@orangepro/orangepro-mcp 0.2.41 → 0.2.43

package/dist/local/analyze/analyzer.js

@@ -10,6 +10,7 @@ import { buildImportGraph } from "../resolve/importGraph.js";
 import { walkBarrel } from "../resolve/barrelWalker.js";
 import { resetResolverCaches } from "../resolve/resolver.js";
 import { resetExportIndexCache } from "../resolve/exportIndex.js";
+import { builtInRankExclusion } from "../score/rankEligibility.js";
 import { baseName, extOf, GENERATED_CODE_REASON, isGeneratedCode, isNonProductPath, NON_PRODUCT_REASON, isTestSupportPath, languageOf, manifestKindOf, roleOf } from "./classify.js";
 import { classifyTestLayer } from "./testLayer.js";
 import { detectFromPackageJson, detectFrameworksFromManifest, detectManifestPackage, frameworkFromConfig } from "./frameworks.js";
@@ -142,6 +143,59 @@ function behaviorSurfaceReason(relPath, name, memberOf) {
     return null;
 }
 const RUNTIME_SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?)$/i;
+/**
+ * Return qualified `Class.run` symbols whose class extends a CLI command base
+ * imported from a known runtime package. This is deliberately import-scoped:
+ * a local class merely named Command/SfCommand never becomes an entry point.
+ */
+function cliEntrySymbols(content) {
+    const out = new Map();
+    const sourceFile = ts.createSourceFile("cli-entry.tsx", content, ts.ScriptTarget.Latest, false, ts.ScriptKind.TSX);
+    const importedBases = new Map();
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isImportDeclaration(stmt) || !ts.isStringLiteral(stmt.moduleSpecifier) || !stmt.importClause || stmt.importClause.isTypeOnly)
+            continue;
+        const source = stmt.moduleSpecifier.text;
+        const framework = source === "@oclif/core" ? "oclif" :
+            source === "@salesforce/sf-plugins-core" ? "salesforce-cli" :
+                source === "commander" ? "commander" :
+                    undefined;
+        if (!framework)
+            continue;
+        const bindings = stmt.importClause.namedBindings;
+        if (!bindings || !ts.isNamedImports(bindings))
+            continue;
+        for (const element of bindings.elements) {
+            if (element.isTypeOnly)
+                continue;
+            const imported = element.propertyName?.text ?? element.name.text;
+            if (imported === "Command" || imported === "SfCommand")
+                importedBases.set(element.name.text, framework);
+        }
+    }
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isClassDeclaration(stmt) || !stmt.name)
+            continue;
+        let framework;
+        for (const clause of stmt.heritageClauses ?? []) {
+            if (clause.token !== ts.SyntaxKind.ExtendsKeyword)
+                continue;
+            for (const type of clause.types) {
+                if (ts.isIdentifier(type.expression))
+                    framework = importedBases.get(type.expression.text) ?? framework;
+            }
+        }
+        if (!framework)
+            continue;
+        const hasRun = stmt.members.some((member) => ts.isMethodDeclaration(member) &&
+            !!member.body &&
+            ts.isIdentifier(member.name) &&
+            member.name.text === "run");
+        if (hasRun)
+            out.set(`${stmt.name.text}.run`, framework);
+    }
+    return out;
+}
 /**
  * Resolve package-level public entry modules from package metadata and the two
  * conventional source entry paths. This gives libraries a semantic behavior
@@ -487,6 +541,20 @@ export function analyzeRepo(root, opts = {}) {
         if (set.size < 32)
             set.add(name);
     };
+    // Stronger than an unanchored receiver name: the qualifier is a runtime
+    // binding imported from a bare external module. Preserve that provenance so
+    // risk scoring can recognize replacement operations without treating every
+    // local `replace*` method as destructive.
+    const importedStaticCalleesByCaller = new Map();
+    const recordImportedStaticCallee = (callerId, name) => {
+        let set = importedStaticCalleesByCaller.get(callerId);
+        if (!set) {
+            set = new Set();
+            importedStaticCalleesByCaller.set(callerId, set);
+        }
+        if (set.size < 32)
+            set.add(name);
+    };
     // Raw (caller, callee) call pairs per TS/JS code file, resolved after the
     // import graph is built (cross-file calls need its bindings + targets).
