flowforge-map 0.4.1__tar.gz → 0.4.2__tar.gz

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: flowforge-map
-Version: 0.4.1
+Version: 0.4.2
 Summary: Map what your app depends on (LLMs, MCP servers, APIs), check their health and security, and see what could run faster. Local and free; the scan needs no AI.
 Project-URL: Homepage, https://github.com/Vishwa-Thangapandiyan/flowforge-agent-orchestrator
 Project-URL: Issues, https://github.com/Vishwa-Thangapandiyan/flowforge-agent-orchestrator/issues
@@ -37,7 +37,7 @@ Description-Content-Type: text/markdown
 
 # FlowForge
 
-**See everything your AI app depends on: whether it's up, whether it's safe, and what's slowing it down.**
+**See everything your AI app depends on: whether it's reachable, whether it's safe, and what's slowing it down.**
 
 ```bash
 npx flowforge-map --example      # a sample app's map in your browser: no keys, nothing sent
@@ -60,7 +60,7 @@ npx flowforge-map --example      # a sample app's map in your browser: no keys,
 
 **Under the hood:** a DAG scheduler runs the checks concurrently under rate limits. It uses a topological sort, a critical-path DP and HLFET list scheduling (within `(2 − 1/k)` of optimal), and it caches repeat calls. See [Scheduling policies and benchmarks](#scheduling-policies-and-benchmarks).
 
-> FlowForge started as a Design and Analysis of Algorithms course project. That version is frozen on the [`DAA`](../../tree/DAA) branch. `main` is the product.
+> FlowForge started as a Design and Analysis of Algorithms course project. That version is commit [`233a681`](../../tree/233a681c3e17fa4081c883193f8456a53a4c049c) in `main`'s history.
 
 ## Quick start
 
@@ -105,9 +105,11 @@ The same dashboard in its own window, with Python inside: nothing else to instal
 | Your computer | Download |
 |---|---|
 | Windows | `FlowForge_x.y.z_x64-setup.exe` or `.msi` |
-| Mac (Apple Silicon or Intel) | `FlowForge_x.y.z_aarch64.dmg` or `_x64.dmg` |
+| Mac (Apple chip) | `FlowForge_x.y.z_aarch64.dmg` |
 | Linux | `.AppImage`, `.deb` or `.rpm` |
 
+Intel Macs have no desktop build yet: use `npx flowforge-map` (it runs FlowForge through `uv` there) or `uvx flowforge-map`.
+
 The builds aren't signed yet (signing costs money every year), so the first launch asks once:
 - **Mac:** right-click FlowForge in Applications → **Open** → **Open**.
 - **Windows:** on "Windows protected your PC", click **More info** → **Run anyway**.
@@ -165,7 +167,16 @@ FlowForge is also an **MCP server**, so Claude Code, Codex or Antigravity can as
 claude mcp add flowforge -- uvx flowforge-map mcp
 ```
 
-Pair your agent once and it sees every project: `flowforge mcp` with no folder answers about the project your agent is working in, or any other by name (`list_projects` shows them all). Your agent gets eleven tools: `list_projects`, `get_map`, `get_flow`, `get_advice`, `check_health`, `get_security_findings`, `get_keys`, `get_fix_requests`, `request_key`, `wait_for_keys` and `what_changed`. All read only, except `request_key`, which only asks you for a key by name. Every answer is masked (key values never appear), the agent can't make FlowForge change your code, and a check starts an MCP server only after you said yes to it on the Checks page. FlowForge needs no AI of its own for any of this.
+Pair your agent once and it sees every project: `flowforge mcp` with no folder answers about the project your agent is working in, or any other by name (`list_projects` shows them all). Your agent gets fourteen tools:
+
+| Kind | Tools |
+|---|---|
+| Read only | `list_projects`, `get_map`, `get_flow`, `get_advice`, `get_security_findings`, `get_keys`, `wait_for_keys`, `app_output`, `get_fix_requests`, `what_changed` |
+| Checks | `check_health`: makes requests, and starts an MCP server only after you said yes to it |
+| Asks you | `request_key`: asks for a key by name |
+| Runs your app | `run_app`, `stop_app`: start and stop your app with its keys filled in, only after you allow that exact command once (D43) |
+
+Every answer is masked (key values never appear), and the agent can't make FlowForge change your code. FlowForge needs no AI of its own for any of this.
 
