codeanalyzer-python 1.1.1__py3-none-any.whl → 1.2.0__py3-none-any.whl

codeanalyzer/__main__.py

@@ -1,8 +1,9 @@
+import json
 import os
 import sys
 from importlib.metadata import version as _pkg_version, PackageNotFoundError
 from pathlib import Path
-from typing import Optional, Annotated
+from typing import List, Optional, Annotated
 
 import typer
 
@@ -10,7 +11,7 @@ import typer
 def _pin_hash_seed() -> None:
     """Re-exec once with ``PYTHONHASHSEED=0`` unless the caller pinned one.
 
-    PyCG's capped fixpoint (``--pycg-max-iter``) iterates hash-ordered sets
+    Jedi's inference (and any hash-ordered iteration in the pipeline) walks sets
     keyed on module/access-path strings, so an unpinned per-interpreter hash
     seed makes the emitted L2+ call graph vary run to run (issue #99). The
     seed cannot be set after interpreter start, hence the exec. Export
@@ -37,9 +38,8 @@ def _pin_hash_seed() -> None:
 
 from codeanalyzer.core import Codeanalyzer
 from codeanalyzer.utils import _set_log_level, logger
-from codeanalyzer.config import OutputFormat
-from codeanalyzer.schema import model_dump_json
-from codeanalyzer.options import AnalysisOptions, EmitTarget, ShardStrategy
+from codeanalyzer.schema import model_dump, model_dump_json, strip_internal_only
+from codeanalyzer.options import AnalysisOptions, EmitTarget
 
