codeanalyzer-python 1.4.0__tar.gz → 1.5.0__tar.gz

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codeanalyzer-python
-Version: 1.4.0
+Version: 1.5.0
 Summary: Static analysis for Python — canonical schema v2 (symbol table, call graph, and native CFG/PDG/SDG dataflow) as analysis.json or a Neo4j property graph.
 Author-email: Rahul Krishna <i.m.ralk@gmail.com>
 License-File: LICENSE
@@ -459,7 +459,7 @@ levels are cumulative and additive — `analysis.json(-a 1) ⊆ … ⊆ analysis
 | **1** | `-a 1` (default) | Symbol table, Jedi call graph, and `call` nodes in each callable's `body` | `body` calls (`callee: null`) |
 | **2** | `-a 2` | Defuse-linker call-graph enrichment; each call's `callee` backfilled to a `can://` id | `call_graph`, `body` callees |
 | **3** | `-a 3` | Native **intraprocedural** CFG/CDG/DDG (syntactic, name-equality, `prov: ["ssa"]`) | `cfg`, `cdg`, `ddg`, `@entry`/`@exit` on each callable |
-| **4** | `-a 4` | **Interprocedural** SDG: synthetic param vertices, alias-aware DDG (`prov: ["points-to"]`) | `param_in`, `param_out`, `summary`, semantic `ddg` |
+| **4** | `-a 4` | **Interprocedural** SDG: synthetic param vertices, alias-aware DDG (`prov: ["points-to"]`), port-wiring DDG between statements and param vertices (`prov: ["reaching-defs"]`) | `param_in`, `param_out`, `summary`, semantic `ddg` |
 
 `-a 1`/`-a 2` timings and output are unaffected by the heavier levels — nothing at level 3+ runs
 unless requested. Flag gating: `--graphs sdg` requires `-a 4`; `--graphs cfg,dfg,pdg` and
@@ -481,7 +481,11 @@ symbol-table signature by construction
 - **Points-to oracle (level 4):** the **Scalpel** may-alias oracle — `ScalpelAliasOracle`
   (`codeanalyzer/dataflow/scalpel_oracle.py`) — consumes Scalpel's SSA copy/const facts to answer
   `may_alias(path_a, path_b)`, adding the alias-aware DDG edges (`prov: ["points-to"]`) and the
-  interprocedural summaries. Scalpel is **vendored** — a `typed_ast`-free slice built into the
+  interprocedural summaries. Level 4 also wires the statement-level DDG to the param
+  vertices (def → `actual_in`, `actual_out` → call site, `formal_in` → use, def → `formal_out`)
+  with `prov: ["reaching-defs"]`; without those the SDG would be two disconnected graphs. So
+  `prov` takes three values: `ssa` (syntactic, L3), `reaching-defs` (port wiring, L4) and
+  `points-to` (alias-derived, L4). Scalpel is **vendored** — a `typed_ast`-free slice built into the
   package under `codeanalyzer/dataflow/scalpel/` — so it is the **default** level-4 oracle with no
   external dependency to install; the analyzer falls back to the built-in `TypeBasedAliasOracle`
   (Jedi-inferred types; unknown types conservatively alias) only when Scalpel can't resolve a
@@ -513,11 +517,11 @@ just populate more of the same tree:
   "k_limit": 3,                   // access-path depth bound (--graph-field-depth); L3+ only
