sourcecode 5.5.0__tar.gz → 5.5.2__tar.gz

{sourcecode-5.5.0 → sourcecode-5.5.2}/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 ## [Unreleased]
 
+## [5.5.2] — 2026-08-13
+
+**Follow-up audit corrections and performance visibility.**
+
+### Fixed
+- `endpoints --include-tests` now admits test-suite `src/main` sources while
+  preserving the production default and its exclusion evidence.
+- `impact` publishes caller provenance and a hub-excluded reach axis instead of
+  presenting service-locator expansion as an undifferentiated repository total.
+- Servlet populations use one unique URL-pattern authority with reconciled
+  declaration counts.
+- Manifest dependency analysis is content-addressed and root output publishes
+  timing layers, including manifest cost.
+- `risk` stdout and `migrate-check --compact` deduplicate invariant rule prose;
+  full reports remain available through `-o`.
+
+### Documentation
+- Consolidated the two follow-up audits in the roadmap without duplicating the
+  already resolved 5.5.0 defect entries.
+
+## [5.5.1] — 2026-08-13
+
+**External audit corrections and command execution performance.**
+
+### Fixed
+- **Impact callers** now expand accessor and interface frontiers consistently,
+  with caller symbols remaining a refinement of caller classes.
+- **Endpoint and validation contracts** now expose test-surface policy, reuse
+  servlet declarations, and require real `Validator`/`setValidator` evidence.
+- **Modernization references** now recognize nested types used by their
+  enclosing class.
+- **Spring audit output** is bounded by default while explicit full output
+  remains available through `--output` and `--compact`.
+- **Repeated command execution** reuses the cached analysis context and reports
+  independent cache-layer states for context, parse, snapshot, and RIS.
+
+### Documentation
+- Closed the 2026-08-13 external audit backlog in the roadmap with fix hashes
+  and regression coverage.
+
 ## [5.5.0] — 2026-08-12
 
 **Audit backlog resolved and performance signals made explicit.**

{sourcecode-5.5.0 → sourcecode-5.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.5.0
+Version: 5.5.2
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.0-blue)
+![Version](https://img.shields.io/badge/version-5.5.2-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.0 — and, on a build that has aged,
+ask version                    # ask 5.5.2 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.0 → sourcecode-5.5.2}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.0-blue)
+![Version](https://img.shields.io/badge/version-5.5.2-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.0 — and, on a build that has aged,
+ask version                    # ask 5.5.2 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.0 → sourcecode-5.5.2}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.5.0
+# ask 5.5.2
 ```
 
 Requires Python 3.9+.

{sourcecode-5.5.0 → sourcecode-5.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.5.0"
+version = "5.5.2"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.5.0 → sourcecode-5.5.2}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.5.0"
+__version__ = "5.5.2"

{sourcecode-5.5.0 → sourcecode-5.5.2}/src/sourcecode/cli.py

@@ -3125,6 +3125,7 @@ def main(
         raise typer.Exit()
 
     _t0 = time.monotonic()
+    _root_timing: dict[str, float] = {}
     no_tree: bool = False  # set True by --agent; --no-tree flag removed
 
     # Validate new flag choices
@@ -3457,6 +3458,9 @@ def main(
     _core_hash = ""
     _core_flags_str = ""
     _view_flags_str = ""
+    # Reuse the freshness decision for cache metadata; otherwise the root
+    # command repeats a full Git status walk after the analysis completes.
+    _tree_is_dirty: Optional[bool] = None
 
     if not no_cache:
         try:
@@ -3506,6 +3510,8 @@ def main(
                 Path(_git_root_str) if _git_root_str else target,
                 scope=target,
             )
+            if _tree_sig and _git_sha:
+                _tree_is_dirty = _tree_sig != _git_sha
             if _tree_sig:
                 _core_key = f"{_tree_sig}-{_core_h}"
             else:
@@ -3821,7 +3827,11 @@ def main(
             if format == "json":
                 try:
                     from sourcecode.ris import _has_uncommitted_changes as _huc
-                    _uncommitted = _huc(target)
+                    _uncommitted = (
+                        _tree_is_dirty
+                        if _tree_is_dirty is not None
+                        else _huc(target)
+                    )
                 except Exception:
                     _uncommitted = False
                 _data_scope = "COMPACT" if compact else ("AGENT" if agent else "FULL")
@@ -3938,6 +3948,7 @@ def main(
         if _advisory:
             typer.echo(_advisory, err=True)
 
+    _manifest_t0 = time.perf_counter()
     _perf_detection = perf.start()
     detector = ProjectDetector(build_default_detectors())
     workspace_analysis = WorkspaceAnalyzer().analyze(target, manifests)
@@ -3998,6 +4009,7 @@ def main(
         root_dependencies, root_summary = dependency_analyzer.analyze(target)
         dependency_records.extend(root_dependencies)
         dependency_summaries.append(root_summary)
+    _root_timing["manifests_ms"] = round((time.perf_counter() - _manifest_t0) * 1000, 2)
     module_graphs = []
     if graph_analyzer is not None:
         root_graph_tree = (
@@ -4643,6 +4655,13 @@ def main(
                 )
 
     perf.stop("analysis", _perf_analysis)
+    # Root timings are deliberately a small diagnostic envelope. They make cold
+    # manifest cost visible even when the optional perf recorder is disabled.