     const rawCallsByFile = new Map();
@@ -774,10 +842,18 @@ export function analyzeRepo(root, opts = {}) {
             }
             const content = readSafe(file.absPath);
             const isGenerated = content ? isGeneratedCode(content) : false;
+            const treeStructure = content && isTreeSitterLanguage(language) && treeSitterReady(language)
+                ? extractTreeSitterStructure(content, language, file.relPath)
+                : undefined;
             if (isGenerated)
                 generatedCodeFiles.add(file.relPath);
-            if (content && (language === "typescript" || language === "javascript") && !isGenerated && !isNonProductPath(file.relPath)) {
-                for (const contract of extractBehaviorContracts(content, file.relPath)) {
+            if (content && !isGenerated && !isNonProductPath(file.relPath)) {
+                const behaviorContracts = language === "typescript" || language === "javascript"
+                    ? extractBehaviorContracts(content, file.relPath)
+                    : language === "python"
+                        ? (treeStructure?.pythonBehaviorContracts ?? [])
+                        : [];
+                for (const contract of behaviorContracts) {
                     if (behaviorSurfaceExclusionReason(file.relPath, contract.handler ?? contract.title))
                         continue;
                     behaviorContractsTotal++;
@@ -800,7 +876,9 @@ export function analyzeRepo(root, opts = {}) {
                             file: contract.file,
                             source: contract.source,
                             ...(contract.handler ? { handler: contract.handler } : {}),
-                            ...(contract.controller ? { controller: contract.controller } : {})
+                            ...(contract.controller ? { controller: contract.controller } : {}),
+                            ...(contract.route_prefix_status ? { route_prefix_status: contract.route_prefix_status } : {}),
+                            ...(contract.route_prefix ? { route_prefix: contract.route_prefix } : {})
                         },
                         evidence_strength: "hard",
                         review_status: "auto_detected",
@@ -830,6 +908,7 @@ export function analyzeRepo(root, opts = {}) {
                 const extraction = opts.parseCache
                     ? opts.parseCache.symbols(file.hash, `${language}#${extractionBackend(language)}`, () => extractFileSymbols(content, language))
                     : extractFileSymbols(content, language);
+                const cliEntries = language === "typescript" || language === "javascript" ? cliEntrySymbols(content) : new Map();
                 if (extraction.truncated)
                     symbolFilesTruncated++;
                 for (const sym of extraction.symbols) {
@@ -855,20 +934,24 @@ export function analyzeRepo(root, opts = {}) {
                     // Trivial accessors (Java getId/toString, Python __repr__) are real
                     // symbols but carry no testable behavior — kept in the graph, dropped
                     // from the denominator with disclosure so coverage is not under-claimed.
-                    const isBoilerplate = !isDts && !isInfra && !isGeneratedSymbol && callableKind && isBoilerplateSymbol(sym.name, language, sym.symbol_kind, sym.trivial_accessor);
+                    const boilerplateName = language === "python" ? (sym.name.split(".").pop() ?? sym.name) : sym.name;
+                    const isBoilerplate = !isDts && !isInfra && !isGeneratedSymbol && callableKind && isBoilerplateSymbol(boilerplateName, language, sym.symbol_kind, sym.trivial_accessor);
                     const callableBehaviorCandidate = !isDts && !isInfra && !isGeneratedSymbol && !isBoilerplate && behaviorCallableKind;
                     const surfaceExclusionReason = callableBehaviorCandidate
                         ? behaviorSurfaceExclusionReason(file.relPath, sym.name, sym.member_of)
                         : null;
+                    const cliFramework = cliEntries.get(sym.name);
+                    const cliDenominatorOverride = Boolean(cliFramework) && callableBehaviorCandidate;
                     const surfaceReason = nonTsClassBehavior
                         ? "Non-TS class/constructor behavior surface — countable for language proof."
                         : callableBehaviorCandidate && !surfaceExclusionReason
                             ? behaviorSurfaceReason(file.relPath, sym.name, sym.member_of)
                             : null;
                     const publicApiEntry = callableBehaviorCandidate && !surfaceExclusionReason && publicEntryFiles.has(file.relPath);
-                    const eligible = callableBehaviorCandidate && (surfaceReason !== null || publicApiEntry);
-                    const behaviorSurfaceExcluded = callableBehaviorCandidate && surfaceExclusionReason !== null;
+                    const eligible = cliDenominatorOverride || (callableBehaviorCandidate && (surfaceReason !== null || publicApiEntry));
+                    const behaviorSurfaceExcluded = callableBehaviorCandidate && surfaceExclusionReason !== null && !cliDenominatorOverride;
                     const notEntryPointAdjacent = callableBehaviorCandidate && !eligible && !behaviorSurfaceExcluded;
+                    const rankingExclusion = builtInRankExclusion(file.relPath);
                     if (isBoilerplate)
                         excludedBoilerplate++;
                     nodes.push(makeNode({
@@ -881,10 +964,27 @@ export function analyzeRepo(root, opts = {}) {
                             ...(sym.start_line ? { start_line: sym.start_line } : {}),
                             ...(sym.end_line ? { end_line: sym.end_line } : {}),
                             ...(sym.member_of ? { member_of: sym.member_of } : {}),
+                            ...(cliFramework ? { cli_entrypoint: true, entry_lane: "cli", cli_framework: cliFramework } : {}),
                             ...(sym.callable !== undefined ? { callable_const: sym.callable } : {}),
-                            ...(surfaceReason ? { behavior_surface: "entrypoint_adjacent" } : publicApiEntry ? { behavior_surface: "public_api_entry" } : {}),
+                            ...(cliDenominatorOverride
