ghostpkg 0.1.0__tar.gz → 0.2.0__tar.gz

{ghostpkg-0.1.0 → ghostpkg-0.2.0}/CHANGELOG.md

@@ -6,6 +6,31 @@ this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-09-01
+
+### Fixed
+- **`scan` reported nonsense for `pyproject.toml`.** Every file that was not
+  `package.json` was handed to the requirements.txt parser, so TOML keys were
+  read as package names: `build-backend` came back "does not exist on pypi",
+  and `version` came back "ok" because a package of that name exists. For a
+  security tool, confidently reporting nonsense is the worst failure mode.
+
+### Added
+- `pyproject.toml` support in `scan`: PEP 621 `project.dependencies` and
+  `project.optional-dependencies`, plus Poetry's `tool.poetry` groups.
+  `[build-system] requires` is excluded, and Poetry's `python` constraint is
+  not treated as a package.
+- Manifests are now detected explicitly. An unrecognised file is **refused with
+  an error rather than guessed at** — guessing was the root cause of the bug
+  above.
+- A narrow TOML fallback parser for Python 3.9 and 3.10, which have no
+  `tomllib`. Adding a TOML dependency would contradict the zero-dependency rule,
+  and the fallback is tested by forcing the import to fail rather than by
+  trusting the interpreter the suite runs on.
+
+### Changed
+- `--version` now reads `__version__` instead of a hardcoded string.
+
 ## [0.1.0] - 2026-09-01
 
 First release.
@@ -35,5 +60,6 @@ First release.
 - No corpus of hallucinated package names is shipped, following the decision of
   the USENIX'25 authors not to publish theirs.
 
-[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.2.0
 [0.1.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.1.0

{ghostpkg-0.1.0 → ghostpkg-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ghostpkg
-Version: 0.1.0
+Version: 0.2.0
 Summary: Catch package names that do not exist before you install them
 Project-URL: Homepage, https://github.com/m1rwana12/ghostpkg
 Project-URL: Issues, https://github.com/m1rwana12/ghostpkg/issues
@@ -59,8 +59,8 @@ Language models invent library names. Attackers register those names in advance.
 **English** · [Українська](https://github.com/M1rwana12/ghostpkg/blob/main/README.md)
 
 [![CI](https://github.com/M1rwana12/ghostpkg/actions/workflows/ci.yml/badge.svg)](https://github.com/M1rwana12/ghostpkg/actions/workflows/ci.yml)
-[![PyPI](https://img.shields.io/pypi/v/ghostpkg.svg?color=A78BFA)](https://pypi.org/project/ghostpkg/)
-[![Python](https://img.shields.io/pypi/pyversions/ghostpkg.svg?color=A78BFA)](https://pypi.org/project/ghostpkg/)
+[![PyPI](https://img.shields.io/pypi/v/ghostpkg?color=A78BFA&label=pypi)](https://pypi.org/project/ghostpkg/)
+[![Python](https://img.shields.io/pypi/pyversions/ghostpkg?color=A78BFA&label=python)](https://pypi.org/project/ghostpkg/)
 [![Dependencies](https://img.shields.io/badge/dependencies-0-3FB950.svg)](https://github.com/M1rwana12/ghostpkg/blob/main/pyproject.toml)
 [![License](https://img.shields.io/badge/license-MIT-8B949E.svg)](https://github.com/M1rwana12/ghostpkg/blob/main/LICENSE)
 
@@ -158,12 +158,19 @@ ghostpkg check react-router-dom-utils -e npm
 
 ```bash
 ghostpkg scan requirements.txt
+ghostpkg scan pyproject.toml
 ghostpkg scan package.json
 ```
 
-`requirements.txt` parsing skips comments, flags, VCS URLs and direct links, and
-takes the bare project name off each requirement line. `package.json` reads
-`dependencies`, `devDependencies` and `optionalDependencies`.
+| Manifest | What is read |
+|---|---|
+| `requirements*.txt` | Every requirement line. Comments, flags, VCS URLs and direct links are skipped. |
+| `pyproject.toml` | PEP 621 `project.dependencies` and `project.optional-dependencies`, plus Poetry's `tool.poetry` groups. `[build-system] requires` is not included, and the `python` constraint is not treated as a package. |
+| `package.json` | `dependencies`, `devDependencies`, `optionalDependencies`. |
+
+Anything else is **refused with an error rather than guessed at**. Guessing is
+what made an earlier version read `pyproject.toml` with the requirements parser
+and report TOML keys as package names.
 
