sourcecode 5.9.6__tar.gz → 5.9.7__tar.gz

{sourcecode-5.9.6 → sourcecode-5.9.7}/CHANGELOG.md

@@ -9217,3 +9217,13 @@ implementors.
 - 3 `--slim` tests verifying the option is absent from help and CLI surface.
 - 6 `angular_version` parsing tests covering `dependencies`, `devDependencies`,
   `peerDependencies`, `null` JSON values, and version prefix stripping.
+## [5.9.7] — 2026-08-27
+
+### Fixed
+- Exposed functional root options in `ask --help` and aligned help discoverability tests.
+- Unified empty `--files -` handling for `pr-impact` and `pr-risk`.
+- Normalized Git reference failures to `GIT_REF_NOT_FOUND`.
+- Corrected the `cold-start --compact` size contract and endpoint omission disclosure.
+- Added delayed liveness warnings for long non-interactive runs.
+- Improved natural-language routing for unsecured endpoint questions.
+- Kept unresolved impact symbols explicitly unscored.

{sourcecode-5.9.6 → sourcecode-5.9.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.6
+Version: 5.9.7
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.6-blue)
+![Version](https://img.shields.io/badge/version-5.9.7-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.6 retains the shared Canonical IR
+**Current performance status.** Release 5.9.7 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -218,7 +218,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.6 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.7 also hardens the boundary contracts: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -251,7 +251,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.6 — and, on a build that has aged,
+ask version                    # ask 5.9.7 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.6 → sourcecode-5.9.7}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.6-blue)
+![Version](https://img.shields.io/badge/version-5.9.7-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.6 retains the shared Canonical IR
+**Current performance status.** Release 5.9.7 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -169,7 +169,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.6 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.7 also hardens the boundary contracts: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -202,7 +202,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.6 — and, on a build that has aged,
+ask version                    # ask 5.9.7 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.6 → sourcecode-5.9.7}/docs/DEFECT-LEDGER.md

@@ -41,6 +41,36 @@ polyglot repository. It also did not open zero endpoints, minimum token-budget
 refusal, unsupported `explain --compact`, or contractless `verify`: each matched
 the declared contract and non-coverage in the observed run.
 
