codeanalyzer-python 1.4.0__py3-none-any.whl → 1.4.1__py3-none-any.whl

codeanalyzer/dataflow/builder.py

@@ -43,6 +43,7 @@ from codeanalyzer.dataflow.alias import TypeBasedAliasOracle
 from codeanalyzer.dataflow.pdg import build_pdg
 from codeanalyzer.dataflow.sdg import ProgramGraphsIR, assemble_sdg
 from codeanalyzer.dataflow.summaries import CallSite, FunctionInfo, compute_summaries
+from codeanalyzer.schema.ids import stamp_body_ids
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass, PyModule
 from codeanalyzer.utils import logger
 
@@ -333,6 +334,7 @@ def emit_l3_body(
                     for e in pdg.edges
                     if e.type == "DDG"
                 ]
+            stamp_body_ids(pycallable)
 
 
 def build_program_graphs(
@@ -538,6 +540,7 @@ def emit_l4(
             pycallable.body[im.local(pn.id)] = BodyNode(
                 kind=pn.kind, of=pn.var, parent=parent
             )
+        stamp_body_ids(pycallable)
 
     # (b/c/d) SDG edges → summary / param_in / param_out; CALL dropped.
     for e in ir.sdg_edges:

codeanalyzer/dataflow/identity.py

@@ -16,6 +16,8 @@ from __future__ import annotations
 from collections import defaultdict
 from typing import Dict, Iterable, Optional, Tuple
 
+from codeanalyzer.schema.ids import global_ordinal
+
 
 class IdentityMap:
     def __init__(self, callable_id: str, id_to_local: Dict[int, str]):
@@ -83,9 +85,7 @@ class IdentityMap:
 
     def global_id(self, node_id: int) -> str:
         """Fully addressable id: ``"<callable-id>@<local>"``."""
-        loc = self._map[node_id]
-        # local statements are "line:col"; bookends already carry the leading "@"
-        return f"{self._callable_id}{loc}" if loc.startswith("@") else f"{self._callable_id}@{loc}"
+        return global_ordinal(self._callable_id, self._map[node_id])
 
     def node_ids(self) -> Iterable[int]:
         return self._map.keys()

codeanalyzer/entrypoints/matching.py

@@ -64,7 +64,8 @@ def _compile(pattern: str) -> str:
         if ch == "{":
             j = pattern.index("}", i)
             alts = pattern[i + 1 : j].split(",")
-            out.append("(?:" + "|".join(re.escape(a.strip()) for a in alts) + ")")
+            # `*` keeps its meaning inside an alternative, so `{route,*.route}` works.
+            out.append("(?:" + "|".join(_compile(a.strip()) for a in alts) + ")")
             i = j + 1
         elif ch == "*":
             out.append(r"[^.\s]*")
@@ -93,15 +94,17 @@ def _route_of(dec, spec: Optional[Dict[str, Any]]) -> Optional[str]:
     if idx >= len(args):
         return None
     value = _literal(args[idx])
+    if isinstance(value, (list, tuple)):
+        value = next((v for v in value if isinstance(v, str)), None)
     return value if isinstance(value, str) else None
 
 
-def _methods_of(dec, spec: Optional[Dict[str, Any]]) -> List[str]:
+def _methods_of(dec, spec: Optional[Dict[str, Any]], qualified: Optional[str] = None) -> List[str]:
     if not spec:
         return []
     source = spec.get("from")
     if source == "match_suffix":
-        verb = (dec.qualified_name or "").rsplit(".", 1)[-1]
+        verb = (qualified or dec.qualified_name or "").rsplit(".", 1)[-1]
         return [verb.upper()]
     if source == "keyword":
         raw = (dec.keyword_arguments or {}).get(spec.get("name", ""))
@@ -113,12 +116,27 @@ def _methods_of(dec, spec: Optional[Dict[str, Any]]) -> List[str]:
 
 
 def entrypoints_from_decorators(
-    node, framework: str, rules: Iterable["DecoratorRule"]
+    node,
+    framework: str,
+    rules: Iterable["DecoratorRule"],
+    resolve: Optional[Callable[[str], str]] = None,
+    on_written: bool = False,
 ) -> List[PyEntrypoint]:
+    """``resolve`` is the module's import-table resolver (#177): when Jedi could
+    not resolve a decorator (the framework is not importable in the analysis
+    environment -- every ``--no-venv`` run), ``@http.route`` still resolves to
+    ``odoo.http.route`` from ``from odoo import http`` alone, the same way base
+    classes already do. Jedi's definition path wins when it exists.
+
+    ``on_written`` is the heuristic tier: rules match the decorator's spelling
+    as WRITTEN (``http.route``, ``router.post``), no resolution at all, so a
+    shape that reads as an HTTP entrypoint is recorded whether or not any
+    framework rule knows the library behind it."""
     out: List[PyEntrypoint] = []
     for dec in getattr(node, "decorators", []) or []:
+        qualified = dec.name if on_written else decorator_qualified_name(dec, resolve)
         for rule in rules:
-            if not match_pattern(rule.match, dec.qualified_name):
+            if not match_pattern(rule.match, qualified):
                 continue
             out.append(
                 PyEntrypoint(
@@ -126,14 +144,25 @@ def entrypoints_from_decorators(
                     confidence=rule.confidence,
                     rule=rule.id,
                     ruleset=rule.origin,
-                    evidence=dec.qualified_name,
+                    evidence=qualified,
                     route=_route_of(dec, rule.route),
-                    http_methods=_methods_of(dec, rule.methods),
+                    http_methods=_methods_of(dec, rule.methods, qualified),
                 )
             )
     return out
 
 
+def decorator_qualified_name(dec, resolve: Optional[Callable[[str], str]]) -> Optional[str]:
+    """Jedi's resolution, else the import-table resolution of the written
+    spelling, else ``None`` (a spelling the import table cannot map either)."""
+    if dec.qualified_name:
+        return dec.qualified_name
+    if resolve is None:
+        return None
+    resolved = resolve(dec.name)
+    return resolved if resolved != dec.name else None
+
+
 def entrypoints_from_bases(
     cls,
     framework: str,

codeanalyzer/entrypoints/pipeline.py

@@ -6,11 +6,14 @@ loses flags, never the analysis.
 """
 from __future__ import annotations
 
+import builtins
 from pathlib import Path
-from typing import Dict, Iterable, Iterator
+from typing import Dict, Iterable, Iterator, Set
 
 from codeanalyzer.entrypoints.detect import detected_frameworks
-from codeanalyzer.entrypoints.matching import entrypoints_from_bases, entrypoints_from_decorators
+from codeanalyzer.entrypoints.matching import (
+    decorator_qualified_name, entrypoints_from_bases, entrypoints_from_decorators,
+)
 from codeanalyzer.entrypoints.rules import RuleSet, load_rules
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass, PyModule
 from codeanalyzer.utils import logger
@@ -56,18 +59,34 @@ def _run_stages(app: PyApplication, project_dir: Path, rules: RuleSet) -> None:
     """
     for node in _walk(app):
         node.entrypoints = []
+    app.entrypoint_report.unresolved = {}
 
     app.entrypoint_report.rulesets = list(rules.rulesets)
     frameworks = detected_frameworks(app, project_dir, rules)
     app.entrypoint_report.frameworks_detected = sorted(frameworks)
 
