flowforge-map 0.1.0__py3-none-any.whl

flowforge/scan/mcp_config.py

@@ -0,0 +1,75 @@
+"""MCP servers from config files (D21): .mcp.json, mcp.json, .vscode/.cursor mcp.json, claude_desktop_config.json.
+
+Only the command, its arguments (redacted) and env var *names* are kept. Env values are never read out; a key-like
+name whose value is written in the file rather than referenced is noted by name and line (D31).
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass, field
+from pathlib import PurePosixPath
+
+from flowforge.scan.urls import clean_url
+from flowforge.security.logfilter import REDACTED, SECRET_NAME, Redactor, redact_code
+
+CONFIG_NAMES = frozenset({".mcp.json", "mcp.json", "claude_desktop_config.json"})
+_redactor = Redactor()
+
+
+@dataclass
+class Server:
+    name: str
+    line: int
+    command: list[str] = field(default_factory=list)
+    env_names: list[str] = field(default_factory=list)
+    env_literals: list[tuple[str, int]] = field(default_factory=list)   # (key-like name, line): a value written in
+
+
+def is_config(rel: str) -> bool:
+    return PurePosixPath(rel).name in CONFIG_NAMES
+
+
+def safe_args(args: list[str]) -> list[str]:
+    """Arguments with key-shaped values and the values of key-like flags (--api-key X, TOKEN=X) masked."""
+    out: list[str] = []
+    for i, arg in enumerate(args):
+        if i and SECRET_NAME.search(args[i - 1]) and args[i - 1].startswith("-"):
+            out.append(REDACTED)
+        elif "=" in arg and SECRET_NAME.search(arg.split("=", 1)[0]):
+            out.append(f"{arg.split('=', 1)[0]}={REDACTED}")
+        else:
+            out.append(redact_code(arg, _redactor))
+    return out
+
+
+def _line_of(lines: list[str], key: str, after: int) -> int:
+    return next((i for i, raw in enumerate(lines, 1) if i > after and raw.lstrip().startswith(key)), after)
+
+
+def parse(text: str) -> list[Server]:
+    try:
+        data = json.loads(text)
+    except ValueError:
+        return []
+    block = data.get("mcpServers") or data.get("servers") if isinstance(data, dict) else None
+    if not isinstance(block, dict):
+        return []
+    lines = text.splitlines()
+    servers = []
+    for name, spec in block.items():
+        if not isinstance(spec, dict):
+            continue
+        key = f'"{name}"'
+        line = next((i for i, raw in enumerate(lines, 1) if raw.lstrip().startswith(key)), 1)
+        args = [str(a) for a in spec.get("args", []) if isinstance(a, (str, int, float))]
+        command = [str(spec["command"]), *args] if spec.get("command") else []
+        if not command and spec.get("url"):   # a remote (HTTP/SSE) server: scheme, host and path only (D21)
+            url = clean_url(str(spec["url"]))
+            command = [url] if url else []
+        env = spec.get("env") if isinstance(spec.get("env"), dict) else {}
+        literals = [(n, _line_of(lines, f'"{n}"', line)) for n, v in env.items()
+                    if SECRET_NAME.search(n) and isinstance(v, str) and v.strip() and not v.strip().startswith("$")]
+        servers.append(Server(name=name, line=line, command=safe_args(command), env_names=sorted(env),
+                              env_literals=literals))
+    return servers

flowforge/scan/models.py

@@ -0,0 +1,73 @@
+"""The scan's output (D21). Names, hosts, paths and `file:line` only: never a key, query string or env value."""
+
+from __future__ import annotations
+
+from typing import Literal
+
+from pydantic import BaseModel, ConfigDict, Field
+
+DependencyKind = Literal["llm", "api", "mcp", "local"]
+
+
+class _Model(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+
+class ScanEvidence(_Model):
+    """One place in the repo that shows the dependency. `lines` is a redacted excerpt around `ref`."""
