deployproof 0.1.7__tar.gz → 0.1.8__tar.gz

{deployproof-0.1.7/src/deployproof.egg-info → deployproof-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deployproof
-Version: 0.1.7
+Version: 0.1.8
 Summary: A deterministic AI-code deployability checker that catches what coverage misses.
 Author-email: SVS Praveen <svspraveens@gmail.com>
 License-Expression: MIT
@@ -32,9 +32,11 @@ Dynamic: license-file
 
 > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
 
-[![PyPI version](https://img.shields.io/pypi/v/deployproof.svg?color=007ec6)](https://pypi.org/project/deployproof/)
-[![Python versions](https://img.shields.io/pypi/pyversions/deployproof.svg?color=3776ab)](https://pypi.org/project/deployproof/)
-[![Tests](https://img.shields.io/badge/tests-79%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.1.8-007ec6.svg)](https://pypi.org/project/deployproof/)
+[![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
+[![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
+[![Tests](https://img.shields.io/badge/tests-88%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![Stress Tests](https://img.shields.io/badge/stress%20tests-11%2F11%20passed-2ea44f.svg)](stress_fixtures/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 ---
@@ -65,7 +67,100 @@ Run all verification checks against changes in the current session (git diff):
 deployproof check
 ```
 
-Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push.
+Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. 
+
+### Exit Codes:
+* `0` — **PASSED**: All verification checks passed and mutation score meets threshold.
+* `1` — **FAILED**: Code quality or security gate triggered (mutation score below threshold, untested files, hardcoded secrets, sandbox-escape symlinks, hallucinated packages, or strict flags).
+* `2` — **ERROR**: Test environment failure (test suite failed to collect or execute before mutation testing began due to missing dependencies or broken imports).
+
+### Example Walkthrough
+
+Given a newly written function `calculator.py`:
+
+```python
+def calculate_discount(price: float, rate: float) -> float:
+    if rate > 0.5:
+        return price * 0.5
+    return price * (1.0 - rate)
+```
+
+With an AI-generated test that achieves 100% line coverage by only asserting standard discounts (`rate = 0.2`):
+
+```python
+def test_calculate_discount_basic():
+    assert calculate_discount(100.0, 0.2) == 80.0
+```
+
+Running `deployproof check` mutates AST operators and detects that boundary conditions and threshold caps are untested:
+
+```
+$ deployproof check
+
+DeployProof - LOCAL PRE-CHECK (approximate) - not the verified score
+====================================================================
+
+Target Scope (1 file evaluated):
+  * calculator.py
+
+Symlink & Sandbox Escape Scan (CWE-61/CWE-451):
+  Clean: No symlinks or sandbox-escape traversal links detected across 1 session file.
+
+Secrets & Credentials Pre-Push Scan:
+  Clean: No hardcoded secrets or tracked .env files detected across 1 session file.
+
+Dependency & Slopsquatting Scan (PyPI Registry & Age Analysis):
+  Clean: No new external packages introduced across 1 session file.
+
+Mock Usage Introduced (flagged for review):
+  Clean: No modified test files in scope.
+
+Control Flow & Error Handling (flagged for review):
+  Clean: No bare excepts, swallowed exceptions, or unreachable code detected across 1 session file.
+
+Local Pre-Check Mutation Verification:
+  Score:  57.1% (4/7 mutants killed)
+  Status: FAILED (score 57.1% below 80.0%) (threshold: 80.0%)
+  Time:   2.27s
+
+Skipped Constructs: None (No known unsupported constructs detected)
+
+Surviving Mutants (3 unverified changes):
+
+  [1] calculator.py:2
+      Mutation: Replace numeric constant '0.5' with '1.5'
+      Original: if rate > 0.5:
+      Mutated:  if rate > 1.5:
+
+  [2] calculator.py:3
+      Mutation: Replace numeric constant '0.5' with '1.5'
+      Original: return price * 0.5
+      Mutated:  return price * 1.5
+
+  [3] calculator.py:3
+      Mutation: Replace binary operator '*' with '/'
+      Original: return price * 0.5
+      Mutated:  return price / 0.5
+
+====================================================================
+Notice: Local pre-check only. Full verified score runs in CI on push (via mutmut).
+Pre-check FAILED: Score 57.1% is below threshold 80.0% (3 surviving mutants).
+```
+
+Adding tests for threshold cap (`rate = 0.8`) and exact boundary (`rate = 0.5`) kills all mutants:
+
+```
+Local Pre-Check Mutation Verification:
+  Score:  100.0% (7/7 mutants killed)
+  Status: PASSED (threshold: 80.0%)
+  Time:   2.31s
+
+Surviving Mutants: None (All generated mutants caught by test suite)
+
+====================================================================
+Notice: Local pre-check only. Full verified score runs in CI on push (via mutmut).
+Pre-check clean: 100% of tested basic mutations caught.
+```
 
 ### CLI Options & Flags
 
@@ -80,6 +175,8 @@ Output includes a section for each check — symlink scan, secrets scan, depende
 | `deployproof check --base <ref>` | Base git ref (branch/commit/tag) to diff against. |
 | `deployproof check --wsl` | Delegate mutation testing to `mutmut` inside WSL (Windows only). |
 
+> **Note:** `deployproof check --wsl` (Windows only) is newer and less battle-tested than the core checks — [file an issue](https://github.com/SVSPraveen/DeployProof/issues) if you hit something.
+
 ### Machine-Readable Output (`--json`)
 
 DeployProof provides a stable structured JSON schema for CI/CD pipelines, IDEs, and automation:
@@ -92,7 +189,7 @@ deployproof check --json
 