     names = sorted(frameworks)
+    unresolved = app.entrypoint_report.unresolved
     for mod in app.symbol_table.values():
         resolve = _base_resolver(mod)
+        known = _known_heads(mod)
         for node in _walk_module(mod):
+            # #177: what neither Jedi nor the import table could name. This is
+            # the counter that makes silence visible; it was never written before.
+            # A builtin, a declared class, or a name whose head is imported is
+            # nameable and is not counted (`object`, `Exception`, `typing.Generic[T]`).
+            for dec in getattr(node, "decorators", None) or []:
+                if decorator_qualified_name(dec, resolve) is None and _unnameable(dec.name, known):
+                    unresolved[dec.name] = unresolved.get(dec.name, 0) + 1
+            if isinstance(node, PyClass):
+                for base in node.base_classes or []:
+                    if _unnameable(base, known):
+                        unresolved[base] = unresolved.get(base, 0) + 1
             for name in names:
                 fw = rules.frameworks[name]
-                node.entrypoints.extend(entrypoints_from_decorators(node, name, fw.decorators))
+                node.entrypoints.extend(
+                    entrypoints_from_decorators(node, name, fw.decorators, resolve)
+                )
                 if isinstance(node, PyClass) and fw.bases:
                     class_eps, method_eps = entrypoints_from_bases(
                         node, name, fw.bases, resolve
@@ -77,6 +96,34 @@ def _run_stages(app: PyApplication, project_dir: Path, rules: RuleSet) -> None:
                         target = (node.callables or {}).get(method_name)
                         if target is not None:
                             target.entrypoints.extend(eps)
+            # Heuristic tier: the written spelling, no framework needed. Runs
+            # last so a node a framework rule already claimed keeps one record.
+            if not node.entrypoints and rules.heuristics:
+                node.entrypoints.extend(
+                    entrypoints_from_decorators(
+                        node, "heuristic", rules.heuristics, resolve, on_written=True
+                    )
+                )
+
+
+_BUILTIN_NAMES: Set[str] = set(dir(builtins))
+
+
+def _known_heads(mod: PyModule) -> Set[str]:
+    """Names that can head a nameable spelling in this module: its declared classes
+    and every imported name or alias."""
+    heads = {cl.name for cl in (mod.types or {}).values()}
+    for imp in mod.imports or []:
+        heads.add(imp.alias or imp.name)
+    return heads
+
+
+def _unnameable(written: str, known: Set[str]) -> bool:
+    """Whether a written base/decorator spelling maps to nothing this module can
+    name: not a builtin, not a declared class, and its head is not imported.
+    Subscripts (`Generic[T]`, `dict[K, V]`) are stripped before the check."""
+    head = written.split("[", 1)[0].split(".", 1)[0].strip()
+    return bool(head) and head not in _BUILTIN_NAMES and head not in known
 
 
 def _base_resolver(mod: PyModule):
@@ -90,7 +137,8 @@ def _base_resolver(mod: PyModule):
     aliases: Dict[str, str] = {}
     for imp in mod.imports or []:
         original = imp.alias or imp.name
-        aliases[imp.name] = imp.module if imp.module == original else f"{imp.module}.{original}"
+        module = imp.resolved_module or imp.module
+        aliases[imp.name] = module if imp.module == original else f"{module}.{original}"
 
     def resolve(written: str) -> str:
         head, _, rest = written.partition(".")

codeanalyzer/entrypoints/rules.py

@@ -22,7 +22,7 @@ _CONFIDENCE = {"declared", "certain", "heuristic"}
 # blocks (Units 4-5) not implemented yet; they are deliberately absent here
 # rather than accepted-and-ignored, so a user file using them fails loudly
 # instead of loading clean and doing nothing.
-_TOP_LEVEL_KEYS = {"version", "frameworks", "disable"}
+_TOP_LEVEL_KEYS = {"version", "frameworks", "heuristics", "disable"}
 
 
 class RulesError(Exception):
@@ -60,6 +60,10 @@ class Framework:
 @dataclass
 class RuleSet:
     frameworks: Dict[str, Framework] = field(default_factory=dict)
+    # Framework-independent decorator rules matched on the WRITTEN spelling,
+    # confidence `heuristic` by default. They run on every node regardless of
+    # `frameworks_detected` and never double a record a framework rule made.
+    heuristics: List[DecoratorRule] = field(default_factory=list)
     rulesets: List[str] = field(default_factory=list)
 
 
@@ -103,9 +107,16 @@ def _merge(out: RuleSet, data: Dict[str, Any], origin: str) -> None:
         for raw in body.get("bases") or []:
             fw.bases.append(_base_rule(raw, origin))
 
+    heuristics = data.get("heuristics") or {}
+    if not isinstance(heuristics, dict):
+        raise RulesError(f"{origin}: `heuristics` must be a mapping")
+    for raw in heuristics.get("decorators") or []:
+        out.heuristics.append(_decorator_rule({"confidence": "heuristic", **raw}, origin))
+
     for fw in out.frameworks.values():
         fw.decorators = [r for r in fw.decorators if r.id not in disabled]
         fw.bases = [r for r in fw.bases if r.id not in disabled]
+    out.heuristics = [r for r in out.heuristics if r.id not in disabled]
 
 
 def _disable_list(data: Dict[str, Any], origin: str) -> List[str]:

codeanalyzer/entrypoints/rules.yml

@@ -22,6 +22,24 @@ frameworks:
         transitive: true
         dispatch: [get, post, put, delete, patch]
 
+  odoo:
+    detect: [odoo]
+    decorators:
+      # `route` is a plain function in odoo/http.py, so Jedi's definition path
+      # and the import-table fallback (`from odoo import http` + `@http.route`,
+      # the shape every --no-venv run sees) both spell it `odoo.http.route`.
+      # The first positional may be one route or a list of them. Odoo serves
+      # GET and POST on a route unless `methods=` narrows it (json-typed routes
+      # are POST), so the default is both, not GET.
+      - id: odoo.route
+        match: "odoo.http.route"
+        route: {from: positional, index: 0}
+        methods: {from: keyword, name: methods, default: [GET, POST]}
+    bases:
+      - id: odoo.controller
+        match: "odoo.http.Controller"
+        transitive: true
+
   fastapi:
     detect: [fastapi]
     decorators:
@@ -86,3 +104,19 @@ frameworks:
         match: "django.views.generic.*"
         transitive: true
         dispatch: [get, post, put, patch, delete, head, options]
+
+# Framework-independent tier. Matched on the decorator's WRITTEN spelling, never
+# on a resolved name, so a shape that reads as an HTTP entrypoint is flagged even
+# when the library behind it has no `frameworks:` block above (or is not
+# importable). Confidence `heuristic`; a consumer wanting only certain hits
+# filters on it. A node a framework rule already matched gets no heuristic record.
+heuristics:
+  decorators:
+    - id: heuristic.http-route
+      match: "{route,*.route,*.*.route}"
+      route: {from: positional, index: 0}
+      methods: {from: keyword, name: methods}
+    - id: heuristic.http-verb
+      match: "{*,*.*}.{get,post,put,patch,delete,head,options,websocket}"
+      route: {from: positional, index: 0}
+      methods: {from: match_suffix}

codeanalyzer/neo4j/bolt.py

@@ -37,13 +37,16 @@ opt-in under the same flag that already forces a clean analysis rebuild.
 
 Nodes are MERGE-upserted, never blindly deleted, so a declaration another
 (unchanged) module still references survives and its incoming edges stay valid.
-``:PyExternal`` / ``:PyPackage`` / ``:PyDecorator`` are shared (no ``_module``) and are
+``:PyExternal`` / ``:PyPackage`` / ``:PyDecorator`` have no owning module and are
 MERGE-only.
 
-Every ``_module`` match is anchored on the python-owned labels
-(``schema.MODULE_OWNED_PATTERN``). ``_module`` is a shared convention, not a python-private
-one -- codeanalyzer-java and codeanalyzer-typescript set it on their nodes too -- so an
-unlabelled match reaches a sibling analyzer's graph in a shared database (#171).
+**Every destructive statement is scoped on the ``can://`` id prefix** (#173). The id is a
+path — ``can://python/<app>/<file>/...`` — so ``id = <module-id> OR id STARTS WITH
+<module-id> + '/'`` is containment, and it is one language, one application and one
+module at once. That is what neither a label anchor nor the retired ``_module`` property
+could give: two python applications sharing ``src/foo.py`` carry identical labels and an
+identical file key, and only the id tells them apart. ``:PyCanNode`` anchors the predicate
+so it seeks an index instead of scanning the store; it carries no safety claim.
 