+                                ? {
+                                    behavior_surface: "cli_command_entry",
+                                    denominator_reason_code: "cli_command_entry",
+                                    ...(surfaceExclusionReason ? { denominator_override_from: surfaceExclusionReason } : {})
+                                }
+                                : surfaceReason
+                                    ? { behavior_surface: "entrypoint_adjacent" }
+                                    : publicApiEntry
+                                        ? { behavior_surface: "public_api_entry" }
+                                        : {}),
                             ...(behaviorSurfaceExcluded ? { denominator_reason_code: "infra_behavior_surface" } : {}),
-                            ...(notEntryPointAdjacent ? { denominator_reason_code: "not_entry_point_adjacent" } : {})
+                            ...(notEntryPointAdjacent ? { denominator_reason_code: "not_entry_point_adjacent" } : {}),
+                            ...(rankingExclusion
+                                ? {
+                                    ranking_exclusion_reason_code: rankingExclusion.code,
+                                    ranking_exclusion_reason: rankingExclusion.reason
+                                }
+                                : {})
                         },
                         evidence_strength: "hard",
                         review_status: "auto_detected",
@@ -900,17 +1000,19 @@ export function analyzeRepo(root, opts = {}) {
                                     ? GENERATED_CODE_REASON
                                     : isBoilerplate
                                         ? BOILERPLATE_REASON
-                                        : eligible && surfaceReason
-                                            ? surfaceReason
-                                            : publicApiEntry
-                                                ? "Callable export from a package public entry module — countable library behavior surface."
-                                                : behaviorSurfaceExcluded && surfaceExclusionReason
-                                                    ? surfaceExclusionReason
-                                                    : callableBehaviorCandidate
-                                                        ? "Callable export is not API/service/route/job-adjacent — kept for grounding, excluded from the behavior denominator."
-                                                        : sym.symbol_kind === "class"
-                                                            ? "Exported class container — kept for grounding; methods/functions carry behavior in v1."
-                                                            : "Exported const (not provably callable) — excluded from the denominator in v1."
+                                        : cliDenominatorOverride
+                                            ? `Verified ${cliFramework} CLI command run() entry — countable behavior surface${surfaceExclusionReason ? `; overrides: ${surfaceExclusionReason}` : "."}`
+                                            : eligible && surfaceReason
+                                                ? surfaceReason
+                                                : publicApiEntry
+                                                    ? "Callable export from a package public entry module — countable library behavior surface."
+                                                    : behaviorSurfaceExcluded && surfaceExclusionReason
+                                                        ? surfaceExclusionReason
+                                                        : callableBehaviorCandidate
+                                                            ? "Callable export is not API/service/route/job-adjacent — kept for grounding, excluded from the behavior denominator."
+                                                            : sym.symbol_kind === "class"
+                                                                ? "Exported class container — kept for grounding; methods/functions carry behavior in v1."
+                                                                : "Exported const (not provably callable) — excluded from the denominator in v1."
                     }));
                     edges.push(makeEdge({
                         from_external_id: symId,
@@ -978,9 +1080,8 @@ export function analyzeRepo(root, opts = {}) {
                     if (generatedServices.length > 0)
                         medusaGeneratedServicesByFile.set(file.relPath, generatedServices);
                 }
-                else if (isTreeSitterLanguage(language) && treeSitterReady(language) && !isNonProductFile(file.relPath)) {
-                    const structure = extractTreeSitterStructure(content, language);
-                    nonTsStructureByFile.set(file.relPath, { language, structure });
+                else if (treeStructure && !isNonProductFile(file.relPath)) {
+                    nonTsStructureByFile.set(file.relPath, { language, structure: treeStructure });
                 }
             }
         }
@@ -1075,10 +1176,18 @@ export function analyzeRepo(root, opts = {}) {
         const importBindingsByFile = new Map();
         const typeBindingsByFile = new Map();
         const namespaceBindingsByFile = new Map();
+        const externalRuntimeBindingsByFile = new Map();
         for (const e of importGraph.edges) {
+            const fromRel = relByAbs.get(path.resolve(e.from));
+            if (fromRel && e.importKind === "runtime" && e.category === "bare-external") {
+                let bindings = externalRuntimeBindingsByFile.get(fromRel);
+                if (!bindings)
+                    externalRuntimeBindingsByFile.set(fromRel, (bindings = new Set()));
+                for (const binding of e.bindings)
+                    bindings.add(binding.local);
+            }
             if (!e.resolved || e.external || !e.target)
                 continue;
-            const fromRel = relByAbs.get(path.resolve(e.from));
             const targetRel = relByAbs.get(path.resolve(e.target));
             // Skip targets outside the scanned set (ignored/generated files): no node to link.
