sourcecode 5.5.2__tar.gz → 5.5.5__tar.gz

{sourcecode-5.5.2 → sourcecode-5.5.5}/CHANGELOG.md

@@ -2,6 +2,67 @@
 
 ## [Unreleased]
 
+## [5.5.5] — 2026-08-13
+
+**MSAS performance-audit corrections and read-only hygiene verification.**
+
+### Fixed
+- `spring-audit` now preserves full default JSON when it fits the stdout
+  budget; only oversized answers are bounded, and the notice points to
+  `--output` for the complete report.
+- SEC-004 ignores import-only deprecated encoders and reports concrete
+  construction or factory evidence instead.
+- `pr-impact --files -` fails immediately on a terminal stdin with a pipe
+  instruction instead of waiting indefinitely.
+- `ask config` now distinguishes declared custom security annotations from
+  mechanisms inferred with Likely confidence.
+
+### Verification
+- Re-ran read-only hygiene over the `spaghetti-api` and `eureka` fixtures.
+  The commands leave their checkouts untouched; `cold-start` reports `no_ris`
+  explicitly where no semantic model is available.
+
+### Documentation
+- Recorded the MSAS findings, their reproductions, the resolved commits, and
+  the remaining bounded-output, schema, timeline, benchmark, and Git-basis
+  work in the roadmap.
+
+## [5.5.4] — 2026-08-13
+
+**Re-audit performance and HTTP contract corrections.**
+
+### Fixed
+- Consolidated repeated XML and configuration traversals in `endpoints`; servlet
+  discovery now uses a pruned walk or the inventories already computed by the
+  endpoint analysis.
+- Parsed braced Spring `RequestMethod` declarations and expose complete
+  `methods` lists while retaining the backwards-compatible primary `method`.
+- Verified that atomic `--output` replacement produced the requested destination
+  before recording the run as successful.
+
+### Documentation
+- Documented `ANY` semantics and synchronized the defect ledger, roadmap, and
+  atomic audit-fix commits. The reported CLI alias discrepancy was not
+  reproducible against the public command signatures.
+
+## [5.5.3] — 2026-08-13
+
+**Audit regression fixes and diagnostic output.**
+
+### Fixed
+- Restored bounded default `spring-audit` stdout while preserving complete
+  reports through `--output`.
+- Added depth, provenance, unit declarations, and hub-excluded reach to
+  `impact` for service-locator architectures.
+- Hardened `web.xml` mapping extraction for legacy descriptors and consecutive
+  mappings, without activating commented mappings.
+- Published root timing metadata and reused content-addressed manifest analysis.
+- Made excluded test-source route counts explicit in endpoint output.
+
+### Documentation
+- Updated the roadmap with the 5.5.2 audit follow-up, deduplicated against
+  previous defect entries and linked to atomic fix commits.
+
 ## [5.5.2] — 2026-08-13
 
 **Follow-up audit corrections and performance visibility.**

{sourcecode-5.5.2 → sourcecode-5.5.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.5.2
+Version: 5.5.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.2-blue)
+![Version](https://img.shields.io/badge/version-5.5.5-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.2 — and, on a build that has aged,
+ask version                    # ask 5.5.5 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.2 → sourcecode-5.5.5}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.2-blue)
+![Version](https://img.shields.io/badge/version-5.5.5-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.2 — and, on a build that has aged,
+ask version                    # ask 5.5.5 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.2 → sourcecode-5.5.5}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,21 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ---
 