 The ``neo4j`` driver is imported lazily so it stays an optional dependency and
 off the default (json) output path entirely.
@@ -53,16 +56,34 @@ from __future__ import annotations
 from dataclasses import dataclass
 from typing import Dict, List, Optional
 
-from codeanalyzer.neo4j.rows import EdgeRow, GraphRows, NodeRow, chunk
-from codeanalyzer.neo4j.schema import CONSTRAINTS, INDEXES, MODULE_OWNED_PATTERN
+from codeanalyzer.neo4j.rows import (
+    CAN_NODE, EdgeRow, GraphRows, NodeRow, application_prefix, chunk, descendant_prefix,
+)
+from codeanalyzer.neo4j.schema import CONSTRAINTS, INDEXES
 from codeanalyzer.utils import logger
 
-DESCENDANTS = (
-    "[:PY_DECLARES|PY_HAS_METHOD|PY_HAS_ATTRIBUTE|PY_DECLARES_VAR"
-    "|PY_HAS_CALLSITE|PY_HAS_BODY_NODE*1..]"
-)
 BATCH = 1000
 
+# The per-module purge (#173): the module by equality, its subtree by prefix. Anchored
+# on :PyCanNode only so the predicate can seek (see ``rows.CAN_NODE``).
+PURGE_MODULE_EDGES = (
+    f"MATCH (x:{CAN_NODE}) WHERE x.id = $mid OR x.id STARTS WITH $pre "
+    "MATCH (x)-[r]->() DELETE r"
+)
+PURGE_VANISHED_NODES = (
+    f"MATCH (x:{CAN_NODE}) WHERE (x.id = $mid OR x.id STARTS WITH $pre) "
+    "AND NOT x.id IN $keys DETACH DELETE x"
+)
+# The orphan prune: modules inside this application's prefix that the run no longer
+# emits, and everything under each. Batched — deleting a large application in one
+# transaction exhausts dbms.memory.transaction.total.max (typescript#116).
+PRUNE_VANISHED_MODULES = (
+    f"MATCH (m:PyModule:{CAN_NODE}) WHERE m.id STARTS WITH $app AND NOT m.id IN $present "
+    f"CALL {{ WITH m MATCH (x:{CAN_NODE}) WHERE x.id = m.id OR x.id STARTS WITH m.id + '/' "
+    "DETACH DELETE x } IN TRANSACTIONS OF 1000 ROWS "
+    "RETURN count(*) AS pruned"
+)
+
 
 @dataclass
 class BoltConfig:
@@ -93,35 +114,44 @@ def bolt_writer(rows: GraphRows, cfg: BoltConfig, full_run: bool, eager: bool =
             for stmt in [*CONSTRAINTS, *INDEXES]:
                 s.run(stmt)
 
-        # The application anchor (a shared node) — used to scope the orphan prune
-        # so it never touches modules belonging to a different :PyApplication.
+        # The application anchor. Every destructive statement below is scoped to
+        # ``can://python/<app>/``; an empty application id is refused up front rather
+        # than becoming ``STARTS WITH ''`` (every node in the database).
         app_name = next(
             (n.value for n in rows.nodes if n.labels and n.labels[0] == "PyApplication"),
             None,
         )
+        app_prefix = application_prefix(app_name)
 
-        # Partition nodes by owning module; shared nodes have no _module.
+        # Partition nodes by owning module (an in-memory field, never emitted, #173);
+        # shared nodes have none.
         by_module: Dict[str, List[NodeRow]] = {}
         shared: List[NodeRow] = []
         module_of: Dict[str, str] = {}  # node value → owning module
         for n in rows.nodes:
-            m = n.props.get("_module")
-            if isinstance(m, str):
-                by_module.setdefault(m, []).append(n)
-                module_of[n.value] = m
+            if n.module is not None:
+                by_module.setdefault(n.module, []).append(n)
+                module_of[n.value] = n.module
             else:
                 shared.append(n)
 
-        # 2. diff content_hash.
+        # 2. diff content_hash, keyed by module id inside this application's prefix.
+        # Keyed by file key it was application-blind: a second application whose
+        # module shares the path and the hash looked "unchanged" and was never written.
         db_hash: Dict[str, Optional[str]] = {}
         with session() as s:
-            res = s.run("MATCH (m:PyModule) RETURN m.file_key AS k, m.content_hash AS h")
+            res = s.run(
+                f"MATCH (m:PyModule:{CAN_NODE}) WHERE m.id STARTS WITH $app "
+                "RETURN m.id AS k, m.content_hash AS h",
+                app=app_prefix,
+            )
             for rec in res:
                 db_hash[rec["k"]] = rec["h"]
         changed = set()
         for m, nodes in by_module.items():
-            row_hash = _hash_of(nodes, m)
-            if m not in db_hash or row_hash is None or row_hash != db_hash.get(m):
+            mid = _module_id_of(nodes)
+            row_hash = _hash_of(nodes)
+            if mid not in db_hash or row_hash is None or row_hash != db_hash.get(mid):
                 changed.add(m)
         logger.info(
             f"neo4j(bolt): {len(by_module)} modules ({len(changed)} changed), "
@@ -139,23 +169,19 @@ def bolt_writer(rows: GraphRows, cfg: BoltConfig, full_run: bool, eager: bool =
             if not eager:
                 _upsert_nodes(session, neo4j, nodes)
                 continue
+            # The module id comes from the module's own row, never by splitting a
+            # declaration's id: a file key may itself contain '/'.
+            module_id = _module_id_of(nodes)
+            if module_id is None or not module_id.startswith(app_prefix):
+                raise ValueError(
+                    f"neo4j: module {m!r} has no can:// id under {app_prefix!r}; "
+                    "refusing to purge"
+                )
             with session() as s:
-                def _purge(tx, module=m, node_keys=keys):
-                    # Anchored on python-owned labels: `_module` is also set by the java
-                    # and typescript analyzers, so an unlabelled match would delete a
-                    # sibling's nodes wherever a file key collides (#171).
-                    tx.run(
-                        f"MATCH (x:{MODULE_OWNED_PATTERN}) WHERE x._module = $m "
-                        "MATCH (x)-[r]->() DELETE r",
-                        m=module,
-                    )
-                    tx.run(
-                        f"MATCH (x:{MODULE_OWNED_PATTERN}) WHERE x._module = $m "
-                        "AND NOT coalesce(x.signature, x.id, x.file_key) IN $keys "
-                        "DETACH DELETE x",
-                        m=module,
-                        keys=node_keys,
-                    )
+                def _purge(tx, mid=module_id, node_keys=keys):
+                    params = {"mid": mid, "pre": descendant_prefix(mid)}
+                    tx.run(PURGE_MODULE_EDGES, **params)
+                    tx.run(PURGE_VANISHED_NODES, keys=node_keys, **params)
 
                 s.execute_write(_purge)
             _upsert_nodes(session, neo4j, nodes)
@@ -169,19 +195,13 @@ def bolt_writer(rows: GraphRows, cfg: BoltConfig, full_run: bool, eager: bool =
         _upsert_edges(session, neo4j, edges)
 
         # 6. orphan prune — only safe on a full run (a targeted run can't tell deleted from untargeted).
-        # Scope to THIS application's anchor so a full run for application B never
-        # deletes application A's modules from a shared database.
-        if full_run and eager and app_name is not None:
-            present = list(by_module.keys())
+        # Scoped to ``can://python/<app>/`` so a full run for application B never deletes
+        # application A's modules from a shared database — even when both are python and
+        # share a module path.
+        if full_run and eager:
+            present = [mid for mid in (_module_id_of(ns) for ns in by_module.values()) if mid]
             with session() as s:
-                res = s.run(
-                    "MATCH (:PyApplication {name: $app})-[:PY_HAS_MODULE]->(m:PyModule) "
-                    "WHERE NOT m.file_key IN $present "
-                    f"OPTIONAL MATCH (m)-{DESCENDANTS}->(x) DETACH DELETE x, m "
-                    "RETURN count(m) AS pruned",
-                    app=app_name,
-                    present=present,
-                )
+                res = s.run(PRUNE_VANISHED_MODULES, app=app_prefix, present=present)
                 pruned = res.single()
                 pruned_count = pruned["pruned"] if pruned else 0
                 logger.info(f"neo4j(bolt): pruned {pruned_count} vanished module(s)")
@@ -263,12 +283,19 @@ def _upsert_edges(session, neo4j, edges: List[EdgeRow]) -> None:
 # ----------------------------------------------------------------------------------------------
 