+
+    type: Literal["code"] = "code"
+    ref: str                       # "services/llm.py:5"
+    text: str = ""                 # one short sentence: what this line shows
+    first_line: int | None = None  # the excerpt's first line number
+    lines: list[str] = Field(default_factory=list, max_length=5)
+    highlight: int | None = None   # the line `ref` points at
+
+
+class Dependency(_Model):
+    id: str                        # stable: llm-<provider>, api-<host or service>, mcp-<name>, local-<program>
+    kind: DependencyKind
+    name: str
+    catalog: str | None = None     # a known service's id (presets.SERVICES), for its tile
+    target: str | None = None      # what a check would reach: a URL without its query, host:port, or a command
+    targets: list[str] = Field(default_factory=list)  # every distinct URL seen, for a service on several hosts
+    model: str | None = None       # llm only
+    command: list[str] | None = None  # mcp and local: the program and its arguments (redacted)
+    status: Literal["confirmed", "unconfirmed"] = "confirmed"
+    scope: Literal["app", "dev_tool"] = "app"   # dev_tool: an MCP server only your coding tools use
+    via: str | None = None         # reached through this MCP server, e.g. "mcp-fetch"
+    evidence: list[ScanEvidence] = Field(default_factory=list)   # at most 10
+    places: int = 0                # how many places show it in all
+    env_names: list[str] = Field(default_factory=list)
+
+
+class Finding(_Model):
+    """Something unsafe the scan saw (D31). Never holds the value it found: `excerpt` is masked like evidence."""
+
+    id: str                        # stable: <kind>-<path>-<line>
+    kind: Literal["key_in_code", "key_in_config", "plain_http", "unpinned_server", "broad_files"]
+    level: Literal["high", "medium", "low"]
+    title: str
+    ref: str                       # "config.py:23"
+    line: int
+    dep_id: str | None = None      # the dependency it belongs to, when one does
+    first_line: int | None = None
+    excerpt: list[str] = Field(default_factory=list, max_length=5)
+    fix: str                       # one sentence
+    prompt: str                    # the whole change, for a coding agent (D27's rule)
+
+
+class EnvName(_Model):
+    name: str
+    ref: str
+
+
+class ScanResult(_Model):
+    root: str                      # the folder's name, not its full path
+    files_scanned: int = 0
+    skipped: dict[str, int] = Field(default_factory=dict)
+    languages: dict[str, int] = Field(default_factory=dict)
+    dependencies: list[Dependency] = Field(default_factory=list)
+    env_names: list[EnvName] = Field(default_factory=list)
+    findings: list[Finding] = Field(default_factory=list)   # D31
+    findings_checked: bool = False   # the finders ran: a scan stored before D31 has an empty list that means nothing

flowforge/scan/patterns.py

@@ -0,0 +1,86 @@
+"""Facts from JS/TS and Dart files by patterns, line by line (D21). Less exact than Python's AST, and said so.
+
+A URL counts only when a quote opens right before it (so URLs inside longer strings and bare comment links don't),
+and it is confirmed by a call or key on the same line: fetch(, .get(, Uri.parse(, urlTemplate:, baseURL: …
+"""
+
+from __future__ import annotations
+
+import re
+
+from flowforge.scan import services
+from flowforge.scan.facts import FileFacts, LLMClient, Ref, UrlHit
+from flowforge.scan.urls import clean_url
+
+_JS_IMPORT = re.compile(r"""^\s*import\s+(?:[^'"]*?\s+from\s+)?['"]([^'"]+)['"]|require\(\s*['"]([^'"]+)['"]\s*\)"""
+                        r"""|import\(\s*['"]([^'"]+)['"]\s*\)""")
+_DART_IMPORT = re.compile(r"""^\s*import\s+['"]package:([A-Za-z0-9_]+)/""")
+_URL = re.compile(r"""['"`](https?://[^'"`\s]+)""")
+_DART_URI = re.compile(r"""Uri\.https?\(\s*['"]([^'"]+)['"]\s*(?:,\s*['"]([^'"]*)['"])?""")