   "analyzer": { "name": "codeanalyzer-python", "version": "1.0.0" },
   "application": {
-    "id": "can://python/<app>",
+    "id": "can://<app>",
     "kind": "application",
     "symbol_table": {             // relative POSIX path → module
       "pkg/mod.py": {
-        "id": "can://python/<app>/pkg/mod.py",
+        "id": "can://<app>/python/pkg/mod.py",
         "kind": "module",
         "source": "…full file text, stored once per module…",
         "types":     { "<Class>": { "id": "…", "kind": "class", "callables": { /* methods */ } } },
@@ -527,8 +531,8 @@ just populate more of the same tree:
     "call_graph": [ { "src": "can://…/main(a)", "dst": "can://…/helper(x)",
                       "weight": 1, "prov": ["defuse", "jedi"] } ],
     "external_symbols": {         // imported/builtin call targets, keyed by id
-      "can://python/<app>/@external/os/getcwd":
-        { "id": "can://python/<app>/@external/os/getcwd", "kind": "external",
+      "can://<app>/@external/os/getcwd":
+        { "id": "can://<app>/@external/os/getcwd", "kind": "external",
           "name": "getcwd", "module": "os" }
     },
     "param_in":  [ { "src": "can://…/main(a)@6:4/actual_in:0", "dst": "can://…/helper(x)@formal_in:0" } ],
@@ -546,7 +550,8 @@ A **callable** (function or method) carries its own CPG, keyed by node id:
   "body": {                                       // node id → node
     "@entry": { "kind": "entry" },
     "6:4":    { "kind": "statement", "span": { … } },
-    "6:8":    { "kind": "call", "span": { … }, "callee": "can://…/helper(x)" },  // callee null until L2
+    "6:8":    { "id": "can://…/main()@6:8", "kind": "call", "span": { … },
+                "callee": "can://…/helper(x)" },                                // callee null until L2
     "@formal_in:0":    { "kind": "formal_in", "of": "a" },              // L4 param vertices
     "6:4/actual_in:0": { "kind": "actual_in", "of": "a", "parent": "6:4" },
     "@exit":  { "kind": "exit" }
@@ -563,7 +568,7 @@ The application envelope also contains three substrate sections:
 - **`artifacts`** — discovered non-code files (manifests, configs, Docker files, CI workflows,
   packaging files, scripts, docs, and legal files) with extraction status (`none`, `partial`, or
   `full`; default `none`), keyed by relative path; each artifact carries the
-  `can://artifact/<app>/<path>` id namespace. Config files carry extracted `config_keys`
+  `can://<app>/artifact/<path>` id namespace. Config files carry extracted `config_keys`
   (keys, values, namespaces, and references) and `DEFINES_CONFIG` Neo4j edges.
 - **`dependencies`** — declared packages with kind (`runtime`/`dev`/`optional`/`build`), spec,
   locked version, and provenance (`prov`): where each binding came from (manifest file, lock file,
@@ -574,7 +579,7 @@ The application envelope also contains three substrate sections:
 Notable properties:
 
