sourcecode 5.5.1__tar.gz → 5.5.2__tar.gz

{sourcecode-5.5.1 → sourcecode-5.5.2}/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [5.5.2] — 2026-08-13
+
+**Follow-up audit corrections and performance visibility.**
+
+### Fixed
+- `endpoints --include-tests` now admits test-suite `src/main` sources while
+  preserving the production default and its exclusion evidence.
+- `impact` publishes caller provenance and a hub-excluded reach axis instead of
+  presenting service-locator expansion as an undifferentiated repository total.
+- Servlet populations use one unique URL-pattern authority with reconciled
+  declaration counts.
+- Manifest dependency analysis is content-addressed and root output publishes
+  timing layers, including manifest cost.
+- `risk` stdout and `migrate-check --compact` deduplicate invariant rule prose;
+  full reports remain available through `-o`.
+
+### Documentation
+- Consolidated the two follow-up audits in the roadmap without duplicating the
+  already resolved 5.5.0 defect entries.
+
 ## [5.5.1] — 2026-08-13
 
 **External audit corrections and command execution performance.**

{sourcecode-5.5.1 → sourcecode-5.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.5.1
+Version: 5.5.2
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.1-blue)
+![Version](https://img.shields.io/badge/version-5.5.2-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.1 — and, on a build that has aged,
+ask version                    # ask 5.5.2 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.1 → sourcecode-5.5.2}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.1-blue)
+![Version](https://img.shields.io/badge/version-5.5.2-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.1 — and, on a build that has aged,
+ask version                    # ask 5.5.2 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.1 → sourcecode-5.5.2}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.5.1
+# ask 5.5.2
 ```
 
 Requires Python 3.9+.

{sourcecode-5.5.1 → sourcecode-5.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.5.1"
+version = "5.5.2"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.5.1 → sourcecode-5.5.2}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.5.1"
+__version__ = "5.5.2"

{sourcecode-5.5.1 → sourcecode-5.5.2}/src/sourcecode/cli.py

@@ -3125,6 +3125,7 @@ def main(
         raise typer.Exit()
 
     _t0 = time.monotonic()
+    _root_timing: dict[str, float] = {}
     no_tree: bool = False  # set True by --agent; --no-tree flag removed
 
     # Validate new flag choices
@@ -3947,6 +3948,7 @@ def main(
         if _advisory:
             typer.echo(_advisory, err=True)
 
+    _manifest_t0 = time.perf_counter()
     _perf_detection = perf.start()
     detector = ProjectDetector(build_default_detectors())
     workspace_analysis = WorkspaceAnalyzer().analyze(target, manifests)
@@ -4007,6 +4009,7 @@ def main(
         root_dependencies, root_summary = dependency_analyzer.analyze(target)
         dependency_records.extend(root_dependencies)
         dependency_summaries.append(root_summary)
+    _root_timing["manifests_ms"] = round((time.perf_counter() - _manifest_t0) * 1000, 2)
     module_graphs = []
     if graph_analyzer is not None:
         root_graph_tree = (
@@ -4652,6 +4655,13 @@ def main(
                 )
 
     perf.stop("analysis", _perf_analysis)
+    # Root timings are deliberately a small diagnostic envelope. They make cold
+    # manifest cost visible even when the optional perf recorder is disabled.