 ### Options
 

{ghostpkg-0.1.0 → ghostpkg-0.2.0}/README.en.md

@@ -12,8 +12,8 @@ Language models invent library names. Attackers register those names in advance.
 **English** · [Українська](https://github.com/M1rwana12/ghostpkg/blob/main/README.md)
 
 [![CI](https://github.com/M1rwana12/ghostpkg/actions/workflows/ci.yml/badge.svg)](https://github.com/M1rwana12/ghostpkg/actions/workflows/ci.yml)
-[![PyPI](https://img.shields.io/pypi/v/ghostpkg.svg?color=A78BFA)](https://pypi.org/project/ghostpkg/)
-[![Python](https://img.shields.io/pypi/pyversions/ghostpkg.svg?color=A78BFA)](https://pypi.org/project/ghostpkg/)
+[![PyPI](https://img.shields.io/pypi/v/ghostpkg?color=A78BFA&label=pypi)](https://pypi.org/project/ghostpkg/)
+[![Python](https://img.shields.io/pypi/pyversions/ghostpkg?color=A78BFA&label=python)](https://pypi.org/project/ghostpkg/)
 [![Dependencies](https://img.shields.io/badge/dependencies-0-3FB950.svg)](https://github.com/M1rwana12/ghostpkg/blob/main/pyproject.toml)
 [![License](https://img.shields.io/badge/license-MIT-8B949E.svg)](https://github.com/M1rwana12/ghostpkg/blob/main/LICENSE)
 
@@ -111,12 +111,19 @@ ghostpkg check react-router-dom-utils -e npm
 
 ```bash
 ghostpkg scan requirements.txt
+ghostpkg scan pyproject.toml
 ghostpkg scan package.json
 ```
 
-`requirements.txt` parsing skips comments, flags, VCS URLs and direct links, and
-takes the bare project name off each requirement line. `package.json` reads
-`dependencies`, `devDependencies` and `optionalDependencies`.
+| Manifest | What is read |
+|---|---|
+| `requirements*.txt` | Every requirement line. Comments, flags, VCS URLs and direct links are skipped. |
+| `pyproject.toml` | PEP 621 `project.dependencies` and `project.optional-dependencies`, plus Poetry's `tool.poetry` groups. `[build-system] requires` is not included, and the `python` constraint is not treated as a package. |
+| `package.json` | `dependencies`, `devDependencies`, `optionalDependencies`. |
+
+Anything else is **refused with an error rather than guessed at**. Guessing is
+what made an earlier version read `pyproject.toml` with the requirements parser
+and report TOML keys as package names.
 
 ### Options
 

{ghostpkg-0.1.0 → ghostpkg-0.2.0}/README.md

@@ -12,8 +12,8 @@
 [English](README.en.md) · **Українська**
 
 [![CI](https://github.com/M1rwana12/ghostpkg/actions/workflows/ci.yml/badge.svg)](https://github.com/M1rwana12/ghostpkg/actions/workflows/ci.yml)
-[![PyPI](https://img.shields.io/pypi/v/ghostpkg.svg?color=A78BFA)](https://pypi.org/project/ghostpkg/)
-[![Python](https://img.shields.io/pypi/pyversions/ghostpkg.svg?color=A78BFA)](https://pypi.org/project/ghostpkg/)
+[![PyPI](https://img.shields.io/pypi/v/ghostpkg?color=A78BFA&label=pypi)](https://pypi.org/project/ghostpkg/)
+[![Python](https://img.shields.io/pypi/pyversions/ghostpkg?color=A78BFA&label=python)](https://pypi.org/project/ghostpkg/)
 [![Залежності](https://img.shields.io/badge/%D0%B7%D0%B0%D0%BB%D0%B5%D0%B6%D0%BD%D0%BE%D1%81%D1%82%D0%B5%D0%B9-0-3FB950.svg)](pyproject.toml)
 [![Ліцензія](https://img.shields.io/badge/%D0%BB%D1%96%D1%86%D0%B5%D0%BD%D0%B7%D1%96%D1%8F-MIT-8B949E.svg)](LICENSE)
 