 - **Durable `can://` ids** identify every node at callable granularity and above
-  (`can://python/<app>/<file>/<callable-sig>`); nodes below a callable use ordinal ids
+  (`can://<app>/python/<file>/<callable-sig>`); nodes below a callable use ordinal ids
   (`@entry`, `@exit`, `line:col`, `@formal_in:N`, `line:col/actual_in:N`).
 - **`source` lives once per module**; every node's text is the `module.source[span.bytes]` slice.
 - **Cross-function edges** — `call_graph`, `param_in`, `param_out`, `config_uses` — live at **application** scope;
@@ -686,13 +691,17 @@ RETURN DISTINCT c.id
 MATCH (m:PyCallable {is_entrypoint: true})
 RETURN m.id, m.entrypoint_frameworks
 
+// did the entrypoint pass find anything? (no entrypoints vs. nothing detected)
+MATCH (a:PyApplication)
+RETURN a.entrypoint_frameworks, a.entrypoint_report_json
+
 // data dependences into one statement (level 3+)
 MATCH (s:PyBodyNode {id: $stmt})<-[d:PY_DDG]-(src:PyBodyNode)
 RETURN src.id, d.var, d.prov
 
 // interprocedural flow through a parameter (level 4)
 MATCH (a:PyBodyNode)-[:PY_PARAM_IN]->(f:PyBodyNode)
-WHERE f.id STARTS WITH "can://python/myapp/src/api.py"
+WHERE f.id STARTS WITH "can://myapp/python/src/api.py"
 RETURN a.id, f.id
 ```
 
@@ -721,3 +730,25 @@ RETURN f.id, l.version
 ## License
 
 Apache 2.0 — see [LICENSE](./LICENSE).
+
+## Polyglot applications: all languages, or none
+
+A `--emit neo4j` push is **destructive**. It sweeps everything under `can://<app>/` that this
+analyzer marked, then rewrites what it found. Since the id grammar puts the application outermost,
+every analyzer over the same `<app>` shares that prefix — so a push reclaims stale rows belonging to
+*this* analyzer and, in the shared namespaces, sweeps rows a sibling wrote.
+
+For most of what is shared that is harmless: the artifact walk is a whole-repo inventory, so an
+`:Artifact` a sibling wrote is re-created by this push (with a thinner view of it — `roles` falls
+back to `unknown` and its config keys and dependency edges are gone until that sibling pushes
+again). `@external` ghosts are not inventoried that way: they are per-language, so a sibling's
+ghosts are swept and not restored.
+
+**So for an application analysed in more than one language, run every analyzer or none.** Running
+one in isolation leaves the others' derived rows missing until they run again. Running them
+together is always correct, in any order, because the last push restores everything the batch
+swept.
+
+Nothing here corrupts a graph: what is lost is derived and regenerates. But a partial run leaves a
+partial answer, and nothing in the data says so.
+

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/README.md

@@ -426,7 +426,7 @@ levels are cumulative and additive — `analysis.json(-a 1) ⊆ … ⊆ analysis
 | **1** | `-a 1` (default) | Symbol table, Jedi call graph, and `call` nodes in each callable's `body` | `body` calls (`callee: null`) |
 | **2** | `-a 2` | Defuse-linker call-graph enrichment; each call's `callee` backfilled to a `can://` id | `call_graph`, `body` callees |
 | **3** | `-a 3` | Native **intraprocedural** CFG/CDG/DDG (syntactic, name-equality, `prov: ["ssa"]`) | `cfg`, `cdg`, `ddg`, `@entry`/`@exit` on each callable |
-| **4** | `-a 4` | **Interprocedural** SDG: synthetic param vertices, alias-aware DDG (`prov: ["points-to"]`) | `param_in`, `param_out`, `summary`, semantic `ddg` |
+| **4** | `-a 4` | **Interprocedural** SDG: synthetic param vertices, alias-aware DDG (`prov: ["points-to"]`), port-wiring DDG between statements and param vertices (`prov: ["reaching-defs"]`) | `param_in`, `param_out`, `summary`, semantic `ddg` |
 
 `-a 1`/`-a 2` timings and output are unaffected by the heavier levels — nothing at level 3+ runs
 unless requested. Flag gating: `--graphs sdg` requires `-a 4`; `--graphs cfg,dfg,pdg` and
@@ -448,7 +448,11 @@ symbol-table signature by construction
 - **Points-to oracle (level 4):** the **Scalpel** may-alias oracle — `ScalpelAliasOracle`
   (`codeanalyzer/dataflow/scalpel_oracle.py`) — consumes Scalpel's SSA copy/const facts to answer
   `may_alias(path_a, path_b)`, adding the alias-aware DDG edges (`prov: ["points-to"]`) and the
-  interprocedural summaries. Scalpel is **vendored** — a `typed_ast`-free slice built into the
+  interprocedural summaries. Level 4 also wires the statement-level DDG to the param
+  vertices (def → `actual_in`, `actual_out` → call site, `formal_in` → use, def → `formal_out`)
+  with `prov: ["reaching-defs"]`; without those the SDG would be two disconnected graphs. So
+  `prov` takes three values: `ssa` (syntactic, L3), `reaching-defs` (port wiring, L4) and