+## Audit synchronization
+
+| ID | Defect | Found | Severity | Status |
+|---|---|---|---|---|
+| AS-01 | `risk`/`enrich` could omit `sql_taint.bounded_interpolations`, making `sinks_total` impossible to audit against its bounded evidence. | 5.4.2 re-audit | Medium | **closed 5.4.2** — both projections preserve the bounded rows; the paired fixture asserts the sink total and the retained bounded interpolation. |
+| AS-02 | Route projection emitted declarations from abstract Spring controllers, creating phantom routes and inflating the unprotected census. | 5.4.2 re-audit | Low | **closed 5.4.2** — abstract declarers are excluded while concrete subtype projection remains admitted; the route-surface regression covers both sides. |
+| AS-03 | The distributed ledger could leave `C3-123` open after the 5.4.1 build already excluded static assets. | 5.4.2 re-audit | Informational | **closed 5.4.2** — the stale state was synchronized to the wheel it documents. |
+| AS-04 | An unconstrained `@RequestMapping` was described by consumers as GET although Spring admits every verb. | 5.5.1 audit | Medium | **closed 5.5.1** — primary `method` is `ANY`; 5.5.4 adds the concrete `methods` list so consumers do not need to infer its expansion. |
+| AS-05 | Test-source endpoint exclusion was neither visible nor reversible for modules whose test code lives below `src/main`. | 5.5.1 audit | High | **closed 5.5.3** — `--include-tests` changes admission and the production answer counts exclusions; 5.5.4 recovery adds the matched path basis. |
+| AS-06 | `@InitBinder` alone was treated as evidence of programmatic validation, contaminating gaps and confidence. | 5.5.1 audit | High | **closed 5.5.1** — only a Spring `Validator` implementation or `setValidator` wiring declares the limit; 5.5.4 recovery publishes that population separately from annotation validators. |
+| AS-07 | Nested types used as field types were reported statically unreferenced by modernization. | 5.5.1 audit | Medium | **closed 5.5.1** — field-type references contribute an incoming static edge. |
+| AS-08 | `spring-audit` severity census could sum to zero beside nonzero findings. | 5.5.4 re-audit | High | **closed 5.5.4** — severity partitions reconcile to `total_findings`; this is asserted in the audit battery. |
+
+---
+
 ## Class C1 — One fact, two authorities
 