+**External audit intake AUD-611, re-audit of release 5.9.6 — 2026-08-27.**
+The external scope was restricted to repositories under Documents/workspace/testing
+and covered about 250 real invocations across seven forks, with 104/104 CLI
+commands exercised. The auditor reports zero target-repository writes, commits
+or dirty worktrees. The final score was 7.4/10; an earlier interim pass recorded
+8/10, so 7.4/10 is the governing result.
+
+The three TeaVM field fixes are confirmed across eight or more control
+repositories with no regressions. The new and still-relevant queue is:
+
+| ID | Severity | Status | Evidence / closure boundary |
+|---|---:|---|---|
+| AUD-611-B01 | Critical | open | With stdout redirected to /dev/null, an invalid invocation returned exit 0 and empty stderr in 5/5 runs; normal files, pipes and command substitution retained exit 1. Scope is currently INVALID_INPUT only. Fix error transport and exit status independently, then test every error class and redirection form. |
+| AUD-611-B02 | Critical | open | tutorials has 24,073 Java files; cold root compact ran 240.092 seconds, ended with external timeout exit 124 and zero stdout/stderr. CPU was active, so deadlock versus extreme analysis cost is unresolved. Reproduce on supported Windows/Git Bash and POSIX environments, add progress/deadline/partial diagnostics and define a scale contract. |
+| AUD-611-B03 | High | open | Root compact/agent YAML took 85-380 seconds and reported served_from_cache false on repeated unchanged runs. Add a format/view cache regression and publish latency expectations. |
+| AUD-611-B04 | High | open | One selftest hang occurred in about 16 aggregate runs. Other suspected hangs were retracted after adequate-timeout reruns. Add phase correlation, bounded execution and structured timeout failure. |
+| AUD-611-B05 | High | closed | Root help now exposes all 22 accepted functional flags. Dedicated parity coverage and a real TeaVM execution of `--tree --compact` pass; future internal-only options must be explicitly deprecated or hidden. |
+| AUD-611-B06 | Medium | closed | `pr-risk --files -` now rejects an empty list with the same `INVALID_INPUT` stderr envelope and `exit 1` as `pr-impact`; dedicated TeaVM regression passes. No-diff behavior from implicit Git sources remains separately scoped. |
+| AUD-611-B07 | Medium | closed | Shared Git-ref failures now publish canonical `GIT_REF_NOT_FOUND`; TeaVM regressions cover delta and contract-diff, and existing ref consumers were aligned. |
+| AUD-611-B08 | Medium | closed | `cold-start --compact` now qualifies its size as snapshot-dependent instead of claiming `~10K`; the TeaVM no-RIS path and compact identity regressions pass. A hard ceiling remains an optional future product requirement. |
+| AUD-611-B09 | Medium-high | closed | Non-interactive long runs now emit one delayed stderr warning after 60 seconds by default, configurable with `ASK_PROGRESS_WARNING_SECONDS`; short runs remain silent. TeaVM stdout JSON remains valid under the regression. |
+| AUD-611-B10 | Medium | closed | Added the missing `which endpoints have no security` anchor for `security-surface`; natural TeaVM resolution succeeds without scanning, while equal security-intent questions still refuse deterministically. |
+| AUD-611-B11 | Medium | closed | Missing-symbol `impact-chain` results now use `risk_score: null` and `risk_score_raw: null`, matching `impact`'s unscored semantics; both TeaVM command paths return `not_found`, `unknown`, and `exit 1`. |
+| AUD-611-B12 | Medium | open | Compact endpoint omission now carries explicit `population_total` and an inline measured-population note; the JUnit4 project-type classification half remains open. |
+| AUD-611-B13 | Medium | investigation | retrieve endpoint-security failed silently once in 15 runs (6.7%), exit 1 and zero bytes. Add phase/correlation capture and repeated/concurrent reproduction before closure. |
+
+Commercially, the audit supports normal repositories up to several thousand
+files and keeps a provisional $35-50/developer/month range, but B01/B02 block
+annual-grade reliability and enterprise-scale positioning until resolved.
+
 **External audit intake `AUD-610`, release 5.9.3 — 2026-08-27.** The attached
 report scored the build **7.2/10** after five parallel batches and approximately
 120 invocations. It verified a clean target repository, no Java-file changes,

{sourcecode-5.9.6 → sourcecode-5.9.7}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,7 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.6`; external reconciliation `AUD-610` is triaged and the reproducible fixes are implemented.**
+> **CURRENT QUEUE — release `5.9.7`; external reconciliation `AUD-611` adds the next correction queue.**
 > The 2026-08-27 external review adds `AUD-610-B01` through `AUD-610-B10`, led by
 > silent `selftest` nondeterminism, silent root/audit-report failures, a legal-zero
 > `risk --limit 0` crash, an unvalidated consumer path and contradictory Spring
@@ -170,6 +170,47 @@ unsupported flag, and `verify` returning `UNVERIFIED` without contracts all
 matched their documented contracts. These behaviours must remain in regression
 coverage, but are not roadmap bugs from this run.
 