 ### Fix what's unsafe, with one click
 

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/README.md

@@ -1,6 +1,6 @@
 # FlowForge
 
-**See everything your AI app depends on: whether it's up, whether it's safe, and what's slowing it down.**
+**See everything your AI app depends on: whether it's reachable, whether it's safe, and what's slowing it down.**
 
 ```bash
 npx flowforge-map --example      # a sample app's map in your browser: no keys, nothing sent
@@ -23,7 +23,7 @@ npx flowforge-map --example      # a sample app's map in your browser: no keys,
 
 **Under the hood:** a DAG scheduler runs the checks concurrently under rate limits. It uses a topological sort, a critical-path DP and HLFET list scheduling (within `(2 − 1/k)` of optimal), and it caches repeat calls. See [Scheduling policies and benchmarks](#scheduling-policies-and-benchmarks).
 
-> FlowForge started as a Design and Analysis of Algorithms course project. That version is frozen on the [`DAA`](../../tree/DAA) branch. `main` is the product.
+> FlowForge started as a Design and Analysis of Algorithms course project. That version is commit [`233a681`](../../tree/233a681c3e17fa4081c883193f8456a53a4c049c) in `main`'s history.
 
 ## Quick start
 
@@ -68,9 +68,11 @@ The same dashboard in its own window, with Python inside: nothing else to instal
 | Your computer | Download |
 |---|---|
 | Windows | `FlowForge_x.y.z_x64-setup.exe` or `.msi` |
-| Mac (Apple Silicon or Intel) | `FlowForge_x.y.z_aarch64.dmg` or `_x64.dmg` |
+| Mac (Apple chip) | `FlowForge_x.y.z_aarch64.dmg` |
 | Linux | `.AppImage`, `.deb` or `.rpm` |
 
+Intel Macs have no desktop build yet: use `npx flowforge-map` (it runs FlowForge through `uv` there) or `uvx flowforge-map`.
+
 The builds aren't signed yet (signing costs money every year), so the first launch asks once:
 - **Mac:** right-click FlowForge in Applications → **Open** → **Open**.
 - **Windows:** on "Windows protected your PC", click **More info** → **Run anyway**.
@@ -128,7 +130,16 @@ FlowForge is also an **MCP server**, so Claude Code, Codex or Antigravity can as
 claude mcp add flowforge -- uvx flowforge-map mcp
 ```
 
-Pair your agent once and it sees every project: `flowforge mcp` with no folder answers about the project your agent is working in, or any other by name (`list_projects` shows them all). Your agent gets eleven tools: `list_projects`, `get_map`, `get_flow`, `get_advice`, `check_health`, `get_security_findings`, `get_keys`, `get_fix_requests`, `request_key`, `wait_for_keys` and `what_changed`. All read only, except `request_key`, which only asks you for a key by name. Every answer is masked (key values never appear), the agent can't make FlowForge change your code, and a check starts an MCP server only after you said yes to it on the Checks page. FlowForge needs no AI of its own for any of this.
+Pair your agent once and it sees every project: `flowforge mcp` with no folder answers about the project your agent is working in, or any other by name (`list_projects` shows them all). Your agent gets fourteen tools:
+
+| Kind | Tools |
+|---|---|
+| Read only | `list_projects`, `get_map`, `get_flow`, `get_advice`, `get_security_findings`, `get_keys`, `wait_for_keys`, `app_output`, `get_fix_requests`, `what_changed` |
+| Checks | `check_health`: makes requests, and starts an MCP server only after you said yes to it |
+| Asks you | `request_key`: asks for a key by name |
+| Runs your app | `run_app`, `stop_app`: start and stop your app with its keys filled in, only after you allow that exact command once (D43) |
+
+Every answer is masked (key values never appear), and the agent can't make FlowForge change your code. FlowForge needs no AI of its own for any of this.
 