 | ID | Defect | Found | Severity | Status |
@@ -35,7 +50,7 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 | C1-13 | **Hub-guard publishes `endpoints_total: 0` instead of `unknown`.** A service with 780 callers is capped at `depth=1` for cost — defensible — but reports 0 endpoints reached, contradicting the epistemic standard the tool imposes on itself everywhere else. Hubs are precisely where blast radius is asked for | 3.2.1 (eval #4) | Medium | **closed 3.6.0** — no battery repository crosses the guard (openmrs-core's largest hub, `Context`, has 215 caller classes against a threshold of 500), so it was reproduced on a generated fixture: `bfs_truncated: true`, `depth_reached: 1`, `endpoints_affected_count: 0` beside four more zeros nothing looked for. A reach-derived count of 0 under the cap is now `null`, named in `stats.unknown_under_cap`. The distinction is the point and is asserted both ways: a **non-zero** count under the cap stays a number (it is a floor the effect block already describes), and an **uncapped** run keeps its measured zero, because converting that would be the mirror-image defect. The hub threshold moved to module level so the fixture crosses the real guard instead of a copy of its value |
 | C1-14 | **File-count drift across commands**: 3 334 / 3 337 / 3 342 / 3 374 files for one repository in one session. No command is wrong in isolation; together they cost the one thing a deterministic tool cannot lose — that its numbers agree with themselves | 3.2.1 (eval #4) | Medium | **within-document half closed 3.6.0 · cross-command half does not reproduce.** Of six commands measured on openmrs-core (`--compact`, `endpoints`, `spring-audit`, `migrate-check`, `modernize`, `validation`) only `migrate-check` publishes a scanned-file count at all, so there are no two figures left to disagree. What does reproduce is the same defect *inside one document*: `affected_files` named two populations — 265 under `summary` (every finding, any scope) against 264 under `effort_breakdown` (blocking findings only). Both correct; the shared name was the contradiction. Same remedy as C1-5: the narrower becomes `blocking_affected_files`, both carry a `_basis`, the old key stays an alias, and the battery asserts the two diverge exactly when a finding is non-blocking |
 | C1-15 | **Analysis assumes a single destination.** Asked about a JDK move, `migrate-check` answers `headline_blocker: boot3_migration` and emits fix hints that send a developer to migrate namespaces they never planned to touch (481 `javax.persistence` under MIG-001). There is no way to say "JDK 11, keep Boot 2.7" | 3.2.1 (eval #4) | **High (product)** | **closed 3.6.0** — `--target-jdk N` and `--keep-boot` say which migration is being planned, filtered over the `migration_target` vocabulary every rule already carried rather than a parallel one. Measured on openmrs-core with `--target-jdk 11 --keep-boot`, the row's own acceptance: **MIG-001 85 → 0**, blocking 114 → 0, `headline_blocker` `hibernate_rewrite` → `none_applicable`, and the Hibernate 5→6 rewrite drops with it because Hibernate 6 arrives with Boot 3. Narrowing is not silencing: `metadata.route` publishes the target, the flag and every excluded axis, a `limitations` entry states how many findings were left out and that they are unresolved rather than fixed, and the route's own blockers stay (a JDK 11 route still reports MIG-021, asserted). The default is untouched, verified identical on three repositories |
-| C1-16 | **Four fan-in figures for one class, and the note that promises the relationship is itself false.** Field: `modernize.in_degree` 1 026 / `impact-chain.direct_callers` 611 / `explain.incoming_callers` 519 / `impact.stats.direct_caller_count` 484 for one service, plus 3 222 vs 3 458 endpoints affected. **Re-measured on the battery, 3.4.0, `Money` @ BroadleafCommerce: 673 / 1 868 / 151 / 418** — `impact-chain` is absent from the published relationship and is **2,8× larger than the figure the note declares "always the largest of the three"**, while `explain` vs `impact` differ by **177 %**, not the *"small margin"* the same note promises. In the same runs `impact.stats.endpoints_affected_count: 0` against a populated `endpoints_affected` from `impact-chain` — a **false zero** on the blast-radius axis | 3.2.1 (eval #5) | **High** — this is the number a risk decision is taken with: *"¿el blast radius son 484 o 611 clases?"* | **closed 4.10.0** — the caller-axis unit fix closed in 3.5.0 (`caller_metrics.caller_classes`, unit-named figures, generated note, no `len(display_list)` in `compare`). The endpoint reach half then bound `impact`, `impact-chain` and `migrate-check --blast-radius` to `caller_reach`, crossing class→method keys and DI interface boundaries without admitting structural `implements`/`extends` edges as callers. The remaining asymmetry is now closed too: `impact` expands class/interface seeds to in-repo subtypes before BFS, using `ImplementationGraph` and a class-aware seed resolver so a base-class query reaches callers of subclass members the same way `impact-chain` does. Tests cover DI parity, endpoint count/list parity, caller-unit stability and the base-class subtype regression fixture |