+  `points-to` (alias-derived, L4). Scalpel is **vendored** — a `typed_ast`-free slice built into the
   package under `codeanalyzer/dataflow/scalpel/` — so it is the **default** level-4 oracle with no
   external dependency to install; the analyzer falls back to the built-in `TypeBasedAliasOracle`
   (Jedi-inferred types; unknown types conservatively alias) only when Scalpel can't resolve a
@@ -480,11 +484,11 @@ just populate more of the same tree:
   "k_limit": 3,                   // access-path depth bound (--graph-field-depth); L3+ only
   "analyzer": { "name": "codeanalyzer-python", "version": "1.0.0" },
   "application": {
-    "id": "can://python/<app>",
+    "id": "can://<app>",
     "kind": "application",
     "symbol_table": {             // relative POSIX path → module
       "pkg/mod.py": {
-        "id": "can://python/<app>/pkg/mod.py",
+        "id": "can://<app>/python/pkg/mod.py",
         "kind": "module",
         "source": "…full file text, stored once per module…",
         "types":     { "<Class>": { "id": "…", "kind": "class", "callables": { /* methods */ } } },
@@ -494,8 +498,8 @@ just populate more of the same tree:
     "call_graph": [ { "src": "can://…/main(a)", "dst": "can://…/helper(x)",
                       "weight": 1, "prov": ["defuse", "jedi"] } ],
     "external_symbols": {         // imported/builtin call targets, keyed by id
-      "can://python/<app>/@external/os/getcwd":
-        { "id": "can://python/<app>/@external/os/getcwd", "kind": "external",
+      "can://<app>/@external/os/getcwd":
+        { "id": "can://<app>/@external/os/getcwd", "kind": "external",
           "name": "getcwd", "module": "os" }
     },
     "param_in":  [ { "src": "can://…/main(a)@6:4/actual_in:0", "dst": "can://…/helper(x)@formal_in:0" } ],
@@ -513,7 +517,8 @@ A **callable** (function or method) carries its own CPG, keyed by node id:
   "body": {                                       // node id → node
     "@entry": { "kind": "entry" },
     "6:4":    { "kind": "statement", "span": { … } },
-    "6:8":    { "kind": "call", "span": { … }, "callee": "can://…/helper(x)" },  // callee null until L2
+    "6:8":    { "id": "can://…/main()@6:8", "kind": "call", "span": { … },
+                "callee": "can://…/helper(x)" },                                // callee null until L2
     "@formal_in:0":    { "kind": "formal_in", "of": "a" },              // L4 param vertices
     "6:4/actual_in:0": { "kind": "actual_in", "of": "a", "parent": "6:4" },
     "@exit":  { "kind": "exit" }
@@ -530,7 +535,7 @@ The application envelope also contains three substrate sections:
 - **`artifacts`** — discovered non-code files (manifests, configs, Docker files, CI workflows,
   packaging files, scripts, docs, and legal files) with extraction status (`none`, `partial`, or
   `full`; default `none`), keyed by relative path; each artifact carries the
-  `can://artifact/<app>/<path>` id namespace. Config files carry extracted `config_keys`
+  `can://<app>/artifact/<path>` id namespace. Config files carry extracted `config_keys`
   (keys, values, namespaces, and references) and `DEFINES_CONFIG` Neo4j edges.
 - **`dependencies`** — declared packages with kind (`runtime`/`dev`/`optional`/`build`), spec,
   locked version, and provenance (`prov`): where each binding came from (manifest file, lock file,
@@ -541,7 +546,7 @@ The application envelope also contains three substrate sections:
 Notable properties:
 
 - **Durable `can://` ids** identify every node at callable granularity and above
-  (`can://python/<app>/<file>/<callable-sig>`); nodes below a callable use ordinal ids
+  (`can://<app>/python/<file>/<callable-sig>`); nodes below a callable use ordinal ids
   (`@entry`, `@exit`, `line:col`, `@formal_in:N`, `line:col/actual_in:N`).
 - **`source` lives once per module**; every node's text is the `module.source[span.bytes]` slice.
 - **Cross-function edges** — `call_graph`, `param_in`, `param_out`, `config_uses` — live at **application** scope;
@@ -653,13 +658,17 @@ RETURN DISTINCT c.id
 MATCH (m:PyCallable {is_entrypoint: true})
 RETURN m.id, m.entrypoint_frameworks
 
+// did the entrypoint pass find anything? (no entrypoints vs. nothing detected)
+MATCH (a:PyApplication)
+RETURN a.entrypoint_frameworks, a.entrypoint_report_json
+
 // data dependences into one statement (level 3+)
 MATCH (s:PyBodyNode {id: $stmt})<-[d:PY_DDG]-(src:PyBodyNode)
 RETURN src.id, d.var, d.prov
 
 // interprocedural flow through a parameter (level 4)
 MATCH (a:PyBodyNode)-[:PY_PARAM_IN]->(f:PyBodyNode)
-WHERE f.id STARTS WITH "can://python/myapp/src/api.py"
+WHERE f.id STARTS WITH "can://myapp/python/src/api.py"
 RETURN a.id, f.id
 ```
 
