| `cache status\|warm\|model\|clear` · `auth` · `telemetry` · `mcp` · `config` · `version` | supported | housekeeping | `activate` too |
+| `cache status\|warm\|model\|clear` · `auth` · `telemetry` · `mcp` · `config` · `version` | supported | housekeeping | `cache model [path]` explains what a warm buys per command; `activate` too |
 
 ---
 

{sourcecode-4.6.0 → sourcecode-4.8.0}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.6.0-blue)
+![Version](https://img.shields.io/badge/version-4.8.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -59,7 +59,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.6.0 — and, on a build that has aged,
+ask version                    # ask 4.8.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -173,7 +173,7 @@ Bounded, noise-free repo context designed to drop straight into an agent's conte
 
 ### 2 · Impact Analysis
 Blast radius from a class or interface — reverse dependencies, through Spring DI, to the HTTP endpoints a change reaches.
-`ask impact` · `ask impact-chain` (TX/SEC-enriched) · `ask pr-impact`
+`ask impact` · `ask impact-chain` (blast radius; `--with-findings` for TX/SEC audit findings) · `ask pr-impact`
 → [reference](docs/USER_GUIDE.md#core-commands)
 
 ### 3 · Architecture Intelligence
@@ -268,13 +268,13 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
-| `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority |
+| `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; the same composition as `risk`, with the scanner as the severity authority |
 | `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
 | `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls |
-| `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
-| `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |
+| `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment`; `--table --rule SEC-008 --top-n 20` for human-scale review |
+| `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
 | `impact` / `impact-chain` | core | blast radius of a change, to the endpoints it reaches | target the **interface**, not the `Impl` |
 | `pr-impact` | core | the same, scoped to a PR diff | gating command: `--fail-on`, exit codes |
 | `verify` | core | does the repo satisfy its declared contracts, **relative to a baseline** | `.ask/contracts.yml`; exit 0/1/2 |
@@ -290,7 +290,7 @@ from it.
 | `retrieve` | parked | typed knowledge queries over the model | |
 | `archetype` | experimental | evidence-based architectural archetype | |
 | `rename-class` / `chunk-file` | supported | word-boundary Java rename; split a large file for an agent | |
-| `cache status\|warm\|model\|clear` · `auth` · `telemetry` · `mcp` · `config` · `version` | supported | housekeeping | `activate` too |
+| `cache status\|warm\|model\|clear` · `auth` · `telemetry` · `mcp` · `config` · `version` | supported | housekeeping | `cache model [path]` explains what a warm buys per command; `activate` too |
 
 ---
 

{sourcecode-4.6.0 → sourcecode-4.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.6.0"
+version = "4.8.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.6.0 → sourcecode-4.8.0}/scripts/perf_harness.py

@@ -201,6 +201,12 @@ def main() -> int:
     ap.add_argument("--fleet-root", type=Path, default=DEFAULT_FLEET_ROOT)
     ap.add_argument("--out", type=Path, default=None,
                     help="Output dir (default: docs/perf/baselines/<tool_version>).")
+    ap.add_argument("--compare-dir", type=Path, default=None,
+                    help="Previous perf-baseline directory to gate against.")
+    ap.add_argument("--max-regression", type=float, default=0.25,
+                    help="Allowed wall p50/p95 regression ratio before failing (default: 0.25).")
+    ap.add_argument("--allow-incomparable", action="store_true",
+                    help="Do not fail when baseline/current cells are incomparable.")
     ap.add_argument("--quick", action="store_true", help="petclinic only, 2 runs — smoke test.")
     ap.add_argument("--dry-run", action="store_true", help="Print the plan, run nothing.")
     args = ap.parse_args()
@@ -227,6 +233,7 @@ def main() -> int:
         return 0
 
     out_dir.mkdir(parents=True, exist_ok=True)
+    failures: list[tuple[str, dict]] = []
     for cmd, name, mode in plan:
         subdir = FLEET.get(name, name)
         repo_path = args.fleet_root / subdir
@@ -242,9 +249,39 @@ def main() -> int:
         fname = f"{name}__{cmd or 'ask'}__{mode}.json"
         (out_dir / fname).write_text(json.dumps(cell, indent=2) + "\n", encoding="utf-8")
         w = cell["wall_ms"]
-        print(f" p50={w['p50']}ms p95={w['p95']}ms -> {fname}")
+        gate = None
+        if args.compare_dir:
+            base_path = args.compare_dir / fname
+            if base_path.exists():
+                try:
+                    baseline = json.loads(base_path.read_text(encoding="utf-8"))
+                    gate = perf.regression_gate(
+                        baseline,
+                        cell,
+                        max_regression=args.max_regression,
+                        allow_incomparable=args.allow_incomparable,
+                    )
+                    (out_dir / f"{fname}.gate.json").write_text(
+                        json.dumps(gate, indent=2) + "\n", encoding="utf-8"
+                    )
+                    if not gate.get("passed"):
+                        failures.append((fname, gate))
+                except (OSError, ValueError) as exc:
+                    failures.append((fname, {
+                        "status": "incomparable",
+                        "passed": False,
+                        "reasons": [f"could not read baseline: {exc}"],
+                    }))
+        _gate_text = f" gate={gate['status']}" if gate else ""
+        print(f" p50={w['p50']}ms p95={w['p95']}ms{_gate_text} -> {fname}")
 
     print(f"done. artifacts in {out_dir}")
+    if failures:
+        print("perf regression gate failed:", file=sys.stderr)
+        for fname, gate in failures:
+            detail = gate.get("failed_metrics") or gate.get("reasons")
+            print(f"  {fname}: {gate.get('status')} {detail}", file=sys.stderr)
+        return 1
     return 0
 
 

{sourcecode-4.6.0 → sourcecode-4.8.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.6.0"
+__version__ = "4.8.0"