+### External Audit Intake — `AUD-611` re-audit, release 5.9.6
+
+The external re-audit covered only repositories under the testing corpus:
+antlr4, netty, junit4, struts, spring-petclinic, spring-framework-petclinic,
+thingsboard, dropwizard, quarkus-quickstarts, vertx-examples, byte-buddy,
+aspectj, mall, spring-security, openmrs-core and tutorials. It reports
+approximately 250 real invocations across seven forks, 104/104 CLI commands
+exercised, no target-repository writes, no commits and clean Git status
+throughout. The final score is 7.4/10 (an interim pass recorded 8/10); the
+final score is the governing assessment.
+
+The audit confirms the previous cache, Spring-presence and README-badge fixes
+across multiple repositories with no regression. It also confirms that
+audit-report, risk --limit 0, timeline, consumer-path admission, CVE validation,
+baseline collision protection, MCP population disclosure and empty baseline
+handling now behave correctly. The following queue captures the new defects and
+the older findings that remain materially relevant:
+
+| ID | Severity | Finding | Required future closure |
+|---|---:|---|---|
+| AUD-611-B01 | Critical | Redirecting an invalid invocation with ask <bad-input> >/dev/null suppresses both the structured error and the non-zero exit: 5/5 reproductions returned exit 0 with empty stderr. Pipes and command substitution retained exit 1. Only INVALID_INPUT was tested; other error classes remain unverified. | Make error emission and process status independent of stdout destination. Test /dev/null, regular files, pipes, merged streams and all error codes; require structured stderr and non-zero status. |
+| AUD-611-B02 | Critical | Cold root ask . --compact on tutorials (24,073 Java files) ran for exactly 240 seconds until external timeout, returned exit 124 and produced zero bytes on stdout/stderr. The process consumed CPU; no progress or partial answer was available. Windows/Git Bash signal handling may contribute and must be distinguished from analysis cost. | Reproduce on the supported matrix, publish phase progress/heartbeat, enforce an internal deadline that preserves diagnostics, and establish an explicit scale ceiling or bounded execution mode before enterprise-scale claims. |
+| AUD-611-B03 | High | Three consecutive root --compact/--agent -f yaml runs took 85-380 seconds and reported served_from_cache false every time on the same unchanged repository. Output eventually completed, so this is cache/performance correctness rather than a crash. | Include format/view/mode in the canonical cache key or share the context cache correctly; add a cold/warm multi-process benchmark and document expected latency. |
+| AUD-611-B04 | High | selftest still hung once in approximately 16 aggregate executions across three evaluators. Prior suspected hangs for pr-risk, pack gate and audit-report were retracted after isolated reruns with adequate timeouts. | Instrument phase/correlation IDs, enforce bounded child execution and preserve a structured failure envelope; distinguish tool hangs from auditor timeout artefacts. |
+| AUD-611-B05 | High | **Closed in this fix.** Root --help now exposes the 22 functional root flags accepted by the callback, including architecture, tree, symbol, graph, dependency and docs flags. | Keep the live help/registry parity test green; internal-only options must be explicitly deprecated or hidden rather than silently omitted. |
+| AUD-611-B06 | Medium | **Closed in this fix.** Empty `--files -` now yields the same `INVALID_INPUT` structured stderr envelope and `exit 1` in `pr-impact` and `pr-risk`. | Keep both command contracts covered; no-diff paths not sourced from `--files` remain a separate policy surface. |
+| AUD-611-B07 | Medium | **Closed in this fix.** Shared Git reference failures now publish `GIT_REF_NOT_FOUND` across delta, contract-diff and the other ref-consuming surfaces. | Keep the cross-command error-code vocabulary test green. |
+| AUD-611-B08 | Medium | **Closed in this fix.** `cold-start --compact` no longer promises a fixed `~10K` ceiling; help and command documentation now state that the bounded orientation subset depends on stored snapshot size. No data is silently truncated to satisfy a false bound. | If a hard token ceiling becomes a product requirement, implement it with explicit omission metadata and corpus benchmarks. |
+| AUD-611-B09 | Medium-high | **Closed in this fix.** Non-interactive runs now emit one delayed stderr liveness warning after 60 seconds by default (configurable with `ASK_PROGRESS_WARNING_SECONDS`), while short runs remain byte-silent and stdout stays machine-readable. | Keep the warning opt-out and periodic `--progress` heartbeat contracts covered. |
+| AUD-611-B10 | Medium | **Closed in this fix.** The natural question `which endpoints have no security` now maps deterministically to `security-surface`; equal security intents continue to refuse with both candidates named. | Keep lexical anchors and equal-score refusal tests synchronized with the retrieve registry. |
+| AUD-611-B11 | Medium | **Closed in this fix.** For missing symbols, `impact-chain` now publishes null risk scores instead of the misleading numeric zero and preserves the same `not_found`/`unknown`/`exit 1` policy as `impact`. | Keep the shared not-found risk semantics covered; `impact`'s existing omission of `risk_score_raw` remains a separate schema choice. |
+| AUD-611-B12 | Medium | **Partially closed in this fix.** Compact endpoint output now publishes an explicit `population_total` beside the omitted rows and repeats the measured population in the inline note, so `endpoints: []` cannot be read as “no endpoints”. JUnit4 classification remains open. | Add evidence-backed JUnit4 project classification without heuristic overreach. |
+| AUD-611-B13 | Medium | retrieve endpoint-security failed silently once in 15 consecutive attempts (6.7%), exit 1 and zero bytes, with normal timing and no traceback. | Capture correlation/phase failures and reproduce under repeated/concurrent cache-control tests before claiming deterministic closure. |
+
+**Commercial interpretation.** The audit supports adoption for normal repositories up
+to several thousand files and values the product at a provisional $35-50 per
+developer/month, but the final score and the critical /dev/null and extreme-scale
+findings block an annual-grade reliability claim. Pricing and enterprise
+positioning remain hypotheses until AUD-611-B01 and AUD-611-B02 are closed and
+the latency contract is explicit.
+
 ### External Audit Intake — `AUD-610` detail, release 5.9.3
 