 
 def _version_callback(value: bool) -> None:
@@ -80,15 +80,6 @@ def main(
         Optional[Path],
         typer.Option("-o", "--output", help="Output directory for artifacts."),
     ] = None,
-    format: Annotated[
-        OutputFormat,
-        typer.Option(
-            "-f",
-            "--format",
-            help="Output format for --emit json: json or msgpack.",
-            case_sensitive=False,
-        ),
-    ] = OutputFormat.JSON,
     emit: Annotated[
         EmitTarget,
         typer.Option(
@@ -141,26 +132,31 @@ def main(
         ),
     ] = None,
     analysis_level: Annotated[
-        int,
+        Optional[int],
         typer.Option(
             "-a",
             "--analysis-level",
-            help="Analysis depth: 1=symbol table+Jedi call graph, 2=+PyCG call "
+            help="Analysis depth: 1=symbol table+Jedi call graph, 2=+defuse-linker call "
             "graph, 3=+native intraprocedural dataflow (CFG/PDG), "
-            "4=+interprocedural SDG (param/summary edges, alias-aware DDG).",
+            "4=+interprocedural SDG (param/summary edges, alias-aware DDG). "
+            "[default: 1; incompatible with --emit neo4j, which is always "
+            "full-depth]",
             min=1,
             max=4,
+            show_default="1",
         ),
-    ] = 1,
+    ] = None,
     graphs: Annotated[
-        str,
+        Optional[str],
         typer.Option(
             "--graphs",
             help="Level 3+ only: comma-separated program-graph sections to emit "
             "(cfg, dfg, pdg, sdg). Default: cfg,dfg,pdg. `dfg` emits the PDG's data "
-            "edges only; `sdg` requires -a 4.",
+            "edges only; `sdg` requires -a 4. Incompatible with --emit neo4j "
+            "(always full-depth).",
+            show_default="cfg,dfg,pdg",
         ),
-    ] = "cfg,dfg,pdg",
+    ] = None,
     graph_field_depth: Annotated[
         int,
         typer.Option(
@@ -222,87 +218,54 @@ def main(
     verbosity: Annotated[
         int, typer.Option("-v", count=True, help="Increase verbosity: -v, -vv, -vvv")
     ] = 0,
-    pycg_shard: Annotated[
-        bool,
-        typer.Option(
-            "--pycg-shard/--no-pycg-shard",
-            help=(
-                "Shard PyCG call-graph analysis by Python package (level 2 only). "
-                "When the project exceeds the 500-file ceiling, PyCG is run "
-                "independently per top-level package with cross-package imports "
-                "treated as ghost nodes. Without this flag, projects over the "
-                "ceiling fall back to Jedi-only edges."
-            ),
-        ),
-    ] = False,
-    pycg_shard_ceiling: Annotated[
-        int,
-        typer.Option(
-            "--pycg-shard-ceiling",
-            help=(
-                "Maximum files per shard when --pycg-shard is active (default 100). "
-                "Shards exceeding this limit are skipped; their call edges are "
-                "omitted from the call graph (Jedi edges for those packages are "
-                "still included). Lower values are safer for packages with deep "
-                "class hierarchies or heavy import graphs."
-            ),
-            min=1,
-        ),
-    ] = 100,
-    pycg_shard_timeout: Annotated[
-        int,
-        typer.Option(
-            "--pycg-shard-timeout",
-            help=(
-                "Per-shard wall-clock timeout in seconds when --pycg-shard is "
-                "active (default 120). A shard that exceeds this limit is skipped "
-                "gracefully. PyCG's fixpoint is bimodal: it either converges "
-                "quickly or diverges indefinitely, so the timeout acts as a final "
-                "safety net after the file-count ceiling. Set to 0 to disable. "
-                "POSIX only (macOS / Linux); ignored on Windows."
-            ),
-            min=0,
-        ),
-    ] = 120,
-    pycg_shard_strategy: Annotated[
-        ShardStrategy,
-        typer.Option(
-            "--pycg-shard-strategy",
-            help=(
-                "How --pycg-shard groups files (level 2 only). 'jedi' (default) "
-                "partitions the Jedi module-dependency graph (SCC + Louvain) so "
-                "tightly-coupled modules co-compute and few call edges are "
-                "severed between shards; import cycles are never split. "
-                "'package' uses the legacy one-shard-per-package-directory "
-                "grouping."
-            ),
-        ),
-    ] = ShardStrategy.JEDI,
-    pycg_max_iter: Annotated[
-        int,
+    entrypoint_rules: Annotated[
+        Optional[List[Path]],
         typer.Option(
-            "--pycg-max-iter",
-            help=(
-                "Cap on PyCG's fixpoint passes per shard/project (level 2; "
-                "default 50). PyCG iterates until its points-to state stops "
-                "changing, but its access-path domain has no convergence bound, "
-                "so heavy metaclass/mixin code (e.g. an ORM) can loop with each "
-                "pass costing seconds. The cap returns a sound-but-incomplete "
-                "call graph instead of looping until the timeout kills it. "
-                "Set to -1 for PyCG's unbounded run-to-convergence behaviour."
-            ),
-            min=-1,
+            "--entrypoint-rules",
+            help="Extra entrypoint rules file (YAML). Repeatable; merges with "
+            "the shipped rules. A malformed file is an error.",
         ),
-    ] = 50,
+    ] = None,
 ):
     # Determinism: pin the interpreter hash seed before any analysis (no-op
     # when PYTHONHASHSEED is already set; --version exits before this).
     _pin_hash_seed()
 
     # Flag validation (strict: unrecognized values error out, never fall back).
-    selected_graphs = [g.strip() for g in graphs.split(",") if g.strip()]
+    # -a and --graphs use None sentinels so an explicitly-passed flag is
+    # distinguishable from the default (#119).
+    explicit_level = analysis_level is not None
+    explicit_graphs = graphs is not None
+
+    # Neo4j is always full-depth (#119): the graph carries every level's
+    # facts, so depth/section selectors cannot be combined with it — reject
+    # explicitly-passed flags and force level 4 with every graph section.
     from codeanalyzer.dataflow.builder import VALID_GRAPHS
 