             if (!fromRel || !targetRel || fromRel === targetRel)
@@ -1264,6 +1373,7 @@ export function analyzeRepo(root, opts = {}) {
             const imports = importBindingsByFile.get(rel);
             const typeImports = typeBindingsByFile.get(rel);
             const namespaces = namespaceBindingsByFile.get(rel);
+            const externalRuntimeBindings = externalRuntimeBindingsByFile.get(rel);
             for (const c of calls) {
                 if (!localSyms.has(c.caller))
                     continue; // caller must be an emitted symbol
@@ -1323,6 +1433,9 @@ export function analyzeRepo(root, opts = {}) {
                                 queueMay(callerId, cands[0], rel, 0.65, `Imported-binding member match: the qualifier is imported from the module defining the only *.method symbol.`);
                             }
                         }
+                        if (externalRuntimeBindings?.has(c.qualifier)) {
+                            recordImportedStaticCallee(callerId, `${c.qualifier}.${c.callee}`);
+                        }
                         // A non-imported (local/param) qualifier is NOT anchored — no edge.
                         if (!ns && !qImport)
                             recordExternalCallee(callerId, `${c.qualifier}.${c.callee}`); // round two: retain by name
@@ -1413,6 +1526,9 @@ export function analyzeRepo(root, opts = {}) {
     let javaProofAttempted = 0;
     let pythonProofConfirmedPairs = 0;
     let pythonProofAttempted = 0;
+    let pythonDependencyEdges = 0;
+    let pythonEndpointReachablePromoted = 0;
+    let pythonStructuralContainersExcluded = 0;
     if (nonTsStructureByFile.size > 0) {
         const nodeByExternalId = new Map(nodes.map((n) => [n.external_id, n]));
         const codeFilesByLanguage = new Map();
@@ -1558,12 +1674,12 @@ export function analyzeRepo(root, opts = {}) {
                 }
             }));
         };
-        const addImportBinding = (fromRel, local, target, imported, kind) => {
+        const addImportBinding = (fromRel, local, target, imported, kind, module) => {
             let map = importBindingsByFile.get(fromRel);
             if (!map)
                 importBindingsByFile.set(fromRel, (map = new Map()));
             if (!map.has(local))
-                map.set(local, { ...target, imported, kind });
+                map.set(local, { ...target, imported, kind, module });
         };
         const uniquePythonModule = (mod) => {
             const set = pythonModuleToFiles.get(mod);
@@ -1618,6 +1734,39 @@ export function analyzeRepo(root, opts = {}) {
                 return null;
             return symbolKind(targetRel, methodName) === "method" ? targetRel : null;
         };
+        const pythonQualifiedMemberId = (targetRel, className, methodName) => {
+            if (!targetRel)
+                return null;
+            const member = `${className}.${methodName}`;
+            return symbolsByFile.get(targetRel)?.has(member) && symbolKind(targetRel, member) === "method"
+                ? `sym:${targetRel}#${member}`
+                : null;
+        };
+        const shouldRetainPythonImportedSink = (binding, callee) => {
+            if (!/^(?:delete|destroy|purge|drop|erase|wipe|truncate|terminate|revoke|remove|replace|overwrite)/i.test(callee))
+                return false;
+            const topModule = (binding.module ?? "").replace(/^\.+/, "").split(".")[0]?.toLowerCase();
+            if (new Set(["os", "pathlib", "shutil", "tempfile"]).has(topModule ?? ""))
+                return false;
+            const moduleName = (binding.module ?? "").toLowerCase();
+            const owner = binding.imported ?? "";
+            return /(?:^|[._])(db|database|model|orm|prisma|repo|repository|record|redis|mongo|sql|store|storage|table)(?:$|[._])/.test(moduleName)
+                || /(?:Model|Repository|Repo|Store|Client|Table|Database|DB)$/.test(owner);
+        };
+        const shouldRetainPythonReceiverFieldSink = (qualifier, callee) => {
+            if (!/^(?:delete|destroy|purge|drop|erase|wipe|truncate|terminate|revoke|remove|replace|overwrite)/i.test(callee))
+                return false;
+            const tokens = qualifier
+                .replace(/\([^)]*\)/g, "")
+                .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+                .toLowerCase()
+                .split(/[^a-z0-9]+/)
+                .filter(Boolean);
+            return tokens.some((token) => new Set([
+                "db", "database", "model", "orm", "prisma", "repo", "repository", "record", "redis",
+                "mongo", "sql", "session", "store", "storage", "table"
+            ]).has(token));
+        };
         const guardedCsharpMemberTarget = (fromRel, className, methodName) => {
             const ownNamespace = nonTsStructureByFile.get(fromRel)?.structure.moduleName;
             const namespaces = new Set([...(ownNamespace ? [ownNamespace] : []), ...(csharpUsingNamespacesByFile.get(fromRel) ?? [])]);
@@ -1821,7 +1970,7 @@ export function analyzeRepo(root, opts = {}) {
                 return null;
             if (!classTargetRel || symbolKind(classTargetRel, rootQualifier) !== "class")
                 return null;
-            return eligiblePythonSymbol(classTargetRel, callee);
+            return eligiblePythonSymbol(classTargetRel, `${rootQualifier}.${callee}`);
         };
         for (const [rel, { language, structure }] of nonTsStructureByFile) {
             for (const i of structure.imports) {
@@ -1850,11 +1999,19 @@ export function analyzeRepo(root, opts = {}) {
                 }
                 else if (language === "c" || language === "cpp")
                     targetRel = resolveRelativeModule(rel, i.module, [".h", ".hpp", ".hh", ".hxx", ".c", ".cc", ".cpp", ".cxx"]);
-                if (!targetRel && !targetDir)
+                if (!targetRel && !targetDir) {
+                    // Python external runtime imports do not produce graph edges, but the
+                    // binding still anchors `Model.delete()`/`client.replace()` as an
+                    // imported external call. TYPE_CHECKING imports were removed by the
+                    // AST extractor, so they cannot become sink provenance here.