 ### Fix what's unsafe, with one click
 

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/agent/server.py

@@ -157,7 +157,8 @@ def headline(tool: str, data: dict[str, Any]) -> str | None:
         return _plural(len(data["dependencies"]), "dependency", "dependencies")
     if tool == "check_health":
         counts = data["summary"]
-        parts = [f"{counts[s]} {s}" for s in ("up", "warn", "down", "skipped") if counts.get(s)]
+        words = {"up": "reachable", "warn": "need a look", "down": "down", "skipped": "not checked"}   # D52
+        parts = [f"{counts[s]} {w}" for s, w in words.items() if counts.get(s)]
         return " · ".join(parts) or "Nothing to check"
     if tool in ("get_flow", "get_advice") and not data["available"]:
         return "No flow: no Python calls found"

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/api/keys.py

@@ -185,6 +185,18 @@ def _writable(s: AppState) -> Path:
     return repo
 
 
+@router.get("/keys/asked")
+def keys_asked() -> dict[str, list[str]]:
+    """The names your agent asked for and you haven't saved yet (D38): cheap enough for the rail's badge to poll,
+    since it never reads the code. Names only."""
+    s = app_state()
+    repo = repo_path(s)
+    if repo is None or not repo.is_dir():
+        return {"names": []}
+    saved = set(KeyStore(repo).names())
+    return {"names": [r["name"] for r in key_requests(s.storage, repo) if r["name"] not in saved]}
+
+
 @router.get("/keys")
 def keys() -> dict[str, Any]:
     s = app_state()

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/checks/probes.py

@@ -205,6 +205,13 @@ def _warnings(url: str, answer: _Answer) -> list[str]:
     return out
 
 
+def _reachable(code: int) -> str:
+    """What one answer proves (D52): the server is there. Not that a key works, nor that your call does."""
+    if code in (401, 403):
+        return f"Reachable, needs a key ({code})"
+    return "Reachable" if code < 300 else f"Reachable, answered {code}"   # a redirect isn't followed: say so
+
+
 async def api(t: CheckTarget, http: httpx.AsyncClient) -> CheckResult:
     if not t.target:
         return _result(t, "skipped", "Not checked: no address in the code")
@@ -215,7 +222,11 @@ async def api(t: CheckTarget, http: httpx.AsyncClient) -> CheckResult:
     detail = {"http_status": answer.code}
     if answer.code >= 500:
         return _result(t, "down", f"Answered {answer.code}", latency_ms=answer.ms, detail=detail)
-    up = f"Up, needs a key ({answer.code})" if answer.code in (401, 403) else "Up"
+    if answer.code == 429:
+        return _result(t, "warn", "Reachable, but rate-limiting this computer (429)", latency_ms=answer.ms,
+                       detail=detail, fix="Check again later. If it keeps happening, your app may be hitting the "
+                                          "same limit.")
+    up = _reachable(answer.code)
     if warnings := _warnings(url, answer):
         return _result(t, "warn", f"{up}, but {'; '.join(warnings)}", latency_ms=answer.ms, detail=detail)
     return _result(t, "up", up, latency_ms=answer.ms, detail=detail)
@@ -252,8 +263,12 @@ async def llm(t: CheckTarget, http: httpx.AsyncClient) -> CheckResult:
     detail = {"http_status": answer.code}
     if answer.code >= 500:
         return _result(t, "down", f"Answered {answer.code}", latency_ms=answer.ms, detail=detail)
+    if answer.code == 429:
+        return _result(t, "warn", "Reachable, but rate-limiting this computer (429)", latency_ms=answer.ms,
+                       detail=detail, fix="Check again later. If it keeps happening, your app may be hitting the "
+                                          "same limit.")
     if answer.code in (401, 403):
-        return _result(t, "up", f"Up, needs a key ({answer.code}) to list its models", latency_ms=answer.ms,
+        return _result(t, "up", f"Reachable, needs a key ({answer.code}) to list its models", latency_ms=answer.ms,
                        detail=detail)
     if t.model and answer.body is not None:
         listed = t.model.removesuffix(":latest") in _model_names(answer.body)
@@ -261,8 +276,8 @@ async def llm(t: CheckTarget, http: httpx.AsyncClient) -> CheckResult:
         if not listed:
             fix = f"Run `ollama pull {t.model}`." if t.catalog == "ollama" else None
             what = "isn't pulled" if t.catalog == "ollama" else "isn't in its model list"
-            return _result(t, "warn", f"Up, but {t.model} {what}", latency_ms=answer.ms, detail=detail, fix=fix)
-    up = f"Up, {t.model} is ready" if t.model and detail.get("model_listed") else "Up"
+            return _result(t, "warn", f"Reachable, but {t.model} {what}", latency_ms=answer.ms, detail=detail, fix=fix)
+    up = f"Reachable, {t.model} is ready" if t.model and detail.get("model_listed") else _reachable(answer.code)
     if warnings := _warnings(url, answer):
         return _result(t, "warn", f"{up}, but {'; '.join(warnings)}", latency_ms=answer.ms, detail=detail)
     return _result(t, "up", up, latency_ms=answer.ms, detail=detail)
@@ -329,7 +344,7 @@ async def mcp(t: CheckTarget, root: Path, http: httpx.AsyncClient) -> CheckResul
                 reason += f"\nIts config sets {', '.join(t.env_names)}."
             return _result(t, "down", "Stopped while starting", reason=reason, fix=_env_fix(t))
     ms = (time.perf_counter() - start) * 1000
-    up = f"Up: {len(tools)} tool{'s' if len(tools) != 1 else ''}"
+    up = f"Reachable: {len(tools)} tool{'s' if len(tools) != 1 else ''}"
     detail = {"tools": tools}
     if ms > MCP_SLOW_MS:
         return _result(t, "warn", f"{up}, but slow to start: {took(ms)}", latency_ms=ms, detail=detail)