+    if emit == EmitTarget.NEO4J:
+        explicit = [
+            flag
+            for flag, was_explicit in (
+                ("-a/--analysis-level", explicit_level),
+                ("--graphs", explicit_graphs),
+            )
+            if was_explicit
+        ]
+        if explicit:
+            logger.error(
+                "--emit neo4j is always full-depth (level 4, all graph "
+                f"sections); {' and '.join(explicit)} cannot be combined with it."
+            )
+            raise typer.Exit(code=2)
+        analysis_level = 4
+        graphs = ",".join(VALID_GRAPHS)
+
+    if analysis_level is None:
+        analysis_level = 1
+    if graphs is None:
+        graphs = "cfg,dfg,pdg"
+    selected_graphs = [g.strip() for g in graphs.split(",") if g.strip()]
+
     unknown_graphs = [g for g in selected_graphs if g not in VALID_GRAPHS]
     if unknown_graphs:
         logger.error(
@@ -316,7 +279,7 @@ def main(
     if "sdg" in selected_graphs and analysis_level < 4:
         logger.error("--graphs sdg requires -a 4 (interprocedural SDG).")
         raise typer.Exit(code=2)
-    if analysis_level < 3 and graphs != "cfg,dfg,pdg":
+    if analysis_level < 3 and explicit_graphs:
         logger.error("--graphs is a level-3 option; pass -a 3 to emit program graphs.")
         raise typer.Exit(code=2)
     if analysis_level < 3 and graph_field_depth != 3:
@@ -326,7 +289,7 @@ def main(
     options = AnalysisOptions(
         input=input,
         output=output,
-        format=format,
+
         emit=emit,
         app_name=app_name,
         neo4j_uri=neo4j_uri,
@@ -344,15 +307,25 @@ def main(
         cache_dir=cache_dir,
         clear_cache=clear_cache,
         verbosity=verbosity,
-        pycg_shard=pycg_shard,
-        pycg_shard_ceiling=pycg_shard_ceiling,
-        pycg_shard_timeout=pycg_shard_timeout,
-        pycg_shard_strategy=pycg_shard_strategy,
-        pycg_max_iter=pycg_max_iter,
+        entrypoint_rules=tuple(entrypoint_rules or ()),
     )
 
     _set_log_level(options.verbosity)
 
+    # Entrypoint rules are configuration, validated before any analysis work
+    # starts (#122 review) -- a typo must fail in milliseconds, not after the
+    # symbol table, venv build, Jedi and the defuse linker have all run. `detect_entrypoints`
+    # loads the rules again at its own call site; that second load is cheap
+    # and keeps the entrypoints pipeline self-contained.
+    if options.entrypoint_rules:
+        from codeanalyzer.entrypoints.rules import RulesError, load_rules
+
+        try:
+            load_rules(options.entrypoint_rules)
+        except RulesError as exc:
+            logger.error(f"Invalid --entrypoint-rules: {exc}")
+            raise typer.Exit(code=1)
+
     # The schema contract is a static artifact — no project analysis required.
     if options.emit == EmitTarget.SCHEMA:
         from codeanalyzer.neo4j.emit import emit_schema
@@ -392,37 +365,36 @@ def main(
 
             emit_neo4j(artifacts, options)
         elif options.output is None:
-            print(model_dump_json(artifacts, exclude_none=True))
+            print(
+                json.dumps(
+                    strip_internal_only(
+                        model_dump(artifacts, mode="json", exclude_none=True)
+                    )
+                )
+            )
         else:
             options.output.mkdir(parents=True, exist_ok=True)
-            _write_output(artifacts, options.output, options.format)
-
-
-def _write_output(artifacts, output_dir: Path, format: OutputFormat):
-    """Write artifacts to file in the specified format."""
-    if format == OutputFormat.JSON:
-        output_file = output_dir / "analysis.json"
-        # Use Pydantic's model_dump_json() for compact output
-        json_str = model_dump_json(artifacts, indent=None, exclude_none=True)
-        with output_file.open("w") as f:
-            f.write(json_str)
-        logger.info(f"Analysis saved to {output_file}")
-
-    elif format == OutputFormat.MSGPACK:
-        output_file = output_dir / "analysis.msgpack"
-        msgpack_data = artifacts.to_msgpack_bytes()
-        with output_file.open("wb") as f:
-            f.write(msgpack_data)
-        logger.info(f"Analysis saved to {output_file}")
-        logger.info(
-            f"Compression ratio: {artifacts.get_compression_ratio():.1%} of JSON size"
-        )
+            _write_output(artifacts, options.output)
+
+
+def _write_output(artifacts, output_dir: Path):
+    """Write analysis.json (the single wire format since #118)."""
+    output_file = output_dir / "analysis.json"
+    # Use Pydantic's model_dump_json() for compact output
+    # Strip internal-only fields here rather than with a field-level Pydantic
+    # `exclude`: the analysis cache shares the serializer and must keep them.
+    json_str = json.dumps(
+        strip_internal_only(model_dump(artifacts, mode="json", exclude_none=True))
+    )
+    with output_file.open("w") as f:
+        f.write(json_str)
+    logger.info(f"Analysis saved to {output_file}")
 
