codebread 1.0.1__py3-none-any.whl → 1.0.3__py3-none-any.whl

codebread/__init__.py

@@ -1,3 +1,3 @@
 """CodeBread — slice open a codebase and see its internal structure."""
 
-__version__ = "1.0.1"
+__version__ = "1.0.2"

codebread/analyzer.py

@@ -34,8 +34,12 @@ def analyze(root: str,
             info.warnings.append(err)
         info.layer = classify(info, text)
         if info.parsed or info.language in ("html", "css"):
-            info.source = text if len(text) <= 300_000 else \
+            src = text if len(text) <= 300_000 else \
                 text[:300_000] + "\n… (truncated)"
+            if info.language == "config":
+                from .parsers.generic_parser import redact_secrets
+                src = redact_secrets(src)
+            info.source = src
         parsed.append(info)
         for w in info.warnings:
             if w.startswith("Unsupported:"):

codebread/parsers/generic_parser.py

@@ -286,3 +286,17 @@ def parse_config(info: FileInfo, text: str) -> None:
                 value = value[:57] + "..."
         info.db_config.append(f"{key} = {value}")
     info.db_config = info.db_config[:20]
+
+
+def redact_secrets(text: str) -> str:
+    """Mask secret-looking values line by line. Used on config-file source
+    before it's stored/exported, so the raw "IDE view" / JSON export can't
+    leak what the DB-config summary already redacts."""
+    out = []
+    for line in text.splitlines():
+        m = re.match(r"^(\s*[\"']?[\w.\-]+[\"']?\s*[:=]\s*)(.+)$", line)
+        if m and SECRET_KEY_RE.search(m.group(1)):
+            out.append(m.group(1) + "•••masked•••")
+        else:
+            out.append(URL_CREDS_RE.sub("://***:***@", line))
+    return "\n".join(out)

codebread/server.py

@@ -10,6 +10,7 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Dict
 
 WEB_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "web")
+WEB_ROOT = os.path.realpath(WEB_DIR)
 
 MIME = {".html": "text/html; charset=utf-8",
         ".js": "application/javascript; charset=utf-8",
@@ -45,11 +46,19 @@ def serve(graph: Dict, port: int = 8137, open_browser: bool = True) -> None:
                 self._file(path.lstrip("/"))
 
         def _file(self, rel: str):
-            rel = os.path.normpath(rel).replace("\\", "/")
-            if rel.startswith("..") or rel.startswith("/"):
+            # Resolve against WEB_DIR and verify the *result* is still inside
+            # it. String-prefix checks on `rel` alone aren't enough: on
+            # Windows, os.path.join(WEB_DIR, "C:/some/file") silently
+            # discards WEB_DIR because the second argument is drive-absolute,
+            # which would otherwise let a request read any file on disk.
+            full = os.path.realpath(os.path.join(WEB_DIR, rel))
+            try:
+                inside = os.path.commonpath([full, WEB_ROOT]) == WEB_ROOT
+            except ValueError:
+                inside = False  # e.g. different drives on Windows
+            if not inside:
                 self.send_error(403)
                 return
-            full = os.path.join(WEB_DIR, rel)
             if not os.path.isfile(full):
                 self.send_error(404)
                 return

codebread/web/app.js

@@ -348,36 +348,61 @@ function visibleEdges() {
 }
 
 /* ---------------- DOM (re)build ---------------- */
+/* Incremental: only the nodes/edges that actually entered or left the
+   visible set touch the DOM. A full teardown+rebuild here would mean every
+   single click in a large, densely-linked graph re-creates *everything*
+   already on screen (elements + listeners) just to add one more node —
+   that's the "too many links = lag" complaint this replaced. */
 function rebuild() {
-  nodesG.innerHTML = ""; edgesG.innerHTML = "";
-  S.elNodes.clear(); S.elEdges.clear();
-  S.drawnEdges = [];
+  const newEdges = visibleEdges();
+  const newEdgeKeys = new Set(newEdges.map(edgeKey));
 