+    _root_timing.setdefault("context_ms", round((time.monotonic() - _t0) * 1000, 2))
+    _root_timing.setdefault("parse_ms", 0.0)
+    _root_timing.setdefault("cir_ms", 0.0)
+    _root_timing.setdefault("ris_ms", 0.0)
+    _root_timing.setdefault("snapshot_ms", 0.0)
     # 4. Serialize
     _progress.update("serializing output")
     _perf_serialize = perf.start()
@@ -4688,8 +4707,16 @@ def main(
         raw_dict = standard_view(sm, include_tree=tree and not no_tree)
         if not no_redact:
             raw_dict = redact_dict(raw_dict)
+        data = raw_dict
         content = _serialize_dict(raw_dict, format)
 
+    if isinstance(data, dict):
+        data.setdefault("_meta", {})["timing_ms"] = {
+            **_root_timing,
+            "total_ms": round((time.monotonic() - _t0) * 1000, 2),
+        }
+        content = _serialize_dict(data, format)
+
     perf.stop("serialize", _perf_serialize)
     perf.flush_recorder()
 
@@ -4717,7 +4744,11 @@ def main(
     if format == "json":
         try:
             from sourcecode.ris import _has_uncommitted_changes as _huc_fresh
-            _uncommitted_fresh = _huc_fresh(target)
+            _uncommitted_fresh = (
+                _tree_is_dirty
+                if _tree_is_dirty is not None
+                else _huc_fresh(target)
+            )
             # _huc_fresh uses --untracked-files=no — it misses repos where all
             # files are untracked (no staged/unstaged changes to tracked files).
             # Promote to True when _allowed_changed_files contains untracked files.
@@ -6503,6 +6534,10 @@ def endpoints_cmd(
              "the endpoint count, and the endpoint total is carried across as one "
              "number rather than 3 500 rows.",
     ),
+    include_tests: bool = typer.Option(
+        False, "--include-tests",
+        help="Include endpoints from test source and test-fixture modules; excluded by default.",
+    ),
     client_usage: bool = typer.Option(
         False, "--client-usage",
         help="Join the routes against the HTTP calls written in the TypeScript/"
@@ -6563,7 +6598,7 @@ def endpoints_cmd(
     _prog = Progress()
     _prog.start("scanning endpoints")
     try:
-        data = _extract_java_endpoints(target)
+        data = _extract_java_endpoints(target, include_tests=include_tests)
     finally:
         _prog.finish()
 
@@ -8989,9 +9024,26 @@ def spring_audit_cmd(
             # 9,53 s on a 1 303-file repository) and it is the same parse the other
             # knowledge commands share, so it is fetched rather than rebuilt — which
             # is what makes a warm worth anything here (cold == warm before C3-94).
-            cir = _ctxcache.shared_cir(
-                target, file_list, progress=_work_sink(_prog)
+            _repo_root = _ctxcache.repo_root_of(target)
+            cir, _cir_lookup = _ctxcache.get_or_build_cir(
+                _repo_root, target, file_list, progress=_work_sink(_prog)
             )
+            _cache_state = {
+                "context": "warm" if _cir_lookup.hit else "cold",
+                "parse": "warm" if _cir_lookup.hit else "cold",
+            }
+            try:
+                from sourcecode import cache as _cache_state_mod
+                _cache_status = _cache_state_mod.status(target)
+                _cache_state["snapshot"] = (
+                    "warm" if _cache_status.get("cached_cores") else "cold"
+                )
+                _cache_state["ris"] = (
+                    "warm" if _cache_status.get("ris_exists") else "cold"
+                )
+            except Exception:
+                _cache_state["snapshot"] = "unknown"
+                _cache_state["ris"] = "unknown"
             # C3-85: the stretch between the last `linking` tick and the first rule
             # tick reports nothing, and what stays on the line is `n/n` — a counter
             # that finished, reading as a stage still running. Measured on keycloak
@@ -9142,7 +9194,18 @@ def spring_audit_cmd(
                         "phase that never ran is not evidence there is none."