 
 app = typer.Typer(
     callback=main,
     name="canpy",
-    help="Static Analysis on Python source code using Jedi, PyCG and Tree sitter.",
+    help="Static Analysis on Python source code using Jedi and Tree sitter.",
     invoke_without_command=True,
     no_args_is_help=True,
     add_completion=False,

codeanalyzer/core.py

@@ -29,7 +29,7 @@ from codeanalyzer.semantic_analysis.call_graph import (
     merge_edges,
     resolve_unresolved_constructors,
 )
-from codeanalyzer.semantic_analysis.pycg import PyCG, PyCGExceptions
+from codeanalyzer.semantic_analysis.defuse_linker import defuse_linker_edges
 from codeanalyzer.syntactic_analysis.exceptions import SymbolTableBuilderRayError
 from codeanalyzer.syntactic_analysis.import_resolver import resolve_imports
 from codeanalyzer.syntactic_analysis.symbol_table_builder import SymbolTableBuilder
@@ -41,7 +41,7 @@ def _ensure_ray() -> None:
     """Initialize Ray with the driver's pinned hash seed in the workers.
 
     An implicit auto-init would not carry PYTHONHASHSEED into worker
-    interpreters, so PyCG shards (and Jedi inference) run there with random
+    interpreters, so Jedi inference in Ray workers would run with random
     set-iteration order and the emitted edges vary run to run (issue #99)."""
     if not ray.is_initialized():
         ray.init(
@@ -592,14 +592,20 @@ class Codeanalyzer:
         logger.info("✅ Jedi: %d edges in %.1fs", len(call_graph), time.perf_counter() - t0_jedi)
 
         if self.analysis_level >= 2:
-            # Level 2: also add PyCG edges. The Jedi edges double as the
-            # coupling graph that drives coupling-aware PyCG sharding.
-            pycg_edges = self._get_pycg_call_graph(symbol_table, jedi_edges)
-            call_graph = merge_edges(call_graph, pycg_edges)
+            # Level 2: the defuse linker backfills call sites Jedi could not
+            # resolve, from local def-use chains and module-scope bindings
+            # (docs/design/specs/2026-08-25-defuse-linker-call-graph-design.md).
+            t0_linker = time.perf_counter()
+            defuse_edges, defuse_resolutions = defuse_linker_edges(symbol_table)
+            call_graph = merge_edges(call_graph, defuse_edges)
+            logger.info(
+                "✅ defuse linker: %d edges in %.1fs",
+                len(defuse_edges), time.perf_counter() - t0_linker,
+            )
 
         call_graph = filter_external_edges(call_graph, symbol_table)
-        # Canonical edge order: backend iteration order (PyCG dicts, Counter
-        # insertion) is not a contract — sort so identical edge SETS always
+        # Canonical edge order: backend iteration order (Counter insertion,
+        # dict iteration) is not a contract — sort so identical edge SETS always
         # serialize identically (issue #99 determinism gate), and so the
         # external-symbol homing below assigns ids in a stable order.
         call_graph.sort(key=lambda e: (e.src, e.dst))
@@ -633,9 +639,15 @@ class Codeanalyzer:
         app.external_symbols = self._home_external_symbols(app, app.id, sig_to_id)
         populate_l1_body(app)
         if self.analysis_level >= 2:
-            backfill_callees(app, sig_to_id)
+            backfill_callees(app, sig_to_id, resolutions=defuse_resolutions)
         reidentify_call_graph(app, sig_to_id)
 