-  for (const e of visibleEdges()) {
+  for (const { key } of S.drawnEdges) {
+    if (newEdgeKeys.has(key)) continue;
+    const els = S.elEdges.get(key);
+    if (!els) continue;
+    els.vis.remove(); els.hit.remove();
+    S.elEdges.delete(key);
+  }
+
+  const drawnEdges = [];
+  for (const e of newEdges) {
     const key = edgeKey(e);
-    const vis = document.createElementNS(SVGNS, "path");
-    vis.setAttribute("class", "edge k-" + e.kind + (e.cycle ? " cycle" : ""));
-    const hit = document.createElementNS(SVGNS, "path");
-    hit.setAttribute("class", "edge-hit");
-    hit.addEventListener("mousemove", (ev) => showEdgeTooltip(e, ev));
-    hit.addEventListener("mouseleave", hideTooltip);
-    hit.addEventListener("contextmenu", (ev) => {
-      ev.preventDefault(); ev.stopPropagation();
-      onEdgeContextMenu(e, ev);
-    });
-    edgesG.appendChild(vis); edgesG.appendChild(hit);
-    S.elEdges.set(key, { vis, hit });
-    S.drawnEdges.push({ edge: e, key });
+    let els = S.elEdges.get(key);
+    if (!els) {
+      const vis = document.createElementNS(SVGNS, "path");
+      vis.setAttribute("class", "edge k-" + e.kind + (e.cycle ? " cycle" : ""));
+      const hit = document.createElementNS(SVGNS, "path");
+      hit.setAttribute("class", "edge-hit");
+      hit.addEventListener("mousemove", (ev) => showEdgeTooltip(e, ev));
+      hit.addEventListener("mouseleave", hideTooltip);
+      hit.addEventListener("contextmenu", (ev) => {
+        ev.preventDefault(); ev.stopPropagation();
+        onEdgeContextMenu(e, ev);
+      });
+      edgesG.appendChild(vis); edgesG.appendChild(hit);
+      els = { vis, hit };
+      S.elEdges.set(key, els);
+    }
+    drawnEdges.push({ edge: e, key });
   }
+  S.drawnEdges = drawnEdges;
 
+  for (const [id, g] of S.elNodes) {
+    const n = S.nodesById.get(id);
+    if (S.visible.has(id) && n && passesFilter(n)) continue;
+    g.remove();
+    S.elNodes.delete(id);
+  }
   for (const id of S.visible) {
     const n = S.nodesById.get(id);
-    if (!n || !passesFilter(n)) continue;
+    if (!n || !passesFilter(n) || S.elNodes.has(id)) continue;
     ensurePos(id);
     const g = makeNodeEl(n);
     nodesG.appendChild(g);
     S.elNodes.set(id, g);
   }
+
   applyHighlight();
   updatePositions();
   renderMinimap();

{codebread-1.0.1.dist-info → codebread-1.0.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codebread
-Version: 1.0.1
+Version: 1.0.3
 Summary: Interactive codebase analyzer & visualizer — slice open a project and see how it's wired together.
 Author: Danial Irsyad
 License: MIT
@@ -22,7 +22,7 @@ Dynamic: license-file
 </p>
 
 <p align="center">
-  <img alt="version" src="https://img.shields.io/badge/version-1.0.1-2dd4bf">
+  <img alt="version" src="https://img.shields.io/badge/version-1.0.2-2dd4bf">
   <img alt="python" src="https://img.shields.io/badge/python-3.9%2B-0284c7">
   <img alt="deps" src="https://img.shields.io/badge/required%20dependencies-none-2dd4bf">
   <img alt="license" src="https://img.shields.io/badge/license-MIT-8b5cf6">
@@ -164,14 +164,38 @@ the map already scanned.
 