+                    if (language === "python") {
+                        addImportBinding(rel, i.local, {}, i.imported, i.kind, i.module);
+                    }
                     continue;
+                }
                 if (targetRel)
                     emitImport(rel, targetRel);
-                addImportBinding(rel, i.local, { ...(targetRel ? { targetRel } : {}), ...(targetDir ? { targetDir } : {}) }, i.imported, i.kind);
+                addImportBinding(rel, i.local, { ...(targetRel ? { targetRel } : {}), ...(targetDir ? { targetDir } : {}) }, i.imported, i.kind, i.module);
             }
         }
         // Go package-level method index (dir → "Recv.M" → file) for receiver calls that
@@ -1897,8 +2054,10 @@ export function analyzeRepo(root, opts = {}) {
                         emitCall(callerId, `sym:${rel}#${c.callee}`, rel);
                         continue;
                     }
-                    if (language === "python" && localSyms.has(c.callee))
+                    if (language === "python" && localSyms.has(c.callee)) {
+                        emitCall(callerId, `sym:${rel}#${c.callee}`, rel);
                         continue;
+                    }
                     const b = imports?.get(c.callee);
                     if (language === "php" && b?.targetRel && b.imported && symbolKind(b.targetRel, b.imported) !== "function")
                         continue;
@@ -1907,11 +2066,38 @@ export function analyzeRepo(root, opts = {}) {
                     }
                 }
                 else if (c.qualifier) {
-                    const rootQualifier = c.qualifier.split(".")[0];
-                    if (shadowed.has(rootQualifier))
+                    const rootQualifier = language === "python" ? pythonQualifierRoot(c.qualifier) : c.qualifier.split(".")[0];
+                    if (shadowed.has(rootQualifier) && !(language === "python" && (rootQualifier === "self" || rootQualifier === "cls")))
                         continue;
                     const b = imports?.get(rootQualifier);
-                    if (language === "go" && c.receiverVar && c.receiverType && c.qualifier === c.receiverVar) {
+                    if (language === "python") {
+                        const callerNode = nodeByExternalId.get(callerId);
+                        const callerOwner = typeof callerNode?.properties.member_of === "string" ? callerNode.properties.member_of : undefined;
+                        const selfMember = (rootQualifier === "self" || rootQualifier === "cls") && callerOwner
+                            ? pythonQualifiedMemberId(rel, callerOwner, c.callee)
+                            : null;
+                        const localClassMember = pythonQualifiedMemberId(rel, rootQualifier.replace(/\(.*$/, ""), c.callee);
+                        const importedClassMember = b?.kind === "named" && b.imported
+                            ? pythonQualifiedMemberId(b.targetRel, b.imported, c.callee)
+                            : null;
+                        if (selfMember || localClassMember || importedClassMember) {
+                            emitCall(callerId, selfMember ?? localClassMember ?? importedClassMember, rel);
+                        }
+                        else if (b?.kind === "module" && b.targetRel && symbolsByFile.get(b.targetRel)?.has(c.callee)) {
+                            emitCall(callerId, `sym:${b.targetRel}#${c.callee}`, rel);
+                        }
+                        else if (b && !b.targetRel && shouldRetainPythonImportedSink(b, c.callee)) {
+                            const qualifier = b.kind === "named" ? c.qualifier.replace(/\([^)]*\)/g, "") : c.qualifier;
+                            recordImportedStaticCallee(callerId, `${qualifier}.${c.callee}`);
+                        }
+                        else if (!b && c.qualifier.includes(".") && shouldRetainPythonReceiverFieldSink(c.qualifier, c.callee)) {
+                            // Attribute-chain receiver (`self.repo.delete`, `store.client.replace`):
+                            // retain a name fact only. Scoring applies its own persistence + verb
+                            // policy; no graph edge or evidence claim is created here.