+        # Entrypoints: a post-pass over the built L1 tree (#27). Runs at every
+        # level -- entrypoints are L1 data and must not vary with -a.
+        from codeanalyzer.entrypoints import detect_entrypoints
+
+        detect_entrypoints(app, self.project_dir, self.options.entrypoint_rules)
+
         # L3: intraprocedural dataflow (CFG/CDG/DDG) emitted onto the v2 tree.
         if self.analysis_level >= 3:
             from codeanalyzer.dataflow.builder import (
@@ -936,39 +948,3 @@ class Codeanalyzer:
             len(symbol_table), time.perf_counter() - t0_st,
         )
         return symbol_table
-
-    def _get_pycg_call_graph(
-        self,
-        symbol_table: Dict[str, PyModule],
-        jedi_edges: List[PyCallEdge],
-    ) -> List[PyCallEdge]:
-        """Build PyCG-resolved call edges.
-
-        Runs PyCG's iterative name-pointer analysis over the whole project
-        and returns edges with ``prov=["pycg"]``.  Falls back to an
-        empty list and logs a warning on any failure so the caller can
-        continue with Jedi-only edges.
-
-        *jedi_edges* are the level-1 call edges; under the ``jedi`` shard
-        strategy they drive coupling-aware partitioning (see
-        :func:`shard_planner.plan_shards`).
-        """
-        try:
-            pycg = PyCG(
-                self.project_dir,
-                skip_tests=self.skip_tests,
-                shard=self.options.pycg_shard,
-                shard_ceiling=self.options.pycg_shard_ceiling,
-                shard_timeout=self.options.pycg_shard_timeout,
-                shard_strategy=self.options.pycg_shard_strategy,
-                max_iter=self.options.pycg_max_iter,
-                using_ray=self.using_ray,
-            )
-            return pycg.build_call_graph_edges(symbol_table, jedi_edges=jedi_edges)
-        except PyCGExceptions.PyCGImportError as exc:
-            logger.warning(f"PyCG not installed — level 2 edges will be Jedi-only: {exc}")
-            return []
-        except PyCGExceptions.PyCGAnalysisError as exc:
-            logger.warning(f"PyCG analysis failed — level 2 edges will be Jedi-only: {exc}")
-            logger.debug("PyCG full traceback:", exc_info=True)
-            return []

codeanalyzer/dataflow/access_paths.py

@@ -245,15 +245,37 @@ def _names_loaded(node: ast.AST) -> Set[str]:
     return out
 
 
-def build_scope(func: ast.AST, enclosing_locals: Set[str]) -> FunctionScope:
+#: Jedi resolves every spelling of the builtin -- ``@staticmethod``,
+#: ``@builtins.staticmethod``, ``from builtins import staticmethod as sm`` --
+#: to this one name (#135).
+_STATICMETHOD_QUALIFIED = "builtins.staticmethod"
+
+
+def build_scope(
+    func: ast.AST,
+    enclosing_locals: Set[str],
+    decorator_names: Optional[Set[str]] = None,
+) -> FunctionScope:
     """Classify every base name the callable touches. ``enclosing_locals`` is
     the union of locals/params of all enclosing callables (for capture vs
-    global disambiguation)."""
+    global disambiguation).
+
+    ``decorator_names`` are the callable's Jedi-resolved decorator
+    ``qualified_name``s. When supplied, staticmethod detection is by identity,
+    so a dotted or aliased spelling is recognised (#135). When omitted -- a
+    caller with no resolved records -- it falls back to matching the written
+    source, which only recognises the bare ``@staticmethod``.
+    """
     params = _param_names(func)
     scope = FunctionScope(params=params)
     if params and isinstance(func, (ast.FunctionDef, ast.AsyncFunctionDef)):
-        decorators = {ast.unparse(d) for d in func.decorator_list}
-        if params[0] in ("self", "cls") and "staticmethod" not in decorators:
+        if decorator_names is None:
+            is_static = "staticmethod" in {
+                ast.unparse(d) for d in func.decorator_list
+            }
+        else:
+            is_static = _STATICMETHOD_QUALIFIED in decorator_names
+        if params[0] in ("self", "cls") and not is_static:
             scope.self_name = params[0]
     scope.globals_ = _declared(func, ast.Global)
     nonlocals = _declared(func, ast.Nonlocal)