 ## Language support
 
-| Language | Parser | Extracted |
-|---|---|---|
-| Python | stdlib `ast` (precise) | functions, classes, params/annotations, docstrings, Flask/FastAPI/Django routes, SQLAlchemy/Django models, raw SQL, `requests`/`httpx` calls |
-| JavaScript / TypeScript / JSX / TSX / Vue / Svelte | structural regex + brace matching | functions, arrow fns, classes, Express/Nest/Fastify routes, `fetch`/`axios` calls, Mongoose/Prisma/Sequelize/Knex/TypeORM, raw SQL |
-| Java, C#, Go, PHP, Ruby | structural regex | functions/methods, classes, Spring/ASP.NET/Laravel/Rails/Gin routes, raw SQL |
-| SQL | regex | `CREATE TABLE` schemas with columns |
-| Config (`.env`, json/yaml/toml/ini, settings.py…) | key scan | DB connection settings — **credentials always masked** |
-| Anything else (Rust, Kotlin, Swift, C/C++…) | — | shown in the UI as "⚠ Unsupported — parsing skipped", never silently dropped |
+Parser used per language, then exactly what gets extracted — checked feature
+by feature against the actual parser code, not a marketing table:
+
+| Language | Parser | Functions / methods | Classes / structs | Backend routes | Outgoing API calls | ORM / DB models | Raw SQL | Call graph | Page-nav links |
+|---|---|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|
+| Python | stdlib `ast` (precise) | ✅ | ✅ | ✅ Flask / FastAPI / Django | ✅ `requests` / `httpx` / `aiohttp` / `urllib` | ✅ SQLAlchemy / Django / peewee / tortoise | ✅ | ✅ | – |
+| JavaScript / TypeScript / JSX / TSX | regex + brace matching | ✅ | ✅ | ✅ Express / Fastify / Koa / NestJS | ✅ `fetch` / `axios` | ✅ Mongoose / Prisma / Sequelize / Knex / TypeORM | ✅ | ✅ | – |
+| Vue / Svelte | regex, `<script>` block only¹ | ✅ | ✅ | ✅ (same as JS) | ✅ (same as JS) | ✅ (same as JS) | ✅ | ✅ | – |
+| Java | regex | ✅ | ✅ | ✅ Spring `@*Mapping` | – | – | ✅ | ✅ | – |
+| C# | regex | ✅ | ✅ | ✅ ASP.NET `[Http*]` | – | – | ✅ | ✅ | – |
+| Go | regex | ✅ | ✅ (structs) | ✅ Gin / net-http style | – | – | ✅ | ✅ | – |
+| PHP | regex | ✅ | ✅ | ✅ Laravel `Route::` | – | – | ✅ | ✅ | ✅ |
+| Ruby | regex | ✅ | ✅ | ✅ Rails / Sinatra | – | – | ✅ | ✅ | ✅ |
+| SQL (`.sql` files) | regex | – | – | – | – | ✅ `CREATE TABLE` schemas + columns | ✅ | – | – |
+| Config (`.env`, json/yaml/toml/ini/xml…)² | key scan | – | – | – | – | – | – | – | – |
+| Anything else (Rust, Kotlin, Swift, C/C++, Scala, Elixir, Erlang, Lua, R, Perl, Dart, Zig…) | – | – | – | – | – | – | – | – | – |
+
+Unsupported languages still show up in the Explorer tree with an
+"⚠ Unsupported — parsing skipped" badge — never silently dropped — they just
+have no functions/edges to draw.
+
+¹ Vue/Svelte only parse the `<script>` block — template-only bindings
+(`@click`, `v-on`, Svelte reactive markup) aren't extracted.
+² Config-format files get a DB-connection-settings scan instead of code
+extraction — **credentials always masked**, see [export.py](codebread/export.py)-embedded
+source too. Files like `settings.py` or `config.js` are parsed as their real
+language (full extraction above), not this bucket — only non-code formats
+(json/yaml/toml/ini/`.env`/xml/properties) land here.
+
+Only Python's `ast`-based parser captures real parameter type annotations,
+return types, and docstrings — every regex-based parser above extracts
+parameter *names* only.
 