+| C1-16 | **Four fan-in figures for one class, and the note that promises the relationship is itself false.** Field: `modernize.in_degree` 1 026 / `impact-chain.direct_callers` 611 / `explain.incoming_callers` 519 / `impact.stats.direct_caller_count` 484 for one service, plus 3 222 vs 3 458 endpoints affected. **Re-measured on the battery, 3.4.0, `Money` @ BroadleafCommerce: 673 / 1 868 / 151 / 418** — `impact-chain` is absent from the published relationship and is **2,8× larger than the figure the note declares "always the largest of the three"**, while `explain` vs `impact` differ by **177 %**, not the *"small margin"* the same note promises. In the same runs `impact.stats.endpoints_affected_count: 0` against a populated `endpoints_affected` from `impact-chain` — a **false zero** on the blast-radius axis | 3.2.1 (eval #5), reopened 5.5.4 | **High** — this is the number a risk decision is taken with: *"¿el blast radius son 484 o 611 clases?"* | **reopened 5.5.4.** The DI and subtype fixtures remain closed, but the claimed one-authority implementation was false for service locators: `impact` kept a local BFS that elevated `Locator#accessor` to every caller of `Locator`, while `impact-chain` used `caller_reach` and did not. 5.5.4 recovery removes that elevation and adds a two-accessor regression fixture; authority unification and cross-command parity remain open as Q-03. |
 | C1-17 | **A fact with an authority still contradicts itself across two commands**: `--compact.analysis_gaps` says *"1 test file for 3 336 Java files"* while `review-pr.test_coverage_risk.repository_has_test_sources` says `false`, in the same repository. C1-2 was closed in 3.2.1 with five consumers rebound, and this evaluation ran **on 3.2.1** | 3.2.1 (eval #5) | Medium | **does not reproduce (measured 3.6.0)** — re-measured as the row instructed. On openmrs-core, keycloak and spring-petclinic neither statement is emitted, and both consumers reach one authority: `--compact` through `analyze_test_sources`, `review-pr` through `is_test_path`. What was missing is now asserted: the authority has **two entry points** and nothing held them to each other, which is exactly the shape a sixth consumer would take. Zero mismatches across a case table including the C1-2 discriminator (a `test` package inside a *main* source root is production code), plus the literal contradiction — "N test files" and "no test sources" — asserted unreachable in both directions |
 | C1-18 | **The profile population differs per command, and the narrower one is what an agent reads.** Field: `--agent` reports a two-name profile set while `prepare-context fix-bug` reports four for the same repository in the same session — and the two names missing from the agent payload are the ones the *build* names for its deployable artefacts. Every finding about conditional security is keyed on that set, so the default agent surface answers the profile question with the population that lost the environments | 3.5.0 (eval #6) | **High** — it is the input to the one capability nothing else in the market has | **closed (unreleased)** — **fixture first, as C1-10 required**, and it reproduced worse than reported: on `tests/fixtures/spring_profile_population` the same repository in one session answered **`["qa","dev"]`** (default view — filenames + overlay directories), **`["dev","prod","staging"]`** (`posture` — config documents + `@Profile`) and **`["dev","prod","qa","staging"]`** (`--agent` / `fix-bug`, the union). Three populations under one name; every conditional-security finding is keyed on it. Authority `spring_profiles.profile_population`: four named signals (`file_naming`, `overlay_directory`, `config_documents`, `annotations`, plus `caller_supplied`), the union, and `by_signal` published so a name's provenance is auditable. The stack detector, `posture` and the serializer section all read it — asserted per surface, not claimed. Closing it exposed two false positives in the signals it inherited, both fixed structurally (never by name — VAI): an `application-{x}` file counts only **beside its base config** (alfresco's `alfresco/messages/application-model_de.properties` + 19 siblings invented twenty environments; now 0) and an overlay directory counts only when it **holds a config file** (spring-petclinic's `db/ messages/ static/ templates/` reported four; now `mysql, postgres`, which are its real profiles) |
 | C1-19 | **File-count drift across commands, with witnesses this time.** 3 337 (`compact.project_summary`) / 3 336 (`analysis_gaps.testing`) / 3 342 (`migrate-check.metadata.java_files_scanned`) for one repository in one session | 3.8.0 (eval #7) | Medium | **closed 3.9.0** — measured, not equalised: the three figures count code-extension files in any language, the non-test denominator of a test ratio, and the .java files handed to the migration rules. Each names its population now, and `migrate-check.files_scanned_basis` states the two it is not. Original note: open — **C1-14's cross-command half, reopened.** 3.6.0 recorded that half as *not reproducing* because on openmrs-core only `migrate-check` published a scanned-file count at all; eval #7 shows three commands publishing one on a repository we do not have. Three populations are plausible and each may be right in isolation (all Java files / files admitted to the graph / files the migration rules scanned), which is exactly the C1-5 remedy: name the unit per figure, or bind them to one authority. Do not fix by making the numbers equal — measure which population each counts first |