 
-def _hash_of(nodes: List[NodeRow], file_key: str) -> Optional[str]:
-    for n in nodes:
-        if n.labels[0] == "PyModule" and n.value == file_key:
-            h = n.props.get("content_hash")
-            return h if isinstance(h, str) else None
-    return None
+def _module_row(nodes: List[NodeRow]) -> Optional[NodeRow]:
+    return next((n for n in nodes if n.labels[0] == "PyModule"), None)
+
+
+def _module_id_of(nodes: List[NodeRow]) -> Optional[str]:
+    row = _module_row(nodes)
+    return row.value if row is not None else None
+
+
+def _hash_of(nodes: List[NodeRow]) -> Optional[str]:
+    row = _module_row(nodes)
+    h = row.props.get("content_hash") if row is not None else None
+    return h if isinstance(h, str) else None
 
 
 def _to_params(props, neo4j) -> dict:

codeanalyzer/neo4j/cypher.py

@@ -28,9 +28,11 @@ from __future__ import annotations
 from typing import Dict, List
 
 from codeanalyzer.neo4j.rows import (
+    CAN_NODE,
     EdgeRow,
     GraphRows,
     NodeRow,
+    application_prefix,
     chunk,
     cypher_map,
     cypher_value,
@@ -66,13 +68,17 @@ def render_cypher(rows: GraphRows, app_name: str) -> str:
 
 
 def _wipe(app_name: str) -> str:
+    """Everything under ``can://python/<app>/`` plus the application anchor (#173).
+    Scoped by id prefix, so it is one language and one application by construction —
+    a second python app sharing a module path, a sibling analyzer's graph, and the
+    cross-language :Artifact / :Package nodes are all outside it."""
+    prefix = cypher_value(application_prefix(app_name))
     name = cypher_value(app_name)
     return "\n".join(
         [
-            f"MATCH (a:PyApplication {{name: {name}}})",
-            "OPTIONAL MATCH (a)-[:PY_HAS_MODULE]->(m:PyModule)",
-            "OPTIONAL MATCH (m)-[:PY_DECLARES|PY_HAS_METHOD|PY_HAS_ATTRIBUTE|PY_DECLARES_VAR|PY_HAS_CALLSITE*1..]->(x)",
-            "DETACH DELETE x, m, a;",
+            f"MATCH (x:{CAN_NODE}) WHERE x.id STARTS WITH {prefix}",
+            "CALL { WITH x DETACH DELETE x } IN TRANSACTIONS OF 1000 ROWS;",
+            f"MATCH (a:PyApplication {{name: {name}}}) DETACH DELETE a;",
         ]
     )
 

codeanalyzer/neo4j/project.py

@@ -27,14 +27,15 @@ Modelling decisions (mirror of the TypeScript backend):
   - call-graph endpoints absent from the symbol table become ``:PyExternal`` ghost
     nodes, so RPC / third-party / framework edges are preserved (matching the
     analyzer's own ghost-node behaviour).
-  - every project-owned node carries an internal ``_module`` provenance prop, so
+  - every project-owned node names its owning module (``_module`` in the props it
+    hands RowBuilder, lifted to ``NodeRow.module`` and never emitted, #173), so
     the incremental writer can delete exactly what a re-analyzed module emitted.
 """
 from __future__ import annotations
 
 import json
 from pathlib import Path
-from typing import Any, List, Optional
+from typing import Any, Callable, Dict, List, Optional
 
 from codeanalyzer.neo4j.schema import SCHEMA_VERSION
 from codeanalyzer.neo4j.rows import GraphRows, NodeRef, Props, RowBuilder, prune
@@ -47,7 +48,8 @@ from codeanalyzer.schema import (
     PyModule,
     PyVariableDeclaration,
 )
-from codeanalyzer.schema.ids import application_id, purl_pypi
+from codeanalyzer.schema import model_dump
+from codeanalyzer.schema.ids import application_id, global_ordinal, purl_pypi
 from codeanalyzer.schema.py_schema import PyDecorator
 
 
@@ -70,6 +72,13 @@ def project(app: PyApplication, app_name: str, sig_to_id: dict,
                 "repo_uri": app.repository.uri if app.repository else None,
                 "source_revision": app.repository.revision if app.repository else None,
                 "repo_dirty": app.repository.dirty if app.repository else None,
+                # #177: the entrypoint pass under-approximates by design, so a
+                # graph consumer must be able to tell "no entrypoints" from "the
+                # pass found nothing". Always present, even when empty.
+                "entrypoint_frameworks": list(app.entrypoint_report.frameworks_detected),
+                "entrypoint_report_json": json.dumps(
+                    model_dump(app.entrypoint_report, mode="json"), sort_keys=True
+                ),
             }
         ),
     )
@@ -87,19 +96,21 @@ def project(app: PyApplication, app_name: str, sig_to_id: dict,
     for file_key, mod in app.symbol_table.items():
         mod_ref = b.node(["PyModule"], "id", mod.id, _module_props(mod, file_key))
         b.edge("PY_HAS_MODULE", app_ref, mod_ref)
-        _project_module_body(b, file_key, mod_ref, mod, externals, sig_to_id, module_id_by_key)
+        _project_module_body(b, file_key, mod_ref, mod, externals, sig_to_id, module_id_by_key,
+                             application_id(app_name))
 
     # The aggregated :PY_CALLS twin.
+    app_can_id = application_id(app_name)
     for e in app.call_graph:
-        src = _call_endpoint(b, e.src, externals, sig_to_id)
-        tgt = _call_endpoint(b, e.dst, externals, sig_to_id)
+        src = _call_endpoint(b, e.src, externals, sig_to_id, app_can_id)
+        tgt = _call_endpoint(b, e.dst, externals, sig_to_id, app_can_id)
         b.edge(
             "PY_CALLS", src, tgt, _call_edge_props(e.weight, list(e.prov or []))
         )
 
     # Level-3 CPG overlay: each callable's v2 body/cfg/cdg/ddg. Idempotent under
     # MERGE — a no-op when no callable carries L3 fields (levels 1/2).
-    _project_program_graphs(b, app, externals, sig_to_id)
+    _project_program_graphs(b, app, externals, sig_to_id, app_can_id)
 
     # Neutral artifact/dependency subgraph (Task 6). L1 data — always present,
     # full-depth-always regardless of -a.
@@ -109,7 +120,7 @@ def project(app: PyApplication, app_name: str, sig_to_id: dict,
     # _project_program_graphs above) into the config-key subgraph
     # (ConfigKey from _project_artifacts above), plus first-class unresolved
     # reads.
-    _project_config_uses(b, app, app_ref, externals, sig_to_id)
+    _project_config_uses(b, app, app_ref, externals, sig_to_id, app_can_id)
 
     return b.finish()
 
@@ -128,11 +139,7 @@ def _global_ordinal(callable_id: str, local_key: str) -> str:
     This MUST agree with :meth:`IdentityMap.global_id` for the same node, so the
     JSON ``body``/``cfg`` projection and this Neo4j projection land on one node
     identity (two-projection agreement)."""
-    return (
-        f"{callable_id}{local_key}"
-        if local_key.startswith("@")
-        else f"{callable_id}@{local_key}"
-    )
+    return global_ordinal(callable_id, local_key)
 
 
 def _body_ref(callable_id: str, local_key: str) -> NodeRef:
@@ -140,7 +147,7 @@ def _body_ref(callable_id: str, local_key: str) -> NodeRef:
 
 
 def _project_program_graphs(
-    b: RowBuilder, app: PyApplication, externals: dict, sig_to_id: dict
+    b: RowBuilder, app: PyApplication, externals: dict, sig_to_id: dict, app_can_id: str,
 ) -> None:
     """Level-3 CPG overlay, projected off each callable's v2 ``body``/``cfg``/
     ``cdg``/``ddg`` (populated by ``emit_l3_body`` at ``-a 3``; empty otherwise).
@@ -209,7 +216,7 @@ def _project_program_graphs(
                     b.edge(
                         "PY_RESOLVES_TO",
                         ref,
-                        _call_endpoint(b, node.callee, externals, sig_to_id),
+                        _call_endpoint(b, node.callee, externals, sig_to_id, app_can_id),
                     )
             for e in c.cfg or []:
                 # kind-discriminated: a conditional's true/false pair between one
@@ -399,6 +406,7 @@ def _project_artifacts(b: RowBuilder, app: PyApplication, app_name: str, app_ref
 
 def _project_config_uses(
     b: RowBuilder, app: PyApplication, app_ref: NodeRef, externals: dict, sig_to_id: dict,
+    app_can_id: str,
 ) -> None:
     """config_use (#162): PY_USES_CONFIG (`app.config_uses`) and
     PY_READS_CONFIG_UNRESOLVED (`app.config_reads_unresolved`).
@@ -428,7 +436,7 @@ def _project_config_uses(
             prune({"prov": list(e.prov) if e.prov else None}),
         )
     for r in app.config_reads_unresolved:
-        ghost_ref = _call_endpoint(b, r.callee, externals, sig_to_id)
+        ghost_ref = _call_endpoint(b, r.callee, externals, sig_to_id, app_can_id)
         b.edge(
             "PY_READS_CONFIG_UNRESOLVED",
             app_ref,
@@ -453,8 +461,54 @@ def _symbol_ref(signature: str, externals: dict, sig_to_id: dict) -> NodeRef:
     return NodeRef("PySymbol", "signature", signature)
 