codeanalyzer/dataflow/builder.py

@@ -186,6 +186,13 @@ def build_function_pdgs(
                 oracle=oracle,
                 k=k,
                 global_qualifier=module.module_name,
+                # Resolved decorator names, so staticmethod detection works for a
+                # dotted or aliased spelling and not just bare `@staticmethod` (#135).
+                decorator_names={
+                    d.qualified_name
+                    for d in (pycallable.decorators or [])
+                    if d.qualified_name
+                },
             )
             infos[pycallable.signature] = FunctionInfo(
                 signature=pycallable.signature, pdg=pdg, oracle=oracle

codeanalyzer/dataflow/identity.py

@@ -10,7 +10,7 @@ Two forms per node:
   an L1 body node and its coinciding CFG node land on the same key and L1 ⊆ L3
   holds.
 * **global** — ``"<callable can:// id>@<local>"``, the fully addressable id for
-  cross-callable references and the Neo4j PyCFGNode keys (a later task).
+  cross-callable references and the Neo4j PyBodyNode keys (a later task).
 """
 from __future__ import annotations
 from collections import defaultdict

codeanalyzer/dataflow/pdg.py

@@ -66,10 +66,15 @@ def build_pdg(
     oracle: TypeBasedAliasOracle,
     k: int = 3,
     global_qualifier: Optional[str] = None,
+    decorator_names: Optional[Set[str]] = None,
 ) -> FunctionPDG:
-    """CFG → dominance → def-use → PDG for one callable."""
+    """CFG → dominance → def-use → PDG for one callable.
+
+    ``decorator_names`` are the callable's resolved decorator qualified names,
+    used for staticmethod detection by identity rather than spelling (#135).
+    """
     cfg = build_cfg(func)
-    scope = build_scope(func, enclosing_locals)
+    scope = build_scope(func, enclosing_locals, decorator_names=decorator_names)
     facts = statement_facts(cfg, func, scope, k, global_qualifier)
 
     edges: List[PDGEdge] = [

codeanalyzer/dataflow/scc.py

@@ -17,7 +17,7 @@
 """Stage 5b of the level-3 dataflow ladder: SCC condensation of the call graph.
 
 The call graph is a frozen oracle (level-1 Jedi edges, provenance-merged with
-level-2 PyCG when enabled); Tarjan condenses it into strongly connected
+level-2 resolvers); Tarjan condenses it into strongly connected
 components, and the condensation DAG in reverse topological order is the
 bottom-up processing schedule for summary composition — callees before
 callers, one monotone fixpoint per SCC (mutual recursion).

codeanalyzer/entrypoints/__init__.py

@@ -0,0 +1,3 @@
+from codeanalyzer.entrypoints.pipeline import detect_entrypoints
+
+__all__ = ["detect_entrypoints"]