{sourcecode-5.5.2 → sourcecode-5.5.5}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.5.2
+# ask 5.5.5
 ```
 
 Requires Python 3.9+.
@@ -261,7 +261,13 @@ ask endpoints /path/to/repo
 ask endpoints . --format yaml
 ```
 
-Output: list of `{method, path, controller, handler}`. Covers `@GetMapping`, `@PostMapping`, `@PutMapping`, `@DeleteMapping`, `@PatchMapping`, `@RequestMapping`, `@GET`, `@POST`, `@PUT`, `@DELETE`, `@PATCH` + `@Path`.
+Output: list of `{method, methods, path, controller, handler}`. `method` remains
+the backwards-compatible primary verb; `methods` is the complete declared set.
+An unconstrained `@RequestMapping` reports `method: "ANY"` and
+`methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]`, because it accepts all
+of those verbs rather than defaulting to GET. Covers `@GetMapping`, `@PostMapping`,
+`@PutMapping`, `@DeleteMapping`, `@PatchMapping`, `@RequestMapping`, `@GET`,
+`@POST`, `@PUT`, `@DELETE`, `@PATCH` + `@Path`.
 
 Each endpoint carries a `security` policy. Standard annotations (`@PreAuthorize`, `@Secured`, `@RolesAllowed`, …) are recognized automatically; a custom authorization annotation reports `policy: "none_detected"` until declared in a `sourcecode.config.json` at the repo root:
 

{sourcecode-5.5.2 → sourcecode-5.5.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.5.2"
+version = "5.5.5"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.5.2 → sourcecode-5.5.5}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.5.2"
+__version__ = "5.5.5"

{sourcecode-5.5.2 → sourcecode-5.5.5}/src/sourcecode/cli.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import contextlib
+import errno
 import hashlib
 import json
 import difflib
@@ -1196,6 +1197,15 @@ def _safe_write_file(path: "Path", content: str) -> None:
             fh.flush()
             os.fsync(fh.fileno())
         tmp.replace(path)
+        # Atomic replacement alone does not prove that the destination is the
+        # requested artifact. Verify the postcondition before reporting a run
+        # output path, especially for non-empty JSON reports.
+        if not path.is_file() or (content and path.stat().st_size == 0):
+            raise OSError(
+                errno.EIO,
+                "atomic output replacement did not produce the requested file",
+                str(path),
+            )
         try:
             dir_fd = os.open(str(path.parent), os.O_RDONLY)
             try:
@@ -2071,6 +2081,14 @@ def _resolve_files_option(
 
     raw = str(files).replace(_text_input.BOM_CHAR, "").strip()
     if raw == "-":
+        if sys.stdin.isatty():
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                "--files - reads the file list from stdin, but stdin is a terminal.",
+                hint=f"Pipe the list: git diff --name-only main | ask {command} . --files -",
+                expected="Piped stdin, a list file, or a comma-separated file list.",
+            )
+            raise typer.Exit(code=1)
         return _text_input.parse_path_lines(_text_input.read_stdin_text()), "stdin"
     as_path = Path(raw)
     if as_path.is_file():
@@ -8857,7 +8875,8 @@ def spring_audit_cmd(
         help=(
             "Bounded summary: caps `findings` and the per-endpoint security projection "
             "to their top 5, most-severe first. Every count is still measured over the "
-            "whole population. The full report can exceed 1 MB on a monolith."
+            "whole population. Stdout also switches to this form only when the full "
+            "JSON exceeds its 50 KB budget; use --output for the complete report."
         ),
     ),
     table: bool = typer.Option(
@@ -9194,17 +9213,19 @@ def spring_audit_cmd(
                         "phase that never ran is not evidence there is none."
                     )
 
