progmune-runtime 3.7.9 → 3.7.11

package/tools/extract_framework_django.py

@@ -0,0 +1,269 @@
+#!/usr/bin/env python3
+"""
+Django Framework Structure Extractor — 框架结构扫描（M2）
+
+从 Python AST 提取 Django 结构：
+  1) urlpatterns 解析：url()/path()/re_path() → 视图引用（FBV views.foo /
+     CBV Foo.as_view() / include('module.urls') 递归）
+  2) 视图注册表：
+     - FBV：函数装饰器（login_required/permission_required/staff_member_required/
+       user_passes_test/authentication_decorator 等 *auth* 名装饰器）
+     - CBV：基类（APIView/View/generics.*/LoginRequiredMixin/
+       PermissionRequiredMixin）、方法（get/post/put/patch/delete）、
+       @method_decorator、DRF permission_classes（AllowAny/IsAuthenticated/
+       IsAdminUser/其他类名）
+     - @api_view 装饰器：methods + permission_classes kwarg
+  3) 每个 urlpattern → 视图解析（按短名匹配注册表）
+
+输出 JSON：{hasDjango, routes:[{pattern,urlname,view,kind,file}],
+views:{name:{file,decorators,methods,permissionClasses,isDrf,isProtected}},
+filesScanned}
+
+用法：python3 extract_framework_django.py <projectRoot> <outJson>
+"""
+
+import ast
+import json
+import os
+import re
+import sys
+
+SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",
+             ".git", "migrations", "__pycache__", "scripts", "docs",
+             "staticfiles", "static"}
+
+AUTH_DECORATORS = {
+    "login_required", "permission_required", "staff_member_required",
+    "user_passes_test", "authentication_decorator", "login_required_decorator",
+    "require_http_methods",
+}
+
+AUTH_MIXINS = {"LoginRequiredMixin", "PermissionRequiredMixin",
+               "UserPassesTestMixin", "StaffMemberRequiredMixin"}
+
+DRF_BASES = {"APIView", "GenericAPIView", "RetrieveAPIView", "ListAPIView",
+             "CreateAPIView", "UpdateAPIView", "DestroyAPIView",
+             "RetrieveUpdateAPIView", "ListCreateAPIView",
+             "RetrieveUpdateDestroyAPIView", "ViewSet", "ModelViewSet",
+             "GenericViewSet", "ReadOnlyModelViewSet"}
+
+MUTATION_METHODS = {"post", "put", "patch", "delete"}
+
+VIEW_BASES = DRF_BASES | {"View", "TemplateView", "FormView", "CreateView",
+                          "UpdateView", "DeleteView", "ListView", "DetailView"}
+
+OPEN_PERMISSIONS = {"AllowAny"}
+
+
+def name_of(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    return None
+
+
+def short_view_name(ref):
+    """views.auth_lab → auth_lab；Foo.as_view() → Foo"""
+    if isinstance(ref, ast.Attribute):
+        return ref.attr
+    if isinstance(ref, ast.Call) and isinstance(ref.func, ast.Attribute):
+        return ref.func.value.attr if isinstance(ref.func.value, ast.Attribute) \
+            else name_of(ref.func.value)
+    if isinstance(ref, ast.Name):
+        return ref.id
+    return None
+
+
+class ViewCollector(ast.NodeVisitor):
+    """收集全部函数/类的视图特征（与 urlpatterns 解耦）"""
+
+    def __init__(self, filepath):
+        self.file = filepath
+        self.fbvs = {}   # name -> {decorators, apiView: [methods]}
+        self.classes = {}  # name -> {bases, methods, decorators, permissionClasses, isDrf, protected}
+
+    def visit_FunctionDef(self, node):
+        self._scan_function(node, async_=False)
+        self.generic_visit(node)
+
+    def visit_AsyncFunctionDef(self, node):
+        self._scan_function(node, async_=True)
+        self.generic_visit(node)
+
+    def _scan_function(self, node, async_):
+        decorators = []
+        api_view_methods = None
+        permission_classes = []
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Name):
+                decorators.append(dec.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Name):
+                decorators.append(dec.func.id)
+                if dec.func.id == "api_view":
+                    if dec.args and isinstance(dec.args[0], (ast.List, ast.Tuple)):
+                        api_view_methods = [
+                            e.value.lower() for e in dec.args[0].elts
+                            if isinstance(e, ast.Constant)
+                        ]
+                    for kw in dec.keywords:
+                        if kw.arg == "permission_classes" and isinstance(kw.value, (ast.List, ast.Tuple)):
+                            permission_classes = [name_of(e) for e in kw.value.elts if name_of(e)]
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                decorators.append(dec.func.attr)  # django.views.decorators.login_required
+        self.fbvs[node.name] = {
+            "file": self.file,
+            "decorators": decorators,