+_CONFIRMS = re.compile(r"fetch\(|axios|\.(get|post|put|patch|delete|request)\(|Uri\.(parse|https?)\(|urlTemplate|"
+                       r"base_?url|baseURL|endpoint|\burl\s*[:=]|http\.|dio\.", re.IGNORECASE)
+_BASE_URL = re.compile(r"base_?url|baseURL", re.IGNORECASE)
+_MODEL = re.compile(r"""\bmodel\s*[:=]\s*['"]([^'"]+)['"]""")
+_ENV = re.compile(r"""process\.env\.([A-Za-z_][A-Za-z0-9_]*)|process\.env\[\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]"""
+                  r"""|import\.meta\.env\.([A-Za-z_][A-Za-z0-9_]*)"""
+                  r"""|String\.fromEnvironment\(\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]"""
+                  r"""|Platform\.environment\[\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]"""
+                  r"""|dotenv\.(?:env\[|get\()\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]""")
+# child_process calls, bare or on child_process/cp, but never a method like regex.exec("…")
+_COMMAND = re.compile(r"""(?:(?<![\w.$])|(?<=child_process\.)|(?<=\bcp\.))"""
+                      r"""(?:spawn|spawnSync|execFile|execFileSync|exec|execSync)\(\s*['"]([^'"\s]+)"""
+                      r"""|Process\.(?:run|start|runSync)\(\s*['"]([^'"\s]+)['"]""")
+_STDIO = re.compile(r"""StdioClientTransport\(\s*\{([^}]*)\}""")
+_STDIO_COMMAND = re.compile(r"""command:\s*['"]([^'"]+)['"]""")
+_STDIO_ARGS = re.compile(r"""args:\s*\[([^\]]*)\]""")
+_QUOTED = re.compile(r"""['"]([^'"]*)['"]""")
+_STRING = re.compile(r"""['"]([^'"\n]{1,120})['"]""")
+
+
+def _package(spec: str) -> str | None:
+    """npm package name from an import path; None for relative or built-in imports."""
+    if spec.startswith((".", "/", "node:")):
+        return None
+    parts = spec.split("/")
+    return "/".join(parts[:2]) if spec.startswith("@") else parts[0]
+
+
+def extract(path: str, text: str, language: str) -> FileFacts:
+    facts = FileFacts(path=path, language=language)
+    dart = language == "dart"
+    for n, line in enumerate(text.splitlines(), 1):
+        stripped = line.lstrip()
+        if stripped.startswith(("//", "/*", "*")):
+            continue
+        if dart:
+            if m := _DART_IMPORT.match(line):
+                facts.imports.append((m.group(1), n))
+        else:
+            for m in _JS_IMPORT.finditer(line):
+                pkg = _package(next(g for g in m.groups() if g))
+                if pkg:
+                    facts.imports.append((pkg, n))
+        confirmed = bool(_CONFIRMS.search(line))
+        for m in _URL.finditer(line):
+            if url := clean_url(m.group(1)):
+                facts.urls.append(UrlHit(line=n, url=url, confirmed=confirmed))
+                if _BASE_URL.search(line):
+                    facts.clients.append(LLMClient(line=n, sdk="", base_url=Ref(literal=url)))
+        for m in _DART_URI.finditer(line):
+            if url := clean_url(f"https://{m.group(1)}{m.group(2) or ''}"):
+                facts.urls.append(UrlHit(line=n, url=url, confirmed=True))
+        if m := _MODEL.search(line):
+            facts.models.append((Ref(literal=m.group(1)), n))
+        for m in _ENV.finditer(line):
+            facts.env.append((next(g for g in m.groups() if g), n))
+        for m in _COMMAND.finditer(line):
+            facts.commands.append(([next(g for g in m.groups() if g)], n))
+        for m in _STDIO.finditer(line):   # an MCP server started from code, on one line
+            if command := _STDIO_COMMAND.search(m.group(1)):
+                args = _STDIO_ARGS.search(m.group(1))
+                facts.stdio.append(([command.group(1), *(_QUOTED.findall(args.group(1)) if args else [])], n))
+        facts.strings.update(_STRING.findall(line))
+    # a base URL line is an LLM client only in a file that imports an LLM SDK; it belongs to that SDK
+    llm_sdk = next((pkg for pkg, _ in facts.imports if (s := services.by_sdk(pkg)) and s["kind"] == "llm"), None)
+    facts.clients = [LLMClient(line=c.line, sdk=llm_sdk, base_url=c.base_url) for c in facts.clients] if llm_sdk else []
+    return facts

flowforge/scan/python_ast.py

@@ -0,0 +1,246 @@
+"""Facts from a Python file through the stdlib `ast` (D21). Nothing is imported or run."""