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/cli_ui.py

@@ -73,9 +73,13 @@ def level(value: str) -> Text:
     return Text(value, style=STYLES.get(value, ""))
 
 
+HEALTH_WORDS = {"up": "reachable", "warn": "needs a look"}   # what a check proves (D52)
+
+
 def dot(out: Console, status: str) -> Text:
     """Health keeps its label even without colour (D41)."""
-    return Text(f"{'●' if utf8(out) else '*'} {status}", style=STYLES.get(status, "bright_black"))
+    word = HEALTH_WORDS.get(status, status)
+    return Text(f"{'●' if utf8(out) else '*'} {word}", style=STYLES.get(status, "bright_black"))
 
 
 def table(out: Console, title: str, columns: list[str], rows: list[list[Any]], *, border: bool = True) -> None:

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/example_data.py

@@ -176,21 +176,21 @@ def _recorded(id: str, status: Status, latency_ms: float | None, summary: str, *
 
 # Recorded check results for the trip planner (D24): what a real check run gave, so example mode stays offline.
 CHECK_RESULTS: dict[str, CheckResult] = {r.id: r for r in [
-    _recorded("mcp-time", "up", 1900, "Up: 2 tools"),
-    _recorded("mcp-files", "up", 2400, "Up: 14 tools"),
-    _recorded("mcp-fetch", "warn", 6800, "Up: 1 tool, but slow to start: 6.8 s"),
+    _recorded("mcp-time", "up", 1900, "Reachable: 2 tools"),
+    _recorded("mcp-files", "up", 2400, "Reachable: 14 tools"),
+    _recorded("mcp-fetch", "warn", 6800, "Reachable: 1 tool, but slow to start: 6.8 s"),
     _recorded("mcp-currency", "down", None, "Stopped while starting",
               reason="currency server: CURRENCY_API_URL is not set",
               fix="Its code reads CURRENCY_API_URL (mcp_servers/currency.py:9), but its MCP config gives it no env."),
     _recorded("local-packing-list", "up", None, "Found, not run"),
     _recorded("llm-ollama", "down", None, "Nothing answers at localhost:11434",
               reason="[Errno 111] Connection refused", fix="Start Ollama (`ollama serve`)."),
-    _recorded("api-osrm", "up", 640, "Up"),
-    _recorded("api-open-meteo", "up", 180, "Up"),
-    _recorded("api-nominatim", "up", 420, "Up"),
-    _recorded("api-ip-api-com", "warn", 210, "Up, but plain http://: not encrypted"),
-    _recorded("api-google-maps", "up", 230, "Up, needs a key (403)"),
-    _recorded("api-wikipedia", "up", 310, "Up"),
+    _recorded("api-osrm", "up", 640, "Reachable"),
+    _recorded("api-open-meteo", "up", 180, "Reachable"),
+    _recorded("api-nominatim", "up", 420, "Reachable"),
+    _recorded("api-ip-api-com", "warn", 210, "Reachable, but plain http://: not encrypted"),
+    _recorded("api-google-maps", "up", 230, "Reachable, needs a key (403)"),
+    _recorded("api-wikipedia", "up", 310, "Reachable"),
 ]}
 
