entrygraph 0.1.27__tar.gz → 0.1.28__tar.gz

{entrygraph-0.1.27 → entrygraph-0.1.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.27
+Version: 0.1.28
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.27'
-__version_tuple__ = version_tuple = (0, 1, 27)
+__version__ = version = '0.1.28'
+__version_tuple__ = version_tuple = (0, 1, 28)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/api.py

@@ -88,6 +88,17 @@ class _FilteredAdjacency:
         )
 
 
+class PathResults(list):
+    """CallPath list that also reports whether enumeration was budget-truncated.
+
+    It is a plain list for every existing use (iteration, len, indexing); the
+    `truncated` flag lets the CLI warn when 0 paths may mean "budget spent", not
+    "no reachable sink".
+    """
+
+    truncated: bool = False
+
+
 def _has_sanitizer(path: CallPath) -> bool:
     """True if a category sanitizer is called on the path (heuristic, no dataflow).
 
@@ -317,11 +328,15 @@ class CodeGraph:
             sources = self._source_ids(session, source, source_category)
             sinks = self._sink_ids(session, sink, sink_category)
             if not sources or not sinks:
-                return []
+                return PathResults()
             traverser = self._traverser(session, engine, kinds, floor, include_cha)
             raw_paths = traverser.paths(sources, sinks, max_depth=max_depth, max_paths=max_paths)
             if not raw_paths:
-                return []
+                # 0 paths may mean the visit budget was spent before any sink was
+                # reached — propagate the flag so this isn't mistaken for "safe".
+                empty = PathResults()
+                empty.truncated = bool(getattr(raw_paths, "truncated", False))
+                return empty
             all_ids = {node for path in raw_paths for node, _ in path}
             symbol_map = q.symbols_by_ids(session, all_ids)
             registry = self._registry(session)
@@ -347,7 +362,12 @@ class CodeGraph:
         results.sort(
             key=lambda p: (-(p.risk_score or 0.0), len(p.symbols), [s.id for s in p.symbols])
         )
-        return results
+        # Enumeration collected a candidate pool; return the top max_paths by risk.
+        # Truncating after the risk rank (not during DFS) is what makes the widen
+        # flags monotonic — a wider edge set can only add candidates to rank.
+        out = PathResults(results[:max_paths])
+        out.truncated = bool(getattr(raw_paths, "truncated", False))
+        return out
 
     def reachable(
         self,

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/cli/main.py

@@ -8,6 +8,7 @@ directly testable.
 from __future__ import annotations
 
 import argparse
+import sys
 from dataclasses import asdict
 from pathlib import Path
 
@@ -277,6 +278,15 @@ def cmd_paths(args) -> int:
             include_callbacks=args.include_callbacks,
             prune_sanitized=args.prune_sanitized,
         )
+    truncated = bool(getattr(paths, "truncated", False))
+    if truncated:
+        # A budget-truncated search may have missed paths — never let an empty or
+        # short result read as a clean "no reachable sinks" on a large graph.
+        print(
+            "warning: path search hit its work budget and may be incomplete; "
+            "narrow --source/--sink or lower --max-depth for a complete answer.",
+            file=sys.stderr,
+        )
     if args.json:
         print(
             to_json(

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/base.py

@@ -74,6 +74,17 @@ def first_string_arg(decorator_text: str) -> str | None:
     return match.group(1) if match else None
 
 
+def compose_route(prefix: str | None, path: str | None) -> str:
+    """Join a class/group-level route prefix with a method-level path.
+
+    Either side may be None/empty or carry stray leading/trailing slashes. The
+    result is a single slash-prefixed route ("/" when both are empty), matching
+    the NestJS rule so composed routes read consistently across frameworks.
+    """
+    parts = [seg.strip("/") for seg in (prefix, path) if seg and seg.strip("/")]
+    return "/" + "/".join(parts)
+
+
 def methods_kwarg(decorator_text: str) -> list[str]:
     match = _METHODS_KWARG.search(decorator_text)
     if not match:

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/csharp.py

@@ -14,6 +14,7 @@ import re
 
 from entrygraph.detect.entrypoints.base import (
     EntrypointRule,
+    compose_route,
     first_string_arg,
     register,
 )
@@ -48,14 +49,32 @@ def _is_controller(t: RawSymbol) -> bool:
     return any("Controller" in b for b in t.bases)
 
 
+def _controller_token(qname: str) -> str:
+    """The `[controller]` route-token value: the class name minus a Controller suffix."""
+    name = qname.rsplit(".", 1)[-1]
+    return name[: -len("Controller")] if name.endswith("Controller") else name
+
+
+def _class_route_prefix(t: RawSymbol) -> str:
+    """A controller's class-level [Route("...")] prefix, with [controller] expanded."""
+    route_dec = next((d for d in t.decorators if _ROUTE_ATTR.match(d)), None)
+    prefix = first_string_arg(route_dec) if route_dec else None
+    if not prefix:
+        return ""
+    return prefix.replace("[controller]", _controller_token(t.qualified_name))
+
+
 def _aspnet_controller_routes(x: FileExtraction) -> list[EntrypointHint]:
-    controllers = {t.qualified_name for t in _type_symbols(x) if _is_controller(t)}
+    controller_syms = [t for t in _type_symbols(x) if _is_controller(t)]
+    controllers = {t.qualified_name for t in controller_syms}
     if not controllers:
         return []
+    prefixes = {t.qualified_name: _class_route_prefix(t) for t in controller_syms}
     hints: list[EntrypointHint] = []
     for method in _methods(x):
         if method.parent_qualified_name not in controllers:
             continue
+        prefix = prefixes.get(method.parent_qualified_name or "", "")
         for decorator in method.decorators:
             m = _HTTP_ATTR.match(decorator)
             if m:
@@ -64,7 +83,7 @@ def _aspnet_controller_routes(x: FileExtraction) -> list[EntrypointHint]:
                         rule_id="csharp.aspnet.controller-route",
                         kind=EntrypointKind.HTTP_ROUTE,
                         handler_qualified_name=method.qualified_name,
-                        route=first_string_arg(decorator) or "",
+                        route=compose_route(prefix, first_string_arg(decorator)),
                         http_methods=[m.group(1).upper()],
                         framework="aspnetcore",
                     )
@@ -79,7 +98,7 @@ def _aspnet_controller_routes(x: FileExtraction) -> list[EntrypointHint]:
                         rule_id="csharp.aspnet.controller-route",
                         kind=EntrypointKind.HTTP_ROUTE,
                         handler_qualified_name=method.qualified_name,
-                        route=first_string_arg(route_dec) or "",
+                        route=compose_route(prefix, first_string_arg(route_dec)),
                         http_methods=["*"],
                         framework="aspnetcore",
                     )

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/golang.py

@@ -11,8 +11,11 @@ from entrygraph.detect.entrypoints.base import (
 from entrygraph.extract.ir import EntrypointHint, FileExtraction
 from entrygraph.kinds import EntrypointKind, SymbolKind
 
-_GIN_METHODS = frozenset(
-    {"GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS", "Any", "Handle"}
+# gin exports UPPERCASE verbs (r.GET); chi/fiber use TitleCase (r.Get). Accept
+# both so the shared _gin_style matcher recognizes chi/fiber, not just gin.
+_HTTP_VERBS = frozenset({"GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"})
+_GIN_METHODS = (
+    _HTTP_VERBS | frozenset(v.title() for v in _HTTP_VERBS) | frozenset({"Any", "Handle"})
 )
 _NETHTTP_REGISTER = frozenset({"HandleFunc", "Handle"})
 
@@ -73,12 +76,8 @@ def _gin_routes(x: FileExtraction) -> list[EntrypointHint]:
         ):
             route = first_string_arg("(" + ref.arg_preview.lstrip("("))
             if route is not None and route.startswith("/"):
-                method = (
-                    ref.callee_name.upper()
-                    if ref.callee_name
-                    in {"GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"}
-                    else "*"
-                )
+                verb = ref.callee_name.upper()
+                method = verb if verb in _HTTP_VERBS else "*"
                 hints.append(
                     EntrypointHint(
                         rule_id="go.gin.route",

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/java.py

@@ -13,6 +13,7 @@ import re
 
 from entrygraph.detect.entrypoints.base import (
     EntrypointRule,
+    compose_route,
     first_string_arg,
     register,
 )
@@ -38,6 +39,10 @@ def _annotation_names(decorators: list[str], pattern: re.Pattern) -> bool:
     return any(pattern.match(d) for d in decorators)
 
 
+def _class_prefix(qname: str | None, prefixes: dict[str, str]) -> str:
+    return prefixes.get(qname or "", "")
+
+
 def _type_symbols(x: FileExtraction) -> list[RawSymbol]:
     return [s for s in x.symbols if s.kind in (SymbolKind.CLASS, SymbolKind.INTERFACE)]
 
@@ -50,6 +55,17 @@ def _enclosing_type(method: RawSymbol, types: list[RawSymbol]) -> RawSymbol | No
     return next((t for t in types if t.qualified_name == method.parent_qualified_name), None)
 
 
+def _class_route_prefixes(types: list[RawSymbol], pattern: re.Pattern) -> dict[str, str]:
+    """Map controller/resource qname -> its class-level route prefix (via `pattern`)."""
+    prefixes: dict[str, str] = {}
+    for t in types:
+        for decorator in t.decorators:
+            if pattern.match(decorator):
+                prefixes[t.qualified_name] = first_string_arg(decorator) or ""
+                break
+    return prefixes
+
+
 def _spring_routes(x: FileExtraction) -> list[EntrypointHint]:
     types = _type_symbols(x)
     controllers = {
@@ -57,6 +73,10 @@ def _spring_routes(x: FileExtraction) -> list[EntrypointHint]:
     }
     if not controllers:
         return []
+    # A controller's own @RequestMapping("/api") is its route prefix.
+    prefixes = _class_route_prefixes(
+        [t for t in types if t.qualified_name in controllers], _SPRING_MAPPING
+    )
     hints = []
     for method in _methods(x):
         if method.parent_qualified_name not in controllers:
@@ -67,12 +87,15 @@ def _spring_routes(x: FileExtraction) -> list[EntrypointHint]:
                 continue
             verb = _MAPPING_VERB.get(match.group(1))
             methods = [verb] if verb else ["*"]
+            route = compose_route(
+                _class_prefix(method.parent_qualified_name, prefixes), first_string_arg(decorator)
+            )
             hints.append(
                 EntrypointHint(
                     rule_id="java.spring.route",
                     kind=EntrypointKind.HTTP_ROUTE,
                     handler_qualified_name=method.qualified_name,
-                    route=first_string_arg(decorator) or "",
+                    route=route,
                     http_methods=methods,
                     framework="spring-boot",
                 )
@@ -85,6 +108,10 @@ def _jaxrs_routes(x: FileExtraction) -> list[EntrypointHint]:
     resources = {t.qualified_name for t in types if _annotation_names(t.decorators, _JAXRS_PATH)}
     if not resources:
         return []
+    # A resource class's own @Path("/api") prefixes every sub-resource method.
+    prefixes = _class_route_prefixes(
+        [t for t in types if t.qualified_name in resources], _JAXRS_PATH
+    )
     hints = []
     for method in _methods(x):
         if method.parent_qualified_name not in resources:
@@ -95,13 +122,16 @@ def _jaxrs_routes(x: FileExtraction) -> list[EntrypointHint]:
         )
         if verb is None:
             continue
-        route = next((first_string_arg(d) for d in method.decorators if _JAXRS_PATH.match(d)), None)
+        method_path = next(
+            (first_string_arg(d) for d in method.decorators if _JAXRS_PATH.match(d)), None
+        )
+        route = compose_route(_class_prefix(method.parent_qualified_name, prefixes), method_path)
         hints.append(
             EntrypointHint(
                 rule_id="java.jaxrs",
                 kind=EntrypointKind.HTTP_ROUTE,
                 handler_qualified_name=method.qualified_name,
-                route=route or "",
+                route=route,
                 http_methods=[verb],
                 framework="jax-rs",
             )
@@ -121,6 +151,9 @@ def _micronaut_routes(x: FileExtraction) -> list[EntrypointHint]:
     }
     if not controllers:
         return []
+    prefixes = _class_route_prefixes(
+        [t for t in types if t.qualified_name in controllers], _MICRONAUT_CONTROLLER
+    )
     hints = []
     for method in _methods(x):
         if method.parent_qualified_name not in controllers:
@@ -128,12 +161,16 @@ def _micronaut_routes(x: FileExtraction) -> list[EntrypointHint]:
         for decorator in method.decorators:
             m = _MICRONAUT_MAPPING.match(decorator)
             if m:
+                route = compose_route(
+                    _class_prefix(method.parent_qualified_name, prefixes),
+                    first_string_arg(decorator),
+                )
                 hints.append(
                     EntrypointHint(
                         rule_id="java.micronaut.route",
                         kind=EntrypointKind.HTTP_ROUTE,
                         handler_qualified_name=method.qualified_name,
-                        route=first_string_arg(decorator) or "",
+                        route=route,
                         http_methods=[m.group(1).upper()],
                         framework="micronaut",
                     )

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/javascript.py

@@ -14,6 +14,31 @@ _NEST_DECORATOR = re.compile(r"^@(Get|Post|Put|Delete|Patch|All)\b")
 
 
 _TRAILING_IDENT = re.compile(r",\s*([A-Za-z_$][\w$]*)\s*\)?\s*$")
+_RECEIVER_ROOT = re.compile(r"^\s*([A-Za-z_$][\w$]*)")
+# HTTP-client and test-harness roots whose .get()/.post() are *requests*, not
+# route registrations: supertest/nock/chai/superagent and Node/browser clients.
+# Excludes them so test suites don't flood the route table (ghost 72%, strapi 99%).
+_CLIENT_ROOTS = frozenset(
+    {
+        "nock",
+        "supertest",
+        "request",
+        "superagent",
+        "agent",
+        "chai",
+        "axios",
+        "got",
+        "fetch",
+        "http",
+        "https",
+        "fastify",
+    }  # fastify.inject(...).get is a test call
+)
+
+
+def _receiver_root(receiver_text: str) -> str | None:
+    m = _RECEIVER_ROOT.match(receiver_text)
+    return m.group(1) if m else None
 
 
 def _router_routes(framework: str):
@@ -29,6 +54,7 @@ def _router_routes(framework: str):
             if (
                 ref.kind == "call"
                 and ref.receiver_text is not None
+                and _receiver_root(ref.receiver_text) not in _CLIENT_ROOTS
                 and ref.callee_name in _HTTP_METHODS
                 and ref.arg_preview
             ):

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/python.py

@@ -53,8 +53,14 @@ def _flask_routes(x: FileExtraction) -> list[EntrypointHint]:
         else:
             verb = _HTTP_VERB.match(decorator)
             if verb:
-                route = first_string_arg(decorator)
-                methods = [verb.group(2).upper()]
+                candidate = first_string_arg(decorator)
+                # The @app.get/@router.post shorthand shares its shape with
+                # @mock.patch("dotted.target"), which the verb `patch` matches.
+                # A real Flask/FastAPI route is a URL path ("/..."); a mock target
+                # is a dotted import path. Require the URL shape to exclude mocks.
+                if candidate is not None and candidate.startswith("/"):
+                    route = candidate
+                    methods = [verb.group(2).upper()]
         if route is not None:
             hints.append(
                 EntrypointHint(