 The attached external report audited ASK `5.9.3` in five parallel batches

{sourcecode-5.9.6 → sourcecode-5.9.7}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.6`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.7`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -19,6 +19,19 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **RE-AUDIT — 5.9.6, received 2026-08-27.** Seven independent forks exercised
+> approximately 250 invocations across the testing corpus with no target-repository
+> mutation or regression in the three latest fixes. The final score is **7.4/10**.
+> Commercial adoption remains suitable for normal repositories, provisionally
+> `$35-50/developer/month`, but annual-grade reliability is blocked by two new
+> critical findings: invalid-input errors can be suppressed by redirecting stdout
+> to `/dev/null`, and the root compact scan of a 24,073-Java-file repository timed
+> out after 240 seconds with no output. Additional roadmap debt covers root help
+> parity, cache reuse for YAML/view combinations, default progress signals, intent
+> tie semantics, impact not-found parity, compact sizing and one intermittent
+> retrieve failure. Full engineering detail is recorded in `AUD-611` in the
+> development roadmap and defect ledger.
+
 > **EXTERNAL REVIEW — 5.9.2, received 2026-08-27.** No regression was reported in the
 > previously closed surface. Two `auth workspace` defects are now open: overlapping
 > parent/child paths can double-count Java files, and nonexistent paths are accepted as

{sourcecode-5.9.6 → sourcecode-5.9.7}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.6**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.7**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,7 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.6
+### Contratos de fiabilidad de la versión 5.9.7
 
 Las entradas inválidas se rechazan antes del análisis costoso mediante el
 envelope estructurado `INVALID_INPUT`: un `--consumer` inexistente, un feed CVE

{sourcecode-5.9.6 → sourcecode-5.9.7}/docs/USER_GUIDE.md

@@ -46,16 +46,16 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.6, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.7, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.6, with release-artifact verification
+the two pack fixes are included in release 5.9.7, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.6
+### Reliability contracts in 5.9.7
 
 Invalid analysis inputs fail before expensive work and use the structured
 `INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
@@ -236,7 +236,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.6
+# ask 5.9.7
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.6 → sourcecode-5.9.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.6"
+version = "5.9.7"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.6 → sourcecode-5.9.7}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.6"
+__version__ = "5.9.7"