+            "apiViewMethods": api_view_methods,
+            "permissionClasses": permission_classes,
+        }
+
+    def visit_ClassDef(self, node):
+        bases = [name_of(b) for b in node.bases if name_of(b)]
+        methods = []
+        permission_classes = []
+        decorators = []
+        for item in node.body:
+            if isinstance(item, ast.FunctionDef) and item.name in (
+                    "get", "post", "put", "patch", "delete", "create",
+                    "update", "destroy", "list", "retrieve"):
+                methods.append(item.name)
+            if isinstance(item, ast.Assign):
+                for t in item.targets:
+                    if isinstance(t, ast.Name) and t.id == "permission_classes":
+                        if isinstance(item.value, (ast.List, ast.Tuple)):
+                            permission_classes = [name_of(e) for e in item.value.elts if name_of(e)]
+                        elif isinstance(item.value, ast.Name):
+                            permission_classes = [item.value.id]
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Name):
+                decorators.append(dec.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Name):
+                decorators.append(dec.func.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                decorators.append(dec.func.attr)
+        is_drf = any(b in DRF_BASES for b in bases)
+        has_mixin = any(b in AUTH_MIXINS for b in bases)
+        self.classes[node.name] = {
+            "file": self.file,
+            "bases": bases,
+            "methods": methods,
+            "decorators": decorators,
+            "permissionClasses": permission_classes,
+            "isDrf": is_drf,
+            "protectedByMixin": has_mixin,
+        }
+
+
+class UrlCollector(ast.NodeVisitor):
+    """收集 urlpatterns 列表里的视图引用"""
+
+    def __init__(self, filepath):
+        self.file = filepath
+        self.routes = []
+
+    def visit_Assign(self, node):
+        for t in node.targets:
+            if isinstance(t, ast.Name) and t.id == "urlpatterns" and isinstance(node.value, (ast.List, ast.Tuple)):
+                for elt in node.value.elts:
+                    self._scan_entry(elt)
+        self.generic_visit(node)
+
+    def _scan_entry(self, elt):
+        if not isinstance(elt, ast.Call):
+            return
+        fn = name_of(elt.func)  # url / path / re_path
+        if fn not in ("url", "path", "re_path"):
+            return
+        pattern = ""
+        if elt.args and isinstance(elt.args[0], ast.Constant):
+            pattern = str(elt.args[0].value)
+        view_ref = elt.args[1] if len(elt.args) > 1 else None
+        if view_ref is None:
+            return
+        kind = "other"
+        view_name = None
+        if isinstance(view_ref, ast.Call) and isinstance(view_ref.func, ast.Attribute):
+            if view_ref.func.attr == "as_view":
+                kind = "cbv"
+                view_name = short_view_name(view_ref)
+            elif view_ref.func.id == "include" if isinstance(view_ref.func, ast.Name) else False:
+                kind = "include"
+        if view_name is None:
+            if isinstance(view_ref, ast.Name):
+                kind = "include" if False else "fbv"
+                view_name = view_ref.id
+            elif isinstance(view_ref, ast.Attribute):
+                kind = "fbv"
+                view_name = view_ref.attr
+            elif isinstance(view_ref, ast.Call) and isinstance(view_ref.func, ast.Name):
+                if view_ref.func.id == "include":
+                    kind = "include"
+                else:
+                    kind = "fbv"
+                    view_name = view_ref.func.id
+        urlname = ""
+        for kw in elt.keywords:
+            if kw.arg == "name" and isinstance(kw.value, ast.Constant):
+                urlname = str(kw.value)
+        self.routes.append({
+            "pattern": pattern,
+            "urlname": urlname,
+            "view": view_name,
+            "kind": kind,
+            "file": self.file,
+        })
+
+
+def walk_py_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for fn in filenames:
+            if fn.endswith(".py") and not fn.startswith("test_"):
+                yield os.path.join(dirpath, fn)
+
+
+def main():
+    root, out = sys.argv[1], sys.argv[2]
+    views, routes, files_scanned = {}, [], 0
+    for fp in walk_py_files(root):
+        files_scanned += 1
+        try:
+            with open(fp, "r", encoding="utf-8", errors="replace") as f:
+                tree = ast.parse(f.read(), filename=fp)
+        except (SyntaxError, UnicodeDecodeError, OSError):
+            continue
+        vc, uc = ViewCollector(fp), UrlCollector(fp)
+        vc.visit(tree)
+        uc.visit(tree)
+        for name, info in vc.fbvs.items():
+            info["kind"] = "fbv"
+            views[name] = info
+        for name, info in vc.classes.items():
+            info["kind"] = "cbv"
+            views[name] = info
+        routes.extend(uc.routes)
+
+    # 保护判定（扫描器只算事实，规则在 TS 检测器侧）
+    for name, info in views.items():
+        auth_dec = [d for d in info.get("decorators", [])
+                    if d in AUTH_DECORATORS or "auth" in d.lower() or "login" in d.lower()]
+        info["authDecorators"] = auth_dec
+        if info["kind"] == "cbv":
+            pc = info.get("permissionClasses") or []
+            info["openPermission"] = (len(pc) == 0) or all(
+                p in OPEN_PERMISSIONS for p in pc
+            )
+
+    result = {
+        "hasDjango": bool(routes),
+        "routes": routes,
+        "views": views,
+        "filesScanned": files_scanned,
+    }
+    with open(out, "w", encoding="utf-8") as f:
+        json.dump(result, f, ensure_ascii=False, indent=2)
+
+
+if __name__ == "__main__":
+    main()

package/tools/extract_framework_flask.py

@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+"""
+Flask Framework Structure Extractor — 框架结构扫描（第 5 个框架适配）
+
+从 Python AST 提取 Flask 结构：
+  1) 应用与蓝图：app = Flask(...) / bp = Blueprint(...) / register_blueprint
+  2) 路由：@app.route("/x", methods=[...]) / @bp.route(...) → handler 函数
+  3) 认证信号：
+     - handler 装饰器：login_required / permission_required / 自定义 *auth* 名
+     - 全局守卫：app.before_request(auth_fn) / bp.before_request(auth_fn)，
+       auth_fn 名命中认证词表
+  4) 路由方法：methods kwarg（缺省 = GET only）
+
+输出 JSON：{hasFlask, apps, blueprints, routes:[{method,path,handler,file,line,
+authDecorators}], beforeRequestAuth:[names], filesScanned}
+
+用法：python3 extract_framework_flask.py <projectRoot> <outJson>
+"""
+
+import ast
+import json
+import os
+import sys
+
+SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",
+             ".git", "migrations", "__pycache__", "scripts", "docs",
+             "staticfiles", "static"}
+
+AUTH_WORDS = ("auth", "login", "permission", "token", "credential", "session",
+              "user")
+
+MUTATION_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
+
+
+def name_of(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    return None
+
+
+def is_auth_like(name):
+    if not name:
+        return False
+    ln = name.lower()
+    return any(w in ln for w in AUTH_WORDS)
+
+
+class FlaskCollector(ast.NodeVisitor):
+    def __init__(self, filepath):
+        self.file = filepath
+        self.apps = []
+        self.blueprints = []
+        self.routes = []
+        self.before_requests = []  # 注册的 before_request 函数名
+
+    def visit_Assign(self, node):
+        if len(node.targets) == 1 and isinstance(node.targets[0], ast.Name):
+            v = node.value
+            if isinstance(v, ast.Call) and isinstance(v.func, ast.Name):
+                if v.func.id == "Flask":
+                    self.apps.append(node.targets[0].id)
+                elif v.func.id == "Blueprint":
+                    self.blueprints.append(node.targets[0].id)
+        self.generic_visit(node)
+
+    def visit_Expr(self, node):
+        # app.before_request(auth_fn) / app.register_blueprint(bp) 是表达式语句
+        v = node.value
+        if isinstance(v, ast.Call) and isinstance(v.func, ast.Attribute):
+            attr = v.func.attr
+            if attr == "before_request" and v.args:
+                fn_name = name_of(v.args[0])
+                if fn_name:
+                    self.before_requests.append(fn_name)
+            if attr == "register_blueprint" and v.args:
+                bp = name_of(v.args[0])
+                if bp and bp not in self.blueprints:
+                    self.blueprints.append(bp)
+        self.generic_visit(node)
+
+    def visit_FunctionDef(self, node):
+        self._scan(node)
+        self.generic_visit(node)
+
+    def visit_AsyncFunctionDef(self, node):
+        self._scan(node)
+        self.generic_visit(node)
+
+    def _scan(self, node):
+        auth_decorators = []
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                # @app.route("/x", methods=["POST"]) / @bp.route(...)