@@ -688,3 +697,25 @@ RETURN f.id, l.version
 ## License
 
 Apache 2.0 — see [LICENSE](./LICENSE).
+
+## Polyglot applications: all languages, or none
+
+A `--emit neo4j` push is **destructive**. It sweeps everything under `can://<app>/` that this
+analyzer marked, then rewrites what it found. Since the id grammar puts the application outermost,
+every analyzer over the same `<app>` shares that prefix — so a push reclaims stale rows belonging to
+*this* analyzer and, in the shared namespaces, sweeps rows a sibling wrote.
+
+For most of what is shared that is harmless: the artifact walk is a whole-repo inventory, so an
+`:Artifact` a sibling wrote is re-created by this push (with a thinner view of it — `roles` falls
+back to `unknown` and its config keys and dependency edges are gone until that sibling pushes
+again). `@external` ghosts are not inventoried that way: they are per-language, so a sibling's
+ghosts are swept and not restored.
+
+**So for an application analysed in more than one language, run every analyzer or none.** Running
+one in isolation leaves the others' derived rows missing until they run again. Running them
+together is always correct, in any order, because the last push restores everything the batch
+swept.
+
+Nothing here corrupts a graph: what is lost is derived and regenerates. But a partial run leaves a
+partial answer, and nothing in the data says so.
+

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/codeanalyzer/core.py

@@ -19,6 +19,7 @@ from codeanalyzer.schema import (
     model_validate_json,
 )
 from codeanalyzer.schema.assign_ids import assign_ids
+from codeanalyzer.schema.ids import external_id
 from codeanalyzer.schema.l1_body import populate_l1_body
 from codeanalyzer.schema.l2_callees import backfill_callees
 from codeanalyzer.schema.call_graph_ids import reidentify_call_graph
@@ -564,8 +565,7 @@ class Codeanalyzer:
                 if sig in sig_to_id:
                     continue
                 module, name = sig.rsplit(".", 1) if "." in sig else (None, sig)
-                ext_id = f"{app_id}/@external/{module}/{name}" if module else \
-                    f"{app_id}/@external/{name}"
+                ext_id = external_id(app_id, module, name)
                 sig_to_id[sig] = ext_id
                 externals[ext_id] = PyExternalSymbol(
                     id=ext_id, name=name, module=module

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/codeanalyzer/dataflow/builder.py

@@ -43,6 +43,7 @@ from codeanalyzer.dataflow.alias import TypeBasedAliasOracle
 from codeanalyzer.dataflow.pdg import build_pdg
 from codeanalyzer.dataflow.sdg import ProgramGraphsIR, assemble_sdg
 from codeanalyzer.dataflow.summaries import CallSite, FunctionInfo, compute_summaries
+from codeanalyzer.schema.ids import stamp_body_ids
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass, PyModule
 from codeanalyzer.utils import logger
 
@@ -333,6 +334,7 @@ def emit_l3_body(
                     for e in pdg.edges
                     if e.type == "DDG"
                 ]
+            stamp_body_ids(pycallable)
 
 
 def build_program_graphs(
@@ -538,6 +540,7 @@ def emit_l4(
             pycallable.body[im.local(pn.id)] = BodyNode(
                 kind=pn.kind, of=pn.var, parent=parent
             )
+        stamp_body_ids(pycallable)
 
     # (b/c/d) SDG edges → summary / param_in / param_out; CALL dropped.
     for e in ir.sdg_edges:

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/codeanalyzer/dataflow/identity.py

@@ -16,6 +16,8 @@ from __future__ import annotations
 from collections import defaultdict
 from typing import Dict, Iterable, Optional, Tuple
 
+from codeanalyzer.schema.ids import global_ordinal
+
 
 class IdentityMap:
     def __init__(self, callable_id: str, id_to_local: Dict[int, str]):
@@ -83,9 +85,7 @@ class IdentityMap:
 
     def global_id(self, node_id: int) -> str:
         """Fully addressable id: ``"<callable-id>@<local>"``."""
-        loc = self._map[node_id]
-        # local statements are "line:col"; bookends already carry the leading "@"
-        return f"{self._callable_id}{loc}" if loc.startswith("@") else f"{self._callable_id}@{loc}"
+        return global_ordinal(self._callable_id, self._map[node_id])
 
     def node_ids(self) -> Iterable[int]:
         return self._map.keys()