 ```json
 {
-  "version": "0.1.7",
+  "version": "0.1.8",
   "status": "passed",
   "summary": {
     "target_files_count": 1,
@@ -181,17 +278,17 @@ deployproof check --json
 
 ## See It Catch Real Bugs
 
-Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 7 planted edge cases:
+Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 11 planted edge cases:
 
 ```bash
 python stress_fixtures/run_stress_tests.py
 ```
 
-Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, and GhostApproval sandbox-escape traps.
+Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, GhostApproval sandbox-escape traps, swallowed exceptions/dead code, and mock-masked broken implementations.
 
 ## Status & Roadmap
 
-- **Current (v0.1.7):** Diff-scoped AST mutation testing, secrets scanner (including unquoted .env values), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with recursive `-r` requirements scanning and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks` and deduplicated decorator detection), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Current (v0.1.8):** Diff-scoped AST mutation testing (with recursive `test/`/`tests/` discovery and precise column-offset snippet reconstruction), baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner (including unquoted .env values and prefix validation), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks` and deduplicated decorator detection), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, 88 unit tests, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
 - **Next:** Multi-language mutation support and expanded ecosystem rule packs.
 
 ## Contributing

{deployproof-0.1.7 → deployproof-0.1.8}/README.md

@@ -2,9 +2,11 @@
 
 > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
 
-[![PyPI version](https://img.shields.io/pypi/v/deployproof.svg?color=007ec6)](https://pypi.org/project/deployproof/)
-[![Python versions](https://img.shields.io/pypi/pyversions/deployproof.svg?color=3776ab)](https://pypi.org/project/deployproof/)
-[![Tests](https://img.shields.io/badge/tests-79%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.1.8-007ec6.svg)](https://pypi.org/project/deployproof/)
+[![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
+[![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
+[![Tests](https://img.shields.io/badge/tests-88%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![Stress Tests](https://img.shields.io/badge/stress%20tests-11%2F11%20passed-2ea44f.svg)](stress_fixtures/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 ---
@@ -35,7 +37,100 @@ Run all verification checks against changes in the current session (git diff):
 deployproof check
 ```
 
-Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. Exit code is non-zero on any finding that should block a push.
+Output includes a section for each check — symlink scan, secrets scan, dependency scan, mock detection, control flow analysis, and mutation score — with a pass/fail line at the bottom. 
+
+### Exit Codes:
+* `0` — **PASSED**: All verification checks passed and mutation score meets threshold.
+* `1` — **FAILED**: Code quality or security gate triggered (mutation score below threshold, untested files, hardcoded secrets, sandbox-escape symlinks, hallucinated packages, or strict flags).
+* `2` — **ERROR**: Test environment failure (test suite failed to collect or execute before mutation testing began due to missing dependencies or broken imports).
+
+### Example Walkthrough
+
+Given a newly written function `calculator.py`:
+
+```python