 ## How it classifies layers
 

{codebread-1.0.1.dist-info → codebread-1.0.3.dist-info}/RECORD

@@ -1,5 +1,5 @@
-codebread/__init__.py,sha256=zaQz04FV7Jd-aoPIR3qYYkZq1BbI0XO3OWKdY1hjya0,97
-codebread/analyzer.py,sha256=7uf00Lw5jjtsA4-fb8x2bUsoZybyPNeVQsXSBx1bPhY,3061
+codebread/__init__.py,sha256=InwUkpEmPv-mS3-33Vu1RXBTw1Zm4tYbe9RB4DAsW5s,97
+codebread/analyzer.py,sha256=tCsV0Cwi1l-If5zbNLbMtsuKW3o-rl8mekNG-B7MXpY,3234
 codebread/classifier.py,sha256=jehD-XQ80CP_O4x9YRi4JQqzd4AaHxKpzI83wLG1yvM,4067
 codebread/cli.py,sha256=AMvwk29cOJDjsI-I07pCGbqogdtq1Y6HWnT52FHYyLs,4072
 codebread/connections.py,sha256=FN0c-W9_tnQUVetnF0eVyC6lllyBOyZ3512sXShpy7Q,16609
@@ -8,17 +8,17 @@ codebread/export.py,sha256=rKYmzuSEXYDrgcItnhdyXI_lo0LN2PSoMe0hYElzU88,1512
 codebread/languages.py,sha256=SKHy9v7QPreWZG6FbuX3B0-kq1jqVn-rmwNqJ9ESFqo,4494
 codebread/models.py,sha256=Sw2PJW63dKyl5RpWwfY2ZvCJLYttmjoQg4O5H5DtLgM,4214
 codebread/scanner.py,sha256=bEXSaoENmJ-C_oabj2IF1aWs9-LaIqMc80xXQvo7-eg,8020
-codebread/server.py,sha256=9MPHNx3b_KQV4YA4XGeW9vhfkiq4jz-j5f6M9RDyhSc,3020
+codebread/server.py,sha256=H3kUXJaH8FkExNUwdwSD2HxBMceC_24o6pVSjJjFh8g,3543
 codebread/parsers/__init__.py,sha256=ovsvmXGClshiUlDdx6mkBmRu8__OZIqYos6-1eLb9eM,2285
-codebread/parsers/generic_parser.py,sha256=5XveP1AkCpIni9faEU9MRc93ZGHek7_R_TkQSZEOxts,11382
+codebread/parsers/generic_parser.py,sha256=lz-wLsmQYERoDRM27lhEP3cvNYbomHfA--VI_3LmJ5E,11966
 codebread/parsers/javascript_parser.py,sha256=lVIlydQ3--Owd78816XIM77NntfQ97DeLzYvPrjd5GE,15916
 codebread/parsers/python_parser.py,sha256=QnhCLx01bKYLYqav33cI27qbEQNPUiXnS5uN7cb8poQ,11671
-codebread/web/app.js,sha256=P1zpCHNMyczAuLWL9zM5htl9E3wG3jJdpZ6orLhixTM,65672
+codebread/web/app.js,sha256=bsm7cpji0mJrnpr0TPNhsL6w2bQw4RMwA8lS_T57G1s,66567
 codebread/web/index.html,sha256=6YqjC_wO3pfqyG_11uIhvRM16Wagu2l8eSOs1FNc-UY,8693
 codebread/web/style.css,sha256=fiq1bC-I1bC6-6MxRn0blQwGOjO_fdClPrhf5W7zqPw,23729
-codebread-1.0.1.dist-info/licenses/LICENSE,sha256=okINupIvMgiuOlvMVpsM9DT5jb6QQmKBd--yfZq4bjc,1070
-codebread-1.0.1.dist-info/METADATA,sha256=jsimg1QlF58mJVpAOs4L2Oh12i7R_kE0GSDGgBhHCHM,11367
-codebread-1.0.1.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
-codebread-1.0.1.dist-info/entry_points.txt,sha256=ItG61aUP1YTvA_zA-jlUshBc5BPpJDpCyVnsyaxNXKA,49
-codebread-1.0.1.dist-info/top_level.txt,sha256=KctFB7UQb4tN9YotaJD95GuHWIQuoO5VqyLdo_gEswQ,10
-codebread-1.0.1.dist-info/RECORD,,
+codebread-1.0.3.dist-info/licenses/LICENSE,sha256=okINupIvMgiuOlvMVpsM9DT5jb6QQmKBd--yfZq4bjc,1070
+codebread-1.0.3.dist-info/METADATA,sha256=td-SyaalRl1uapOaU1tzcsGFx5oBRRU27-Utb3mYPmE,13034
+codebread-1.0.3.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+codebread-1.0.3.dist-info/entry_points.txt,sha256=ItG61aUP1YTvA_zA-jlUshBc5BPpJDpCyVnsyaxNXKA,49
+codebread-1.0.3.dist-info/top_level.txt,sha256=KctFB7UQb4tN9YotaJD95GuHWIQuoO5VqyLdo_gEswQ,10
+codebread-1.0.3.dist-info/RECORD,,