                     )
 
-            data = combined.to_compact_dict() if compact else combined.to_dict()
+            _bounded_default = (
+                not compact and output_path is None and format == "json" and not table
+            )
+            data = (
+                combined.to_compact_dict()
+                if compact or _bounded_default
+                else combined.to_dict()
+            )
+            if _bounded_default:
+                data.pop("mode", None)
+                data["default_output"] = "bounded"
+            data.setdefault("metadata", {})["cache_layers"] = _cache_state
             if _stopped_early:
                 # C3-87: the block is composed by `PhasedRun.status`, which is the
                 # authority `risk` is now bound to as well — one vocabulary for
@@ -9176,6 +9239,7 @@ def spring_audit_cmd(
     elif format == "github-comment":
         output = _render_spring_audit_github_comment(combined, min_severity)
     else:
+        data = combined.to_compact_dict() if compact else combined.to_dict()
         output = _serialize_dict(data, format)
 
     # F-AV: our own readers ask for the count under either spelling — the break
@@ -9763,6 +9827,9 @@ def risk_cmd(
             data, rule_filter=rule_filter, band_filter=band_filter, top_n=top_n
         )
     else:
+        if output_path is None:
+            from sourcecode.risk import compact_risk_output
+            data = compact_risk_output(data)
         output = _serialize_dict(data, format)
     _emit_command_output(
         output,

{sourcecode-5.5.0 → sourcecode-5.5.2}/src/sourcecode/dependency_analyzer.py

@@ -162,6 +162,15 @@ class DependencyAnalyzer:
         *,
         workspace: str | None = None,
     ) -> tuple[list[DependencyRecord], DependencySummary]:
+        from sourcecode import manifest_cache
+
+        cached = manifest_cache.load(root)
+        if cached is not None:
+            records, summary = cached
+            if workspace is not None:
+                records = [replace(record, workspace=workspace) for record in records]
+                summary = replace(summary, dependencies=records)
+            return records, summary
         records: list[DependencyRecord] = []
         limitations: list[str] = []
 
@@ -185,7 +194,12 @@ class DependencyAnalyzer:
             replace(r, role=_infer_role(r.name, r.ecosystem, r.scope))
             for r in deduped
         ]
-        return deduped, self._build_summary(deduped, limitations)
+        summary = self._build_summary(deduped, limitations)
+        manifest_cache.save(root, deduped, summary)
+        if workspace is not None:
+            deduped = [replace(record, workspace=workspace) for record in deduped]
+            summary = replace(summary, dependencies=deduped)
+        return deduped, summary
 
     def merge_summaries(self, summaries: Iterable[DependencySummary]) -> DependencySummary:
         result = DependencySummary(requested=True)

sourcecode-5.5.2/src/sourcecode/manifest_cache.py

@@ -0,0 +1,62 @@
+"""Content-addressed cache for manifest dependency analysis."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from dataclasses import asdict
+from pathlib import Path
+
+from sourcecode.schema import DependencyRecord, DependencySummary
+
+
+def _base() -> Path:
+    configured = os.environ.get("SOURCECODE_CACHE_DIR", "")
+    return Path(configured) if configured else Path.home() / ".sourcecode" / "cache"
+
+
+def _key(root: Path) -> str:
+    digest = hashlib.sha256()
+    analyzer = Path(__file__).with_name("dependency_analyzer.py")
+    digest.update(analyzer.read_bytes())
+    names = {
+        "pom.xml", "build.gradle", "build.gradle.kts", "package.json",
+        "package-lock.json", "pyproject.toml", "Cargo.toml", "go.mod",
+        "composer.json", "Gemfile",
+    }
+    paths: set[Path] = set()
+    for name in names:
+        paths.update(root.rglob(name))
+    for path in sorted(paths):
+        if not path.is_file():
+            continue
+        try:
+            digest.update(path.relative_to(root).as_posix().encode())
+            digest.update(path.read_bytes())
+        except OSError:
+            continue
+    return digest.hexdigest()
+
+
+def load(root: Path) -> tuple[list[DependencyRecord], DependencySummary] | None:
+    try:
+        path = _base() / "manifest-cache-v1" / f"{_key(root)}.json"