 

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/flow/__init__.py

@@ -19,8 +19,10 @@ from flowforge.flow.order import Body, Stmt, flatten, label, preds, reduce
 from flowforge.flow.reach import Hit, Reach, writes
 from flowforge.flowmap.models import Evidence, Flow, FlowEdge, FlowNode, Op
 from flowforge.flowmap.validate import DEFAULT_MS, actions_of
+from flowforge.scan.files import language
 from flowforge.scan.models import Dependency, ScanResult
 from flowforge.scan.scanner import Places, scan_with_places
+from flowforge.security.finders import masked_lines
 from flowforge.security.logfilter import Redactor, redact_code
 
 NO_CODE = "Flow order reads Python, Dart, JavaScript and TypeScript."
@@ -130,7 +132,7 @@ class _Builder:
 
     def entry(self, func: Any, body: Body, lang: Any) -> None:
         self.lang = lang
-        lines = self.sources[func.path].splitlines()
+        lines = masked_lines(self.sources[func.path], language(func.path), _redactor)   # every key masked first
         start = f"start-{func.name.replace('.', '-')}"[:64]
         self.nodes.append(FlowNode(id=start, kind="start", title=f"{func.name}()"[:80],
                                    what=f"An entry point in {func.path}.",

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/flow/curly.py

@@ -16,6 +16,7 @@ from flowforge.flow.rewrite import Call
 from flowforge.flowmap.models import Change
 from flowforge.scan import services
 from flowforge.scan.scanner import Places
+from flowforge.security.finders import split_key_in
 from flowforge.security.logfilter import redact_code
 
 LANGUAGES = frozenset({"dart", "javascript", "typescript"})
@@ -852,6 +853,8 @@ def change(calls: list[Call], lang: Lang) -> Change | None:
     first_line = plain[0][0].line
     last_line = lang.end_line(func, plain[-1][0].stmt)
     lines = src.text.splitlines()
+    if split_key_in(src.text, func.language, first_line, last_line):
+        return None   # a key split over lines sits in the block: the prompt only, never its pieces
     indent = re.match(r"\s*", lines[first_line - 1]).group(0)
     semi = ";" if func.language == "dart" or all(p[4] for _, p in plain) else ""
     if func.language == "dart":

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/flow/index.py

@@ -58,6 +58,7 @@ class Index:
     def __init__(self, sources: dict[str, str]):
         self.modules: dict[str, Module] = {}
         self.funcs: dict[str, Func] = {}
+        self.changed: dict[str, set[str]] = {}   # func key -> parameters it changes in place (D51)
         for path, text in sources.items():
             try:
                 tree = ast.parse(text)

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/flow/order.py

@@ -11,7 +11,7 @@ import ast
 import re
 from dataclasses import dataclass, field
 
-from flowforge.flow.index import Func, Index
+from flowforge.flow.index import Func, Index, Module
 from flowforge.flow.reach import Hit, Reach, gathers
 
 MUTATORS = frozenset({"append", "extend", "update", "add", "insert", "pop", "remove", "clear", "setdefault", "write",
@@ -41,17 +41,82 @@ def _reads(node: ast.AST) -> set[str]:
 