 
+def _base_ref_resolver(
+    b: RowBuilder, mod: PyModule, externals: dict, sig_to_id: dict, app_can_id: str,
+) -> Callable[[str], NodeRef]:
+    """Per-module: the written base spelling → the NodeRef PY_EXTENDS lands on (#178).
+
+    ``base_classes`` stores the spelling as written (``Base``, ``views.View``),
+    while ``sig_to_id`` is keyed by signature (``pkg.mod.Base``), so the two never
+    met and every PY_EXTENDS row was dropped as dangling. Resolution order: a class
+    declared in this module (bare name or ``Outer.Inner`` path) → its can:// id; a
+    name the module's import table maps (same resolver the entrypoint pass uses)
+    that is a declared class elsewhere → its can:// id; otherwise an ``@external``
+    ghost with the id shape ``_home_external_symbols`` uses, so a call to the same
+    symbol MERGEs onto the same node."""
+    from codeanalyzer.entrypoints.pipeline import _base_resolver
+
+    local: Dict[str, str] = {}
+
+    def index(cl: PyClass, path: str) -> None:
+        local.setdefault(cl.name, cl.signature)
+        local[path] = cl.signature
+        for ic in (cl.types or {}).values():
+            index(ic, f"{path}.{ic.name}")
+
+    for cl in (mod.types or {}).values():
+        index(cl, cl.name)
+    resolve = _base_resolver(mod)
+
+    def base_ref(written: str) -> NodeRef:
+        sig = local.get(written) or resolve(written)
+        can_id = sig_to_id.get(sig)
+        if can_id is not None:
+            return _sym(can_id)
+        return _external_ghost(b, app_can_id, sig)
+
+    return base_ref
+
+
+def _external_ghost(b: RowBuilder, app_can_id: str, signature: str) -> NodeRef:
+    """A :PyExternal ghost for a dotted signature nobody homed, with the id shape
+    ``_home_external_symbols`` uses — ``<app>/@external/<module>/<name>`` — so it
+    sits inside the application prefix (#173) and MERGEs with a homed twin."""
+    module, name = signature.rsplit(".", 1) if "." in signature else (None, signature)
+    ext_id = f"{app_can_id}/@external/{module}/{name}" if module else f"{app_can_id}/@external/{name}"
+    return b.node(["PySymbol", "PyExternal"], "id", ext_id, prune({"name": name, "module": module}))
+
+
 def _call_endpoint(
-    b: RowBuilder, signature: str, externals: dict, sig_to_id: dict
+    b: RowBuilder, signature: str, externals: dict, sig_to_id: dict, app_can_id: str,
 ) -> NodeRef:
     """A call-graph endpoint: a declared callable already emitted (keyed by its
     canonical ``can://`` id, resolved through ``sig_to_id``), or an external symbol
@@ -484,13 +538,7 @@ def _call_endpoint(
             ext.id or signature,
             prune({"name": ext.name, "module": ext.module}),
         )
-    name = signature.rsplit(".", 1)[-1] if "." in signature else signature
-    return b.node(
-        ["PySymbol", "PyExternal"],
-        "id",
-        signature,
-        prune({"name": name}),
-    )
+    return _external_ghost(b, app_can_id, signature)
 
 
 # ----------------------------------------------------------------------------------------------
@@ -500,16 +548,17 @@ def _call_endpoint(
 
 def _project_module_body(
     b: RowBuilder, file_key: str, mod_ref: NodeRef, mod: PyModule,
-    externals: dict, sig_to_id: dict, module_id_by_key: dict,
+    externals: dict, sig_to_id: dict, module_id_by_key: dict, app_can_id: str,
 ) -> None:
+    base_ref = _base_ref_resolver(b, mod, externals, sig_to_id, app_can_id)
     for fn in (mod.functions or {}).values():
         _project_callable(b, file_key, mod_ref, "PY_DECLARES", fn, externals, sig_to_id,
-                          mod.source)
+                          mod.source, base_ref)
     for cl in (mod.types or {}).values():
         _project_class(b, file_key, mod_ref, "PY_DECLARES", cl, externals, sig_to_id,
-                       mod.source)
+                       mod.source, base_ref)
     for v in mod.variables or []:
-        _project_variable(b, file_key, mod_ref, file_key, v)
+        _project_variable(b, file_key, mod_ref, v)
     _project_imports(b, mod_ref, mod, module_id_by_key)
 
 
@@ -575,7 +624,7 @@ def _project_imports(b: RowBuilder, mod_ref: NodeRef, mod: PyModule,
 
 def _project_class(
     b: RowBuilder, file_key: str, parent: NodeRef, parent_rel: str, cl: PyClass,
-    externals: dict, sig_to_id: dict, source: str,
+    externals: dict, sig_to_id: dict, source: str, base_ref: Callable[[str], NodeRef],
 ) -> None:
     ref = b.node(
         ["PySymbol", "PyClass"], "id", cl.id, _class_props(cl, file_key, source)
@@ -587,20 +636,21 @@ def _project_class(
 
     for base in cl.base_classes or []:
         if base:
-            b.edge_to_symbol("PY_EXTENDS", ref, _symbol_ref(base, externals, sig_to_id))
+            b.edge_to_symbol("PY_EXTENDS", ref, base_ref(base))
 
     for m in (cl.callables or {}).values():
         _project_callable(b, file_key, ref, "PY_HAS_METHOD", m, externals, sig_to_id,
-                          source)
+                          source, base_ref)
     for a in (cl.attributes or {}).values():
-        _project_attribute(b, file_key, ref, cl.signature, a)
+        _project_attribute(b, file_key, ref, a)
     for ic in (cl.types or {}).values():
-        _project_class(b, file_key, ref, "PY_DECLARES", ic, externals, sig_to_id, source)
+        _project_class(b, file_key, ref, "PY_DECLARES", ic, externals, sig_to_id, source,
+                       base_ref)
 
 
 def _project_callable(
     b: RowBuilder, file_key: str, owner: NodeRef, owner_rel: str, c: PyCallable,
-    externals: dict, sig_to_id: dict, source: str,
+    externals: dict, sig_to_id: dict, source: str, base_ref: Callable[[str], NodeRef],
 ) -> None:
     ref = b.node(
         ["PySymbol", "PyCallable"],
@@ -614,18 +664,22 @@ def _project_callable(
         _project_decorator(b, ref, d)
 
     for v in c.local_variables or []:
-        _project_variable(b, file_key, ref, c.signature, v)
+        _project_variable(b, file_key, ref, v)
     for ic in (c.callables or {}).values():
         _project_callable(b, file_key, ref, "PY_DECLARES", ic, externals, sig_to_id,
-                          source)
+                          source, base_ref)
     for cl in (c.types or {}).values():
-        _project_class(b, file_key, ref, "PY_DECLARES", cl, externals, sig_to_id, source)
+        _project_class(b, file_key, ref, "PY_DECLARES", cl, externals, sig_to_id, source,
+                       base_ref)
 
 
 def _project_attribute(
-    b: RowBuilder, file_key: str, owner: NodeRef, owner_sig: str, a: PyClassAttribute
+    b: RowBuilder, file_key: str, owner: NodeRef, a: PyClassAttribute
 ) -> None:
-    attr_id = f"{owner_sig}.{a.name}"
+    # ``<class can:// id>/<name>`` (#173): minted from the owner's id so it carries
+    # the application segment. The signature-minted ``service.Service.name`` it
+    # replaced was identical across applications, so two apps MERGEd onto one node.
+    attr_id = f"{owner.value}/{a.name}"
     ref = b.node(["PyAttribute"], "id", attr_id, _attribute_props(a, attr_id, file_key))
     b.edge("PY_HAS_ATTRIBUTE", owner, ref)
 