+
+from __future__ import annotations
+
+import ast
+
+from flowforge.scan.facts import FileFacts, LLMClient, Ref, UrlHit
+from flowforge.scan.urls import clean_url
+
+HTTP_CALLS = frozenset({"get", "post", "put", "patch", "delete", "head", "options", "request", "stream", "urlopen",
+                        "Request", "fetch"})
+# verbs that dicts and caches have too: an HTTP call only on something that looks like an HTTP client
+AMBIGUOUS_CALLS = frozenset({"get", "delete", "head", "options"})
+HTTP_RECEIVERS = ("client", "session", "http", "requests", "httpx", "aiohttp", "api", "urllib")
+BASE_URL_KEYS = frozenset({"base_url", "api_base", "endpoint", "host"})
+URL_KEYS = frozenset({"url", "uri", "base_url", "api_base", "api_url", "endpoint"})
+MAX_STRING = 120
+SUBPROCESS_CALLS = frozenset({"run", "Popen", "call", "check_call", "check_output"})
+INTERPRETERS = frozenset({"python", "python3", "node", "bash", "sh", "ruby", "perl", "deno", "bun", "php", "pwsh"})
+
+
+def _parents(tree: ast.AST) -> dict[ast.AST, ast.AST]:
+    return {child: node for node in ast.walk(tree) for child in ast.iter_child_nodes(node)}
+
+
+def _callee(call: ast.Call) -> str | None:
+    f = call.func
+    return f.attr if isinstance(f, ast.Attribute) else f.id if isinstance(f, ast.Name) else None
+
+
+def _call_strings(call: ast.AST | None) -> tuple[str, ...]:
+    if not isinstance(call, ast.Call):
+        return ()
+    return tuple(a.value for a in call.args if isinstance(a, ast.Constant) and isinstance(a.value, str))
+
+
+def _receiver(call: ast.Call) -> str:
+    """The lower-cased name the method is called on: `self.client.get` → "client", `requests.get` → "requests"."""
+    f = call.func
+    owner = f.value if isinstance(f, ast.Attribute) else None
+    if isinstance(owner, ast.Attribute):
+        return owner.attr.lower()
+    return owner.id.lower() if isinstance(owner, ast.Name) else ""
+
+
+def _is_http_call(call: ast.Call) -> bool:
+    name = _callee(call)
+    if name not in HTTP_CALLS:
+        return False
+    return name not in AMBIGUOUS_CALLS or any(hint in _receiver(call) for hint in HTTP_RECEIVERS)
+
+
+def _context(node: ast.AST, parents: dict[ast.AST, ast.AST]) -> tuple[bool, tuple[str, ...]]:
+    """(is it where a URL goes, the enclosing call's string arguments).
+
+    Recognised: the first argument of an HTTP call, a url=/base_url= keyword, or the value of a "url" key in a
+    dict (directly or as a call argument: call("fetch", "fetch", {"url": ...})).
+    """
+    parent = parents.get(node)
+    if isinstance(parent, ast.Call):
+        return bool(parent.args) and parent.args[0] is node and _is_http_call(parent), _call_strings(parent)
+    if isinstance(parent, ast.keyword):
+        return parent.arg in URL_KEYS, _call_strings(parents.get(parent))
+    if isinstance(parent, ast.Dict) and node in parent.values:
+        key = parent.keys[parent.values.index(node)]
+        is_url = isinstance(key, ast.Constant) and key.value in URL_KEYS
+        return is_url, _call_strings(parents.get(parent))
+    return False, ()
+
+
+def _ref(node: ast.AST | None) -> Ref:
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return Ref(literal=node.value)
+    if isinstance(node, ast.Name):
+        return Ref(name=node.id)
+    if isinstance(node, ast.Attribute):   # config.BASE_URL
+        return Ref(name=node.attr)
+    return Ref()
+
+
+def _env_read(call: ast.Call) -> tuple[str | None, ast.AST | None]:
+    """(name, default) for os.getenv("X", d) / os.environ.get("X", d); (None, None) for any other call."""