 
 def _writes(node: ast.AST) -> set[str]:
-    out = {n.id for n in ast.walk(node) if isinstance(n, ast.Name) and isinstance(n.ctx, (ast.Store, ast.Del))}
+    bound = {n.id for n in ast.walk(node) if isinstance(n, ast.Name) and isinstance(n.ctx, (ast.Store, ast.Del))}
+    return bound | changes(node)
+
+
+def _base(node: ast.AST) -> str | None:
+    while isinstance(node, (ast.Subscript, ast.Attribute)):
+        node = node.value
+    return node.id if isinstance(node, ast.Name) else None
+
+
+def changes(node: ast.AST) -> set[str]:
+    """Names whose object the code changes in place: `x[k] = …`, `x.a = …`, `x.append(…)` (rebinding `x` isn't)."""
+    out: set[str] = set()
     for n in ast.walk(node):
-        if isinstance(n, (ast.Subscript, ast.Attribute)) and isinstance(n.ctx, ast.Store):
-            base = n.value
-            while isinstance(base, (ast.Subscript, ast.Attribute)):
-                base = base.value
-            if isinstance(base, ast.Name):
-                out.add(base.id)
+        if isinstance(n, (ast.Subscript, ast.Attribute)) and isinstance(n.ctx, (ast.Store, ast.Del)) \
+                and (base := _base(n.value)):
+            out.add(base)
         if isinstance(n, ast.Call) and isinstance(n.func, ast.Attribute) and n.func.attr in MUTATORS \
-                and isinstance(n.func.value, ast.Name):
-            out.add(n.func.value.id)   # facts.append(x) writes facts
+                and (base := _base(n.func.value)):
+            out.add(base)   # facts.append(x) writes facts
+    return out
+
+
+def _params(func: Func) -> list[str]:
+    a = func.node.args
+    return [p.arg for p in (*a.posonlyargs, *a.args, *a.kwonlyargs)]
+
+
+def _is_method(func: Func) -> bool:
+    static = any(isinstance(d, ast.Name) and d.id == "staticmethod" for d in func.node.decorator_list)
+    return "." in func.name and not static
+
+
+def _passed(call: ast.Call, target: Func, changed: set[str]) -> set[str]:
+    """The caller's names that land on `changed` parameters of `target`: by position, by keyword, and the receiver
+    of a method (`cart.add(x)` passes `cart` as `self`)."""
+    params = _params(target)
+    out: set[str] = set()
+    if _is_method(target) and isinstance(call.func, ast.Attribute):
+        if params and params[0] in changed and (base := _base(call.func.value)):
+            out.add(base)
+        params = params[1:]
+    for i, arg in enumerate(call.args):
+        if i < len(params) and params[i] in changed and (base := _base(arg)):
+            out.add(base)
+    for kw in call.keywords:
+        if kw.arg in changed and (base := _base(kw.value)):
+            out.add(base)
+    return out
+
+
+def changed_params(index: Index, key: str, _stack: frozenset[str] = frozenset()) -> set[str]:
+    """The parameters a function in the repo changes in place, itself or through the repo's functions it calls (D51).
+    Library calls are taken not to change their arguments."""
+    if key in index.changed:
+        return index.changed[key]
+    func = index.funcs[key]
+    params = set(_params(func))
+    found = changes(func.node) & params
+    module = index.modules[func.module]
+    cls = func.name.split(".")[0] if "." in func.name else None
+    for n in ast.walk(func.node):
+        if isinstance(n, ast.Call) and (sub := index.resolve(n, module, cls)) and sub not in _stack | {key}:
+            found |= _passed(n, index.funcs[sub], changed_params(index, sub, _stack | {key})) & params
+    if not _stack:
+        index.changed[key] = found   # a result found inside a cycle may be partial: kept only from the top
+    return found
+
+
+def call_writes(node: ast.AST, index: Index, module: Module, cls: str | None) -> set[str]:
+    """Names a statement changes through the repo's own functions it calls: `await load(ctx)` writes `ctx` when `load`
+    fills it (D51)."""
+    out: set[str] = set()
+    for n in ast.walk(node):
+        if isinstance(n, ast.Call) and (key := index.resolve(n, module, cls)):
+            out |= _passed(n, index.funcs[key], changed_params(index, key))
     return out
 
 
@@ -71,7 +136,7 @@ def flatten(func: Func, index: Index, reach: Reach) -> Body:
     def add(node: ast.AST, line: int, ifs: list[tuple[int, str]], loop: bool, *, reads: set[str] | None = None,
             writes: set[str] | None = None, hit_node: ast.AST | None = None, is_if: bool = False) -> Stmt:
         s = Stmt(idx=len(body.stmts), node=node, line=line, reads=_reads(node) if reads is None else reads,
-                 writes=_writes(node) if writes is None else writes,
+                 writes=_writes(node) | call_writes(node, index, module, cls) if writes is None else writes,
                  hits=reach.statement(hit_node if hit_node is not None else node, module, cls) if hit_node is not False
                  else [], ifs=list(ifs), loop=loop, returns=isinstance(node, (ast.Return, ast.Raise)),
                  gathered=gathers(node), is_if=is_if)

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/flow/rewrite.py

@@ -12,7 +12,9 @@ import ast
 from dataclasses import dataclass
 from typing import Any
 
+from flowforge.flow.order import changes
 from flowforge.flowmap.models import Change
+from flowforge.security.finders import split_key_in
 from flowforge.security.logfilter import redact_code
 