+def calculate_discount(price: float, rate: float) -> float:
+    if rate > 0.5:
+        return price * 0.5
+    return price * (1.0 - rate)
+```
+
+With an AI-generated test that achieves 100% line coverage by only asserting standard discounts (`rate = 0.2`):
+
+```python
+def test_calculate_discount_basic():
+    assert calculate_discount(100.0, 0.2) == 80.0
+```
+
+Running `deployproof check` mutates AST operators and detects that boundary conditions and threshold caps are untested:
+
+```
+$ deployproof check
+
+DeployProof - LOCAL PRE-CHECK (approximate) - not the verified score
+====================================================================
+
+Target Scope (1 file evaluated):
+  * calculator.py
+
+Symlink & Sandbox Escape Scan (CWE-61/CWE-451):
+  Clean: No symlinks or sandbox-escape traversal links detected across 1 session file.
+
+Secrets & Credentials Pre-Push Scan:
+  Clean: No hardcoded secrets or tracked .env files detected across 1 session file.
+
+Dependency & Slopsquatting Scan (PyPI Registry & Age Analysis):
+  Clean: No new external packages introduced across 1 session file.
+
+Mock Usage Introduced (flagged for review):
+  Clean: No modified test files in scope.
+
+Control Flow & Error Handling (flagged for review):
+  Clean: No bare excepts, swallowed exceptions, or unreachable code detected across 1 session file.
+
+Local Pre-Check Mutation Verification:
+  Score:  57.1% (4/7 mutants killed)
+  Status: FAILED (score 57.1% below 80.0%) (threshold: 80.0%)
+  Time:   2.27s
+
+Skipped Constructs: None (No known unsupported constructs detected)
+
+Surviving Mutants (3 unverified changes):
+
+  [1] calculator.py:2
+      Mutation: Replace numeric constant '0.5' with '1.5'
+      Original: if rate > 0.5:
+      Mutated:  if rate > 1.5:
+
+  [2] calculator.py:3
+      Mutation: Replace numeric constant '0.5' with '1.5'
+      Original: return price * 0.5
+      Mutated:  return price * 1.5
+
+  [3] calculator.py:3
+      Mutation: Replace binary operator '*' with '/'
+      Original: return price * 0.5
+      Mutated:  return price / 0.5
+
+====================================================================
+Notice: Local pre-check only. Full verified score runs in CI on push (via mutmut).
+Pre-check FAILED: Score 57.1% is below threshold 80.0% (3 surviving mutants).
+```
+
+Adding tests for threshold cap (`rate = 0.8`) and exact boundary (`rate = 0.5`) kills all mutants:
+
+```
+Local Pre-Check Mutation Verification:
+  Score:  100.0% (7/7 mutants killed)
+  Status: PASSED (threshold: 80.0%)
+  Time:   2.31s
+
+Surviving Mutants: None (All generated mutants caught by test suite)
+
+====================================================================
+Notice: Local pre-check only. Full verified score runs in CI on push (via mutmut).
+Pre-check clean: 100% of tested basic mutations caught.
+```
 
 ### CLI Options & Flags
 
@@ -50,6 +145,8 @@ Output includes a section for each check — symlink scan, secrets scan, depende
 | `deployproof check --base <ref>` | Base git ref (branch/commit/tag) to diff against. |
 | `deployproof check --wsl` | Delegate mutation testing to `mutmut` inside WSL (Windows only). |
 
+> **Note:** `deployproof check --wsl` (Windows only) is newer and less battle-tested than the core checks — [file an issue](https://github.com/SVSPraveen/DeployProof/issues) if you hit something.
+
 ### Machine-Readable Output (`--json`)
 
 DeployProof provides a stable structured JSON schema for CI/CD pipelines, IDEs, and automation:
@@ -62,7 +159,7 @@ deployproof check --json
 
