entrygraph 0.1.0__tar.gz

entrygraph-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+# Test pull requests and non-main branch pushes. main is covered by the test
+# gate in release.yml, so it's excluded here to avoid duplicate runs.
+on:
+  pull_request: {}
+  push:
+    branches-ignore: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Run test suite
+        run: uv run --extra dev pytest -q

entrygraph-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,92 @@
+name: Release
+
+# Every merge/push to main auto-bumps the patch version (via a new git tag) and
+# publishes the built package to PyPI using Trusted Publishing (OIDC — no tokens).
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}  # allow a manual release from the Actions tab
+
+# Serialize releases so two quick merges can't race on the tag / version.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Run test suite
+        run: uv run --extra dev pytest -q
+
+  release:
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # push the new version tag
+      id-token: write   # PyPI Trusted Publishing (OIDC)
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # full history + all tags so hatch-vcs can resolve the version
+
+      - name: Compute next version
+        id: ver
+        run: |
+          set -euo pipefail
+          git fetch --tags --force --quiet
+          # Idempotency: if this commit is already released, do nothing.
+          if git describe --exact-match --tags HEAD >/dev/null 2>&1; then
+            echo "HEAD is already tagged — nothing to release."
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          latest="$(git tag --list 'v[0-9]*' --sort=-v:refname | head -n1)"
+          if [ -z "$latest" ]; then
+            next="0.1.0"                       # first release
+          else
+            v="${latest#v}"
+            IFS=. read -r major minor patch <<< "$v"
+            next="${major}.${minor}.$((patch + 1))"   # bump patch on every merge
+          fi
+          echo "Releasing v${next} (previous: ${latest:-none})"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          echo "version=${next}" >> "$GITHUB_OUTPUT"
+
+      - name: Create and push tag
+        if: steps.ver.outputs.release == 'true'
+        run: |
+          set -euo pipefail
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "v${{ steps.ver.outputs.version }}" -m "Release v${{ steps.ver.outputs.version }}"
+          git push origin "v${{ steps.ver.outputs.version }}"
+
+      - uses: astral-sh/setup-uv@v5
+        if: steps.ver.outputs.release == 'true'
+        with:
+          python-version: "3.12"
+
+      - name: Build sdist + wheel
+        if: steps.ver.outputs.release == 'true'
+        run: uv build   # hatch-vcs reads the tag we just created -> clean X.Y.Z version
+
+      - name: Publish to PyPI
+        if: steps.ver.outputs.release == 'true'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        # No password/token: uses OIDC. Configure a Trusted Publisher on PyPI
+        # (see RELEASING.md) that maps this repo + workflow to the project.
+
+      - name: Create GitHub Release
+        if: steps.ver.outputs.release == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "v${{ steps.ver.outputs.version }}" \
+            --title "v${{ steps.ver.outputs.version }}" \
+            --generate-notes \
+            dist/*

entrygraph-0.1.0/.gitignore

@@ -0,0 +1,227 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# entrygraph build artifacts
+dist/
+build/
+*.egg-info/
+.entrygraph.db
+*.entrygraph.db
+# generated by hatch-vcs at build time
+src/entrygraph/_version.py

entrygraph-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Brett Bergin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