+            _full_data = combined.to_dict()
             _bounded_default = (
                 not compact and output_path is None and format == "json" and not table
+                and len(_json.dumps(_full_data, ensure_ascii=False).encode("utf-8")) > 50_000
             )
-            data = (
-                combined.to_compact_dict()
-                if compact or _bounded_default
-                else combined.to_dict()
-            )
+            data = combined.to_compact_dict() if compact or _bounded_default else _full_data
             if _bounded_default:
                 data.pop("mode", None)
                 data["default_output"] = "bounded"
+                data.pop("compact_note", None)
+                data["stdout_budget_note"] = (
+                    "Capped by the stdout payload budget; use --output <file> for the complete report."
+                )
             data.setdefault("metadata", {})["cache_layers"] = _cache_state
             if _stopped_early:
                 # C3-87: the block is composed by `PhasedRun.status`, which is the
@@ -9239,7 +9260,19 @@ def spring_audit_cmd(
     elif format == "github-comment":
         output = _render_spring_audit_github_comment(combined, min_severity)
     else:
-        data = combined.to_compact_dict() if compact else combined.to_dict()
+        _full_data = combined.to_dict()
+        _bounded_default = (
+            not compact and output_path is None and format == "json" and not table
+            and len(_json.dumps(_full_data, ensure_ascii=False).encode("utf-8")) > 50_000
+        )
+        data = combined.to_compact_dict() if compact or _bounded_default else _full_data
+        if _bounded_default:
+            data.pop("mode", None)
+            data["default_output"] = "bounded"
+            data.pop("compact_note", None)
+            data["stdout_budget_note"] = (
+                "Capped by the stdout payload budget; use --output <file> for the complete report."
+            )
         output = _serialize_dict(data, format)
 
     # F-AV: our own readers ask for the count under either spelling — the break
@@ -12850,7 +12883,8 @@ def config_cmd(
         _answer.say(f"Declaration: none at {_declaration_path}")
         _answer.say(
             "  Nothing is declared, so `data-exposure` answers "
-            "`answered: false` and no custom security annotation is recognised."
+            "`answered: false`. Custom security annotations may still be inferred "
+            "from usage with Likely confidence; declare them to make that policy Declared."
         )
     else:
         _answer.say(f"Declaration: {_declaration_path}")

{sourcecode-5.5.2 → sourcecode-5.5.5}/src/sourcecode/deployment_prefix.py

@@ -23,7 +23,7 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Iterable, Optional
 
 # Published Spring Boot property keys (DATA — never a predicate on a repo name).
 _CONTEXT_PATH_KEYS: tuple[str, ...] = (
@@ -163,25 +163,31 @@ def _profile_of_document(flat: "dict[str, str]", file_profile: Optional[str]) ->
     return file_profile
 
 
-def _config_files(root: Path) -> "list[Path]":
+def _config_files(root: Path, files: Optional[Iterable[Path]] = None) -> "list[Path]":
     """Spring config files under conventional resource directories.
 
     Bounded and sorted for determinism; test resources are excluded because a
     prefix declared for tests is not the deployed one.
     """
+    candidates = files if files is not None else root.rglob("application*.*")
     found: list[Path] = []
-    for pattern in ("**/src/main/resources/**/application*.*", "**/config/application*.*"):
-        for path in root.glob(pattern):
-            name = path.name
-            if name in _CONFIG_BASENAMES or _PROFILE_FILE_RE.match(name):
-                text = str(path).replace("\\", "/")
-                if "/src/test/" in text or "/target/" in text:
-                    continue
-                found.append(path)
+    for path in candidates:
+        path = Path(path)
+        name = path.name
+        if name not in _CONFIG_BASENAMES and not _PROFILE_FILE_RE.match(name):
+            continue
+        text = str(path).replace("\\", "/")
+        in_resources = "/src/main/resources/" in text
+        in_config = "/config/" in text
+        if not (in_resources or in_config) or "/src/test/" in text or "/target/" in text:
+            continue
+        found.append(path)
     return sorted(set(found))[:60]
 
 
-def detect_deployment_prefix(root: Path) -> DeploymentPrefix:
+def detect_deployment_prefix(
+    root: Path, *, files: Optional[Iterable[Path]] = None
+) -> DeploymentPrefix:
     """Read the deployment prefix from the repo's Spring configuration.
 
     Best effort and never raises: an unreadable or malformed config yields an
@@ -190,7 +196,7 @@ def detect_deployment_prefix(root: Path) -> DeploymentPrefix:
     """
     result = DeploymentPrefix()
     try:
-        candidates = _config_files(Path(root))
+        candidates = _config_files(Path(root), files)
     except Exception:
         return result