 ```json
 {
-  "version": "0.1.7",
+  "version": "0.1.8",
   "status": "passed",
   "summary": {
     "target_files_count": 1,
@@ -151,17 +248,17 @@ deployproof check --json
 
 ## See It Catch Real Bugs
 
-Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 7 planted edge cases:
+Clone this repository and run the standalone stress-test suite to see DeployProof evaluate 11 planted edge cases:
 
 ```bash
 python stress_fixtures/run_stress_tests.py
 ```
 
-Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, and GhostApproval sandbox-escape traps.
+Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS credentials, GhostApproval sandbox-escape traps, swallowed exceptions/dead code, and mock-masked broken implementations.
 
 ## Status & Roadmap
 
-- **Current (v0.1.7):** Diff-scoped AST mutation testing, secrets scanner (including unquoted .env values), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with recursive `-r` requirements scanning and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks` and deduplicated decorator detection), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Current (v0.1.8):** Diff-scoped AST mutation testing (with recursive `test/`/`tests/` discovery and precise column-offset snippet reconstruction), baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner (including unquoted .env values and prefix validation), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks` and deduplicated decorator detection), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, 88 unit tests, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
 - **Next:** Multi-language mutation support and expanded ecosystem rule packs.
 
 ## Contributing

{deployproof-0.1.7 → deployproof-0.1.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deployproof"
-version = "0.1.7"
+version = "0.1.8"
 description = "A deterministic AI-code deployability checker that catches what coverage misses."
 readme = "README.md"
 requires-python = ">=3.10"

{deployproof-0.1.7 → deployproof-0.1.8}/src/deployproof/__init__.py

@@ -1,2 +1,2 @@
 """DeployProof: Deterministic deployability verification for AI-assisted code."""
-__version__ = "0.1.7"
+__version__ = "0.1.8"

{deployproof-0.1.7 → deployproof-0.1.8}/src/deployproof/cli.py

@@ -301,13 +301,16 @@ def handle_check(args: argparse.Namespace) -> int:
         )
     print(report_text)
 
+    if result.collection_error:
+        return 2
+
     # Fail if mutation score threshold not met, secrets detected, symlink sandbox escapes found, hallucinated packages detected, or strict flags triggered
     strict_mocks_triggered = bool(getattr(args, "strict_mocks", False) and mock_result.total_findings > 0)
     strict_error_triggered = bool(
         getattr(args, "strict_error_handling", False) and control_flow_result.total_findings > 0
     )
     if (
-        result.mutation_score < args.threshold
+        (result.mutation_score is not None and result.mutation_score < args.threshold)
         or len(result.untested_files) > 0
         or len(secrets_result.findings) > 0
         or len(symlink_result.escape_findings) > 0

{deployproof-0.1.7 → deployproof-0.1.8}/src/deployproof/dependencies.py

@@ -9,12 +9,14 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Dict, List, Optional, Set
 