@@ -81,6 +81,7 @@ ghostpkg check react-router-dom-utils -e npm
 
 # перевірити всі залежності з маніфесту
 ghostpkg scan requirements.txt
+ghostpkg scan pyproject.toml
 ghostpkg scan package.json
 
 # машинозчитуваний вивід
@@ -94,6 +95,9 @@ ghostpkg check somepkg --json
 | `--json` | Вивід у JSON для скриптів і CI |
 | `-q`, `--quiet` | Ховає пакети, які пройшли перевірку |
 
+`scan` розпізнає `requirements*.txt`, `pyproject.toml` (PEP 621 і Poetry)
+та `package.json`. Невідомий формат він **відхиляє з помилкою, а не вгадує**.
+
 ---
 
 ## Що саме перевіряється

{ghostpkg-0.1.0 → ghostpkg-0.2.0}/ghostpkg/__init__.py

@@ -1,6 +1,6 @@
 """ghostpkg -- catch package names that do not exist before you install them."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 from .assess import Finding, Verdict, assess
 from .registries import PackageFacts, RegistryError, fetch

{ghostpkg-0.1.0 → ghostpkg-0.2.0}/ghostpkg/cli.py

@@ -6,11 +6,12 @@ import argparse
 import concurrent.futures
 import json
 import os
-import re
 import sys
 from pathlib import Path
 
+from . import __version__
 from .assess import Finding, Verdict, assess
+from .manifests import UnsupportedManifest, load_manifest
 from .registries import RegistryError, fetch
 
 EXIT_OK = 0
@@ -96,42 +97,14 @@ def evaluate(names: list[str], ecosystem: str, strict: bool) -> list[Finding]:
         return list(pool.map(one, names))
 
 
-REQUIREMENT_LINE = re.compile(r"^\s*([A-Za-z0-9][A-Za-z0-9._-]*)")
-
-
-def parse_requirements(text: str) -> list[str]:
-    names = []
-    for raw in text.splitlines():
-        line = raw.strip()
-        if not line or line.startswith(("#", "-", "git+", "http")):
-            continue
-        match = REQUIREMENT_LINE.match(line)
-        if match:
-            names.append(match.group(1))
-    return names
-
-
-def parse_package_json(text: str) -> list[str]:
-    data = json.loads(text)
-    names: list[str] = []
-    for key in ("dependencies", "devDependencies", "optionalDependencies"):
-        names.extend((data.get(key) or {}).keys())
-    return names
-
-
-def load_manifest(path: Path) -> tuple[list[str], str]:
-    text = path.read_text(encoding="utf-8")
-    if path.name == "package.json":
-        return parse_package_json(text), "npm"
-    return parse_requirements(text), "pypi"
-
-
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="ghostpkg",
         description="Catch package names that do not exist before you install them.",
     )
-    parser.add_argument("--version", action="version", version="ghostpkg 0.1.0")
+    parser.add_argument(
+        "--version", action="version", version=f"ghostpkg {__version__}"
+    )
     sub = parser.add_subparsers(dest="command", required=True)
 
     check = sub.add_parser("check", help="check one or more package names")
@@ -139,7 +112,9 @@ def build_parser() -> argparse.ArgumentParser:
     check.add_argument("-e", "--ecosystem", choices=("pypi", "npm"), default="pypi")
 
     scan = sub.add_parser("scan", help="check every dependency in a manifest")
-    scan.add_argument("path", type=Path, help="requirements.txt or package.json")
+    scan.add_argument(
+        "path", type=Path, help="requirements*.txt, pyproject.toml or package.json"
+    )
 
     for command in (check, scan):
         command.add_argument(
@@ -162,7 +137,10 @@ def main(argv: list[str] | None = None) -> int:
             return EXIT_ERROR
         try:
             names, ecosystem = load_manifest(args.path)
-        except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+        except UnsupportedManifest as exc:
+            print(f"ghostpkg: {exc}", file=sys.stderr)
+            return EXIT_ERROR
+        except (json.JSONDecodeError, UnicodeDecodeError, ValueError) as exc:
             print(f"ghostpkg: could not parse {args.path}: {exc}", file=sys.stderr)
             return EXIT_ERROR
         if not names:

ghostpkg-0.2.0/ghostpkg/manifests.py

@@ -0,0 +1,193 @@
+"""Manifest parsing.
+
+Each format is recognised explicitly. Guessing is what made an earlier version
+read `pyproject.toml` with the requirements.txt parser and report TOML keys as
+package names -- `build-backend` came back "does not exist", `version` came back
+"ok" because a package of that name happens to exist. A security tool that
+confidently reports nonsense is worse than one that refuses to run.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+REQUIREMENT_LINE = re.compile(r"^\s*([A-Za-z0-9][A-Za-z0-9._-]*)")
+
+SUPPORTED = "requirements*.txt, pyproject.toml, package.json"
+
+
+class UnsupportedManifest(ValueError):
+    """The file is not a manifest ghostpkg knows how to read."""
+
+
+def parse_requirements(text: str) -> list[str]:
+    names = []
+    for raw in text.splitlines():
+        line = raw.strip()
+        if not line or line.startswith(("#", "-", "git+", "http")):
+            continue
+        match = REQUIREMENT_LINE.match(line)
+        if match:
+            names.append(match.group(1))
+    return names
+
+
+def parse_package_json(text: str) -> list[str]:
+    data = json.loads(text)
+    names: list[str] = []
+    for key in ("dependencies", "devDependencies", "optionalDependencies"):
+        names.extend((data.get(key) or {}).keys())
+    return names
+
+
+def _requirement_name(spec: str) -> str | None:
+    """Take the project name off a PEP 508 requirement string."""
+    spec = spec.strip()
+    if not spec or spec.startswith(("#", "-")):
+        return None
+    match = REQUIREMENT_LINE.match(spec)
+    return match.group(1) if match else None
+
+
+def _toml_arrays(text: str, table: str, key: str) -> list[str]:
+    """Read a string array out of one TOML table without a TOML parser.
+
+    Only the shapes that appear in dependency declarations are handled:
+    `key = ["a", "b"]` on one line, or spread across several. This exists
+    because tomllib is 3.11+ and ghostpkg supports 3.9 with no dependencies.
+    """
+    lines = text.splitlines()
+    current = ""
+    collected: list[str] = []
+    depth = 0
+    buffer = ""
+
+    for raw in lines:
+        line = raw.strip()
+        if depth == 0:
+            if line.startswith("[") and line.endswith("]"):
+                current = line[1:-1].strip().strip('"')
+                continue
+            if current != table:
+                continue
+            stripped = line.split("#", 1)[0].strip()
+            if not stripped.startswith(key):
+                continue
+            after = stripped[len(key):].lstrip()
+            if not after.startswith("="):
+                continue
+            buffer = after[1:].strip()
+            if not buffer.startswith("["):
+                continue
+            depth = 1
+            buffer = buffer[1:]
+        else:
+            buffer += " " + line.split("#", 1)[0].strip()
+
+        if depth:
+            if "]" in buffer:
+                buffer = buffer[: buffer.index("]")]
+                depth = 0
+                collected.extend(re.findall(r'["\']([^"\']+)["\']', buffer))
+                buffer = ""
+    return collected
+
+
+def _toml_table_keys(text: str, table: str) -> list[str]:
+    """Read the keys of one TOML table (`name = value` lines)."""
+    keys: list[str] = []
+    current = ""
+    for raw in text.splitlines():
+        line = raw.split("#", 1)[0].strip()