@@ -634,10 +688,12 @@ def _project_variable(
     b: RowBuilder,
     file_key: str,
     owner: NodeRef,
-    owner_id: str,
     v: PyVariableDeclaration,
 ) -> None:
-    var_id = f"{owner_id}#{v.name}@{v.start_line}"
+    # ``<owner can:// id>/<name>@<line>`` (#173) — the owner is the module or the
+    # callable, so a module-level variable sits under ``<module-id>/`` like every
+    # other declaration and the module's prefix purge reaches it.
+    var_id = f"{owner.value}/{v.name}@{v.start_line}"
     ref = b.node(["PyVariable"], "id", var_id, _variable_props(v, var_id, file_key))
     b.edge("PY_DECLARES_VAR", owner, ref)
 

codeanalyzer/neo4j/rows.py

@@ -50,6 +50,35 @@ class NodeRow:
     key_prop: str
     value: str
     props: Props
+    # The owning module's file key, for the incremental writer's per-module diff.
+    # In memory only (#173): it used to be emitted as ``_module`` and every
+    # destructive statement matched on it, which is application-blind. Scope now
+    # comes from the ``can://`` id prefix; this field only groups rows.
+    module: Optional[str] = None
+
+
+# The marker label on every node keyed by a ``can://python/`` id (#173). It is an
+# INDEX ANCHOR, nothing more: Neo4j property indexes are label-scoped, so the
+# prefix predicate ``id STARTS WITH $p`` needs a label to seek on. Safety comes
+# from the prefix, which carries language, application and module.
+CAN_NODE = "PyCanNode"
+_PY_CAN_PREFIX = "can://python/"
+
+
+def descendant_prefix(can_id: str) -> str:
+    """The prefix that matches a node's descendants and nothing else. The separator
+    is the point: ``can://python/app/src/foo.py`` is also a prefix of
+    ``can://python/app/src/foo.pyX``, so descendants match on ``id + '/'`` and the
+    node itself by equality."""
+    return f"{can_id}/"
+
+
+def application_prefix(app_name: Optional[str]) -> str:
+    """``can://python/<app>/`` — the scope of every destructive statement. Refuses an
+    empty application: ``STARTS WITH ''`` would match every node in the database."""
+    if not app_name:
+        raise ValueError("neo4j: refusing a destructive statement without an application id")
+    return descendant_prefix(f"{_PY_CAN_PREFIX}{app_name}")
 
 
 @dataclass
@@ -100,14 +129,20 @@ class RowBuilder:
         (last write wins) and unions labels — the in-memory analog of
         ``MERGE (n:Label {key}) SET n += props``."""
         node_id = f"{labels[0]} {value}"
+        props = dict(props)
+        module = props.pop("_module", None)  # lifted off the graph (#173)
+        if key_prop == "id" and value.startswith(_PY_CAN_PREFIX) and CAN_NODE not in labels:
+            labels = [*labels, CAN_NODE]
         existing = self._nodes.get(node_id)
         if existing is not None:
             existing.props.update(props)
+            if module is not None:
+                existing.module = module
             for label in labels:
                 if label not in existing.labels:
                     existing.labels.append(label)
         else:
-            self._nodes[node_id] = NodeRow(list(labels), key_prop, value, dict(props))
+            self._nodes[node_id] = NodeRow(list(labels), key_prop, value, props, module)
         self._keys.add((labels[0], value))
         return NodeRef(labels[0], key_prop, value)
 

codeanalyzer/neo4j/schema.py

@@ -57,7 +57,9 @@ class RelType:
 
 
 # Labels layered onto a node in addition to its primary/specific label.
-MARKER_LABELS: List[str] = []
+# ``PyCanNode`` (#173) rides every node keyed by a ``can://python/`` id — an index
+# anchor for the prefix-scoped destructive statements (see ``rows.CAN_NODE``).
+MARKER_LABELS: List[str] = ["PyCanNode"]
 
 _SPAN = {"start_line": "integer", "end_line": "integer"}
 
@@ -75,6 +77,8 @@ NODE_LABELS: List[NodeLabel] = [
             "repo_uri": "string",
             "source_revision": "string",
             "repo_dirty": "boolean",
+            "entrypoint_frameworks": "string[]",
+            "entrypoint_report_json": "string",
         },
     ),
     NodeLabel(
@@ -88,7 +92,6 @@ NODE_LABELS: List[NodeLabel] = [
             "content_hash": "string",
             "last_modified": "float",
             "file_size": "integer",
-            "_module": "string",
         },
     ),
     NodeLabel(
@@ -104,7 +107,6 @@ NODE_LABELS: List[NodeLabel] = [
             "decorators": "string[]",
             "docstring": "string",
             **_SPAN,
-            "_module": "string",
             "is_entrypoint": "boolean",
             "entrypoint_frameworks": "string[]",
         },
@@ -128,7 +130,6 @@ NODE_LABELS: List[NodeLabel] = [
             "modifiers": "string[]",
             "parameters_json": "string",
             "accessed_symbols_json": "string",
-            "_module": "string",
             "is_entrypoint": "boolean",
             "entrypoint_frameworks": "string[]",
         },
@@ -157,7 +158,6 @@ NODE_LABELS: List[NodeLabel] = [
             "initializer": "string",
             "docstring": "string",
             **_SPAN,
-            "_module": "string",
         },
     ),
     NodeLabel(
@@ -171,7 +171,6 @@ NODE_LABELS: List[NodeLabel] = [
             "initializer": "string",
             "scope": "string",
             **_SPAN,
-            "_module": "string",
         },
     ),
     # Level-3 CPG overlay (present only at -a 3). The dataflow vocabulary is
@@ -198,7 +197,6 @@ NODE_LABELS: List[NodeLabel] = [
             "is_constructor_call": "boolean",
             "arguments_json": "string",
             **_SPAN,
-            "_module": "string",
         },
     ),
     # Neutral artifact/dependency subgraph (spec 2026-08-27, Task 6). No `Py`
@@ -332,27 +330,14 @@ def uniqueness_constraints() -> list[str]:
 
 CONSTRAINTS: List[str] = uniqueness_constraints()
 
-# The labels this analyzer owns per module -- the ones carrying the internal ``_module``
-# provenance property. Derived from NODE_LABELS so a new module-scoped label is covered
-# without a second list to maintain. `_module` is NOT python-private: codeanalyzer-java
-# and codeanalyzer-typescript set the same property on their nodes, so every statement
-# matching on it must be anchored to these labels or it matches a sibling analyzer's graph
-# in a shared database (#171).
-MODULE_OWNED_LABELS: List[str] = [n.label for n in NODE_LABELS if "_module" in n.properties]
-
-# The label disjunction to anchor such a statement with: ``MATCH (x:PyModule|PyClass|...)``.
-MODULE_OWNED_PATTERN: str = "|".join(MODULE_OWNED_LABELS)
-
 INDEXES: List[str] = [
     "CREATE INDEX py_callable_name IF NOT EXISTS FOR (c:PyCallable) ON (c.name)",
     "CREATE INDEX py_class_name IF NOT EXISTS FOR (c:PyClass) ON (c.name)",
     "CREATE FULLTEXT INDEX py_code_fts IF NOT EXISTS FOR (c:PyCallable) ON EACH [c.code, c.docstring]",
-] + [
-    # One per module-owned label: the incremental writer's per-module purge matches on
-    # `_module` once per changed module, which without these is a label scan per label per
-    # module -- quadratic on a full push (#171).
-    f"CREATE INDEX {label.lower()}_module IF NOT EXISTS FOR (x:{label}) ON (x._module)"
-    for label in MODULE_OWNED_LABELS
+    # #173: every destructive statement is ``MATCH (x:PyCanNode) WHERE x.id STARTS WITH $p``.
+    # A range index on the marker makes that a prefix seek; without it, a store scan per
+    # changed module. STARTS WITH is index-backed; CONTAINS / ENDS WITH are not.
+    "CREATE INDEX py_can_node_id IF NOT EXISTS FOR (n:PyCanNode) ON (n.id)",
 ]
 
 

codeanalyzer/schema/ids.py

@@ -23,6 +23,23 @@ def ordinal_id(callable_id: str, tag: str) -> str:
     return f"{callable_id}@{tag}"
 
 
+def global_ordinal(callable_id: str, local_key: str) -> str:
+    """The GLOBAL ordinal id of a body node from its LOCAL key: synthetic keys
+    (`@entry`, `@formal_in:0`) already carry the `@`; positional keys (`15:2`,
+    `15:2/actual_in:0`) get one. This is the :PyBodyNode merge key and, since
+    #176, `BodyNode.id` — the one implementation both projections share."""
+    return f"{callable_id}{local_key}" if local_key.startswith("@") else f"{callable_id}@{local_key}"
+
+
+def stamp_body_ids(callable) -> None:
+    """Stamp `id` on every body node and parameter of one callable (#176).
+    Idempotent; each body emitter calls it after writing its nodes."""
+    for key, node in callable.body.items():
+        node.id = global_ordinal(callable.id, key)
+    for i, p in enumerate(callable.parameters or []):
+        p.id = ordinal_id(callable.id, f"formal_in:{i}")
+
+
 def artifact_id(app_name: str, rel_path: str) -> str:
     """Language-neutral artifact id: ``can://artifact/<app>/<rel-path>``.
 