-# Standard library module names (Python 3.10+)
-STDLIB_MODULES: Set[str] = getattr(sys, "stdlib_module_names", set()) | {
+# Standard library module names (Python 3.10 through 3.14+)
+STDLIB_MODULES: Set[str] = set(getattr(sys, "stdlib_module_names", set())) | {
     "__future__",
     "_thread",
+    "_typeshed",
     "abc",
     "aifc",
+    "annotationlib",
     "argparse",
     "array",
     "ast",
@@ -74,10 +76,12 @@ STDLIB_MODULES: Set[str] = getattr(sys, "stdlib_module_names", set()) | {
     "ftplib",
     "functools",
     "gc",
+    "genericpath",
     "getopt",
     "getpass",
     "gettext",
     "glob",
+    "graphlib",
     "grp",
     "gzip",
     "hashlib",
@@ -113,6 +117,7 @@ STDLIB_MODULES: Set[str] = getattr(sys, "stdlib_module_names", set()) | {
     "multiprocessing",
     "netrc",
     "nntplib",
+    "ntpath",
     "numbers",
     "operator",
     "optparse",
@@ -163,6 +168,9 @@ STDLIB_MODULES: Set[str] = getattr(sys, "stdlib_module_names", set()) | {
     "socketserver",
     "spwd",
     "sqlite3",
+    "sre_compile",
+    "sre_constants",
+    "sre_parse",
     "ssl",
     "stat",
     "statistics",
@@ -246,6 +254,35 @@ IMPORT_TO_PYPI_MAP: Dict[str, str] = {
     "Bio": "biopython",
     "psycopg2": "psycopg2",
     "google": "protobuf",
+    "OpenSSL": "pyOpenSSL",
+    "openssl": "pyOpenSSL",
+    "OpenGL": "PyOpenGL",
+    "wx": "wxPython",
+    "gi": "PyGObject",
+    "googleapiclient": "google-api-python-client",
+    "kafka": "kafka-python",
+    "pydantic_core": "pydantic-core",
+    "pkg_resources": "setuptools",
+    "setuptools": "setuptools",
+    "brotli": "Brotli",
+    "zstandard": "zstandard",
+    "markupsafe": "MarkupSafe",
+    "sqlalchemy": "SQLAlchemy",
+    "playwright": "playwright",
+}
+
+# Known namespace umbrella roots (subpackages published separately on PyPI)
+KNOWN_NAMESPACE_ROOTS: Set[str] = {
+    "backports",
+    "google",
+    "azure",
+    "oslo",
+    "zope",
+    "jaraco",
+    "sphinxcontrib",
+    "ruamel",
+    "zc",
+    "plone",
 }
 
 MANIFEST_FILENAMES = {
@@ -256,6 +293,55 @@ MANIFEST_FILENAMES = {
 }
 
 
+def is_stdlib_or_internal(module_name: str) -> bool:
+    """Check if a module name is standard library, typeshed, or internal."""
+    cleaned = module_name.strip()
+    if not cleaned:
+        return True
+    if cleaned.startswith("_"):
+        return True
+    if cleaned in STDLIB_MODULES:
+        return True
+    if hasattr(sys, "stdlib_module_names") and cleaned in sys.stdlib_module_names:
+        return True
+    return False
+
+
+def is_requirements_manifest_file(file_path: Path) -> bool:
+    """
+    Check if a file is a requirements manifest file based on specific naming patterns.
+    
+    Accepts: requirements*.txt, *-requirements.txt, requirements/*.txt, constraints.txt, *.in, etc.
+    Rejects: arbitrary .txt files (LICENSE.txt, README.txt, NOTICE.txt, hello.txt, etc.).
+    """
+    name = file_path.name.lower()
+    parent_names = [p.name.lower() for p in file_path.parents]
+    in_req_dir = any(p in ("requirements", "reqs", "constraints") for p in parent_names)
+
+    if in_req_dir and file_path.suffix in (".txt", ".in"):
+        return True
+
+    if name in ("requirements.txt", "constraints.txt", "requirements.in", "constraints.in"):
+        return True
+
+    if name.startswith("requirements") and file_path.suffix in (".txt", ".in"):
+        return True
+
+    if name.startswith("constraints") and file_path.suffix in (".txt", ".in"):
+        return True
+
+    if name.endswith(("-requirements.txt", "_requirements.txt", ".requirements.txt", "-constraints.txt", "_constraints.txt", ".constraints.txt")):
+        return True
+
+    if name.endswith(("-requirements.in", "_requirements.in", ".requirements.in", "-constraints.in", "_constraints.in", ".constraints.in")):
+        return True
+
+    if name.endswith(".in") and any(k in name for k in ("req", "dev", "test", "base", "prod", "doc")):
+        return True
+
+    return False
+
+
 @dataclass(frozen=True)
 class ExtractedDependency:
     """Represents a newly introduced external dependency."""
@@ -277,7 +363,7 @@ def get_local_module_names(root: Path) -> Set[str]:
     """
     local_names: Set[str] = set()
 
-    search_dirs = [root, root / "src", root / "lib", root / "app"]
+    search_dirs = [root, root / "src", root / "lib", root / "app", root / "tests", root / "test", root / "examples"]
     for s_dir in search_dirs:
         if not s_dir.is_dir():
             continue
@@ -295,10 +381,11 @@ def get_local_module_names(root: Path) -> Set[str]:
         except (PermissionError, OSError):
             continue
 