 
@@ -75,6 +77,20 @@ def _names(node: ast.AST, ctx: type) -> set[str]:
     return {n.id for n in ast.walk(node) if isinstance(n, ast.Name) and isinstance(n.ctx, ctx)}
 
 
+def _handed(node: ast.AST) -> set[str]:
+    """Names handed to any call: a function we can't see into might change them, so a written change won't move a
+    call past it (D51)."""
+    out: set[str] = set()
+    for n in ast.walk(node):
+        if isinstance(n, ast.Call):
+            for arg in [*n.args, *(k.value for k in n.keywords)]:
+                while isinstance(arg, (ast.Subscript, ast.Attribute, ast.Starred)):
+                    arg = arg.value
+                if isinstance(arg, ast.Name):
+                    out.add(arg.id)
+    return out
+
+
 def _quoted(c: Call) -> str:
     return f'"{c.words}" ({c.ref})'
 
@@ -102,16 +118,19 @@ def change(calls: list[Call], source: str, module: ast.Module) -> Change | None:
     targets = set().union(*(_names(c.stmt, ast.Store) for c in plain))
     reads = set().union(*(_names(_awaited(c.stmt)[1], ast.Load) for c in plain))
     for st in body[first: last + 1]:
-        if id(st) not in members and (_names(st, ast.Load) & targets or _names(st, ast.Store) & reads):
-            return None   # code between them uses a result, or changes what a call reads
+        if id(st) not in members and (_names(st, ast.Load) & targets or _names(st, ast.Store) & reads
+                                      or (changes(st) | _handed(st)) & reads):
+            return None   # code between them uses a result, or changes (or may change) what a call reads (D51)
 
     lines = source.splitlines()
+    end = plain[-1].stmt.end_lineno or plain[-1].stmt.lineno
+    if split_key_in(source, "python", plain[0].stmt.lineno, end):
+        return None   # a key split over lines sits in the block: the prompt only, never its pieces
     indent = lines[plain[0].stmt.lineno - 1][: plain[0].stmt.col_offset]
     names = [_awaited(c.stmt)[0] for c in plain]
     lhs = "" if all(n == "_" for n in names) else f"{', '.join(names)} = "
     gather = [f"{indent}{lhs}await asyncio.gather(",
               *(f"{indent}    {ast.unparse(_awaited(c.stmt)[1])}," for c in plain), f"{indent})"]
-    end = plain[-1].stmt.end_lineno or plain[-1].stmt.lineno
     spans = [(c.stmt.lineno, c.stmt.end_lineno or c.stmt.lineno) for c in plain]
     after: list[str] = []
     for n in range(plain[0].stmt.lineno, end + 1):

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/scan/files.py

@@ -27,6 +27,7 @@ LANGUAGES = {".py": "python", ".js": "javascript", ".jsx": "javascript", ".mjs":
 @dataclass
 class Listing:
     files: list[str] = field(default_factory=list)          # paths relative to the root, "/"-separated
+    tests: list[str] = field(default_factory=list)          # test and fake-data code: searched for keys only (D52)
     skipped: dict[str, int] = field(default_factory=dict)   # why -> how many: ignored, binary, too_big, outside…
 
     def skip(self, why: str) -> None:
@@ -37,6 +38,14 @@ def language(rel: str) -> str | None:
     return LANGUAGES.get(Path(rel).suffix.lower())
 
 
+def is_test(rel: str) -> bool:
+    """Test or fake-data code outside hidden folders: left off the map (D23), searched for keys (D52)."""
+    path = Path(rel)
+    if language(rel) is None or any(part.startswith(".") for part in path.parent.parts):
+        return False
+    return any(part in TEST_DIRS for part in path.parent.parts) or bool(TEST_FILE.search(path.name))
+
+
 def classify(rel: str) -> str | None:
     """"read", "ignored" (code or docs skipped on purpose: tests, fake data, docs, your tools' hidden folders) or None
     (not something the scan looks at, such as images or lock files).
@@ -93,20 +102,19 @@ def list_files(root: Path) -> Listing:
         kind = classify(rel)
         if kind is None:
             continue
+        keys_only = kind == "ignored" and is_test(rel)
         if kind == "ignored":
             out.skip("ignored")
-            continue
+            if not keys_only:
+                continue
         path = root / rel
-        if path.is_symlink() and not path.resolve().is_relative_to(root):
-            out.skip("outside")
-            continue
-        if not path.is_file():
-            continue
-        if path.stat().st_size > MAX_BYTES:
-            out.skip("too_big")
-            continue
-        if _is_binary(path):
-            out.skip("binary")
+        why = ("outside" if path.is_symlink() and not path.resolve().is_relative_to(root)
+               else "missing" if not path.is_file()
+               else "too_big" if path.stat().st_size > MAX_BYTES
+               else "binary" if _is_binary(path) else None)
+        if why is not None:
+            if why != "missing" and not keys_only:
+                out.skip(why)
             continue
-        out.files.append(rel)
+        (out.tests if keys_only else out.files).append(rel)
     return out

