fix(python): extract helper methods for direct ref and path detection, add ~/Windows path support

Address code review feedback:
- Extract isDirectReference() and isPathDependency() helper methods for
  clearer naming and a single place to extend edge case handling
- Add ~/home-relative and Windows drive path (C:\) detection
- Add test for # via graph corruption after skipped path dependencies

Implements TC-4538

Signed-off-by: Adva Oren <aoren@redhat.com>
Assisted-by: Claude Code

Author: a-oren

src/main/java/io/github/guacsec/trustifyda/providers/PythonUvProvider.java

@@ -195,14 +195,14 @@ UvDependencyData parseUvExport(String exportOutput) throws IOException {
         inViaBlock = false;
 
         // PEP 440 direct references (name @ url) — skip, no pinned version available
-        if (trimmed.contains(" @ ")) {
+        if (isDirectReference(trimmed)) {
           log.fine("Skipping PEP 440 direct reference: " + trimmed);
           currentKey = null;
           continue;
         }
 
-        // Path dependencies (./local, ../local, /absolute) — skip, no pinned version available
-        if (trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("/")) {
+        // Path dependencies (./local, ../local, /absolute, ~/home, C:\win) — skip
+        if (isPathDependency(trimmed)) {
           log.fine("Skipping path dependency: " + trimmed);
           currentKey = null;
           continue;
@@ -299,6 +299,22 @@ private static String parseEditableInstall(
     }
   }
 
+  private static final Pattern WINDOWS_DRIVE_PATH = Pattern.compile("^[a-zA-Z]:[/\\\\]");
+
+  /** Returns {@code true} if the line is a PEP 440 direct reference ({@code name @ url}). */
+  static boolean isDirectReference(String trimmedLine) {
+    return trimmedLine.contains(" @ ");
+  }
+
+  /** Returns {@code true} if the line is a local or absolute path dependency. */
+  static boolean isPathDependency(String trimmedLine) {
+    return trimmedLine.startsWith("./")
+        || trimmedLine.startsWith("../")
+        || trimmedLine.startsWith("/")
+        || trimmedLine.startsWith("~/")
+        || WINDOWS_DRIVE_PATH.matcher(trimmedLine).find();
+  }
+
   private static final Pattern BARE_PACKAGE_NAME = Pattern.compile("[A-Za-z0-9][A-Za-z0-9._-]*");
 
   private static void recordViaParent(

src/test/java/io/github/guacsec/trustifyda/providers/Python_Uv_Provider_Test.java

@@ -430,24 +430,59 @@ void test_parseUvExport_skips_path_dependencies() throws IOException {
             + "    # via test-project\n"
             + "/absolute/path/package\n"
             + "    # via test-project\n"
+            + "~/home-relative/package\n"
+            + "    # via test-project\n"
+            + "C:\\Users\\dev\\my-package\n"
+            + "    # via test-project\n"
             + "anyio==3.6.2\n"
             + "    # via test-project\n";
 
     // Given/When
     var data = provider.parseUvExport(exportOutput);
 
-    // Then — path dependencies are skipped
+    // Then — all path dependency forms are skipped
     assertThat(data.graph()).doesNotContainKey("./local-package");
     assertThat(data.graph()).doesNotContainKey("../sibling-package");
     assertThat(data.graph()).doesNotContainKey("/absolute/path/package");
+    assertThat(data.graph()).doesNotContainKey("~/home-relative/package");
+    assertThat(data.graph()).doesNotContainKey("c:\\users\\dev\\my-package");
     // anyio is still parsed correctly
     assertThat(data.graph()).containsKey("anyio");
     assertThat(data.directDeps()).contains("anyio");
   }
 
   /**
-   * Verifies that # via comments after skipped packages do not create incorrect parent-child
-   * relationships with the previous package.
+   * Verifies that # via comments after a skipped path dependency do not corrupt the graph by
+   * attaching to the previous package.
+   */
+  @Test
+  void test_parseUvExport_via_after_skipped_path_dep_does_not_corrupt_graph() throws IOException {
+    Path pyprojectPath = Path.of(UV_FIXTURE, "pyproject.toml");
+    var provider = new PythonUvProvider(pyprojectPath);
+
+    // Given — anyio is parsed first, then a path dependency is skipped. The "# via requests"
+    // after the skipped path dep should NOT make anyio a child of requests.
+    String exportOutput =
+        "# This file was autogenerated by uv\n"
+            + "anyio==3.6.2\n"
+            + "    # via test-project\n"
+            + "./local-package\n"
+            + "    # via requests\n"
+            + "requests==2.25.1\n"
+            + "    # via test-project\n";
+
+    // When
+    var data = provider.parseUvExport(exportOutput);
+
+    // Then — requests should NOT have anyio as a child (that would be a corruption)
+    assertThat(data.graph().get("requests").children()).doesNotContain("anyio");
+    // Both anyio and requests are direct deps
+    assertThat(data.directDeps()).containsExactlyInAnyOrder("anyio", "requests");
+  }
+
+  /**
+   * Verifies that # via comments after skipped direct references do not create incorrect
+   * parent-child relationships with the previous package.
    */
   @Test
   void test_parseUvExport_via_after_skipped_does_not_corrupt_graph() throws IOException {