+    _root_timing.setdefault("context_ms", round((time.monotonic() - _t0) * 1000, 2))
+    _root_timing.setdefault("parse_ms", 0.0)
+    _root_timing.setdefault("cir_ms", 0.0)
+    _root_timing.setdefault("ris_ms", 0.0)
+    _root_timing.setdefault("snapshot_ms", 0.0)
     # 4. Serialize
     _progress.update("serializing output")
     _perf_serialize = perf.start()
@@ -4697,8 +4707,16 @@ def main(
         raw_dict = standard_view(sm, include_tree=tree and not no_tree)
         if not no_redact:
             raw_dict = redact_dict(raw_dict)
+        data = raw_dict
         content = _serialize_dict(raw_dict, format)
 
+    if isinstance(data, dict):
+        data.setdefault("_meta", {})["timing_ms"] = {
+            **_root_timing,
+            "total_ms": round((time.monotonic() - _t0) * 1000, 2),
+        }
+        content = _serialize_dict(data, format)
+
     perf.stop("serialize", _perf_serialize)
     perf.flush_recorder()
 
@@ -9221,6 +9239,7 @@ def spring_audit_cmd(
     elif format == "github-comment":
         output = _render_spring_audit_github_comment(combined, min_severity)
     else:
+        data = combined.to_compact_dict() if compact else combined.to_dict()
         output = _serialize_dict(data, format)
 
     # F-AV: our own readers ask for the count under either spelling — the break
@@ -9808,6 +9827,9 @@ def risk_cmd(
             data, rule_filter=rule_filter, band_filter=band_filter, top_n=top_n
         )
     else:
+        if output_path is None:
+            from sourcecode.risk import compact_risk_output
+            data = compact_risk_output(data)
         output = _serialize_dict(data, format)
     _emit_command_output(
         output,

{sourcecode-5.5.1 → sourcecode-5.5.2}/src/sourcecode/dependency_analyzer.py

@@ -162,6 +162,15 @@ class DependencyAnalyzer:
         *,
         workspace: str | None = None,
     ) -> tuple[list[DependencyRecord], DependencySummary]:
+        from sourcecode import manifest_cache
+
+        cached = manifest_cache.load(root)
+        if cached is not None:
+            records, summary = cached
+            if workspace is not None:
+                records = [replace(record, workspace=workspace) for record in records]
+                summary = replace(summary, dependencies=records)
+            return records, summary
         records: list[DependencyRecord] = []
         limitations: list[str] = []
 
@@ -185,7 +194,12 @@ class DependencyAnalyzer:
             replace(r, role=_infer_role(r.name, r.ecosystem, r.scope))
             for r in deduped
         ]
-        return deduped, self._build_summary(deduped, limitations)
+        summary = self._build_summary(deduped, limitations)
+        manifest_cache.save(root, deduped, summary)
+        if workspace is not None:
+            deduped = [replace(record, workspace=workspace) for record in deduped]
+            summary = replace(summary, dependencies=deduped)
+        return deduped, summary
 
     def merge_summaries(self, summaries: Iterable[DependencySummary]) -> DependencySummary:
         result = DependencySummary(requested=True)

sourcecode-5.5.2/src/sourcecode/manifest_cache.py

@@ -0,0 +1,62 @@
+"""Content-addressed cache for manifest dependency analysis."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from dataclasses import asdict
+from pathlib import Path
+
+from sourcecode.schema import DependencyRecord, DependencySummary
+
+
+def _base() -> Path:
+    configured = os.environ.get("SOURCECODE_CACHE_DIR", "")
+    return Path(configured) if configured else Path.home() / ".sourcecode" / "cache"
+
+
+def _key(root: Path) -> str:
+    digest = hashlib.sha256()
+    analyzer = Path(__file__).with_name("dependency_analyzer.py")
+    digest.update(analyzer.read_bytes())
+    names = {
+        "pom.xml", "build.gradle", "build.gradle.kts", "package.json",
+        "package-lock.json", "pyproject.toml", "Cargo.toml", "go.mod",
+        "composer.json", "Gemfile",
+    }
+    paths: set[Path] = set()
+    for name in names:
+        paths.update(root.rglob(name))
+    for path in sorted(paths):
+        if not path.is_file():
+            continue
+        try:
+            digest.update(path.relative_to(root).as_posix().encode())
+            digest.update(path.read_bytes())
+        except OSError:
+            continue
+    return digest.hexdigest()
+
+
+def load(root: Path) -> tuple[list[DependencyRecord], DependencySummary] | None:
+    try:
+        path = _base() / "manifest-cache-v1" / f"{_key(root)}.json"
+        data = json.loads(path.read_text(encoding="utf-8"))
+        records = [DependencyRecord(**row) for row in data["records"]]
+        summary = DependencySummary(**data["summary"])
+        summary.dependencies = records
+        return records, summary
+    except (OSError, ValueError, KeyError, TypeError):
+        return None
+
+
+def save(root: Path, records: list[DependencyRecord], summary: DependencySummary) -> None:
+    try:
+        path = _base() / "manifest-cache-v1" / f"{_key(root)}.json"
+        path.parent.mkdir(parents=True, exist_ok=True)
+        payload = {"records": [asdict(row) for row in records], "summary": asdict(summary)}
+        tmp = path.with_suffix(".tmp")
+        tmp.write_text(json.dumps(payload, sort_keys=True), encoding="utf-8")
+        tmp.replace(path)
+    except OSError:
+        return

{sourcecode-5.5.1 → sourcecode-5.5.2}/src/sourcecode/migrate_check.py

@@ -2375,6 +2375,26 @@ class MigrationReport:
             compact, "findings", top_n,
             key=lambda f: SEVERITY_ORDER.get(f.get("severity"), 3),
         )
+        # Keep invariant rule prose once; each finding carries only location and
+        # rule identity. Full prose remains available in the non-compact report.