-    # Also scan for all subfolders in the root tree that have __init__.py or py files (up to depth 3)
+    # Also scan recursively for package directories
     try:
-        for py_file in root.glob("*/*.py"):
-            if not any(part.startswith(".") or part in ("venv", ".venv", "build", "dist", "node_modules") for part in py_file.parts):
+        for py_file in root.rglob("*.py"):
+            if not any(part.startswith(".") or part in ("venv", ".venv", "build", "dist", "node_modules", "__pycache__") for part in py_file.parts):
+                local_names.add(py_file.stem)
                 local_names.add(py_file.parent.name)
     except (PermissionError, OSError):
         pass
@@ -402,6 +489,9 @@ def normalize_package_name(raw_name: str) -> str:
     cleaned = raw_name.strip()
     if cleaned in IMPORT_TO_PYPI_MAP:
         return IMPORT_TO_PYPI_MAP[cleaned]
+    for imp_k, pypi_v in IMPORT_TO_PYPI_MAP.items():
+        if imp_k.lower() == cleaned.lower():
+            return pypi_v
     return cleaned
 
 
@@ -437,7 +527,7 @@ def extract_new_imports_from_py_file(
 
             for alias in node.names:
                 top_name = alias.name.split(".")[0]
-                if top_name in STDLIB_MODULES or top_name in local_modules:
+                if is_stdlib_or_internal(top_name) or top_name in local_modules:
                     continue
                 pypi_name = normalize_package_name(top_name)
                 key = f"{pypi_name}:{node.lineno}"
@@ -462,7 +552,7 @@ def extract_new_imports_from_py_file(
                 continue
 
             top_name = node.module.split(".")[0]
-            if top_name in STDLIB_MODULES or top_name in local_modules:
+            if is_stdlib_or_internal(top_name) or top_name in local_modules:
                 continue
 
             pypi_name = normalize_package_name(top_name)
@@ -507,7 +597,7 @@ def extract_new_imports_from_py_file(
                 if isinstance(first_arg, ast.Constant) and isinstance(first_arg.value, str):
                     raw_mod_name = first_arg.value.strip()
                     top_name = raw_mod_name.split(".")[0]
-                    if not top_name or top_name in STDLIB_MODULES or top_name in local_modules:
+                    if not top_name or is_stdlib_or_internal(top_name) or top_name in local_modules:
                         continue
 
                     pypi_name = normalize_package_name(top_name)
@@ -665,7 +755,7 @@ def _parse_requirements_file(
         m = req_name_re.match(raw_line)
         if m:
             pkg_name = m.group(1).strip()
-            if pkg_name not in STDLIB_MODULES and pkg_name not in local_modules:
+            if not is_stdlib_or_internal(pkg_name) and pkg_name not in local_modules:
                 try:
                     rel_source_type = file_path.relative_to(root).as_posix()
                 except ValueError:
@@ -696,14 +786,7 @@ def extract_new_manifest_dependencies(
         local_modules = get_local_module_names(root)
 