{sourcecode-5.9.6 → sourcecode-5.9.7}/src/sourcecode/cli.py

@@ -5008,39 +5008,33 @@ def main(
     dependencies: bool = typer.Option(
         False,
         "--dependencies",
-        hidden=True,
         help="Analyze direct dependencies from manifests and lockfiles. " + _IMPLIED_NOTE,
     ),
     graph_modules: bool = typer.Option(
         False,
         "--graph-modules",
-        hidden=True,
         help="Include a structural module graph in output.",
     ),
     graph_detail: str = typer.Option(
         "high",
         "--graph-detail",
-        hidden=True,
         help="Detail level for --graph-modules: high, medium, full.",
         show_default=True,
     ),
     max_nodes: Optional[int] = typer.Option(
         None,
         "--max-nodes",
-        hidden=True,
         help="Maximum nodes in --graph-modules output.",
         min=1,
     ),
     graph_edges: Optional[str] = typer.Option(
         None,
         "--graph-edges",
-        hidden=True,
         help="Edge types for --graph-modules, comma-separated: imports,calls,contains,extends.",
     ),
     tree: bool = typer.Option(
         False,
         "--tree",
-        hidden=True,
         help="Include the full file_tree and flat file_paths list in output.",
     ),
     no_redact: bool = typer.Option(
@@ -5066,32 +5060,27 @@ def main(
     docs: bool = typer.Option(
         False,
         "--docs",
-        hidden=True,
         help="Extract documentation: docstrings, function signatures, and module-level comments.",
     ),
     docs_depth: str = typer.Option(
         "symbols",
         "--docs-depth",
-        hidden=True,
         help="Documentation extraction depth: module, symbols, full.",
         show_default=True,
     ),
     full_metrics: bool = typer.Option(
         False,
         "--full-metrics",
-        hidden=True,
         help="Technical audit: LOC, complexity, test coverage per file.",
     ),
     semantics: bool = typer.Option(
         False,
         "--semantics",
-        hidden=True,
         help="Cross-file symbol resolution and call graph analysis.",
     ),
     architecture: bool = typer.Option(
         False,
         "--architecture",
-        hidden=True,
         help="Architectural layer inference (MVC/hexagonal/layered). " + _IMPLIED_NOTE,
     ),
     git_context: bool = typer.Option(
@@ -5103,7 +5092,6 @@ def main(
     git_depth: int = typer.Option(
         20,
         "--git-depth",
-        hidden=True,
         help="Number of recent commits to include with --git-context (default: 20).",
         min=1,
         max=100,
@@ -5111,7 +5099,6 @@ def main(
     git_days: int = typer.Option(
         90,
         "--git-days",
-        hidden=True,
         help="Time window in days for change hotspot detection (default: 90).",
         min=1,
         max=3650,
@@ -5127,7 +5114,6 @@ def main(
     code_notes: bool = typer.Option(
         False,
         "--code-notes",
-        hidden=True,
         help=(
             "Extract inline annotations: TODO, FIXME, HACK, DEPRECATED, ADRs. "
             + _IMPLIED_NOTE
@@ -5153,26 +5139,22 @@ def main(
     trace_pipeline: bool = typer.Option(
         False,
         "--trace-pipeline",
-        hidden=True,
         help="Diagnostic: include full pipeline trace in output.",
     ),
     mode: str = typer.Option(
         "contract",
         "--mode",
-        hidden=True,
         help="Output mode: contract (default) | standard | raw.",
     ),
     max_symbols: Optional[int] = typer.Option(
         None,
         "--max-symbols",
-        hidden=True,
         help="Limit total exported semantic nodes across all file contracts.",
         min=1,
     ),
     entrypoints_only: bool = typer.Option(
         False,
         "--entrypoints-only",
-        hidden=True,
         help="Include only files with exported symbols or runtime entrypoints.",
     ),
     changed_only: bool = typer.Option(
@@ -5183,25 +5165,21 @@ def main(
     rank_by: str = typer.Option(
         "relevance",
         "--rank-by",
-        hidden=True,
         help="Contract ranking strategy: relevance (default) | centrality | git-churn.",
     ),
     emit_graph: bool = typer.Option(
         False,
         "--emit-graph",
-        hidden=True,
         help="Include a compact dependency graph in contract output.",
     ),
     symbol: Optional[str] = typer.Option(
         None,
         "--symbol",
-        hidden=True,
         help="Extract context for a specific symbol (Python/TS/JS only — not supported for Java).",
     ),
     max_importers: int = typer.Option(
         50,
         "--max-importers",
-        hidden=True,
         help="Maximum importer files returned by --symbol (default: 50).",
         min=1,
         max=10000,
@@ -9156,12 +9134,15 @@ def endpoints_cmd(
         data["endpoints"] = []
         data["endpoints_note"] = (
             f"The endpoints list is intentionally omitted by --compact; "
-            f"{_listed} endpoint(s) were measured. An empty `endpoints` list "
+            f"{data.get('total', _listed)} endpoint(s) were measured in the "
+            f"selected population; {_listed} row(s) were present before omission. "
+            "An empty `endpoints` list "
             "does not mean that the repository has no endpoints. Re-run without "
             "--compact or narrow the request to retrieve rows."
         )
         data["endpoints_omitted"] = {
             "total": _listed,
+            "population_total": data.get("total", _listed),
             "shown": 0,
             "omitted": _listed,
             **cap_effect("display_list", limit=0, total=_listed),
@@ -17328,6 +17309,14 @@ def pr_risk_cmd(
     changed: "list[str]" = []
     if files is not None:
         changed, _origin = _resolve_files_option(files, command="pr-risk")
+        if not changed:
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                f"--files '{_origin}' is empty.",
+                hint="Provide at least one changed file path.",
+                expected="One file path per line, or a comma-separated list.",
+            )
+            raise typer.Exit(code=1)
     else:
         # The same helper `pr-impact` uses, so one diff means one file set.
         changed, _files_desc = _git_changed_files(target, since)
@@ -19335,7 +19324,7 @@ def cold_start_cmd(
     compact: bool = typer.Option(
         False,
         "--compact",
-        help="Emit a compact subset (~10K tokens): status, git_head, stacks, entry_points, and key_dependencies only.",
+        help="Emit a bounded orientation subset; size depends on the stored snapshot. It is not a fixed token ceiling.",
     ),
     output_path: Optional[Path] = typer.Option(
         None,
@@ -19357,8 +19346,9 @@ def cold_start_cmd(
 
