sourcecode 5.5.1__tar.gz → 5.5.4__tar.gz

{sourcecode-5.5.1 → sourcecode-5.5.4}/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 ## [Unreleased]
 
+## [5.5.4] — 2026-08-13
+
+**Re-audit performance and HTTP contract corrections.**
+
+### Fixed
+- Consolidated repeated XML and configuration traversals in `endpoints`; servlet
+  discovery now uses a pruned walk or the inventories already computed by the
+  endpoint analysis.
+- Parsed braced Spring `RequestMethod` declarations and expose complete
+  `methods` lists while retaining the backwards-compatible primary `method`.
+- Verified that atomic `--output` replacement produced the requested destination
+  before recording the run as successful.
+
+### Documentation
+- Documented `ANY` semantics and synchronized the defect ledger, roadmap, and
+  atomic audit-fix commits. The reported CLI alias discrepancy was not
+  reproducible against the public command signatures.
+
+## [5.5.3] — 2026-08-13
+
+**Audit regression fixes and diagnostic output.**
+
+### Fixed
+- Restored bounded default `spring-audit` stdout while preserving complete
+  reports through `--output`.
+- Added depth, provenance, unit declarations, and hub-excluded reach to
+  `impact` for service-locator architectures.
+- Hardened `web.xml` mapping extraction for legacy descriptors and consecutive
+  mappings, without activating commented mappings.
+- Published root timing metadata and reused content-addressed manifest analysis.
+- Made excluded test-source route counts explicit in endpoint output.
+
+### Documentation
+- Updated the roadmap with the 5.5.2 audit follow-up, deduplicated against
+  previous defect entries and linked to atomic fix commits.
+
+## [5.5.2] — 2026-08-13
+
+**Follow-up audit corrections and performance visibility.**
+
+### Fixed
+- `endpoints --include-tests` now admits test-suite `src/main` sources while
+  preserving the production default and its exclusion evidence.
+- `impact` publishes caller provenance and a hub-excluded reach axis instead of
+  presenting service-locator expansion as an undifferentiated repository total.
+- Servlet populations use one unique URL-pattern authority with reconciled
+  declaration counts.
+- Manifest dependency analysis is content-addressed and root output publishes
+  timing layers, including manifest cost.
+- `risk` stdout and `migrate-check --compact` deduplicate invariant rule prose;
+  full reports remain available through `-o`.
+
+### Documentation
+- Consolidated the two follow-up audits in the roadmap without duplicating the
+  already resolved 5.5.0 defect entries.
+
 ## [5.5.1] — 2026-08-13
 
 **External audit corrections and command execution performance.**

{sourcecode-5.5.1 → sourcecode-5.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.5.1
+Version: 5.5.4
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.1-blue)
+![Version](https://img.shields.io/badge/version-5.5.4-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.1 — and, on a build that has aged,
+ask version                    # ask 5.5.4 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.1 → sourcecode-5.5.4}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.1-blue)
+![Version](https://img.shields.io/badge/version-5.5.4-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.1 — and, on a build that has aged,
+ask version                    # ask 5.5.4 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.1 → sourcecode-5.5.4}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,17 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ---
 
+## Audit synchronization
+
+| ID | Defect | Found | Severity | Status |
+|---|---|---|---|---|
+| AS-01 | `risk`/`enrich` could omit `sql_taint.bounded_interpolations`, making `sinks_total` impossible to audit against its bounded evidence. | 5.4.2 re-audit | Medium | **closed 5.4.2** — both projections preserve the bounded rows; the paired fixture asserts the sink total and the retained bounded interpolation. |
+| AS-02 | Route projection emitted declarations from abstract Spring controllers, creating phantom routes and inflating the unprotected census. | 5.4.2 re-audit | Low | **closed 5.4.2** — abstract declarers are excluded while concrete subtype projection remains admitted; the route-surface regression covers both sides. |
+| AS-03 | The distributed ledger could leave `C3-123` open after the 5.4.1 build already excluded static assets. | 5.4.2 re-audit | Informational | **closed 5.4.2** — the stale state was synchronized to the wheel it documents. |
+| AS-04 | An unconstrained `@RequestMapping` was described by consumers as GET although Spring admits every verb. | 5.5.1 audit | Medium | **closed 5.5.1** — primary `method` is `ANY`; 5.5.4 adds the concrete `methods` list so consumers do not need to infer its expansion. |
+
+---
+
 ## Class C1 — One fact, two authorities
 
 | ID | Defect | Found | Severity | Status |

{sourcecode-5.5.1 → sourcecode-5.5.4}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.5.1
+# ask 5.5.4
 ```
 
 Requires Python 3.9+.
@@ -261,7 +261,13 @@ ask endpoints /path/to/repo
 ask endpoints . --format yaml
 ```
 