+        data = json.loads(path.read_text(encoding="utf-8"))
+        records = [DependencyRecord(**row) for row in data["records"]]
+        summary = DependencySummary(**data["summary"])
+        summary.dependencies = records
+        return records, summary
+    except (OSError, ValueError, KeyError, TypeError):
+        return None
+
+
+def save(root: Path, records: list[DependencyRecord], summary: DependencySummary) -> None:
+    try:
+        path = _base() / "manifest-cache-v1" / f"{_key(root)}.json"
+        path.parent.mkdir(parents=True, exist_ok=True)
+        payload = {"records": [asdict(row) for row in records], "summary": asdict(summary)}
+        tmp = path.with_suffix(".tmp")
+        tmp.write_text(json.dumps(payload, sort_keys=True), encoding="utf-8")
+        tmp.replace(path)
+    except OSError:
+        return

{sourcecode-5.5.0 → sourcecode-5.5.2}/src/sourcecode/migrate_check.py

@@ -2375,6 +2375,26 @@ class MigrationReport:
             compact, "findings", top_n,
             key=lambda f: SEVERITY_ORDER.get(f.get("severity"), 3),
         )
+        # Keep invariant rule prose once; each finding carries only location and
+        # rule identity. Full prose remains available in the non-compact report.
+        _rule_catalog: dict[str, dict] = {}
+        _lean_findings: list[dict] = []
+        for _finding in compact.get("findings", []):
+            _rule_id = _finding.get("rule_id", "unknown")
+            _rule_catalog.setdefault(_rule_id, {
+                "title": _finding.get("title", ""),
+                "explanation": _finding.get("explanation", ""),
+                "fix_hint": _finding.get("fix_hint", ""),
+            })
+            _lean_findings.append({
+                key: _finding[key]
+                for key in (
+                    "id", "rule_id", "severity", "source_file", "first_line",
+                    "migration_target", "imports_found", "code_context",
+                ) if key in _finding
+            })
+        compact["rule_catalog"] = _rule_catalog
+        compact["findings"] = _lean_findings
         hib = full.get("hibernate")
         if isinstance(hib, dict):
             h = dict(hib)

{sourcecode-5.5.0 → sourcecode-5.5.2}/src/sourcecode/reference_facts.py

@@ -223,6 +223,18 @@ def _scan_repository(
                     for fqn in by_qualified[hit]:
                         if fqn not in nested_hits and nested[fqn][1] != rel:
                             nested_hits[fqn] = rel
+                # Nested types are often used unqualified by their enclosing
+                # class (`private Operation operation` or `Map<String, DATATYPE>`).
+                # The declaration is not a reference; a second occurrence is.
+                for fqn, (qualified, owner_file) in nested.items():
+                    if owner_file != rel or fqn in nested_hits:
+                        continue
+                    nested_name = qualified.rsplit(".", 1)[-1]
+                    unqualified = re.findall(
+                        rf"(?<!\.)\b{re.escape(nested_name)}\b", text
+                    )
+                    if len(unqualified) > 1:
+                        nested_hits[fqn] = rel
                 scan_java = len(nested_hits) < len(nested)
             if not scan_config and not scan_java:
                 return config_hits, nested_hits, literal_hits
@@ -311,7 +323,7 @@ def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
             entries.append(TypeReference(
                 status=REFERENCED,
                 basis=(
-                    f"named as a qualified nested type in {nested_hits[fqn]}"
+                    f"referenced by its enclosing source in {nested_hits[fqn]}"
                     if fqn in nested_hits
                     else f"referenced by a class literal in {literal_refs[fqn]}"
                 ),

{sourcecode-5.5.0 → sourcecode-5.5.2}/src/sourcecode/release_info.py

@@ -27,7 +27,7 @@ from typing import Any, Optional
 #: The date `__version__` was released, from that version's CHANGELOG entry.
 #: `tests/test_release_info.py` fails the build if the two disagree, so this is
 #: a copy of a fact rather than a second authority for it.
-RELEASE_DATE = "2026-08-12"
+RELEASE_DATE = "2026-08-13"
 
 #: Releases per day, measured over the 30 releases before this one (the same
 #: computation the test re-runs against the CHANGELOG). Stable across window