     name = file_path.name.lower()
-    is_requirements = (
-        name == "requirements.txt"
-        or name.endswith(".requirements.txt")
-        or name.startswith("requirements-")
-        or name.endswith("-requirements.txt")
-        or name.endswith(".in")
-        or file_path.suffix == ".txt"
-    )
+    is_requirements = is_requirements_manifest_file(file_path)
     is_pyproject = name == "pyproject.toml"
     is_setup_py = name == "setup.py"
     is_setup_cfg = name == "setup.cfg"
@@ -741,7 +824,7 @@ def extract_new_manifest_dependencies(
             # Check section headers
             if raw_line.startswith("[") and raw_line.endswith("]"):
                 header = raw_line.strip("[]").strip().lower()
-                if "dependencies" in header or header.endswith(".dependencies"):
+                if "dependencies" in header or header.endswith(".dependencies") or "optional-dependencies" in header:
                     in_dependency_section = True
                 else:
                     in_dependency_section = False
@@ -765,7 +848,7 @@ def extract_new_manifest_dependencies(
                     if m:
                         pkg_name = m.group(1).strip()
                         if pkg_name.lower() not in ("dependencies", "install_requires", "requires", "version", "name"):
-                            if pkg_name not in STDLIB_MODULES and pkg_name not in local_modules:
+                            if not is_stdlib_or_internal(pkg_name) and pkg_name not in local_modules:
                                 extracted.append(
                                     ExtractedDependency(
                                         name=normalize_package_name(pkg_name),
@@ -791,7 +874,7 @@ def extract_new_manifest_dependencies(
                     if m:
                         pkg_name = m.group(1).strip()
                         if pkg_name.lower() not in ("install_requires", "extras_require", "setup", "name", "version"):
-                            if pkg_name not in STDLIB_MODULES and pkg_name not in local_modules:
+                            if not is_stdlib_or_internal(pkg_name) and pkg_name not in local_modules:
                                 extracted.append(
                                     ExtractedDependency(
                                         name=normalize_package_name(pkg_name),
@@ -885,13 +968,22 @@ def query_pypi_registry(
     import urllib.request
 
     norm_name = package_name.strip()
+    if is_stdlib_or_internal(norm_name):
+        return ("OK", None, None, f"Standard library / internal module ({norm_name})")
+
+    if norm_name.lower() in KNOWN_NAMESPACE_ROOTS:
+        return ("OK", None, None, f"Namespace package umbrella root ('{norm_name}') - subpackages published separately on PyPI")
+
     if cache is not None and norm_name in cache:
         return cache[norm_name]
 
-    url = f"https://pypi.org/pypi/{norm_name}/json"
+    # Map import name to PyPI distribution name if known
+    canonical_pkg = normalize_package_name(norm_name)
+
+    url = f"https://pypi.org/pypi/{canonical_pkg}/json"
     req = urllib.request.Request(
         url,
-        headers={"User-Agent": "DeployProof/0.1.7 (https://github.com/SVSPraveen/DeployProof)"},
+        headers={"User-Agent": "DeployProof/0.1.8 (https://github.com/SVSPraveen/DeployProof)"},
     )
 
     try:
@@ -913,8 +1005,10 @@ def query_pypi_registry(
                                 pass
 
                 if not timestamps:
-                    # Package exists on PyPI but has no release files
-                    result = ("MEDIUM_RISK", 0, None, "Package exists on PyPI but has 0 uploaded releases")
+                    if canonical_pkg.lower() in KNOWN_NAMESPACE_ROOTS or norm_name.lower() in KNOWN_NAMESPACE_ROOTS:
+                        result = ("OK", None, None, f"Namespace package umbrella root ('{canonical_pkg}') - subpackages published separately on PyPI")
+                    else:
+                        result = ("MEDIUM_RISK", 0, None, "Package exists on PyPI but has 0 uploaded releases")
                 else:
                     earliest_dt = min(timestamps)
                     now = datetime.datetime.now(datetime.timezone.utc)
@@ -941,12 +1035,15 @@ def query_pypi_registry(
 
     except urllib.error.HTTPError as e:
         if e.code == 404:
-            result = (
-                "HIGH_RISK",
-                None,
-                None,
-                "Package does NOT exist on PyPI (HTTP 404) - hallucinated package name / slopsquatting vulnerability",
-            )
+            if canonical_pkg.lower() in KNOWN_NAMESPACE_ROOTS or norm_name.lower() in KNOWN_NAMESPACE_ROOTS:
+                result = ("OK", None, None, f"Namespace package umbrella root ('{norm_name}') - subpackages published separately on PyPI")
+            else:
+                result = (
+                    "HIGH_RISK",
+                    None,
+                    None,
+                    "Package does NOT exist on PyPI (HTTP 404) - hallucinated package name / slopsquatting vulnerability",
+                )
         else:
             result = ("UNKNOWN", None, None, f"PyPI HTTP Error {e.code}: {e.reason}")
     except (urllib.error.URLError, TimeoutError, OSError) as e: