entrygraph 0.1.7__tar.gz → 0.1.8__tar.gz

{entrygraph-0.1.7 → entrygraph-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.7
+Version: 0.1.8
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.7 → entrygraph-0.1.8}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.7'
-__version_tuple__ = version_tuple = (0, 1, 7)
+__version__ = version = '0.1.8'
+__version_tuple__ = version_tuple = (0, 1, 8)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.7 → entrygraph-0.1.8}/src/entrygraph/extract/javascript.py

@@ -238,12 +238,77 @@ class JavaScriptExtractor:
                         )
         for node in caps.get("export.from", []):
             self._reexport(node, ctx, out)
+        for node in caps.get("require", []):
+            self._commonjs_require(node, ctx, out)
 
         for imp in out.imports:
             out.framework_signals.append(
                 ("import", imp.module.split(".")[0] if "." in imp.module else imp.module)
             )
 
+    def _commonjs_require(self, call, ctx, out) -> None:
+        """CommonJS `require('m')` bindings -> RawImport, mirroring ESM handling.
+
+        ``const cp = require('m')``          -> whole module bound to ``cp``
+        ``const { x, y: z } = require('m')`` -> named imports ``x`` and ``y`` (as ``z``)
+        bare / chained / reassigned          -> module-only (side-effect) import,
+        which still yields the framework signal even when no alias can be bound.
+        """
+        args = call.child_by_field_name("arguments")
+        spec = None
+        if args is not None:
+            for child in args.named_children:
+                if child.type == "string":
+                    spec = node_text(child).strip("'\"`")
+                    break
+        if not spec:
+            return  # dynamic require (variable/template arg) — target unknowable
+        module = self._resolve_module(spec, ctx)
+        span = span_of(call)
+
+        parent = call.parent
+        name_node = None
+        if parent is not None and parent.type == "variable_declarator":
+            name_node = parent.child_by_field_name("name")
+        elif parent is not None and parent.type == "assignment_expression":
+            name_node = parent.child_by_field_name("left")
+
+        if name_node is not None and name_node.type == "identifier":
+            # Bind the alias to the module itself (same as an ESM default import),
+            # so `const cp = require('child_process'); cp.exec()` canonicalizes to
+            # child_process.exec.
+            out.imports.append(
+                RawImport(module=module, imported_name=None, alias=node_text(name_node), span=span)
+            )
+            return
+        if name_node is not None and name_node.type == "object_pattern":
+            for child in name_node.named_children:
+                if child.type == "shorthand_property_identifier_pattern":  # { exec }
+                    nm = node_text(child)
+                    out.imports.append(
+                        RawImport(module=module, imported_name=nm, alias=nm, span=span)
+                    )
+                elif child.type == "pair_pattern":  # { exec: run }
+                    key = child.child_by_field_name("key")
+                    value = child.child_by_field_name("value")
+                    if key is None:
+                        continue
+                    alias = (
+                        node_text(value)
+                        if value is not None and value.type == "identifier"
+                        else node_text(key)
+                    )
+                    out.imports.append(
+                        RawImport(
+                            module=module, imported_name=node_text(key), alias=alias, span=span
+                        )
+                    )
+            return
+        # bare `require('m')`, `require('m').foo`, `module.exports = require('m')`, etc.
+        out.imports.append(
+            RawImport(module=module, imported_name=None, alias=module.split(".")[-1], span=span)
+        )
+
     def _reexport(self, node, ctx, out) -> None:
         """`export { X as Y } from "./m"` / `export * from "./m"` -> RawReexport."""
         source = node.child_by_field_name("source")

entrygraph-0.1.8/tests/fixtures/javascript/commonjs_app/server.js

@@ -0,0 +1,15 @@
+const cp = require('child_process');
+const { exec } = require('child_process');
+const express = require('express');
+
+function runDefault(input) {
+  cp.execSync(input);
+}
+
+function runNamed(input) {
+  exec(input);
+}
+
+const app = express();
+app.get('/a', (req, res) => runDefault(req.query.cmd));
+app.get('/b', (req, res) => runNamed(req.query.cmd));

entrygraph-0.1.8/tests/test_commonjs.py

@@ -0,0 +1,41 @@
+"""End-to-end CommonJS `require()` support (Phase 1.3).
+
+Regression: the JS extractor dropped the `require()` captures entirely, so a
+pure-CommonJS app produced no imports — no framework detection and no
+canonicalization of `cp.execSync` to a `child_process` sink.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from entrygraph import CodeGraph
+
+COMMONJS_APP = Path(__file__).parent / "fixtures" / "javascript" / "commonjs_app"
+
+
+@pytest.fixture(scope="module")
+def graph(tmp_path_factory) -> CodeGraph:
+    db = tmp_path_factory.mktemp("db") / "graph.db"
+    g = CodeGraph.index(COMMONJS_APP, db=db)
+    yield g
+    g.close()
+
+
+def test_commonjs_require_enables_framework_detection(graph):
+    names = {f.name for f in graph.detect().frameworks}
+    assert "express" in names
+
+
+def test_commonjs_require_canonicalizes_command_sinks(graph):
+    # both the default-bound (cp.execSync) and destructured (exec) forms must
+    # resolve to child_process command_exec sinks
+    assert graph.stats().sink_edges >= 2
+    sinks = {
+        row["dst_qname"]
+        for row in graph.sql("SELECT dst_qname FROM edges WHERE sink_id IS NOT NULL")
+    }
+    assert "js:child_process.execSync" in sinks
+    assert "js:child_process.exec" in sinks

{entrygraph-0.1.7 → entrygraph-0.1.8}/tests/test_extract_javascript.py

@@ -72,6 +72,32 @@ def test_relative_import_resolution():
     assert any(i.module == "db.conn" for i in x.imports)
 
 
+def test_commonjs_require_bindings():
+    x = extract(
+        "const cp = require('child_process');\n"
+        "const { exec, spawn: launch } = require('child_process');\n"
+        "const express = require('express');\n"
+        "require('./side-effect');\n"
+        "const rel = require('../db/conn');\n",
+        path="src/routes/users.js",
+    )
+    imports = {(i.module, i.imported_name, i.alias) for i in x.imports}
+    assert ("child_process", None, "cp") in imports  # default -> module binding
+    assert ("child_process", "exec", "exec") in imports  # destructured
+    assert ("child_process", "spawn", "launch") in imports  # destructured + rename
+    assert ("express", None, "express") in imports
+    assert ("db.conn", None, "rel") in imports  # relative resolved to dotted, bound to `rel`
+    # side-effect require still registers the module (framework signal source)
+    assert any(m == "routes.side-effect" and n is None for m, n, _ in imports)
+
+
+def test_commonjs_require_emits_framework_signal():
+    # regression: CommonJS `require('express')` used to yield no import at all,
+    # so express was undetectable in pure-CJS apps.
+    x = extract("const express = require('express');\n")
+    assert ("import", "express") in x.framework_signals
+
+
 def test_calls_with_receivers():
     x = extract(
         "import cp from 'child_process';\nfunction run() { cp.execSync('ls'); helper(); }\n"