+                if dec.func.attr == "route":
+                    target = name_of(dec.func.value)
+                    path = dec.args[0].value if dec.args and isinstance(dec.args[0], ast.Constant) else ""
+                    methods = ["GET"]
+                    for kw in dec.keywords:
+                        if kw.arg == "methods" and isinstance(kw.value, (ast.List, ast.Tuple)):
+                            methods = [
+                                e.value.upper() for e in kw.value.elts
+                                if isinstance(e, ast.Constant)
+                            ]
+                    self.routes.append({
+                        "methods": methods,
+                        "path": path,
+                        "handler": node.name,
+                        "file": self.file,
+                        "line": node.lineno,
+                        "target": target,  # app / bp 变量名
+                    })
+            elif isinstance(dec, ast.Name):
+                if is_auth_like(dec.id):
+                    auth_decorators.append(dec.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Name):
+                if is_auth_like(dec.func.id):
+                    auth_decorators.append(dec.func.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                if is_auth_like(dec.func.attr):
+                    auth_decorators.append(dec.func.attr)
+        # 把装饰器信息挂到该函数名对应的 routes（同函数多装饰器顺序不定）
+        for r in self.routes:
+            if r["handler"] == node.name and r["file"] == self.file:
+                r["authDecorators"] = auth_decorators
+
+
+def walk_py_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for fn in filenames:
+            if fn.endswith(".py") and not fn.startswith("test_"):
+                yield os.path.join(dirpath, fn)
+
+
+def main():
+    root, out = sys.argv[1], sys.argv[2]
+    apps, blueprints, routes, before_requests, files_scanned = [], [], [], [], 0
+    for fp in walk_py_files(root):
+        files_scanned += 1
+        try:
+            with open(fp, "r", encoding="utf-8", errors="replace") as f:
+                tree = ast.parse(f.read(), filename=fp)
+        except (SyntaxError, UnicodeDecodeError, OSError):
+            continue
+        collector = FlaskCollector(fp)
+        collector.visit(tree)
+        apps.extend(collector.apps)
+        blueprints.extend(collector.blueprints)
+        routes.extend(collector.routes)
+        before_requests.extend(collector.before_requests)
+
+    result = {
+        "hasFlask": bool(apps or blueprints or routes),
+        "apps": sorted(set(apps)),
+        "blueprints": sorted(set(blueprints)),
+        "routes": routes,
+        "beforeRequestAuth": sorted(set(
+            fn for fn in before_requests if is_auth_like(fn)
+        )),
+        "filesScanned": files_scanned,
+    }
+    with open(out, "w", encoding="utf-8") as f:
+        json.dump(result, f, ensure_ascii=False, indent=2)
+
+
+if __name__ == "__main__":
+    main()

package/tools/extract_framework_py.py

@@ -0,0 +1,237 @@
+#!/usr/bin/env python3
+"""
+FastAPI Framework Structure Extractor — 框架结构扫描（与 extract_ir.py 解耦）
+
+Progmune 框架适配 M1：从 Python AST 提取 FastAPI 结构——
+路由（@app.get/@router.post 等）、处理器依赖注入（Depends()/Security()）、
+认证方案声明（OAuth2PasswordBearer/HTTPBearer/APIKeyHeader）、全局中间件。
+
+输出 JSON：
+{
+  "hasFastAPI": bool,
+  "apps": [{"name","file"}],
+  "routers": [{"name","file"}],
+  "authSchemes": [{"name","type"}],
+  "globalAuthMiddleware": [names...],
+  "routes": [{
+     "method","path","handler","file","line",
+     "dependencies": [{"name","via","authLike"}],
+  }],
+  "filesScanned": int
+}
+
+用法：python3 extract_framework_py.py <projectRoot> <outJson>
+"""
+
+import ast
+import json
+import os
+import sys
+
+# 认证词表（依赖函数名命中即视为 auth-like；与 TS 侧 annotation-suggest 词表同源）
+# 注意：扫描器只做「结构提取」，规则判定（豁免词/方法门控）在 TS 检测器侧。
+AUTH_WORDS = (
+    "auth", "login", "token", "user", "credential", "session",
+    "bearer", "permission", "current_user", "api_key", "oauth",
+)