+                            recordExternalCallee(callerId, `${c.qualifier}.${c.callee}`);
+                        }
+                    }
+                    else if (language === "go" && c.receiverVar && c.receiverType && c.qualifier === c.receiverVar) {
                         // Go receiver-method call: inside `func (t *task) Run()`, `t.validate()` calls
                         // `task.validate`. The receiver's type is DECLARED in the method signature, so
                         // this is exact resolution: same file first, then the same package (methods of
@@ -1961,14 +2147,151 @@ export function analyzeRepo(root, opts = {}) {
                 }
             }
         }
-        // Fix B: persist retained callee names on their caller symbols (names only).
-        if (externalCalleesByCaller.size > 0) {
-            const byId = new Map(nodes.map((n) => [n.external_id, n]));
-            for (const [callerId, names] of externalCalleesByCaller) {
-                const n = byId.get(callerId);
-                if (!n)
+        const resolvePythonReferenceId = (fromRel, reference) => {
+            const parts = reference.split(".").filter(Boolean);
+            if (parts.length === 0)
+                return null;
+            const local = parts[0];
+            if (parts.length === 1 && symbolsByFile.get(fromRel)?.has(local))
+                return `sym:${fromRel}#${local}`;
+            const localMember = parts.length > 1 ? parts.join(".") : "";
+            if (localMember && symbolsByFile.get(fromRel)?.has(localMember))
+                return `sym:${fromRel}#${localMember}`;
+            const binding = importBindingsByFile.get(fromRel)?.get(local);
+            if (!binding?.targetRel || isNonProductFile(binding.targetRel))
+                return null;
+            const targetName = binding.kind === "module"
+                ? parts.slice(1).join(".")
+                : [binding.imported, ...parts.slice(1)].filter(Boolean).join(".");
+            return targetName && symbolsByFile.get(binding.targetRel)?.has(targetName)
+                ? `sym:${binding.targetRel}#${targetName}`
+                : null;
+        };
+        const seenPythonDependencyEdges = new Set();
+        for (const [rel, { language, structure }] of nonTsStructureByFile) {
+            if (language !== "python")
+                continue;
+            for (const dependency of structure.pythonDependencies ?? []) {
+                const handlerId = `sym:${rel}#${dependency.handler}`;
+                const dependencyId = resolvePythonReferenceId(rel, dependency.dependency);
+                if (!codeSymbolIds.has(handlerId) || !dependencyId || !codeSymbolIds.has(dependencyId))
+                    continue;
+                const callKey = `${handlerId}|${dependencyId}`;
+                if (!seenCalls.has(callKey)) {
+                    seenCalls.add(callKey);
+                    edges.push(makeEdge({
+                        from_external_id: handlerId,
+                        to_external_id: dependencyId,
+                        relationship_type: "CALLS",
+                        evidence_strength: "framework-derived",
+                        review_status: "auto_detected",
+                        provenance: prov(rel),
+                        properties: { call_via: "fastapi_dependency", resolution: "tree_sitter_exact" }
+                    }));
+                }
+                for (const contract of behaviorContractsByFile.get(rel) ?? []) {
+                    if (contract.framework !== "fastapi" || contract.handler !== dependency.handler)
+                        continue;
+                    const key = `${contract.id}|${dependencyId}`;
+                    if (seenPythonDependencyEdges.has(key))
+                        continue;
+                    seenPythonDependencyEdges.add(key);
+                    pythonDependencyEdges++;
+                    edges.push(makeEdge({
+                        from_external_id: contract.id,
+                        to_external_id: dependencyId,
+                        relationship_type: "DEPENDS_ON",
+                        evidence_strength: "framework-derived",
+                        review_status: "auto_detected",
+                        provenance: prov(rel),
+                        properties: { framework: "fastapi", dependency: dependency.dependency }
+                    }));
+                }
+            }
+        }
+        // Python's first-pass denominator is intentionally conservative. Promote only
+        // concrete production methods/functions reached from a framework handler by
+        // exact hard/framework CALLS edges. This repairs denominator visibility without
+        // admitting every class or utility into the score population.