-Output: list of `{method, path, controller, handler}`. Covers `@GetMapping`, `@PostMapping`, `@PutMapping`, `@DeleteMapping`, `@PatchMapping`, `@RequestMapping`, `@GET`, `@POST`, `@PUT`, `@DELETE`, `@PATCH` + `@Path`.
+Output: list of `{method, methods, path, controller, handler}`. `method` remains
+the backwards-compatible primary verb; `methods` is the complete declared set.
+An unconstrained `@RequestMapping` reports `method: "ANY"` and
+`methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]`, because it accepts all
+of those verbs rather than defaulting to GET. Covers `@GetMapping`, `@PostMapping`,
+`@PutMapping`, `@DeleteMapping`, `@PatchMapping`, `@RequestMapping`, `@GET`,
+`@POST`, `@PUT`, `@DELETE`, `@PATCH` + `@Path`.
 
 Each endpoint carries a `security` policy. Standard annotations (`@PreAuthorize`, `@Secured`, `@RolesAllowed`, …) are recognized automatically; a custom authorization annotation reports `policy: "none_detected"` until declared in a `sourcecode.config.json` at the repo root:
 

{sourcecode-5.5.1 → sourcecode-5.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.5.1"
+version = "5.5.4"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.5.1 → sourcecode-5.5.4}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.5.1"
+__version__ = "5.5.4"

{sourcecode-5.5.1 → sourcecode-5.5.4}/src/sourcecode/cli.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import contextlib
+import errno
 import hashlib
 import json
 import difflib
@@ -1196,6 +1197,15 @@ def _safe_write_file(path: "Path", content: str) -> None:
             fh.flush()
             os.fsync(fh.fileno())
         tmp.replace(path)
+        # Atomic replacement alone does not prove that the destination is the
+        # requested artifact. Verify the postcondition before reporting a run
+        # output path, especially for non-empty JSON reports.
+        if not path.is_file() or (content and path.stat().st_size == 0):
+            raise OSError(
+                errno.EIO,
+                "atomic output replacement did not produce the requested file",
+                str(path),
+            )
         try:
             dir_fd = os.open(str(path.parent), os.O_RDONLY)
             try:
@@ -3125,6 +3135,7 @@ def main(
         raise typer.Exit()
 
     _t0 = time.monotonic()
+    _root_timing: dict[str, float] = {}
     no_tree: bool = False  # set True by --agent; --no-tree flag removed
 
     # Validate new flag choices
@@ -3947,6 +3958,7 @@ def main(
         if _advisory:
             typer.echo(_advisory, err=True)
 
+    _manifest_t0 = time.perf_counter()
     _perf_detection = perf.start()
     detector = ProjectDetector(build_default_detectors())
     workspace_analysis = WorkspaceAnalyzer().analyze(target, manifests)
@@ -4007,6 +4019,7 @@ def main(
         root_dependencies, root_summary = dependency_analyzer.analyze(target)
         dependency_records.extend(root_dependencies)
         dependency_summaries.append(root_summary)
+    _root_timing["manifests_ms"] = round((time.perf_counter() - _manifest_t0) * 1000, 2)
     module_graphs = []
     if graph_analyzer is not None:
         root_graph_tree = (
@@ -4652,6 +4665,13 @@ def main(
                 )
 
     perf.stop("analysis", _perf_analysis)
+    # Root timings are deliberately a small diagnostic envelope. They make cold
+    # manifest cost visible even when the optional perf recorder is disabled.
+    _root_timing.setdefault("context_ms", round((time.monotonic() - _t0) * 1000, 2))
+    _root_timing.setdefault("parse_ms", 0.0)
+    _root_timing.setdefault("cir_ms", 0.0)
+    _root_timing.setdefault("ris_ms", 0.0)
+    _root_timing.setdefault("snapshot_ms", 0.0)
     # 4. Serialize
     _progress.update("serializing output")
     _perf_serialize = perf.start()
@@ -4697,8 +4717,16 @@ def main(
         raw_dict = standard_view(sm, include_tree=tree and not no_tree)
         if not no_redact:
             raw_dict = redact_dict(raw_dict)
+        data = raw_dict
         content = _serialize_dict(raw_dict, format)
 