+
+SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",
+             ".git", "migrations", "__pycache__", "scripts", "docs"}
+
+ROUTE_DECORATORS = {"get", "post", "put", "delete", "patch", "head", "options",
+                    "websocket", "api_route"}
+
+SCHEME_CLASSES = {
+    "OAuth2PasswordBearer": "OAuth2PasswordBearer",
+    "OAuth2AuthorizationCodeBearer": "OAuth2AuthorizationCodeBearer",
+    "HTTPBearer": "HTTPBearer",
+    "HTTPBasic": "HTTPBasic",
+    "HTTPDigest": "HTTPDigest",
+    "APIKeyHeader": "APIKeyHeader",
+    "APIKeyQuery": "APIKeyQuery",
+    "APIKeyCookie": "APIKeyCookie",
+    "OpenIdConnect": "OpenIdConnect",
+}
+
+
+def name_of(node):
+    """ast 名字解析（Name/Attribute/Subscript 兼容）"""
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    return None
+
+
+def lower_name(name):
+    return name.lower() if name else ""
+
+
+def is_auth_like(name, schemes):
+    """依赖名是否为认证依赖：命中认证词表，或直接是声明的认证方案"""
+    if not name:
+        return False
+    if name in schemes:
+        return True
+    ln = lower_name(name)
+    return any(w in ln for w in AUTH_WORDS)
+
+
+def resolve_dep_target(node):
+    """Depends(x) 的 x：Name/Attribute 直取；嵌套 Call（如 get_current_user_authorizer()）取内层函数名"""
+    if isinstance(node, (ast.Name, ast.Attribute)):
+        return name_of(node)
+    if isinstance(node, ast.Call):
+        return name_of(node.func)
+    return None
+
+
+def iter_dependency_calls(node):
+    """从签名节点收集 Depends(...)/Security(...) 调用（含 Annotated[...] 订阅）"""
+    found = []
+    for child in ast.walk(node):
+        # Depends(x) / Security(x)
+        if isinstance(child, ast.Call) and isinstance(child.func, ast.Name):
+            if child.func.id in ("Depends", "Security") and child.args:
+                found.append((resolve_dep_target(child.args[0]), child.func.id))
+        # Annotated[X, Depends(y)]
+        if isinstance(child, ast.Subscript):
+            for item in child.slice.elts if isinstance(child.slice, ast.Tuple) else [child.slice]:
+                if isinstance(item, ast.Call) and isinstance(item.func, ast.Name):
+                    if item.func.id in ("Depends", "Security") and item.args:
+                        found.append((resolve_dep_target(item.args[0]), item.func.id))
+    return found
+
+
+class Scanner(ast.NodeVisitor):
+    def __init__(self, filepath):
+        self.file = filepath
+        self.apps = []
+        self.routers = []
+        self.schemes = {}
+        self.middlewares = []
+        self.routes = []
+        self._decorator_targets = {}  # name -> {method,path} 列表
+
+    def visit_Assign(self, node):
+        if len(node.targets) == 1 and isinstance(node.targets[0], ast.Name):
+            v = node.value
+            if isinstance(v, ast.Call) and isinstance(v.func, ast.Name):
+                fn = v.func.id
+                if fn == "FastAPI":
+                    self.apps.append(node.targets[0].id)
+                elif fn == "APIRouter":
+                    self.routers.append(node.targets[0].id)
+                elif fn in SCHEME_CLASSES:
+                    self.schemes[node.targets[0].id] = SCHEME_CLASSES[fn]
+        self.generic_visit(node)
+
+    def visit_Expr(self, node):
+        # app.add_middleware(...) 是 Expr(Call(Attribute(app, add_middleware)))
+        v = node.value
+        if (isinstance(v, ast.Call) and isinstance(v.func, ast.Attribute)
+                and v.func.attr == "add_middleware" and v.args
+                and isinstance(v.args[0], ast.Name)):
+            self.middlewares.append(v.args[0].id)
+        self.generic_visit(node)
+
+    def visit_FunctionDef(self, node):
+        self._scan_decorated(node, is_async=False)
+        self.generic_visit(node)
+
+    def visit_AsyncFunctionDef(self, node):
+        self._scan_decorated(node, is_async=True)
+        self.generic_visit(node)
+
+    def _scan_decorated(self, node, is_async):
+        for dec in node.decorator_list:
+            # @app.get("/path") / @router.post(...) / @r.api_route(...)