     \b
     Note: Full output is large (~100K–200K tokens for medium repos).
-    Use --compact for a ~10K token subset safe for direct LLM injection.
-    Use --output FILE to save the full snapshot for local search tools.
+    Use --compact for a bounded orientation subset; its size depends on the
+    stored snapshot and it is not a fixed token ceiling. Use --output FILE to
+    save the full snapshot for local search tools.
     """
     import json as _json
     from sourcecode.ris import get_cold_start_context as _gcs

{sourcecode-5.9.6 → sourcecode-5.9.7}/src/sourcecode/git_checkout.py

@@ -34,7 +34,7 @@ from pathlib import Path
 from typing import Iterator, Optional
 
 #: Error code published when a ref does not resolve in this repository.
-REF_NOT_FOUND = "git_ref_not_found"
+REF_NOT_FOUND = "GIT_REF_NOT_FOUND"
 
 #: Error code published when the path given is not a git repository at all.
 NOT_A_REPOSITORY = "not_a_git_repository"

{sourcecode-5.9.6 → sourcecode-5.9.7}/src/sourcecode/intent_router.py

@@ -154,7 +154,8 @@ INTENT_VOCABULARY: "dict[str, tuple[str, ...]]" = {
     ),
     "security-surface": (
         "security surface", "what is exposed", "attack surface",
-        "which endpoints are unprotected", "unsecured endpoints",
+        "which endpoints are unprotected", "which endpoints have no security",
+        "unsecured endpoints",
     ),
     "validation-points": (
         "validation points", "where is input validated", "input validation",

{sourcecode-5.9.6 → sourcecode-5.9.7}/src/sourcecode/prepare_context.py

@@ -1346,7 +1346,7 @@ class TaskContextBuilder:
                     key_dependencies=[], code_notes_summary=None,
                     limitations=[], confidence="low",
                     since=since,
-                    error_code="git_ref_not_found",
+                    error_code="GIT_REF_NOT_FOUND",
                     error_message=f"Base ref '{since}' not found in this repository.",
                     error_hints=_pr_hints,
                     gaps=[f"Cannot compute PR diff: git ref '{since}' not found."] + _pr_hints,
@@ -1730,7 +1730,7 @@ class TaskContextBuilder:
                     limitations=[],
                     confidence="low",
                     since=since,
-                    error_code="git_ref_not_found",
+                    error_code="GIT_REF_NOT_FOUND",
                     error_message=f"Git reference '{since}' does not exist in this repository.",
                     error_hints=_hints,
                     gaps=[f"Cannot compute delta: git ref '{since}' not found."] + _hints,