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/extract/javascript.py

@@ -36,6 +36,22 @@ _SCOPE_TYPES = frozenset(
 _NAMED_SCOPES = frozenset({"function_declaration", "method_definition", "class_declaration"})
 _SRC_ROOTS = ("src", "lib", "app")
 _EXPORT_PARENTS = frozenset({"export_statement"})
+_JS_EXTS = (".d.ts", ".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".jsx")
+
+
+def _atomic_segment(filename: str) -> str:
+    """A filename -> one module-path segment: strip a JS/TS extension, then map any
+    remaining internal dots to `_`.
+
+    A dotted stem like ``article.service`` must NOT become two dotted segments, or
+    ``.split(".")`` in relative-import resolution mis-counts package depth and
+    duplicates a directory name (``article.article.article.service``) — issue #42.
+    """
+    for ext in _JS_EXTS:
+        if filename.endswith(ext):
+            filename = filename[: -len(ext)]
+            break
+    return filename.replace(".", "_")
 
 
 class JavaScriptExtractor:
@@ -45,11 +61,7 @@ class JavaScriptExtractor:
         parts = repo_relative_path.split("/")
         if parts[0] in _SRC_ROOTS and len(parts) > 1:
             parts = parts[1:]
-        stem = parts[-1]
-        for ext in (".d.ts", ".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".jsx"):
-            if stem.endswith(ext):
-                stem = stem[: -len(ext)]
-                break
+        stem = _atomic_segment(parts[-1])
         is_package = stem in ("index", "mod")
         parts = parts[:-1] if is_package else [*parts[:-1], stem]
         return ".".join(p for p in parts if p) or "_root", is_package
@@ -358,10 +370,7 @@ class JavaScriptExtractor:
             if segment == "..":
                 parts = parts[:-1]
             else:
-                seg = segment
-                for ext in (".ts", ".tsx", ".js", ".jsx"):
-                    if seg.endswith(ext):
-                        seg = seg[: -len(ext)]
+                seg = _atomic_segment(segment)
                 if seg not in ("index", "mod"):
                     parts.append(seg)
         return ".".join(p for p in parts if p) or "_root"

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/graph/adjacency.py

@@ -20,7 +20,39 @@ from sqlalchemy.orm import Session
 from entrygraph.db.models import Edge
 from entrygraph.kinds import EdgeKind
 
-_MAX_DFS_VISITS = 200_000  # hard bound on path-enumeration work
+# Path-enumeration work bound. The budget scales with graph size so large graphs
+# aren't cut off before any sink is reached (a flat cap silently returned 0 paths
+# on big repos — a false "no reachable sinks"). Floor keeps small graphs cheap;
+# ceiling bounds pathological ones. When the budget is spent, the result is flagged
+# `truncated` so callers can warn instead of treating 0 paths as "safe".
+_MIN_DFS_VISITS = 200_000
+_DFS_VISIT_CEILING = 40_000_000
+_DFS_VISIT_FACTOR = 200
+# Enumerate a candidate pool larger than the caller's max_paths, then let the
+# caller risk-rank and truncate. Decoupling enumeration from max_paths makes the
+# widen flags (--include-fuzzy/-unresolved/-callbacks) monotonic: a wider edge set
+# yields a superset of the pool instead of a different DFS-order slice.
+_CANDIDATE_FACTOR = 4
+_MIN_CANDIDATES = 64
+
+
+class PathList(list):
+    """A path list that also reports whether enumeration was budget-truncated."""
+
+    truncated: bool = False
+
+    @classmethod
+    def of(cls, items, truncated: bool = False) -> PathList:
+        out = cls(items)
+        out.truncated = truncated
+        return out
+
+
+def _candidate_cap(max_paths: int) -> int:
+    # reachable() passes max_paths=1 and only needs existence — don't over-enumerate.
+    if max_paths <= 1:
+        return 1
+    return max(max_paths * _CANDIDATE_FACTOR, _MIN_CANDIDATES)
 
 
 @dataclass(frozen=True, slots=True)
@@ -150,22 +182,30 @@ class AdjacencyCache:
     ) -> list[list[tuple[int, Hop | None]]]:
         """Enumerate simple paths as [(symbol_id, hop_into_it | None), ...].
 