+        if line.startswith("[") and line.endswith("]"):
+            current = line[1:-1].strip().strip('"')
+            continue
+        if current != table or "=" not in line:
+            continue
+        name = line.split("=", 1)[0].strip().strip('"').strip("'")
+        if name:
+            keys.append(name)
+    return keys
+
+
+def parse_pyproject(text: str) -> list[str]:
+    """Dependencies from PEP 621 and from Poetry.
+
+    Uses tomllib where it exists (3.11+) and a narrow fallback parser below
+    that, because adding a TOML dependency would contradict the whole point
+    of this tool.
+    """
+    try:
+        import tomllib  # noqa: PLC0415
+    except ImportError:
+        tomllib = None  # type: ignore[assignment]
+
+    names: list[str] = []
+
+    if tomllib is not None:
+        data = tomllib.loads(text)
+        project = data.get("project") or {}
+        for spec in project.get("dependencies") or []:
+            name = _requirement_name(spec)
+            if name:
+                names.append(name)
+        for group in (project.get("optional-dependencies") or {}).values():
+            for spec in group:
+                name = _requirement_name(spec)
+                if name:
+                    names.append(name)
+        poetry = ((data.get("tool") or {}).get("poetry") or {})
+        for section in ("dependencies", "dev-dependencies"):
+            for name in (poetry.get(section) or {}):
+                if name.lower() != "python":
+                    names.append(name)
+        for group in ((poetry.get("group") or {}).values()):
+            for name in (group.get("dependencies") or {}):
+                if name.lower() != "python":
+                    names.append(name)
+    else:
+        for spec in _toml_arrays(text, "project", "dependencies"):
+            name = _requirement_name(spec)
+            if name:
+                names.append(name)
+        # optional-dependencies is a table of arrays; scan every key in it
+        for raw in text.splitlines():
+            stripped = raw.split("#", 1)[0].strip()
+            if stripped.startswith("[project.optional-dependencies]"):
+                break
+        for key in _toml_table_keys(text, "project.optional-dependencies"):
+            for spec in _toml_arrays(text, "project.optional-dependencies", key):
+                name = _requirement_name(spec)
+                if name:
+                    names.append(name)
+        for table in ("tool.poetry.dependencies", "tool.poetry.dev-dependencies"):
+            for name in _toml_table_keys(text, table):
+                if name.lower() != "python":
+                    names.append(name)
+
+    seen: set[str] = set()
+    unique = []
+    for name in names:
+        if name not in seen:
+            seen.add(name)
+            unique.append(name)
+    return unique
+
+
+def load_manifest(path: Path) -> tuple[list[str], str]:
+    """Return (package names, ecosystem). Raises UnsupportedManifest."""
+    name = path.name.lower()
+    text = path.read_text(encoding="utf-8")
+
+    if name == "package.json":
+        return parse_package_json(text), "npm"
+    if name == "pyproject.toml":
+        return parse_pyproject(text), "pypi"
+    if name.endswith(".txt"):
+        return parse_requirements(text), "pypi"
+
+    raise UnsupportedManifest(
+        f"don't know how to read {path.name!r}. Supported: {SUPPORTED}"
+    )