+    f = call.func
+    is_getenv = isinstance(f, ast.Attribute) and f.attr == "getenv" or isinstance(f, ast.Name) and f.id == "getenv"
+    is_environ_get = isinstance(f, ast.Attribute) and f.attr == "get" and isinstance(f.value, ast.Attribute) \
+        and f.value.attr == "environ"
+    if not (is_getenv or is_environ_get) or not call.args:
+        return None, None
+    first = call.args[0]
+    if not (isinstance(first, ast.Constant) and isinstance(first.value, str)):
+        return None, None
+    default = call.args[1] if len(call.args) > 1 else next((k.value for k in call.keywords if k.arg == "default"), None)
+    return first.value, default
+
+
+def _imports(tree: ast.AST, facts: FileFacts) -> dict[str, str]:
+    """Record imported packages; return local name -> package for the names a client class can come from."""
+    aliases: dict[str, str] = {}
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for a in node.names:
+                facts.imports.append((a.name, node.lineno))
+                aliases[a.asname or a.name.split(".")[0]] = a.name if a.asname else a.name.split(".")[0]
+        elif isinstance(node, ast.ImportFrom) and node.module and node.level == 0:
+            facts.imports.append((node.module, node.lineno))
+            for a in node.names:
+                aliases[a.asname or a.name] = node.module
+                facts.imports.append((f"{node.module}.{a.name}", node.lineno))   # from google import genai
+    return aliases
+
+
+def extract(path: str, text: str) -> FileFacts:
+    facts = FileFacts(path=path, language="python")
+    tree = ast.parse(text)
+    parents = _parents(tree)
+    aliases = _imports(tree, facts)
+    for stmt in tree.body:  # module-level NAME = "..." (or os.getenv(..., "...")) constants
+        if isinstance(stmt, ast.Assign) and len(stmt.targets) == 1 and isinstance(stmt.targets[0], ast.Name):
+            value = stmt.value
+            if isinstance(value, ast.Call):
+                value = _env_read(value)[1]
+            if isinstance(value, ast.Constant) and isinstance(value.value, str):
+                facts.constants[stmt.targets[0].id] = (value.value, stmt.lineno)
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Constant) and isinstance(node.value, str):
+            if len(node.value) <= MAX_STRING:
+                facts.strings.add(node.value)
+            if isinstance(parents.get(node), ast.JoinedStr):
+                continue   # f-string pieces: only a leading URL counts, handled with the f-string below
+            url = clean_url(node.value)
+            if url:
+                confirmed, call = _context(node, parents)
+                facts.urls.append(UrlHit(line=node.lineno, url=url, confirmed=confirmed, call_strings=call))
+        elif isinstance(node, ast.JoinedStr) and node.values:
+            first = node.values[0]
+            confirmed, call = _context(node, parents)
+            if isinstance(first, ast.Constant) and isinstance(first.value, str) and (url := clean_url(first.value)):
+                facts.urls.append(UrlHit(line=node.lineno, url=url, confirmed=confirmed, call_strings=call))
+            elif isinstance(first, ast.FormattedValue) and isinstance(first.value, ast.Name):   # f"{BASE}/x"
+                facts.urls.append(UrlHit(line=node.lineno, name=first.value.id, confirmed=confirmed,
+                                         call_strings=call))
+        elif isinstance(node, ast.Name) and (where := _context(node, parents))[0]:
+            facts.urls.append(UrlHit(line=node.lineno, name=node.id, confirmed=True, call_strings=where[1]))
+        elif isinstance(node, ast.Subscript) and isinstance(node.value, ast.Attribute) \
+                and node.value.attr == "environ" and isinstance(node.slice, ast.Constant) \
+                and isinstance(node.slice.value, str):
+            _env(facts, node.slice.value, node, parents)
+        elif isinstance(node, ast.Call):
+            _call(node, aliases, facts, parents)
+    return facts
+
+
+def _env(facts: FileFacts, name: str, node: ast.AST, parents: dict[ast.AST, ast.AST]) -> None:
+    """An env var name belongs to every line of its statement, so a call split over lines keeps it (D21)."""
+    stmt = node
+    while stmt in parents and not isinstance(stmt, ast.stmt):
+        stmt = parents[stmt]
+    first = getattr(stmt, "lineno", getattr(node, "lineno", 1))
+    last = getattr(stmt, "end_lineno", None) or first
+    facts.env.extend((name, line) for line in range(first, last + 1))
+
+
+def _strings_in_order(node: ast.AST) -> list[str]:
+    """String literals inside an expression, left to right: str(HERE / "tools" / "x.py") → ["tools", "x.py"]."""
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return [node.value]
+    return [s for child in ast.iter_child_nodes(node) for s in _strings_in_order(child)]
+
+
+def _program(parts: list[ast.AST]) -> list[str] | None:
+    """[program] or [interpreter, script] from an argv given as AST nodes; None when it isn't literal."""
+    if not parts:
+        return None
+    first = parts[0]
+    if isinstance(first, ast.Attribute) and first.attr == "executable":   # sys.executable
+        program = "python"
+    elif isinstance(first, ast.Constant) and isinstance(first.value, str) and first.value.strip():
+        program = first.value.split()[0]
+    else:
+        return None
+    if program.rsplit("/", 1)[-1] in INTERPRETERS and len(parts) > 1:
+        script = "/".join(_strings_in_order(parts[1]))
+        if "." in script.rsplit("/", 1)[-1]:
+            return [program, script]
+    return [program]
+
+
+def _subprocess(node: ast.Call, aliases: dict[str, str]) -> list[str] | None:
+    f = node.func
+    owner = f.value.id if isinstance(f, ast.Attribute) and isinstance(f.value, ast.Name) else None
+    name = _callee(node)
+    if name in SUBPROCESS_CALLS and (owner == "subprocess" or (owner is None and aliases.get(name) == "subprocess")):
+        arg = node.args[0] if node.args else next((k.value for k in node.keywords if k.arg == "args"), None)
+        if isinstance(arg, (ast.List, ast.Tuple)):
+            return _program(list(arg.elts))
+        return _program([arg]) if arg is not None else None
+    if owner == "os" and name in ("system", "popen") and node.args:
+        return _program([node.args[0]])
+    if name == "create_subprocess_exec":
+        return _program(list(node.args))
+    if name == "create_subprocess_shell" and node.args:
+        return _program([node.args[0]])
+    return None
+
+
+def _stdio_server(node: ast.Call) -> list[str] | None:
+    """StdioServerParameters(command="uvx", args=["mcp-server-git", …]) with literal values: the argv."""
+    if _callee(node) != "StdioServerParameters":
+        return None
+    kw = {k.arg: k.value for k in node.keywords}
+    command, args = kw.get("command"), kw.get("args")
+    if not (isinstance(command, ast.Constant) and isinstance(command.value, str)):
+        return None
+    rest = [a.value for a in args.elts if isinstance(a, ast.Constant) and isinstance(a.value, str)] \
+        if isinstance(args, (ast.List, ast.Tuple)) else []
+    return [command.value, *rest]
+
+
+def _call(node: ast.Call, aliases: dict[str, str], facts: FileFacts, parents: dict[ast.AST, ast.AST]) -> None:
+    facts.call_strings.update(_call_strings(node))
+    name, _ = _env_read(node)
+    if name:
+        _env(facts, name, node, parents)
+        return
+    server = _stdio_server(node)
+    if server:
+        facts.stdio.append((server, node.lineno))
+        return
+    command = _subprocess(node, aliases)
+    if command:
+        facts.commands.append((command, node.lineno))
+        return
+    f = node.func
+    sdk = None
+    if isinstance(f, ast.Name) and f.id[:1].isupper():                       # OpenAI(...) from openai
+        sdk = aliases.get(f.id)
+    elif isinstance(f, ast.Attribute) and f.attr[:1].isupper() and isinstance(f.value, ast.Name):
+        sdk = aliases.get(f.value.id)                                       # anthropic.Anthropic(...)
+    if sdk is not None:
+        base = next((k.value for k in node.keywords if k.arg in BASE_URL_KEYS), None)
+        facts.clients.append(LLMClient(line=node.lineno, sdk=sdk, base_url=_ref(base)))
+    model = next((k.value for k in node.keywords if k.arg == "model"), None)
+    if model is not None:
+        ref = _ref(model)
+        if ref.literal or ref.name:
+            facts.models.append((ref, node.lineno))