+        const pythonNodeIds = new Set(nodes
+            .filter((n) => n.kind === "CodeSymbol" && typeof n.properties.file === "string" && n.properties.file.endsWith(".py"))
+            .map((n) => n.external_id));
+        const pythonAdjacency = new Map();
+        for (const edge of edges) {
+            if (edge.relationship_type !== "CALLS" || !pythonNodeIds.has(edge.from_external_id) || !pythonNodeIds.has(edge.to_external_id))
+                continue;
+            const list = pythonAdjacency.get(edge.from_external_id);
+            const step = { target: edge.to_external_id, edgeKind: edge.relationship_type };
+            if (list)
+                list.push(step);
+            else
+                pythonAdjacency.set(edge.from_external_id, [step]);
+        }
+        const pythonEntrypoints = [...new Set(edges
+                .filter((e) => e.relationship_type === "IMPLEMENTED_IN" && pythonNodeIds.has(e.to_external_id))
+                .map((e) => e.to_external_id))].sort();
+        const reachablePython = new Set(pythonEntrypoints);
+        const pythonWitness = new Map(pythonEntrypoints.map((seed) => [seed, { seed, edgeKinds: [], hopCount: 0 }]));
+        let frontier = [...pythonEntrypoints];
+        for (let depth = 0; depth < 3 && frontier.length > 0; depth++) {
+            const next = [];
+            for (const current of frontier) {
+                const currentWitness = pythonWitness.get(current);
+                if (!currentWitness)
                     continue;
-                n.properties = { ...(n.properties ?? {}), external_callees: [...names].sort() };
+                for (const step of pythonAdjacency.get(current) ?? []) {
+                    if (reachablePython.has(step.target))
+                        continue;
+                    reachablePython.add(step.target);
+                    pythonWitness.set(step.target, {
+                        seed: currentWitness.seed,
+                        edgeKinds: [...currentWitness.edgeKinds, step.edgeKind],
+                        hopCount: currentWitness.hopCount + 1
+                    });
+                    next.push(step.target);
+                }
+            }
+            frontier = next;
+        }
+        for (const id of reachablePython) {
+            const node = nodeByExternalId.get(id);
+            if (!node || node.properties.symbol_kind === "class")
+                continue;
+            const witness = pythonWitness.get(id);
+            node.properties.endpoint_reachable = true;
+            if (witness) {
+                node.properties.denominator_witness = {
+                    seed: witness.seed,
+                    edge_kinds: witness.edgeKinds,
+                    hop_count: witness.hopCount
+                };
+            }
+            if (node.denominator_eligible === true)
+                continue;
+            const callableName = (node.title ?? "").split(".").pop() ?? node.title ?? "";
+            if (callableName.startsWith("_") || node.properties.denominator_reason_code !== "not_entry_point_adjacent")
+                continue;
+            node.denominator_eligible = true;
+            node.denominator_reason = "Transitively reachable from a Python framework entrypoint through exact static calls.";
+            node.properties.denominator_promotion = "python_entrypoint_reachable";
+            pythonEndpointReachablePromoted++;
+        }
+        const pythonOwnersWithMethods = new Set(nodes
+            .filter((n) => n.kind === "CodeSymbol" &&
+            n.properties.symbol_kind === "method" &&
+            n.denominator_eligible === true &&
+            typeof n.properties.file === "string" &&
+            n.properties.file.endsWith(".py") &&
+            typeof n.properties.member_of === "string")
+            .map((n) => `${n.properties.file}#${n.properties.member_of}`));
+        for (const node of nodes) {
+            if (node.kind === "CodeSymbol" &&
+                node.properties.symbol_kind === "class" &&
+                node.denominator_eligible === true &&
+                typeof node.properties.file === "string" &&
+                pythonOwnersWithMethods.has(`${node.properties.file}#${node.title ?? ""}`)) {
+                node.properties.ranking_exclusion_reason = "python_structural_container";
+                pythonStructuralContainersExcluded++;
             }
         }
         const seenGoProof = new Set();
@@ -2075,6 +2398,25 @@ export function analyzeRepo(root, opts = {}) {
             }
         }
     }
+    // Persist retained callees for every language mix. This must live outside the
+    // non-TS conditional: a TypeScript-only repository still needs its unresolved
+    // external and import-anchored static calls available to risk scoring.