{ghostpkg-0.1.0 → ghostpkg-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ghostpkg"
-version = "0.1.0"
+version = "0.2.0"
 description = "Catch package names that do not exist before you install them"
 readme = "README.en.md"  # English page for PyPI; the repo main page is Ukrainian
 requires-python = ">=3.9"

ghostpkg-0.2.0/tests/test_manifests.py

@@ -0,0 +1,187 @@
+"""Tests for manifest parsing.
+
+The regression these guard against: an earlier version treated every file that
+was not package.json as a requirements.txt, so `scan pyproject.toml` reported
+TOML keys as package names -- `build-backend` came back "does not exist on
+pypi", and `version` came back "ok" because a package of that name exists.
+"""
+
+import json
+
+import pytest
+
+from ghostpkg.manifests import (
+    UnsupportedManifest,
+    load_manifest,
+    parse_package_json,
+    parse_pyproject,
+    parse_requirements,
+)
+
+PYPROJECT = """
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "example"
+version = "1.0.0"
+description = "not a dependency"
+requires-python = ">=3.9"
+dependencies = [
+    "requests>=2.31",
+    "click",
+    # a comment inside the array
+    "rich~=13.0",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=7", "mypy"]
+docs = ["sphinx"]
+
+[tool.ruff]
+line-length = 88
+"""
+
+POETRY = """
+[tool.poetry]
+name = "example"
+version = "1.0.0"
+
+[tool.poetry.dependencies]
+python = "^3.11"
+requests = "^2.31"
+httpx = { version = "^0.27", optional = true }
+
+[tool.poetry.dev-dependencies]
+pytest = "^8.0"
+"""
+
+
+class TestPyproject:
+    def test_finds_pep621_dependencies(self):
+        names = parse_pyproject(PYPROJECT)
+        assert "requests" in names
+        assert "click" in names
+        assert "rich" in names
+
+    def test_finds_optional_dependencies(self):
+        names = parse_pyproject(PYPROJECT)
+        assert "pytest" in names
+        assert "mypy" in names
+        assert "sphinx" in names
+
+    @pytest.mark.parametrize(
+        "key", ["build-backend", "name", "version", "description", "requires-python"]
+    )
+    def test_toml_keys_are_not_treated_as_packages(self, key):
+        """The exact regression: TOML keys reported as package names."""
+        assert key not in parse_pyproject(PYPROJECT)
+
+    def test_build_system_requires_is_not_a_dependency(self):
+        """`requires` under [build-system] is a build dep, not a project one."""
+        assert "hatchling" not in parse_pyproject(PYPROJECT)
+
+    def test_poetry_dependencies(self):
+        names = parse_pyproject(POETRY)
+        assert "requests" in names
+        assert "httpx" in names
+        assert "pytest" in names
+
+    def test_poetry_python_constraint_is_skipped(self):
+        """`python` is an interpreter constraint, not a package."""
+        assert "python" not in parse_pyproject(POETRY)
+
+    def test_no_duplicates(self):
+        names = parse_pyproject(PYPROJECT)
+        assert len(names) == len(set(names))
+
+
+class TestFallbackParser:
+    """Python 3.9 and 3.10 have no tomllib, so a narrow parser stands in.
+
+    These run the fallback explicitly rather than trusting the interpreter
+    version the suite happens to be executed on.
+    """
+
+    @pytest.fixture
+    def no_tomllib(self, monkeypatch):
+        import builtins
+
+        real_import = builtins.__import__
+
+        def fake_import(name, *args, **kwargs):
+            if name == "tomllib":
+                raise ImportError("no tomllib")
+            return real_import(name, *args, **kwargs)
+
+        monkeypatch.setattr(builtins, "__import__", fake_import)
+
+    def test_fallback_finds_dependencies(self, no_tomllib):
+        names = parse_pyproject(PYPROJECT)
+        assert "requests" in names
+        assert "click" in names
+        assert "rich" in names
+
+    def test_fallback_finds_optional_dependencies(self, no_tomllib):
+        names = parse_pyproject(PYPROJECT)
+        assert "pytest" in names
+        assert "sphinx" in names
+
+    def test_fallback_ignores_toml_keys(self, no_tomllib):
+        names = parse_pyproject(PYPROJECT)
+        for key in ("build-backend", "name", "version", "requires-python"):
+            assert key not in names
+
+    def test_fallback_reads_poetry(self, no_tomllib):
+        names = parse_pyproject(POETRY)
+        assert "requests" in names
+        assert "python" not in names
+
+
+class TestRequirements:
+    def test_basic(self):
+        text = "requests==2.31.0\nflask>=3.0\n\n# comment\nnumpy\n"
+        assert parse_requirements(text) == ["requests", "flask", "numpy"]
+
+    def test_skips_flags_and_urls(self):
+        text = "-r base.txt\n--index-url https://example.com\ngit+https://x/y\nrequests\n"
+        assert parse_requirements(text) == ["requests"]
+
+
+class TestPackageJson:
+    def test_all_dependency_groups(self):
+        text = json.dumps(
+            {
+                "dependencies": {"express": "^4"},
+                "devDependencies": {"jest": "^29"},
+                "optionalDependencies": {"fsevents": "^2"},
+            }
+        )
+        assert set(parse_package_json(text)) == {"express", "jest", "fsevents"}
+
+
+class TestDetection:
+    def test_pyproject_is_recognised(self, tmp_path):
+        p = tmp_path / "pyproject.toml"
+        p.write_text(PYPROJECT, encoding="utf-8")
+        names, ecosystem = load_manifest(p)
+        assert ecosystem == "pypi"
+        assert "requests" in names
+
+    def test_package_json_is_npm(self, tmp_path):
+        p = tmp_path / "package.json"
+        p.write_text('{"dependencies": {"express": "^4"}}', encoding="utf-8")
+        assert load_manifest(p) == (["express"], "npm")
+
+    def test_requirements_variants(self, tmp_path):
+        p = tmp_path / "requirements-dev.txt"
+        p.write_text("pytest\n", encoding="utf-8")
+        assert load_manifest(p) == (["pytest"], "pypi")
+
+    def test_unknown_file_is_refused_not_guessed(self, tmp_path):
+        """Refusing beats guessing: guessing is what produced the TOML bug."""
+        p = tmp_path / "LICENSE"
+        p.write_text("MIT License\n", encoding="utf-8")
+        with pytest.raises(UnsupportedManifest):
+            load_manifest(p)