+    if isinstance(data, dict):
+        data.setdefault("_meta", {})["timing_ms"] = {
+            **_root_timing,
+            "total_ms": round((time.monotonic() - _t0) * 1000, 2),
+        }
+        content = _serialize_dict(data, format)
+
     perf.stop("serialize", _perf_serialize)
     perf.flush_recorder()
 
@@ -9221,6 +9249,17 @@ def spring_audit_cmd(
     elif format == "github-comment":
         output = _render_spring_audit_github_comment(combined, min_severity)
     else:
+        _bounded_default = (
+            not compact and output_path is None and format == "json" and not table
+        )
+        data = (
+            combined.to_compact_dict()
+            if compact or _bounded_default
+            else combined.to_dict()
+        )
+        if _bounded_default:
+            data.pop("mode", None)
+            data["default_output"] = "bounded"
         output = _serialize_dict(data, format)
 
     # F-AV: our own readers ask for the count under either spelling — the break
@@ -9808,6 +9847,9 @@ def risk_cmd(
             data, rule_filter=rule_filter, band_filter=band_filter, top_n=top_n
         )
     else:
+        if output_path is None:
+            from sourcecode.risk import compact_risk_output
+            data = compact_risk_output(data)
         output = _serialize_dict(data, format)
     _emit_command_output(
         output,

{sourcecode-5.5.1 → sourcecode-5.5.4}/src/sourcecode/dependency_analyzer.py

@@ -162,6 +162,15 @@ class DependencyAnalyzer:
         *,
         workspace: str | None = None,
     ) -> tuple[list[DependencyRecord], DependencySummary]:
+        from sourcecode import manifest_cache
+
+        cached = manifest_cache.load(root)
+        if cached is not None:
+            records, summary = cached
+            if workspace is not None:
+                records = [replace(record, workspace=workspace) for record in records]
+                summary = replace(summary, dependencies=records)
+            return records, summary
         records: list[DependencyRecord] = []
         limitations: list[str] = []
 
@@ -185,7 +194,12 @@ class DependencyAnalyzer:
             replace(r, role=_infer_role(r.name, r.ecosystem, r.scope))
             for r in deduped
         ]
-        return deduped, self._build_summary(deduped, limitations)
+        summary = self._build_summary(deduped, limitations)
+        manifest_cache.save(root, deduped, summary)
+        if workspace is not None:
+            deduped = [replace(record, workspace=workspace) for record in deduped]
+            summary = replace(summary, dependencies=deduped)
+        return deduped, summary
 
     def merge_summaries(self, summaries: Iterable[DependencySummary]) -> DependencySummary:
         result = DependencySummary(requested=True)

{sourcecode-5.5.1 → sourcecode-5.5.4}/src/sourcecode/deployment_prefix.py

@@ -23,7 +23,7 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Iterable, Optional
 
 # Published Spring Boot property keys (DATA — never a predicate on a repo name).
 _CONTEXT_PATH_KEYS: tuple[str, ...] = (
@@ -163,25 +163,31 @@ def _profile_of_document(flat: "dict[str, str]", file_profile: Optional[str]) ->
     return file_profile
 
 
-def _config_files(root: Path) -> "list[Path]":
+def _config_files(root: Path, files: Optional[Iterable[Path]] = None) -> "list[Path]":
     """Spring config files under conventional resource directories.
 
     Bounded and sorted for determinism; test resources are excluded because a
     prefix declared for tests is not the deployed one.
     """
+    candidates = files if files is not None else root.rglob("application*.*")
     found: list[Path] = []
-    for pattern in ("**/src/main/resources/**/application*.*", "**/config/application*.*"):
-        for path in root.glob(pattern):
-            name = path.name
-            if name in _CONFIG_BASENAMES or _PROFILE_FILE_RE.match(name):
-                text = str(path).replace("\\", "/")
-                if "/src/test/" in text or "/target/" in text:
-                    continue
-                found.append(path)
+    for path in candidates:
+        path = Path(path)
+        name = path.name
+        if name not in _CONFIG_BASENAMES and not _PROFILE_FILE_RE.match(name):
+            continue
+        text = str(path).replace("\\", "/")
+        in_resources = "/src/main/resources/" in text
+        in_config = "/config/" in text
+        if not (in_resources or in_config) or "/src/test/" in text or "/target/" in text:
+            continue
+        found.append(path)
     return sorted(set(found))[:60]
 
 
-def detect_deployment_prefix(root: Path) -> DeploymentPrefix:
+def detect_deployment_prefix(
+    root: Path, *, files: Optional[Iterable[Path]] = None
+) -> DeploymentPrefix:
     """Read the deployment prefix from the repo's Spring configuration.
 