-        DFS with an on-path visited set; neighbor order is deterministic.
-        Results are sorted shortest-first. A global visit budget bounds work on
-        pathological graphs; enumeration also stops at max_paths.
+        DFS with an on-path visited set; neighbor order is deterministic. Results
+        are sorted shortest-first. Enumeration collects up to a candidate pool
+        (>= max_paths) so the caller can risk-rank and truncate; a size-scaled
+        visit budget bounds work, and the returned PathList reports `truncated`
+        when that budget was spent before enumeration finished.
         """
         results: list[list[tuple[int, Hop | None]]] = []
-        budget = _MAX_DFS_VISITS
+        total_hops = sum(len(hops) for hops in self.forward.values())
+        budget = min(_DFS_VISIT_CEILING, max(_MIN_DFS_VISITS, total_hops * _DFS_VISIT_FACTOR))
+        cap = _candidate_cap(max_paths)
+        exhausted = False
 
         for source in sorted(sources):
-            if budget <= 0 or len(results) >= max_paths:
+            if budget <= 0 or len(results) >= cap:
                 break
             stack: list[tuple[int, Hop | None]] = [(source, None)]
             on_path = {source}
 
             def dfs(node: int, depth: int) -> None:
-                nonlocal budget
-                if budget <= 0 or len(results) >= max_paths:
+                nonlocal budget, exhausted
+                if len(results) >= cap:
+                    return
+                if budget <= 0:
+                    exhausted = True
                     return
                 budget -= 1
                 if node in sinks:
@@ -187,4 +227,4 @@ class AdjacencyCache:
             dfs(source, 0)
 
         results.sort(key=lambda p: (len(p), [n for n, _ in p]))
-        return results[:max_paths]
+        return PathList.of(results, truncated=exhausted)

{entrygraph-0.1.27 → entrygraph-0.1.28}/src/entrygraph/graph/cte.py

@@ -15,7 +15,7 @@ from __future__ import annotations
 from sqlalchemy import bindparam, text
 from sqlalchemy.orm import Session
 
-from entrygraph.graph.adjacency import Hop
+from entrygraph.graph.adjacency import Hop, PathList, _candidate_cap
 from entrygraph.kinds import EdgeKind
 
 _SEP = ","
@@ -41,8 +41,9 @@ class CteEngine:
 
     def paths(
         self, sources: set[int], sinks: set[int], max_depth: int = 25, max_paths: int = 10
-    ) -> list[list[tuple[int, Hop | None]]]:
+    ) -> PathList:
         results: list[list[tuple[int, Hop | None]]] = []
+        cap = _candidate_cap(max_paths)
         # a source that is itself a sink is a length-1 path (matches memory engine)
         for src in sorted(sources & sinks):
             results.append([(src, None)])
@@ -86,7 +87,7 @@ class CteEngine:
                 SELECT nodes, lines, kinds, ids, confs, depth FROM walk
                 WHERE node IN :sinks
                 ORDER BY depth
-                LIMIT :max_paths
+                LIMIT :cap
                 """
             ).bindparams(
                 bindparam("sources", expanding=True),
@@ -100,20 +101,22 @@ class CteEngine:
                 "minconf": self.min_confidence,
                 "include_cha": 1 if self.include_cha else 0,
                 "max_depth": max_depth,
-                "max_paths": max_paths,
+                "cap": cap,
                 "sep": _SEP,
             },
         ).all()
 
         for nodes_str, lines_str, kinds_str, ids_str, confs_str, _depth in rows:
-            if len(results) >= max_paths:
+            if len(results) >= cap:
                 break
             path = self._decode(nodes_str, lines_str, kinds_str, ids_str, confs_str)
             if path is not None:
                 results.append(path)
 
         results.sort(key=lambda p: (len(p), [n for n, _ in p]))
-        return results[:max_paths]
+        # The CTE has no per-visit budget (SQLite bounds it), so it never
+        # silently under-returns the way the memory DFS could — never truncated.
+        return PathList.of(results, truncated=False)
 
     @staticmethod
     def _decode(