fix(entrypoints): clear stale records before each detection pass (#27)

detect_entrypoints extended entrypoints onto whatever list a node
already had. On a warm cache, core.py reuses the same cached
PyModule/PyCallable objects when a file is unchanged, so a second run
appended duplicate PyEntrypoint records onto the reused nodes.

_run_stages now opens with a single full-app clear before Stage 0
detection, rather than clearing per-node during the walk -- an inline
clear would erase entrypoints_from_bases records that are written onto
a method before _walk_module visits that method directly.

Adds a unit test that runs the pass twice over the same PyApplication
and asserts the record list is unchanged, and fixes an existing test
that relied on hand-seeding entrypoints (no longer valid once the pass
owns and clears the list on every run).

Author: rahlk

codeanalyzer/entrypoints/pipeline.py

@@ -44,7 +44,19 @@ def _run_stages(app: PyApplication, project_dir: Path, rules: RuleSet) -> None:
     base like ``APIView`` only resolves via that module's own
     ``from rest_framework.views import APIView``), so this walks module by
     module rather than the whole app flat, building one resolver per module.
+
+    Clears every node's ``entrypoints`` first: on a warm cache,
+    ``_build_symbol_table`` reuses the SAME cached ``PyModule``/``PyCallable``
+    objects when a file is unchanged, so without this clear a second run
+    would ``extend`` onto records already written by the first run and
+    duplicate them. A single full clear up front (rather than clearing each
+    node as it's visited) avoids wiping ``entrypoints_from_bases`` records
+    that ``_walk_module`` writes onto a method before visiting that method
+    directly.
     """
+    for node in _walk(app):
+        node.entrypoints = []
+
     app.entrypoint_report.rulesets = list(rules.rulesets)
     frameworks = detected_frameworks(app, project_dir, rules)
     app.entrypoint_report.frameworks_detected = sorted(frameworks)

test/test_entrypoint_pipeline.py

@@ -27,15 +27,22 @@ def boom(*a, **k):
 
 
 def test_derives_is_entrypoint_from_the_list(tmp_path: Path):
-    from codeanalyzer.schema.py_schema import PyCallable, PyEntrypoint, PyModule
+    """`entrypoints` is written entirely by the pass itself (it clears and
+    rebuilds the list every run, see the duplication regression test below)
+    -- so drive this through a real decorator match rather than hand-seeding
+    the list, and check `_derive_flags` sets the boolean from the result."""
+    from codeanalyzer.schema.py_schema import PyCallable, PyDecorator, PyImport, PyModule
 
     fn = PyCallable(name="f", path="a.py", signature="a.f")
-    fn.entrypoints.append(
-        PyEntrypoint(framework="flask", confidence="certain", rule="flask.route", ruleset="shipped")
-    )
+    fn.decorators.append(PyDecorator(name="route", qualified_name="flask.Flask.route"))
     app = PyApplication(
         symbol_table={
-            "a.py": PyModule(file_path="a.py", module_name="a", functions={"f": fn})
+            "a.py": PyModule(
+                file_path="a.py",
+                module_name="a",
+                functions={"f": fn},
+                imports=[PyImport(module="flask", name="Flask")],
+            )
         }
     )
     detect_entrypoints(app, tmp_path)
@@ -156,3 +163,32 @@ def test_dotted_base_class_resolves_through_a_module_import(tmp_path: Path):
     )
     detect_entrypoints(app, tmp_path)
     assert cls.is_entrypoint is True
+
+
+def test_running_the_pass_twice_does_not_duplicate_entrypoints(tmp_path: Path):
+    """#27 regression: on a warm cache, `_build_symbol_table` reuses the SAME
+    cached PyModule/PyCallable objects across runs. `detect_entrypoints` must
+    be safe to call again on that same PyApplication without appending
+    duplicate PyEntrypoint records onto the reused nodes."""
+    from codeanalyzer.schema.py_schema import PyCallable, PyDecorator, PyImport, PyModule
+
+    fn = PyCallable(name="f", path="a.py", signature="a.f")
+    fn.decorators.append(PyDecorator(name="route", qualified_name="flask.Flask.route"))
+    app = PyApplication(
+        symbol_table={
+            "a.py": PyModule(
+                file_path="a.py",
+                module_name="a",
+                functions={"f": fn},
+                imports=[PyImport(module="flask", name="Flask")],
+            )
+        }
+    )
+
+    detect_entrypoints(app, tmp_path)
+    first = [e.model_dump() for e in fn.entrypoints]
+    assert len(first) == 1
+
+    detect_entrypoints(app, tmp_path)
+    second = [e.model_dump() for e in fn.entrypoints]
+    assert second == first