codeanalyzer/schema/l1_body.py

@@ -1,6 +1,7 @@
 """L1 body population: materialize `call` nodes from existing call sites.
 `callee` is left None here — the sanctioned null→id refinement happens at L2."""
 from __future__ import annotations
+from codeanalyzer.schema.ids import stamp_body_ids
 from codeanalyzer.schema.py_schema import PyApplication, PyClass, PyCallable, BodyNode, Span, byte_offsets
 
 def _do_callable(source: str, c: PyCallable) -> None:
@@ -20,6 +21,7 @@ def _do_callable(source: str, c: PyCallable) -> None:
             is_constructor_call=cs.is_constructor_call,
             arguments=list(cs.arguments or []),
         )
+    stamp_body_ids(c)
     for ic in (c.callables or {}).values():
         _do_callable(source, ic)
     for icl in (c.types or {}).values():

codeanalyzer/schema/py_schema.py

@@ -128,6 +128,9 @@ class BodyNode(BaseModel):
     """A node in a callable's `body`: an AST region (statement/call/branch/…) or
     a synthetic analysis vertex (entry/exit/formal_in/out/actual_in/out)."""
     kind: str
+    # #176: the GLOBAL ordinal id — `<callable-id>@<local>` — the same value the
+    # Neo4j projection merges :PyBodyNode on. Stamped by `ids.stamp_body_ids`.
+    id: str = ""
     span: Optional[Span] = None
     callee: Optional[str] = None   # only on `call` nodes; the sanctioned null→id slot
     of: Optional[str] = None       # param vertices: the variable/return they carry
@@ -287,6 +290,9 @@ class PyCallableParameter(BaseModel):
     """Represents a parameter of a Python callable (function/method)."""
 
     name: str
+    # #176: `<callable-id>@formal_in:<i>` for position i — the L4 formal_in vertex
+    # that carries this parameter. A forward reference below level 4.
+    id: str = ""
     type: Optional[str] = None
     default_value: Optional[str] = None
     decorators: List[PyDecorator] = []

{codeanalyzer_python-1.4.0.dist-info → codeanalyzer_python-1.4.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codeanalyzer-python
-Version: 1.4.0
+Version: 1.4.1
 Summary: Static analysis for Python — canonical schema v2 (symbol table, call graph, and native CFG/PDG/SDG dataflow) as analysis.json or a Neo4j property graph.
 Author-email: Rahul Krishna <i.m.ralk@gmail.com>
 License-File: LICENSE
@@ -459,7 +459,7 @@ levels are cumulative and additive — `analysis.json(-a 1) ⊆ … ⊆ analysis
 | **1** | `-a 1` (default) | Symbol table, Jedi call graph, and `call` nodes in each callable's `body` | `body` calls (`callee: null`) |
 | **2** | `-a 2` | Defuse-linker call-graph enrichment; each call's `callee` backfilled to a `can://` id | `call_graph`, `body` callees |
 | **3** | `-a 3` | Native **intraprocedural** CFG/CDG/DDG (syntactic, name-equality, `prov: ["ssa"]`) | `cfg`, `cdg`, `ddg`, `@entry`/`@exit` on each callable |
-| **4** | `-a 4` | **Interprocedural** SDG: synthetic param vertices, alias-aware DDG (`prov: ["points-to"]`) | `param_in`, `param_out`, `summary`, semantic `ddg` |
+| **4** | `-a 4` | **Interprocedural** SDG: synthetic param vertices, alias-aware DDG (`prov: ["points-to"]`), port-wiring DDG between statements and param vertices (`prov: ["reaching-defs"]`) | `param_in`, `param_out`, `summary`, semantic `ddg` |
 
 `-a 1`/`-a 2` timings and output are unaffected by the heavier levels — nothing at level 3+ runs
 unless requested. Flag gating: `--graphs sdg` requires `-a 4`; `--graphs cfg,dfg,pdg` and
@@ -481,7 +481,11 @@ symbol-table signature by construction
 - **Points-to oracle (level 4):** the **Scalpel** may-alias oracle — `ScalpelAliasOracle`
   (`codeanalyzer/dataflow/scalpel_oracle.py`) — consumes Scalpel's SSA copy/const facts to answer
   `may_alias(path_a, path_b)`, adding the alias-aware DDG edges (`prov: ["points-to"]`) and the
-  interprocedural summaries. Scalpel is **vendored** — a `typed_ast`-free slice built into the
+  interprocedural summaries. Level 4 also wires the statement-level DDG to the param
+  vertices (def → `actual_in`, `actual_out` → call site, `formal_in` → use, def → `formal_out`)
+  with `prov: ["reaching-defs"]`; without those the SDG would be two disconnected graphs. So
+  `prov` takes three values: `ssa` (syntactic, L3), `reaching-defs` (port wiring, L4) and
+  `points-to` (alias-derived, L4). Scalpel is **vendored** — a `typed_ast`-free slice built into the
   package under `codeanalyzer/dataflow/scalpel/` — so it is the **default** level-4 oracle with no
   external dependency to install; the analyzer falls back to the built-in `TypeBasedAliasOracle`
   (Jedi-inferred types; unknown types conservatively alias) only when Scalpel can't resolve a
@@ -546,7 +550,8 @@ A **callable** (function or method) carries its own CPG, keyed by node id:
   "body": {                                       // node id → node
     "@entry": { "kind": "entry" },
     "6:4":    { "kind": "statement", "span": { … } },
-    "6:8":    { "kind": "call", "span": { … }, "callee": "can://…/helper(x)" },  // callee null until L2
+    "6:8":    { "id": "can://…/main()@6:8", "kind": "call", "span": { … },
+                "callee": "can://…/helper(x)" },                                // callee null until L2
     "@formal_in:0":    { "kind": "formal_in", "of": "a" },              // L4 param vertices
     "6:4/actual_in:0": { "kind": "actual_in", "of": "a", "parent": "6:4" },
     "@exit":  { "kind": "exit" }
@@ -686,6 +691,10 @@ RETURN DISTINCT c.id
 MATCH (m:PyCallable {is_entrypoint: true})
 RETURN m.id, m.entrypoint_frameworks
 
+// did the entrypoint pass find anything? (no entrypoints vs. nothing detected)
+MATCH (a:PyApplication)
+RETURN a.entrypoint_frameworks, a.entrypoint_report_json
+
 // data dependences into one statement (level 3+)
 MATCH (s:PyBodyNode {id: $stmt})<-[d:PY_DDG]-(src:PyBodyNode)
 RETURN src.id, d.var, d.prov

{codeanalyzer_python-1.4.0.dist-info → codeanalyzer_python-1.4.1.dist-info}/RECORD

@@ -13,11 +13,11 @@ codeanalyzer/artifacts/parsers.py,sha256=xOjC53tT0Mv0k7ONGwzl5XUvpBLnZlEcGmyrX5D
 codeanalyzer/dataflow/__init__.py,sha256=HCNOH24rAGLUMG94N9aC-2SsAWSntk3uys7e39ipU5o,1725
 codeanalyzer/dataflow/access_paths.py,sha256=wC8Q9qD-RZzkoFWMVvu_6uNNmYP8z48OGp9h9v3F1d4,23623
 codeanalyzer/dataflow/alias.py,sha256=ZYKY0DiR3GHv6YJr7C001Lode9rZsk6-gxdomUyIvwg,3928
-codeanalyzer/dataflow/builder.py,sha256=KiISa2bIuBf_0N0v_PzlgMGm0sFtMICEwA-Y6DFXiM4,32687
+codeanalyzer/dataflow/builder.py,sha256=kUjI_oBHn5H8cfcSYxj40OHxiqXX-IbxXqahNLgffyQ,32812
 codeanalyzer/dataflow/cfg.py,sha256=u5YXJjAaDshdgv-9kWWITbBJFP-MwXKq6hbNh0fhDm8,25307
 codeanalyzer/dataflow/defuse.py,sha256=LrX1ToOZzR79NlAGg5T647UAFkpiEqEnT7t0K5RXOiI,4377
 codeanalyzer/dataflow/dominance.py,sha256=X7Ki1QRdVqaseYsJtiUL7m9MbcC2WHEv9b8bczSLFUA,5086
-codeanalyzer/dataflow/identity.py,sha256=WAIal6XchmQqdnXbvbEgu8J6vJdXNRdie1KHz1vJBl8,3906
+codeanalyzer/dataflow/identity.py,sha256=6aAz3iPSOpoS7l_moC7XGr2RS_GqJp_FlsWGglMJDjM,3812
 codeanalyzer/dataflow/pdg.py,sha256=1Bm7AnoRqXBryZulII2idPw0feV8eZQ1VqqprQ8PW-g,3731
 codeanalyzer/dataflow/scalpel_oracle.py,sha256=FxRadKrTWar0VKHyQJM40n3cq25sld3Sj4lMdOm5NFk,11494
 codeanalyzer/dataflow/scc.py,sha256=Doa_0-5f3agCu_5UmeEDlCUErg34TtniKIv8Uqd7Jiw,3493
@@ -38,28 +38,28 @@ codeanalyzer/dataflow/scalpel/core/func_call_visitor.py,sha256=ps0snjTchBXilhor3
 codeanalyzer/dataflow/scalpel/core/vars_visitor.py,sha256=gE5fNyJS6jslD6vsMRbFLoy3n1xTwH-b54mBcNYO72M,5660
 codeanalyzer/entrypoints/__init__.py,sha256=VaMd4mSEPLuPlRxxAve_nTJ9ZH62stXZGTPNwU_BQ50,99
 codeanalyzer/entrypoints/detect.py,sha256=fsWRQz1njvB9d3LIJEHxsNFE1GrB7q52KCvozw_UIUQ,4594
-codeanalyzer/entrypoints/matching.py,sha256=vXrhCsPOeaYHp8tYyILk5kNh9_3rwV_1wi6Z47PqG80,6427
-codeanalyzer/entrypoints/pipeline.py,sha256=PDptL_o105BpofpnQHWZYOtFYVelqTB4zktp0PVPbEc,5540
-codeanalyzer/entrypoints/rules.py,sha256=aYwCiX-J3tvj8qJrrb-tph5zovin5wIdmzc49iR3h2U,5318
-codeanalyzer/entrypoints/rules.yml,sha256=rgDglVOcUNXnQ5FXLMfnJbfI7xHRiRmegTP5bmiemSQ,3112
+codeanalyzer/entrypoints/matching.py,sha256=rQeY_w2dyG36DBUjle7GLXxqDKsoMhJYPjN4s11OGtM,7948
+codeanalyzer/entrypoints/pipeline.py,sha256=vVSdttMfSAWour2fsC3LomMtwFLzRqmJHixJS82VY1I,7828
+codeanalyzer/entrypoints/rules.py,sha256=yG772JHmNc2L10jIpxfg1xTh-QouJa6lNU9ubo3EZYg,6003
+codeanalyzer/entrypoints/rules.yml,sha256=sguICRfDDNGjJPfZz-JSwkI_hzbTJaau1liHV_y4rTA,4637
 codeanalyzer/jedi/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/jedi/jedi.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/neo4j/__init__.py,sha256=8Ei6uThTOqmul6GhnKoGOjLXJZbyDwF5Jo-8I8NxnAk,1574
-codeanalyzer/neo4j/bolt.py,sha256=wobEBSQn5z9uCER3fNtTl98Q1z5WuXG-O1rPRoFwFWI,11949
-codeanalyzer/neo4j/cypher.py,sha256=a7YSmxxDbPcYc5gI4TW9sM6_WOE3RgLXTGBR9K8W8kw,5321
+codeanalyzer/neo4j/bolt.py,sha256=kcBhujHuUst6s1eZD-vARDn0iuKUAxSHrN14nrsKGM8,13472
+codeanalyzer/neo4j/cypher.py,sha256=y2AW9OUAbZJ4TVHkFpHChJU3r_K7q81tTZKt0VNve6g,5677
 codeanalyzer/neo4j/emit.py,sha256=OBCO77TDTaNpqk9Di3JIQzBouLpHPdgoXuPSs44iJuU,3587
-codeanalyzer/neo4j/project.py,sha256=U-2ZurR3aYFY0k8WGpEIYTE4YEET2pJeOyxqb9i_Xyo,35044
-codeanalyzer/neo4j/rows.py,sha256=med0XFa63PPUVUhJMq1TtVcJxgaVW39sgxBRZJDIJ_w,7811
-codeanalyzer/neo4j/schema.py,sha256=88F_biHRhd4NV1RSNvFCwLa062gKJb12_P_-vV6L-rE,15379
+codeanalyzer/neo4j/project.py,sha256=zoLsr2XGywlZbqnwlYvlhIpgu1jmIvSMTyAgIJZkmeM,38494
+codeanalyzer/neo4j/rows.py,sha256=PMlJEyLVIrKITkkK5TOutIzDgBuKLA1RGAkrQ1HLpZo,9579
+codeanalyzer/neo4j/schema.py,sha256=TyT3-Tu9thfWJTuvRtZ3BAIM4kQk13uUEJ-sgr9YAdE,14716
 codeanalyzer/options/__init__.py,sha256=6NewN0a-1HAEgKcxQjYyVn2WEDLrhax8h3WLgZddeqI,94
 codeanalyzer/options/options.py,sha256=2jDCcs74iSEOhz90LoRGts6PC8yV9IDPVxnLPNmonOA,1609
 codeanalyzer/schema/__init__.py,sha256=hIyz02abUJNPW8yUgguaeKflZjTmOZWbDiKICNBD7yk,4141
 codeanalyzer/schema/assign_ids.py,sha256=pQHluLaO5a6hFREp3vjVRsUeAfTYSJ95RXS9TZvnoys,1590
 codeanalyzer/schema/call_graph_ids.py,sha256=mWAhJDBsW8i-siJiINOHCXEm4qM6F_5se9-HuHWIFqU,568
-codeanalyzer/schema/ids.py,sha256=aOzsgVaOo6x72dnRgNxlnt6b5wbZzhTm0JOz6pdI57I,1672
-codeanalyzer/schema/l1_body.py,sha256=5Su347kwAPNflJDf7SvBR3sNXx9PVdGEml2pOpQCwo0,1684
+codeanalyzer/schema/ids.py,sha256=gBjpOlx4S_1JULlXoAHGommd5e81D5dwd5JSopYwdo8,2543
+codeanalyzer/schema/l1_body.py,sha256=_sca0mTkMRb-5lasep87faGjDxZJd9jGB0hmBx3uCgk,1757
 codeanalyzer/schema/l2_callees.py,sha256=CTcBeGoO04DstDC6h-1sHMbbIrHDEOMxP01U9VLBcfc,2327
-codeanalyzer/schema/py_schema.py,sha256=5G8K6uqBopU5iLwlUW30AE5A8jgTEdNaQmOeizhccag,23885
+codeanalyzer/schema/py_schema.py,sha256=lbW7fIRWOdVLH0Ql0yYCYZzaS-iaACBLOuDPmXesjKs,24238
 codeanalyzer/semantic_analysis/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/semantic_analysis/call_graph.py,sha256=6YEB_wTn5-oQYLrbIhJYE0BsHl4fpWPoy5Hwd9mTnGc,11918
 codeanalyzer/semantic_analysis/defuse_linker.py,sha256=bSn1rCun28OQqSd2NOc9aVBSm47Gt9Iul4r_gwfqO1w,64930
@@ -70,9 +70,9 @@ codeanalyzer/syntactic_analysis/symbol_table_builder.py,sha256=eTknBDlUuuQd3JEwb
 codeanalyzer/utils/__init__.py,sha256=hC6VWdR5rerSqBxzu9KQHTASWqwrrYJv-CMDwrTlzkc,137
 codeanalyzer/utils/logging.py,sha256=Fw0tattPAOMs3o0JMjjXhRVLIF64f-SCcygUXF9jqeg,904
 codeanalyzer/utils/progress_bar.py,sha256=C9JtzVdd10lIxTv-KA6PebqjKWueC_vMGwVzAtHuHIw,2818
-codeanalyzer_python-1.4.0.dist-info/METADATA,sha256=DJKj-64VCcSuUoxUbwsesDi7jSkBv69YSrsePcgAzGM,42786
-codeanalyzer_python-1.4.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-codeanalyzer_python-1.4.0.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
-codeanalyzer_python-1.4.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-codeanalyzer_python-1.4.0.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
-codeanalyzer_python-1.4.0.dist-info/RECORD,,
+codeanalyzer_python-1.4.1.dist-info/METADATA,sha256=tmpHTz20bMUPMGvpJp66Guu8NtDqo-SIFso_Sk0BoHI,43485
+codeanalyzer_python-1.4.1.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+codeanalyzer_python-1.4.1.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
+codeanalyzer_python-1.4.1.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+codeanalyzer_python-1.4.1.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
+codeanalyzer_python-1.4.1.dist-info/RECORD,,