{flowforge_map-0.4.1 → flowforge_map-0.4.2}/backend/flowforge/scan/scanner.py

@@ -17,8 +17,9 @@ from flowforge.scan.facts import FileFacts, Ref
 from flowforge.scan.files import language, list_files
 from flowforge.scan.models import Dependency, EnvName, ScanEvidence, ScanResult
 from flowforge.scan.urls import api_shaped, clean_url, host_of, is_local, is_not_a_service
+from flowforge.security.finders import masked_lines
 from flowforge.security.findings import ConfigKey, findings_for
-from flowforge.security.logfilter import Redactor, redact_code
+from flowforge.security.logfilter import Redactor
 
 EXCERPT_RADIUS = 2
 MAX_LINE = 160
@@ -71,6 +72,7 @@ class _Dep:
 class _Merge:
     def __init__(self, texts: dict[str, list[str]], constants: Constants):
         self.texts = texts
+        self._masked: dict[str, list[str]] = {}
         self.constants = constants
         self.deps: dict[str, _Dep] = {}
 
@@ -212,11 +214,17 @@ class _Merge:
             for pkg, at in routers:
                 dep.add(f.path, at, f"imports {pkg.split('.')[0]}")
 
+    def masked(self, path: str) -> list[str]:
+        """The file's lines with every key masked, one split over lines included, cut from once per file."""
+        if path not in self._masked:
+            self._masked[path] = masked_lines("\n".join(self.texts.get(path, [])), language(path), _redactor)
+        return self._masked[path]
+
     def evidence(self, path: str, line: int, text: str) -> ScanEvidence:
-        lines = self.texts.get(path, [])
+        lines = self.masked(path)
         first = max(1, line - EXCERPT_RADIUS)
         last = min(len(lines), line + EXCERPT_RADIUS)
-        excerpt = [redact_code(raw, _redactor)[:MAX_LINE] for raw in lines[first - 1:last]]
+        excerpt = [raw[:MAX_LINE] for raw in lines[first - 1:last]]
         return ScanEvidence(ref=f"{path}:{line}", text=text, first_line=first, lines=excerpt, highlight=line)
 
     def result(self, env: dict[tuple[str, int], list[str]]) -> list[Dependency]:
@@ -290,6 +298,9 @@ def scan_with_places(root: str | Path) -> tuple[ScanResult, Places]:
         if lang:
             languages[lang] = languages.get(lang, 0) + 1
 
+    for rel in listing.tests:   # off the map, but searched for keys (D52)
+        texts[rel] = (root / rel).read_text(encoding="utf-8", errors="replace").splitlines()
+
     constants: Constants = {name: (value, f.path, line) for f in facts for name, (value, line) in f.constants.items()}
     merge = _Merge(texts, constants)
     app_servers: set[str] = set()
@@ -334,7 +345,8 @@ def scan_with_places(root: str | Path) -> tuple[ScanResult, Places]:
         ev = merge.evidence(path, line, "")
         return ev.first_line or line, ev.lines
 
-    findings = findings_for(texts, {rel: language(rel) for rel in texts}, dependencies, by_dep, config_keys, excerpt)
+    findings = findings_for(texts, {rel: language(rel) for rel in texts}, dependencies, by_dep, config_keys, excerpt,
+                            tests=set(listing.tests))
     result = ScanResult(root=root.name, files_scanned=len(listing.files), skipped=listing.skipped,
                         languages=languages, dependencies=dependencies,
                         env_names=[EnvName(name=n, ref=r) for n, r in sorted(seen.items())], findings=findings,