codeanalyzer/entrypoints/detect.py

@@ -0,0 +1,124 @@
+"""Stage 0: which frameworks is this project actually using? (#27)
+
+Gates every later stage, so a project without Celery never pays for Celery
+rules and cannot false-positive on a locally-defined ``shared_task``. A
+package counts as present if first-party source imports it OR the dependency
+manifest names it -- either is sufficient, since an import may be dynamic.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Optional, Set
+
+from codeanalyzer.entrypoints.rules import RuleSet
+from codeanalyzer.schema.py_schema import PyApplication
+
+_REQ = re.compile(r"^\s*['\"]?([A-Za-z0-9_.\-]+)")
+_DEPS_START = re.compile(r"dependencies\s*=\s*\[")
+_TABLE_HEADER = re.compile(r"(?m)^[ \t]*\[")
+_PKG = re.compile(r"['\"]([A-Za-z0-9][A-Za-z0-9_.\-]*)")
+
+
+def detected_frameworks(app: PyApplication, project_dir: Path, rules: RuleSet) -> Set[str]:
+    # `present` (imports, manifest names) and `detect:` values are both
+    # lowercased before comparison -- manifest names were already lowercased
+    # (PyPI/pip is case-insensitive) but imports and `detect:` were not, so
+    # a `detect: [Flask]` user rule silently never matched a `flask` import.
+    present = _imported_packages(app) | _manifest_packages(project_dir)
+    return {
+        name
+        for name, fw in rules.frameworks.items()
+        if any(pkg.lower() in present for pkg in (fw.detect or [name]))
+    }
+
+
+def _imported_packages(app: PyApplication) -> Set[str]:
+    out: Set[str] = set()
+    for mod in app.symbol_table.values():
+        for imp in mod.imports or []:
+            # `from flask import Flask` puts the package in `module`, not `name`.
+            # Prefer `module`; fall back to `name` for a bare `import flask`.
+            spelling = (getattr(imp, "module", "") or getattr(imp, "name", "") or "")
+            spelling = spelling.lstrip(".")
+            if spelling:
+                out.add(spelling.split(".", 1)[0].lower())
+    return out
+
+
+def _manifest_packages(project_dir: Path) -> Set[str]:
+    out: Set[str] = set()
+    pyproject = project_dir / "pyproject.toml"
+    if pyproject.exists():
+        # PEP 621 `[project] dependencies = [...]` -- single- or multi-line,
+        # possibly containing nested `[...]` extras (`celery[redis]`).
+        span = _deps_array_span(_strip_comments(pyproject.read_text()))
+        if span is not None:
+            for pm in _PKG.finditer(span):
+                out.add(pm.group(1).split("[", 1)[0].lower())
+    requirements = project_dir / "requirements.txt"
+    if requirements.exists():
+        for line in requirements.read_text().splitlines():
+            m = _REQ.match(line)
+            if m:
+                out.add(m.group(1).split("[", 1)[0].lower())
+    return out
+
+
+def _strip_comments(text: str) -> str:
+    """Drop everything from an unquoted ``#`` to end of line.
+
+    # ponytail: quote tracking resets each line, so a `#` inside a
+    # triple-quoted string spanning lines could be mis-stripped. TOML
+    # dependency arrays don't use those in practice; revisit if they do.
+    """
+    out_lines = []
+    for line in text.splitlines():
+        in_str = None
+        cut = len(line)
+        for i, ch in enumerate(line):
+            if in_str:
+                if ch == in_str:
+                    in_str = None
+            elif ch in ("'", '"'):
+                in_str = ch
+            elif ch == "#":
+                cut = i
+                break
+        out_lines.append(line[:cut])
+    return "\n".join(out_lines)
+
+
+def _deps_array_span(text: str) -> Optional[str]:
+    """Return the contents between the `dependencies = [` and its matching
+    `]`, counting bracket depth so a nested `[...]` (extras, e.g.
+    `celery[redis]`) doesn't close the span early.
+
+    Bounded by the next TOML table header (a `[` starting a line): if the
+    array never closes before then, it's unterminated (truncated/corrupt
+    file) and this returns None rather than harvesting quoted strings out
+    of whatever table follows.
+    """
+    m = _DEPS_START.search(text)
+    if not m:
+        return None
+    boundary = _TABLE_HEADER.search(text, m.end())
+    limit = boundary.start() if boundary else len(text)
+    depth = 1
+    in_str = None
+    i = m.end()
+    while i < limit and depth > 0:
+        ch = text[i]
+        if in_str:
+            if ch == in_str:
+                in_str = None
+        elif ch in ("'", '"'):
+            in_str = ch
+        elif ch == "[":
+            depth += 1
+        elif ch == "]":
+            depth -= 1
+        i += 1
+    if depth != 0:
+        return None
+    return text[m.end() : i - 1]