+        _rule_catalog: dict[str, dict] = {}
+        _lean_findings: list[dict] = []
+        for _finding in compact.get("findings", []):
+            _rule_id = _finding.get("rule_id", "unknown")
+            _rule_catalog.setdefault(_rule_id, {
+                "title": _finding.get("title", ""),
+                "explanation": _finding.get("explanation", ""),
+                "fix_hint": _finding.get("fix_hint", ""),
+            })
+            _lean_findings.append({
+                key: _finding[key]
+                for key in (
+                    "id", "rule_id", "severity", "source_file", "first_line",
+                    "migration_target", "imports_found", "code_context",
+                ) if key in _finding
+            })
+        compact["rule_catalog"] = _rule_catalog
+        compact["findings"] = _lean_findings
         hib = full.get("hibernate")
         if isinstance(hib, dict):
             h = dict(hib)

{sourcecode-5.5.1 → sourcecode-5.5.2}/src/sourcecode/repository_ir.py

@@ -6411,7 +6411,7 @@ def extract_java_endpoints(
 
     java_files = sorted(
         p for p in root.rglob("*.java")
-        if not is_test_source_file(_rel(p))
+        if (include_tests or not is_test_source_file(_rel(p)))
         and "target/" not in str(p).replace("\\", "/")
         and not any(f in str(p).replace("\\", "/") for f in _CLIENT_PATH_FRAGMENTS)
     )
@@ -7419,16 +7419,22 @@ def compute_blast_radius(
 
     # BFS for indirect callers
     indirect_callers: list[str] = []
+    _indirect_parent: dict[str, str] = {}
+    _hub_frontier_nodes: set[str] = set()
     visited: set[str] = set(matched_fqns) | set(direct_callers)
 
     while queue:
         node, depth = queue.pop(0)
         if depth >= _effective_depth:
             continue
-        for caller in _walk_callers(node):
+        _node_callers = _walk_callers(node)
+        if len(_node_callers) > _HUB_CALLER_THRESHOLD:
+            _hub_frontier_nodes.add(node)
+        for caller in _node_callers:
             if caller not in visited:
                 visited.add(caller)
                 all_affected[caller] = depth + 1
+                _indirect_parent[caller] = node
                 indirect_callers.append(caller)
                 queue.append((caller, depth + 1))
 
@@ -7658,6 +7664,29 @@ def compute_blast_radius(
     n_direct_classes = len(_direct_caller_classes)
     n_direct   = n_direct_symbols
     n_indirect = len(indirect_callers)
+
+    # The complete reverse walk is useful as a measured upper reach, but a
+    # service-locator hub can make it collapse to "the whole repository". Publish
+    # a second, conservative axis that stops at hub frontiers instead of forcing
+    # consumers to guess from a flat list of symbols.