{sourcecode-5.9.6 → sourcecode-5.9.7}/src/sourcecode/progress.py

@@ -34,6 +34,7 @@ def _duration(seconds: float) -> str:
 
 #: Consecutive failed heartbeat writes before the loop gives up on the stream.
 _MAX_WRITE_FAILURES = 5
+_DEFAULT_SLOW_RUN_WARNING_SECONDS = 60.0
 
 # --- Completion registry ----------------------------------------------------
 # Module state, not per-instance: the emitter of the answer (the CLI output
@@ -152,6 +153,14 @@ class Progress:
 
     def __init__(self) -> None:
         self._enabled = _terminal_capable()
+        self._slow_warning = not self._enabled and _progress_setting() not in _PROGRESS_OFF
+        try:
+            self._slow_warning_after = max(
+                1.0,
+                float(os.environ.get("ASK_PROGRESS_WARNING_SECONDS", str(_DEFAULT_SLOW_RUN_WARNING_SECONDS))),
+            )
+        except ValueError:
+            self._slow_warning_after = _DEFAULT_SLOW_RUN_WARNING_SECONDS
         self._line_mode = self._enabled and (
             bool(progress_file_path()) or not sys.stderr.isatty()
         )
@@ -164,6 +173,8 @@ class Progress:
         self._lock = threading.Lock()
         self._stop_event = threading.Event()
         self._thread: Optional[threading.Thread] = None
+        self._slow_warning_thread: Optional[threading.Thread] = None
+        self._slow_warning_emitted = False
         self._stopped = False
         self._done_printed = False
         self._outputs_at_start = 0
@@ -213,6 +224,11 @@ class Progress:
         with _registry_lock:
             self._outputs_at_start = _output_events
         if not self._enabled:
+            if self._slow_warning:
+                self._slow_warning_thread = threading.Thread(
+                    target=self._slow_warning_loop, daemon=True
+                )
+                self._slow_warning_thread.start()
             return self
         self._stop_event.clear()
         self._thread = threading.Thread(target=self._loop, daemon=True)
@@ -313,9 +329,11 @@ class Progress:
         if self._stopped:
             return elapsed
         self._stopped = True
+        self._stop_event.set()
+        if self._slow_warning_thread:
+            self._slow_warning_thread.join(timeout=1.0)
         if not self._enabled:
             return elapsed
-        self._stop_event.set()
         if self._thread:
             self._thread.join(timeout=1.0)
         if not self._line_mode:
@@ -502,3 +520,16 @@ class Progress:
             if not self._emit(idx):
                 break
             idx += 1
+
+    def _slow_warning_loop(self) -> None:
+        """Give non-interactive supervisors a delayed liveness signal only."""
+        if self._stop_event.wait(timeout=self._slow_warning_after) or self._stopped:
+            return
+        try:
+            self._write(
+                f"[ask] warning: run has exceeded {_duration(self._slow_warning_after)}; "
+                "still working (set --progress stderr for periodic heartbeats)\n"
+            )
+            self._slow_warning_emitted = True
+        except Exception:
+            pass

{sourcecode-5.9.6 → sourcecode-5.9.7}/src/sourcecode/spring_impact.py

@@ -1097,6 +1097,8 @@ class ImpactOrchestrator:
                 resolution="not_found",
                 analysis_warnings=warnings,
                 risk_level="unknown",
+                risk_score=None,
+                risk_score_raw=None,
                 confidence="low",
                 explanation=f"Symbol {symbol!r} not found in the IR.",
                 metadata={"analysis_depth": depth},

{sourcecode-5.9.6 → sourcecode-5.9.7}/src/sourcecode/timeline.py

@@ -245,7 +245,7 @@ def commit_series(repo: Path, since: str, *, first_parent: bool = True) -> list[
     result = _git(repo, *args)
     if result.returncode != 0:
         raise TimelineError(
-            "git_ref_not_found",
+            "GIT_REF_NOT_FOUND",
             f"{since!r} does not resolve in this repository, or has no path to HEAD.",
             ref=since,
         )