     Best effort and never raises: an unreadable or malformed config yields an
@@ -190,7 +196,7 @@ def detect_deployment_prefix(root: Path) -> DeploymentPrefix:
     """
     result = DeploymentPrefix()
     try:
-        candidates = _config_files(Path(root))
+        candidates = _config_files(Path(root), files)
     except Exception:
         return result
 

sourcecode-5.5.4/src/sourcecode/manifest_cache.py

@@ -0,0 +1,62 @@
+"""Content-addressed cache for manifest dependency analysis."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from dataclasses import asdict
+from pathlib import Path
+
+from sourcecode.schema import DependencyRecord, DependencySummary
+
+
+def _base() -> Path:
+    configured = os.environ.get("SOURCECODE_CACHE_DIR", "")
+    return Path(configured) if configured else Path.home() / ".sourcecode" / "cache"
+
+
+def _key(root: Path) -> str:
+    digest = hashlib.sha256()
+    analyzer = Path(__file__).with_name("dependency_analyzer.py")
+    digest.update(analyzer.read_bytes())
+    names = {
+        "pom.xml", "build.gradle", "build.gradle.kts", "package.json",
+        "package-lock.json", "pyproject.toml", "Cargo.toml", "go.mod",
+        "composer.json", "Gemfile",
+    }
+    paths: set[Path] = set()
+    for name in names:
+        paths.update(root.rglob(name))
+    for path in sorted(paths):
+        if not path.is_file():
+            continue
+        try:
+            digest.update(path.relative_to(root).as_posix().encode())
+            digest.update(path.read_bytes())
+        except OSError:
+            continue
+    return digest.hexdigest()
+
+
+def load(root: Path) -> tuple[list[DependencyRecord], DependencySummary] | None:
+    try:
+        path = _base() / "manifest-cache-v1" / f"{_key(root)}.json"
+        data = json.loads(path.read_text(encoding="utf-8"))
+        records = [DependencyRecord(**row) for row in data["records"]]
+        summary = DependencySummary(**data["summary"])
+        summary.dependencies = records
+        return records, summary
+    except (OSError, ValueError, KeyError, TypeError):
+        return None
+
+
+def save(root: Path, records: list[DependencyRecord], summary: DependencySummary) -> None:
+    try:
+        path = _base() / "manifest-cache-v1" / f"{_key(root)}.json"
+        path.parent.mkdir(parents=True, exist_ok=True)
+        payload = {"records": [asdict(row) for row in records], "summary": asdict(summary)}
+        tmp = path.with_suffix(".tmp")
+        tmp.write_text(json.dumps(payload, sort_keys=True), encoding="utf-8")
+        tmp.replace(path)
+    except OSError:
+        return

{sourcecode-5.5.1 → sourcecode-5.5.4}/src/sourcecode/migrate_check.py

@@ -2375,6 +2375,26 @@ class MigrationReport:
             compact, "findings", top_n,
             key=lambda f: SEVERITY_ORDER.get(f.get("severity"), 3),
         )
+        # Keep invariant rule prose once; each finding carries only location and
+        # rule identity. Full prose remains available in the non-compact report.
+        _rule_catalog: dict[str, dict] = {}
+        _lean_findings: list[dict] = []
+        for _finding in compact.get("findings", []):
+            _rule_id = _finding.get("rule_id", "unknown")
+            _rule_catalog.setdefault(_rule_id, {
+                "title": _finding.get("title", ""),
+                "explanation": _finding.get("explanation", ""),
+                "fix_hint": _finding.get("fix_hint", ""),
+            })
+            _lean_findings.append({
+                key: _finding[key]
+                for key in (
+                    "id", "rule_id", "severity", "source_file", "first_line",
+                    "migration_target", "imports_found", "code_context",
+                ) if key in _finding
+            })
+        compact["rule_catalog"] = _rule_catalog
+        compact["findings"] = _lean_findings
         hib = full.get("hibernate")
         if isinstance(hib, dict):
             h = dict(hib)