+    _without_hubs: list[str] = []
+    _without_hubs_seen = set(matched_fqns) | set(direct_callers)
+    _without_hubs_queue: list[tuple[str, int]] = [
+        (c, 1) for c in direct_callers
+    ]
+    while _without_hubs_queue:
+        _node, _depth = _without_hubs_queue.pop(0)
+        if _depth >= _effective_depth:
+            continue
+        _next = _walk_callers(_node)
+        if len(_next) > _HUB_CALLER_THRESHOLD:
+            continue
+        for _caller in _next:
+            if _caller not in _without_hubs_seen:
+                _without_hubs_seen.add(_caller)
+                _without_hubs.append(_caller)
+                _without_hubs_queue.append((_caller, _depth + 1))
+
     n_ep       = len(endpoints_affected)
     n_txn      = len(txn_nodes)
     n_mappers  = len(mappers_affected)
@@ -7824,6 +7853,20 @@ def compute_blast_radius(
     _indirect_summary = (
         _indirect_ordered if _indirect_cap is None else _indirect_ordered[:_indirect_cap]
     )
+    def _via_hub(_node: str) -> bool:
+        _seen_path: set[str] = set()
+        _cursor = _node
+        while _cursor in _indirect_parent and _cursor not in _seen_path:
+            _seen_path.add(_cursor)
+            _cursor = _indirect_parent[_cursor]
+            if _cursor in _hub_frontier_nodes:
+                return True
+        return False
+
+    _indirect_details = [
+        {"fqn": _node, "depth": all_affected.get(_node), "via_hub": _via_hub(_node)}
+        for _node in _indirect_summary
+    ]
 
     out: dict = {
         "target": target,
@@ -7870,6 +7913,7 @@ def compute_blast_radius(
             else _direct_caller_symbols[:_direct_cap]
         ),
         "indirect_callers": _indirect_summary,
+        "indirect_caller_details": _indirect_details,
         "container_wired": [w.to_dict() for w in _container_wired],
         "endpoints_affected": endpoints_affected,
         "mappers_affected": mappers_affected,
@@ -7889,6 +7933,10 @@ def compute_blast_radius(
             "indirect_caller_count": n_indirect,
             "indirect_callers_computed": not _bfs_truncated or _indirect_sampled,
             "indirect_callers_sampled": _indirect_sampled,
+            "indirect_caller_count_unit": "reference symbols (methods or classes)",
+            "indirect_callers_without_hubs_count": len(_without_hubs),
+            "indirect_callers_without_hubs_unit": "reference symbols (hub frontiers excluded)",
+            "hub_frontier_count": len(_hub_frontier_nodes),
             "endpoints_affected_count": n_ep,
             # C1-37: four figures called "endpoints" at one commit (3 364 /
             # 3 382 / 3 382 / 3 574). Each one now says which population it

{sourcecode-5.5.1 → sourcecode-5.5.2}/src/sourcecode/risk.py

@@ -47,6 +47,31 @@ if TYPE_CHECKING:
 
 RISK_SCHEMA = "risk-v1"
 
+
+def compact_risk_output(data: dict) -> dict:
+    """Project stdout to stable rule prose plus small per-defect evidence."""
+    compact = dict(data)
+    rows = data.get("risks") or []
+    rules: dict[str, dict] = {}
+    lean: list[dict] = []
+    for row in rows:
+        rule_ids = row.get("rule_ids") or [row.get("rule_id", "unknown")]
+        for rule_id in rule_ids:
+            rules.setdefault(rule_id, {
+                "title": row.get("title", ""),
+                "statement": row.get("statement", ""),
+            })
+        lean.append({
+            key: row[key] for key in (
+                "defect_id", "symbol", "source_file", "first_line", "band",
+                "score", "rule_ids", "factors",
+            ) if key in row
+        })
+    compact["rules"] = rules
+    compact["risks"] = lean
+    compact["default_output"] = "bounded"
+    return compact
+
 #: The composition, in one place. The payload publishes it, `--help` renders it and
 #: the battery holds both to it: a hand-copied model line in the help screen went on
 #: advertising four factors for as long as it took someone to read it, which is the

{sourcecode-5.5.1 → sourcecode-5.5.2}/src/sourcecode/servlet_surface.py

@@ -168,9 +168,16 @@ def build_servlet_surface(root: Path, *, limit: Optional[int] = None) -> dict:
         elif path.suffix == ".java":
             mappings.extend(_from_registration_beans(path, relative))
 
-    # One URL pattern declared twice is two declarations of one reachable path; the
-    # census counts patterns, the rows keep every declaration.
-    patterns = sorted({m.url_pattern for m in mappings})
+    # A URL pattern is the observable HTTP surface. Multiple descriptors can
+    # repeat it, but publishing every duplicate made `declarations` disagree with
+    # the pattern census and with endpoint-side reconciliation. Keep the first
+    # deterministic declaration as provenance and expose one row per reachable
+    # pattern.
+    _unique: dict[str, ServletMapping] = {}
+    for mapping in sorted(mappings, key=lambda m: (m.url_pattern, m.source_file, m.source)):
+        _unique.setdefault(mapping.url_pattern, mapping)
+    mappings = list(_unique.values())
+    patterns = sorted(_unique)
     by_source: "dict[str, int]" = {}
     for mapping in mappings:
         by_source[mapping.source] = by_source.get(mapping.source, 0) + 1