entrygraph-0.1.0/PKG-INFO

@@ -0,0 +1,204 @@
+Metadata-Version: 2.4
+Name: entrygraph
+Version: 0.1.0
+Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
+Project-URL: Repository, https://github.com/brettbergin/entrygraph
+Author-email: Brett Bergin <brettberginbc@yahoo.com>
+License: MIT License
+        
+        Copyright (c) 2026 Brett Bergin
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: call-graph,code-analysis,entrypoints,static-analysis,tree-sitter
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: pathspec<1.0,>=0.12
+Requires-Dist: rich>=13.0
+Requires-Dist: sqlalchemy<3.0,>=2.0.30
+Requires-Dist: tree-sitter-language-pack>=1.10
+Requires-Dist: tree-sitter<0.26,>=0.25
+Provides-Extra: dev
+Requires-Dist: pytest-cov; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# entrygraph
+
+Query your codebase like a graph. `entrygraph` indexes a repository into a
+SQLite database (through the SQLAlchemy ORM) and answers questions about
+**symbols**, **classes/methods**, **entrypoints** (HTTP routes, CLI commands,
+main functions, tasks, lambda handlers), and **source → sink call-graph
+reachability** ("can any HTTP route reach `subprocess.run`?").
+
+Language-agnostic via [tree-sitter](https://tree-sitter.github.io/); first-class
+support for **Python, JavaScript/TypeScript, Go, Java, Ruby, C#, PHP, and
+Rust**, with language *and* framework detection.
+
+Reachability is a heuristic taint tier, not just call-edge closure: paths are
+**risk-ranked**, **sanitizers** prune or discount them, **class-hierarchy
+analysis** recovers virtual dispatch, and confidence flags trade recall for
+precision. Entrypoints include decorator/attribute routes, call-based route
+registration, middleware, and config-file handlers (serverless, SAM, Procfile,
+Dockerfile).
+
+## Install
+
+```bash
+pip install entrygraph        # or: uv pip install entrygraph
+```
+
+Requires Python ≥ 3.11. Depends on `sqlalchemy`, `tree-sitter`,
+`tree-sitter-language-pack`, and `pathspec`.
+
+## Python API
+
+```python
+from entrygraph import CodeGraph
+
+# Index a repo (creates <repo>/.entrygraph.db by default)
+graph = CodeGraph.index("/path/to/repo")
+
+# ...or open an existing index
+graph = CodeGraph.open("graph.db")
+
+# Symbols — glob on name or qualified name, filter by kind or file
+graph.symbols(kind="class", name="User*")
+graph.symbol("app.services.Runner.execute")        # exact; raises if missing
+
+# Detection
+report = graph.detect()
+report.languages      # -> [DetectedLanguage(name="python", percent=96.7, ...), ...]
+report.frameworks     # -> [DetectedFramework(name="flask", confidence=0.94, ...), ...]
+
+# Entrypoints
+graph.entrypoints(framework="flask")
+graph.entrypoints(kind="http_route", route="/api/*")
+
+# Call graph
+graph.callers("app.services.run_report")            # who calls it
+graph.callees("app.services.run_report", depth=3)   # what it (transitively) calls
+graph.references("app.models.CONST")                # inbound edges of any kind
+
+# Source -> sink reachability (paths are risk-ranked, highest first)
+paths = graph.paths(source="app.routes.*", sink_category="command_exec")
+for p in paths:
+    print(p.risk_score, p.render(), "(+may continue)" if p.may_continue else "")
+    # 0.72 app.routes.create_report -> app.services.run_report (line 20)
+    #   -> ...ReportRunner.render_and_execute (line 17) -> py:subprocess.run (line 22)
+
+graph.reachable(source="app.routes.upload", sink="py:subprocess.run")   # -> bool
+
+# Precision/recall dial. By default only EXACT/IMPORT and unique-name FUZZY
+# edges are traversed. Opt into wider (noisier) traversal:
+graph.paths(source="app.routes.*", sink_category="sql",
+            include_unresolved=True)   # follow py:*.execute wildcard-sink guesses
+graph.paths(source="app.routes.*", sink_category="command_exec",
+            include_fuzzy=True)        # follow speculative class-hierarchy (CHA) edges
+graph.paths(source="app.routes.*", sink_category="command_exec",
+            prune_sanitized=True)      # drop paths neutralized by a shlex.quote etc.
+
+# Incremental re-index (only changed/added/deleted files are reparsed)
+graph.refresh()
+
+# Escape hatches
+graph.session()               # raw SQLAlchemy Session
+graph.sql("SELECT ...")       # textual query -> list[dict]
+```
+
+Every result is a frozen, immutable dataclass detached from the DB session, so
+results are safe to hold and trivial to serialize.
+
+## CLI
+
+Human-readable output is rendered with [Rich](https://github.com/Textualize/rich) —
+colored tables, language/confidence bars, a progress spinner while indexing, and
+risk-ranked reachability rendered as call trees (sink nodes highlighted, per-hop
+confidence, sanitizer/const-arg badges). Piped or `--json` output stays plain.
+
+```bash
+entrygraph index PATH [--full] [--paranoid]     # incremental by default
+entrygraph detect
+entrygraph symbols --kind class --name 'User*'
+entrygraph entrypoints --framework flask
+entrygraph callers  app.services.run_report --depth 2
+entrygraph callees  app.services.run_report
+entrygraph paths --source 'app.routes.*' --sink-category command_exec
+entrygraph stats
+```
+
+Add `--json` to any query command for machine-readable output. `entrygraph paths`
+exits 0 when a path is found and 1 when none is — handy in CI:
+
+```bash
+entrygraph paths --source '*' --sink-category command_exec && echo "reachable!"
+```
+
+## How it works
+
+1. **Walk** — `os.scandir` with hard-pruned junk dirs (`node_modules`, `.venv`,
+   …), `.gitignore` rules, and size/binary/minified gates. Every skip is recorded
+   with a reason.
+2. **Extract** — tree-sitter `.scm` queries harvest definitions/imports/calls;
+   small per-language "shaper" modules build qualified names, import maps, and
+   receiver info. Parsing runs across a process pool for large repos.
+3. **Resolve** — a two-pass resolver binds references to symbols with a
+   confidence level (`exact` / `import` / `fuzzy` / `unresolved`). External
+   callees (`subprocess.run`, `child_process.exec`, …) become placeholder nodes
+   so sinks are real graph terminals.
+4. **Detect** — frameworks are scored from manifest dependencies plus code
+   signals (noisy-or); entrypoint rules map framework patterns to route/command
+   records.
+5. **Store** — everything persists to SQLite via the SQLAlchemy 2.0 ORM with
+   bulk inserts and app-assigned keys. Re-indexing is incremental and
+   content-hash driven.
+6. **Query** — reachability runs over an in-memory adjacency cache (BFS/DFS with
+   cycle handling); a recursive-CTE SQL engine is available as a fallback
+   (`engine="sql"`).
+
+## Extending
+
+- **Custom sinks/sources/sanitizers** — drop an `entrygraph.toml` in the repo
+  root with `[[sink]]` / `[[source]]` / `[[sanitizer]]` tables (same schema as
+  the built-in `data/sinks/*.toml`), or call
+  `entrygraph.detect.taint.register_sink(...)` / `register_sanitizer(...)`. A
+  `[[sanitizer]]` with `effect = "neutralizes"` prunes a path for its category;
+  `effect = "reduces"` only discounts the risk score. Third-party wrapper
+  libraries that reach a sink internally are covered by `data/sinks/lib_*.toml`
+  "library summaries" (same schema, with a `library = "..."` tag).
+- **New frameworks / entrypoints** — register a `FrameworkSpec` and an
+  `EntrypointRule`; adding a framework is usually a few lines.
+- **New languages** — add a `<lang>/{definitions,imports,calls}.scm` query set
+  and a shaper implementing the `LanguageExtractor` protocol.
+
+## Releasing
+
+Merging to `main` auto-bumps the patch version (via a git tag) and publishes to
+PyPI through Trusted Publishing — see [RELEASING.md](RELEASING.md). The package
+version is derived from git tags by `hatch-vcs`, so it's never hand-edited.
+
+## License
+
+MIT