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/codeanalyzer/entrypoints/matching.py

@@ -64,7 +64,8 @@ def _compile(pattern: str) -> str:
         if ch == "{":
             j = pattern.index("}", i)
             alts = pattern[i + 1 : j].split(",")
-            out.append("(?:" + "|".join(re.escape(a.strip()) for a in alts) + ")")
+            # `*` keeps its meaning inside an alternative, so `{route,*.route}` works.
+            out.append("(?:" + "|".join(_compile(a.strip()) for a in alts) + ")")
             i = j + 1
         elif ch == "*":
             out.append(r"[^.\s]*")
@@ -93,15 +94,17 @@ def _route_of(dec, spec: Optional[Dict[str, Any]]) -> Optional[str]:
     if idx >= len(args):
         return None
     value = _literal(args[idx])
+    if isinstance(value, (list, tuple)):
+        value = next((v for v in value if isinstance(v, str)), None)
     return value if isinstance(value, str) else None
 
 
-def _methods_of(dec, spec: Optional[Dict[str, Any]]) -> List[str]:
+def _methods_of(dec, spec: Optional[Dict[str, Any]], qualified: Optional[str] = None) -> List[str]:
     if not spec:
         return []
     source = spec.get("from")
     if source == "match_suffix":
-        verb = (dec.qualified_name or "").rsplit(".", 1)[-1]
+        verb = (qualified or dec.qualified_name or "").rsplit(".", 1)[-1]
         return [verb.upper()]
     if source == "keyword":
         raw = (dec.keyword_arguments or {}).get(spec.get("name", ""))
@@ -113,12 +116,27 @@ def _methods_of(dec, spec: Optional[Dict[str, Any]]) -> List[str]:
 
 
 def entrypoints_from_decorators(
-    node, framework: str, rules: Iterable["DecoratorRule"]
+    node,
+    framework: str,
+    rules: Iterable["DecoratorRule"],
+    resolve: Optional[Callable[[str], str]] = None,
+    on_written: bool = False,
 ) -> List[PyEntrypoint]:
+    """``resolve`` is the module's import-table resolver (#177): when Jedi could
+    not resolve a decorator (the framework is not importable in the analysis
+    environment -- every ``--no-venv`` run), ``@http.route`` still resolves to
+    ``odoo.http.route`` from ``from odoo import http`` alone, the same way base
+    classes already do. Jedi's definition path wins when it exists.
+
+    ``on_written`` is the heuristic tier: rules match the decorator's spelling
+    as WRITTEN (``http.route``, ``router.post``), no resolution at all, so a
+    shape that reads as an HTTP entrypoint is recorded whether or not any
+    framework rule knows the library behind it."""
     out: List[PyEntrypoint] = []
     for dec in getattr(node, "decorators", []) or []:
+        qualified = dec.name if on_written else decorator_qualified_name(dec, resolve)
         for rule in rules:
-            if not match_pattern(rule.match, dec.qualified_name):
+            if not match_pattern(rule.match, qualified):
                 continue
             out.append(
                 PyEntrypoint(
@@ -126,14 +144,25 @@ def entrypoints_from_decorators(
                     confidence=rule.confidence,
                     rule=rule.id,
                     ruleset=rule.origin,
-                    evidence=dec.qualified_name,
+                    evidence=qualified,
                     route=_route_of(dec, rule.route),
-                    http_methods=_methods_of(dec, rule.methods),
+                    http_methods=_methods_of(dec, rule.methods, qualified),
                 )
             )
     return out
 
 
+def decorator_qualified_name(dec, resolve: Optional[Callable[[str], str]]) -> Optional[str]:
+    """Jedi's resolution, else the import-table resolution of the written
+    spelling, else ``None`` (a spelling the import table cannot map either)."""
+    if dec.qualified_name:
+        return dec.qualified_name
+    if resolve is None:
+        return None
+    resolved = resolve(dec.name)
+    return resolved if resolved != dec.name else None
+
+
 def entrypoints_from_bases(
     cls,
     framework: str,

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/codeanalyzer/entrypoints/pipeline.py

@@ -6,11 +6,14 @@ loses flags, never the analysis.
 """
 from __future__ import annotations
 
+import builtins
 from pathlib import Path
-from typing import Dict, Iterable, Iterator
+from typing import Dict, Iterable, Iterator, Set
 
 from codeanalyzer.entrypoints.detect import detected_frameworks
-from codeanalyzer.entrypoints.matching import entrypoints_from_bases, entrypoints_from_decorators
+from codeanalyzer.entrypoints.matching import (
+    decorator_qualified_name, entrypoints_from_bases, entrypoints_from_decorators,
+)
 from codeanalyzer.entrypoints.rules import RuleSet, load_rules
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass, PyModule
 from codeanalyzer.utils import logger
@@ -56,18 +59,34 @@ def _run_stages(app: PyApplication, project_dir: Path, rules: RuleSet) -> None:
     """
     for node in _walk(app):
         node.entrypoints = []
+    app.entrypoint_report.unresolved = {}
 
     app.entrypoint_report.rulesets = list(rules.rulesets)
     frameworks = detected_frameworks(app, project_dir, rules)
     app.entrypoint_report.frameworks_detected = sorted(frameworks)
 
     names = sorted(frameworks)
+    unresolved = app.entrypoint_report.unresolved
     for mod in app.symbol_table.values():
         resolve = _base_resolver(mod)
+        known = _known_heads(mod)
         for node in _walk_module(mod):
+            # #177: what neither Jedi nor the import table could name. This is
+            # the counter that makes silence visible; it was never written before.
+            # A builtin, a declared class, or a name whose head is imported is
+            # nameable and is not counted (`object`, `Exception`, `typing.Generic[T]`).
+            for dec in getattr(node, "decorators", None) or []:
+                if decorator_qualified_name(dec, resolve) is None and _unnameable(dec.name, known):
+                    unresolved[dec.name] = unresolved.get(dec.name, 0) + 1
+            if isinstance(node, PyClass):
+                for base in node.base_classes or []:
+                    if _unnameable(base, known):
+                        unresolved[base] = unresolved.get(base, 0) + 1
             for name in names:
                 fw = rules.frameworks[name]
-                node.entrypoints.extend(entrypoints_from_decorators(node, name, fw.decorators))
+                node.entrypoints.extend(
+                    entrypoints_from_decorators(node, name, fw.decorators, resolve)
+                )
                 if isinstance(node, PyClass) and fw.bases:
                     class_eps, method_eps = entrypoints_from_bases(
                         node, name, fw.bases, resolve
@@ -77,6 +96,34 @@ def _run_stages(app: PyApplication, project_dir: Path, rules: RuleSet) -> None:
                         target = (node.callables or {}).get(method_name)
                         if target is not None:
                             target.entrypoints.extend(eps)
+            # Heuristic tier: the written spelling, no framework needed. Runs
+            # last so a node a framework rule already claimed keeps one record.
+            if not node.entrypoints and rules.heuristics:
+                node.entrypoints.extend(
+                    entrypoints_from_decorators(
+                        node, "heuristic", rules.heuristics, resolve, on_written=True
+                    )
+                )
+
+
+_BUILTIN_NAMES: Set[str] = set(dir(builtins))
+
+
+def _known_heads(mod: PyModule) -> Set[str]:
+    """Names that can head a nameable spelling in this module: its declared classes
+    and every imported name or alias."""
+    heads = {cl.name for cl in (mod.types or {}).values()}
+    for imp in mod.imports or []:
+        heads.add(imp.alias or imp.name)
+    return heads
+
+
+def _unnameable(written: str, known: Set[str]) -> bool:
+    """Whether a written base/decorator spelling maps to nothing this module can
+    name: not a builtin, not a declared class, and its head is not imported.
+    Subscripts (`Generic[T]`, `dict[K, V]`) are stripped before the check."""
+    head = written.split("[", 1)[0].split(".", 1)[0].strip()
+    return bool(head) and head not in _BUILTIN_NAMES and head not in known
 
 
 def _base_resolver(mod: PyModule):
@@ -90,7 +137,8 @@ def _base_resolver(mod: PyModule):
     aliases: Dict[str, str] = {}
     for imp in mod.imports or []:
         original = imp.alias or imp.name
-        aliases[imp.name] = imp.module if imp.module == original else f"{imp.module}.{original}"
+        module = imp.resolved_module or imp.module
+        aliases[imp.name] = module if imp.module == original else f"{module}.{original}"
 
     def resolve(written: str) -> str:
         head, _, rest = written.partition(".")

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/codeanalyzer/entrypoints/rules.py

@@ -22,7 +22,7 @@ _CONFIDENCE = {"declared", "certain", "heuristic"}
 # blocks (Units 4-5) not implemented yet; they are deliberately absent here
 # rather than accepted-and-ignored, so a user file using them fails loudly
 # instead of loading clean and doing nothing.
-_TOP_LEVEL_KEYS = {"version", "frameworks", "disable"}
+_TOP_LEVEL_KEYS = {"version", "frameworks", "heuristics", "disable"}
 
 
 class RulesError(Exception):
@@ -60,6 +60,10 @@ class Framework:
 @dataclass
 class RuleSet:
     frameworks: Dict[str, Framework] = field(default_factory=dict)
+    # Framework-independent decorator rules matched on the WRITTEN spelling,
+    # confidence `heuristic` by default. They run on every node regardless of
+    # `frameworks_detected` and never double a record a framework rule made.
+    heuristics: List[DecoratorRule] = field(default_factory=list)
     rulesets: List[str] = field(default_factory=list)
 
 
@@ -103,9 +107,16 @@ def _merge(out: RuleSet, data: Dict[str, Any], origin: str) -> None:
         for raw in body.get("bases") or []:
             fw.bases.append(_base_rule(raw, origin))
 
+    heuristics = data.get("heuristics") or {}
+    if not isinstance(heuristics, dict):
+        raise RulesError(f"{origin}: `heuristics` must be a mapping")
+    for raw in heuristics.get("decorators") or []:
+        out.heuristics.append(_decorator_rule({"confidence": "heuristic", **raw}, origin))
+
     for fw in out.frameworks.values():
         fw.decorators = [r for r in fw.decorators if r.id not in disabled]
         fw.bases = [r for r in fw.bases if r.id not in disabled]
+    out.heuristics = [r for r in out.heuristics if r.id not in disabled]
 
 
 def _disable_list(data: Dict[str, Any], origin: str) -> List[str]:

{codeanalyzer_python-1.4.0 → codeanalyzer_python-1.5.0}/codeanalyzer/entrypoints/rules.yml

@@ -22,6 +22,24 @@ frameworks:
         transitive: true
         dispatch: [get, post, put, delete, patch]
 
+  odoo:
+    detect: [odoo]
+    decorators:
+      # `route` is a plain function in odoo/http.py, so Jedi's definition path
+      # and the import-table fallback (`from odoo import http` + `@http.route`,
+      # the shape every --no-venv run sees) both spell it `odoo.http.route`.
+      # The first positional may be one route or a list of them. Odoo serves
+      # GET and POST on a route unless `methods=` narrows it (json-typed routes
+      # are POST), so the default is both, not GET.
+      - id: odoo.route
+        match: "odoo.http.route"
+        route: {from: positional, index: 0}
+        methods: {from: keyword, name: methods, default: [GET, POST]}
+    bases:
+      - id: odoo.controller
+        match: "odoo.http.Controller"
+        transitive: true
+
   fastapi:
     detect: [fastapi]
     decorators:
@@ -86,3 +104,19 @@ frameworks:
         match: "django.views.generic.*"
         transitive: true
         dispatch: [get, post, put, patch, delete, head, options]
+
+# Framework-independent tier. Matched on the decorator's WRITTEN spelling, never
+# on a resolved name, so a shape that reads as an HTTP entrypoint is flagged even
+# when the library behind it has no `frameworks:` block above (or is not
+# importable). Confidence `heuristic`; a consumer wanting only certain hits
+# filters on it. A node a framework rule already matched gets no heuristic record.
+heuristics:
+  decorators:
+    - id: heuristic.http-route
+      match: "{route,*.route,*.*.route}"
+      route: {from: positional, index: 0}
+      methods: {from: keyword, name: methods}
+    - id: heuristic.http-verb
+      match: "{*,*.*}.{get,post,put,patch,delete,head,options,websocket}"
+      route: {from: positional, index: 0}
+      methods: {from: match_suffix}