+            if (isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute)
+                    and dec.func.attr in ROUTE_DECORATORS):
+                target = name_of(dec.func.value)
+                method = dec.func.attr
+                path = dec.args[0].value if dec.args and isinstance(dec.args[0], ast.Constant) else ""
+                deps = iter_dependency_calls(node.args)
+                # 装饰器级 dependencies=[Depends(...)]（realworld 风格：
+                # @router.put(..., dependencies=[Depends(check_permissions)]）
+                for kw in dec.keywords:
+                    if kw.arg == "dependencies" and isinstance(kw.value, ast.List):
+                        for item in kw.value.elts:
+                            if isinstance(item, ast.Call) and isinstance(item.func, ast.Name):
+                                if item.func.id in ("Depends", "Security") and item.args:
+                                    deps.append((resolve_dep_target(item.args[0]), item.func.id))
+                auth_like = [
+                    {"name": d[0], "via": d[1],
+                     "authLike": is_auth_like(d[0], self.schemes)}
+                    for d in deps
+                ]
+                self.routes.append({
+                    "method": method,
+                    "path": path,
+                    "handler": node.name,
+                    "file": self.file,
+                    "line": node.lineno,
+                    "dependencies": auth_like,
+                })
+
+
+def scan_file(filepath):
+    try:
+        with open(filepath, "r", encoding="utf-8", errors="replace") as f:
+            tree = ast.parse(f.read(), filename=filepath)
+    except (SyntaxError, UnicodeDecodeError, OSError):
+        return None
+    scanner = Scanner(filepath)
+    scanner.visit(tree)
+    return scanner
+
+
+def walk_py_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for fn in filenames:
+            if fn.endswith(".py") and not fn.startswith("test_"):
+                yield os.path.join(dirpath, fn)
+
+
+def main():
+    root = sys.argv[1]
+    out = sys.argv[2]
+    apps, routers, schemes, middlewares, routes = [], [], {}, [], []
+    files_scanned = 0
+    for fp in walk_py_files(root):
+        files_scanned += 1
+        sc = scan_file(fp)
+        if not sc:
+            continue
+        apps.extend(sc.apps)
+        routers.extend(sc.routers)
+        schemes.update(sc.schemes)
+        middlewares.extend(sc.middlewares)
+        routes.extend(sc.routes)
+
+    # 路由处理器名去重（同文件同名函数只记一次）
+    seen = set()
+    unique_routes = []
+    for r in routes:
+        key = (r["file"], r["handler"], r["method"], r["path"])
+        if key in seen:
+            continue
+        seen.add(key)
+        unique_routes.append(r)
+
+    result = {
+        "hasFastAPI": bool(apps or routers),
+        "apps": sorted(set(apps)),
+        "routers": sorted(set(routers)),
+        "authSchemes": [{"name": n, "type": t} for n, t in schemes.items()],
+        "globalAuthMiddleware": sorted(set(middlewares)),
+        "routes": unique_routes,
+        "filesScanned": files_scanned,
+    }
+    with open(out, "w", encoding="utf-8") as f:
+        json.dump(result, f, ensure_ascii=False, indent=2)
+
+
+if __name__ == "__main__":
+    main()