+    if (externalCalleesByCaller.size > 0 || importedStaticCalleesByCaller.size > 0) {
+        const byId = new Map(nodes.map((n) => [n.external_id, n]));
+        const callerIds = new Set([...externalCalleesByCaller.keys(), ...importedStaticCalleesByCaller.keys()]);
+        for (const callerId of callerIds) {
+            const n = byId.get(callerId);
+            if (!n)
+                continue;
+            const external = externalCalleesByCaller.get(callerId);
+            const importedStatic = importedStaticCalleesByCaller.get(callerId);
+            n.properties = {
+                ...(n.properties ?? {}),
+                ...(external?.size ? { external_callees: [...external].sort() } : {}),
+                ...(importedStatic?.size ? { imported_static_callees: [...importedStatic].sort() } : {})
+            };
+        }
+    }
     // ---- Static assertion candidates (Phase 4 / Gate 2): TypeChecker-derived hard edges ----
     // Upgrade resolver-derived test->source candidates to HARD TESTED_BY/COVERS
     // ONLY where the 5-conjunct confirmer proves a runtime, asserted use of a real
@@ -2157,7 +2499,7 @@ export function analyzeRepo(root, opts = {}) {
             involved.add(c.implAbs);
         }
         if (candidates.length === 0) {
-            confirmedCoverage = { confirmed_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: 0 };
+            confirmedCoverage = { confirmed_pairs: 0, associated_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: 0 };
         }
         else
             try {
@@ -2174,7 +2516,7 @@ export function analyzeRepo(root, opts = {}) {
                     })
                     : { candidates, riskSymbols: 0, involvedFiles: involved.size };
                 if (involved.size > confirmBudget && scoped.candidates.length === 0) {
-                    confirmedCoverage = { confirmed_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: involved.size };
+                    confirmedCoverage = { confirmed_pairs: 0, associated_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: involved.size };
                     warnings.push(`Static confirmation skipped: ${involved.size} files exceed the confirmer budget (${confirmBudget}), and no high-risk subset fit. Use \`--base <ref>\` for PR-scoped confirmation, or raise ORANGEPRO_MAX_CONFIRM_FILES.`);
                 }
                 else {
@@ -2195,8 +2537,28 @@ export function analyzeRepo(root, opts = {}) {
                             lastVerified: proofVerifiedAt
                         }));
                     }
+                    let associatedPairs = 0;
+                    for (const c of result.associations) {
+                        const edgeKey = `test:${c.testRel}|${c.symId}`;
+                        if (seenEdge.has(edgeKey))
+                            continue;
+                        seenEdge.add(edgeKey);
+                        associatedPairs++;
+                        edges.push(...makeProofEdges({
+                            testRel: c.testRel,
+                            symId: c.symId,
+                            provenance: prov(c.testRel, hashString(`${c.symId}:runtime-invocation`)),
+                            lastVerified: proofVerifiedAt,
+                            properties: {
+                                static_association: "runtime_invocation",
+                                assertion_observed: false,
+                                association_reason: c.reason
+                            }
+                        }));
+                    }
                     confirmedCoverage = {
                         confirmed_pairs: confirmedPairs,
+                        associated_pairs: associatedPairs,
                         attempted: result.attempted,
                         capped_downgrades: result.capped_downgrades,
                         skipped_files_budget: involved.size > confirmBudget ? involved.size : 0,
@@ -2222,7 +2584,7 @@ export function analyzeRepo(root, opts = {}) {
                 // or a TS compiler-API edge must NEVER crash analyze. Degrade to
                 // candidate-only coverage with a disclosure.
                 const msg = err instanceof Error ? err.message : String(err);
-                confirmedCoverage = { confirmed_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: 0 };
+                confirmedCoverage = { confirmed_pairs: 0, associated_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: 0 };
                 warnings.push(`Static confirmation skipped: the structural confirmer could not run on this project (${msg.slice(0, 160)}). Coverage is reported from candidate links only.`);
             }
     }
@@ -2230,6 +2592,7 @@ export function analyzeRepo(root, opts = {}) {
     if (nonTsHardProofAttempted > 0) {
         confirmedCoverage = {
             confirmed_pairs: (confirmedCoverage?.confirmed_pairs ?? 0) + goProofConfirmedPairs + javaProofConfirmedPairs + pythonProofConfirmedPairs,
+            associated_pairs: confirmedCoverage?.associated_pairs ?? 0,
             attempted: (confirmedCoverage?.attempted ?? 0) + nonTsHardProofAttempted,
             capped_downgrades: confirmedCoverage?.capped_downgrades ?? 0,
             skipped_files_budget: confirmedCoverage?.skipped_files_budget ?? 0
@@ -2412,6 +2775,7 @@ export function analyzeRepo(root, opts = {}) {
         files_scanned: filesProcessed,
         files_cap_hit: filesCapHit,
         max_files: maxFiles,
+        max_symbols: maxSymbols,
         ...(budgetStopped
             ? { not_analyzed_due_to_budget: { files_not_analyzed: filesNotAnalyzed, elapsed_ms: elapsedMs, budget_ms: budgetMs } }
             : {}),
@@ -2432,6 +2796,15 @@ export function analyzeRepo(root, opts = {}) {
                 }
             }
             : {}),
+        ...(pythonDependencyEdges || pythonEndpointReachablePromoted || pythonStructuralContainersExcluded
+            ? {
+                python_structural_recalibration: {
+                    dependency_edges: pythonDependencyEdges,
+                    endpoint_reachable_promoted: pythonEndpointReachablePromoted,
+                    structural_containers_rank_excluded: pythonStructuralContainersExcluded
+                }
+            }
+            : {}),
         flows,
         structural_clusters: structuralClusters,
         ...(tsStatus.loaded.length || tsStatus.failed.length