fix(python): align UV provider with JS client behavior

- Skip self-referencing editable installs (root project as its own dep)
- Require both name and version for editable installs (skip if missing)
- Fall back to tool.poetry.name/version for editable install metadata
- Validate bare package names in # via comments (skip version specifiers/extras)
- Throw on unpinned versions in uv export output
- Prevent workspace root walk-up from escaping into parent workspace

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

src/main/java/io/github/guacsec/trustifyda/providers/PythonProviderFactory.java

@@ -87,6 +87,12 @@ static Path findLockFileDirInParents(Path startDir) {
       return null;
     }
 
+    // If startDir itself is a workspace root, don't walk up to avoid escaping into a parent
+    // workspace
+    if (PyprojectTomlUtils.isUvWorkspaceRoot(startDir)) {
+      return null;
+    }
+
     String gitRoot = Operations.getGitRootDir(startDir.toString()).orElse(null);
     Path boundary = gitRoot != null ? Path.of(gitRoot) : startDir.toAbsolutePath().getRoot();
 

src/main/java/io/github/guacsec/trustifyda/providers/PythonUvProvider.java

@@ -27,6 +27,7 @@
 import io.github.guacsec.trustifyda.utils.PyprojectTomlUtils;
 import io.github.guacsec.trustifyda.utils.PythonControllerBase;
 import java.io.IOException;
+import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -37,6 +38,7 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.logging.Logger;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import org.tomlj.TomlParseResult;
 
@@ -181,16 +183,19 @@ UvDependencyData parseUvExport(String exportOutput) throws IOException {
         continue;
       }
 
-      // Skip editable installs (workspace members)
+      // Editable installs are workspace members — resolve name/version from their pyproject.toml
       if (line.startsWith("-e ")) {
-        currentKey = null;
         inViaBlock = false;
+        currentKey = parseEditableInstall(line, packages, projectName);
         continue;
       }
 
       // Package line: name==version [; env-marker]
-      if (!line.startsWith(" ") && trimmed.contains("==")) {
+      if (!line.startsWith(" ") && !trimmed.startsWith("#")) {
         inViaBlock = false;
+        if (!trimmed.contains("==")) {
+          throw new IOException("uv export: package '" + trimmed + "' has no pinned version");
+        }
         String spec = trimmed.split(";")[0].trim();
         String[] parts = spec.split("==", 2);
         String name = parts[0].split("\\[")[0].trim(); // strip extras like [bar]
@@ -230,12 +235,66 @@ UvDependencyData parseUvExport(String exportOutput) throws IOException {
     return new UvDependencyData(directDeps, packages);
   }
 
+  /**
+   * Parses an editable install line ({@code -e file:///path/to/member}) by reading the member's
+   * {@code pyproject.toml} to extract name and version. Skips the root project itself and packages
+   * missing either name or version, matching the JS client behavior.
+   *
+   * @return the canonicalized package key, or {@code null} if the member could not be resolved
+   */
+  private static String parseEditableInstall(
+      String line, Map<String, UvPackage> packages, String projectName) {
+    String uri = line.substring("-e ".length()).trim();
+    try {
+      Path memberDir = Path.of(URI.create(uri));
+      Path memberToml = memberDir.resolve("pyproject.toml");
+      if (!Files.isRegularFile(memberToml)) {
+        log.fine("Editable install pyproject.toml not found: " + memberToml);
+        return null;
+      }
+      TomlParseResult toml = PyprojectTomlUtils.parseToml(memberToml);
+      String name = PyprojectTomlUtils.getProjectName(toml);
+      if (name == null) {
+        // Fall back to Poetry name
+        name = PyprojectTomlUtils.getPoetryProjectName(toml);
+      }
+      if (name == null) {
+        log.fine("Editable install has no project.name: " + memberToml);
+        return null;
+      }
+      String version = PyprojectTomlUtils.getProjectVersion(toml);
+      if (version == null) {
+        // Fall back to Poetry version
+        version = PyprojectTomlUtils.getPoetryProjectVersion(toml);
+      }
+      if (version == null) {
+        log.fine("Editable install has no project.version: " + memberToml);
+        return null;
+      }
+      String key = PyprojectTomlUtils.canonicalize(name);
+      // Skip the root project itself
+      if (key.equals(projectName)) {
+        return null;
+      }
+      packages.put(key, new UvPackage(name, version, new ArrayList<>()));
+      return key;
+    } catch (Exception e) {
+      log.fine("Failed to resolve editable install '" + uri + "': " + e.getMessage());
+      return null;
+    }
+  }
+
+  private static final Pattern BARE_PACKAGE_NAME = Pattern.compile("[A-Za-z0-9][A-Za-z0-9._-]*");
+
   private static void recordViaParent(
       String parentName,
       String childKey,
       String projectName,
       List<String> directDeps,
       List<String[]> parentChildPairs) {
+    if (!BARE_PACKAGE_NAME.matcher(parentName).matches()) {
+      return;
+    }
     String parentKey = PyprojectTomlUtils.canonicalize(parentName);
     if (parentKey.equals(projectName)) {
       if (!directDeps.contains(childKey)) {

src/main/java/io/github/guacsec/trustifyda/utils/PyprojectTomlUtils.java

@@ -105,6 +105,18 @@ public static boolean hasPoetryDependencies(TomlParseResult toml) {
     return toml.getTable("tool.poetry.dependencies") != null;
   }
 
+  /** Reads {@code tool.poetry.name} from a parsed pyproject.toml, or {@code null} if absent. */
+  public static String getPoetryProjectName(TomlParseResult toml) {
+    String name = toml.getString("tool.poetry.name");
+    return (name != null && !name.isBlank()) ? name : null;
+  }
+
+  /** Reads {@code tool.poetry.version} from a parsed pyproject.toml, or {@code null} if absent. */
+  public static String getPoetryProjectVersion(TomlParseResult toml) {
+    String version = toml.getString("tool.poetry.version");
+    return (version != null && !version.isBlank()) ? version : null;
+  }
+
   /**
    * Canonicalizes a Python package name by lower-casing it and collapsing runs of hyphens,
    * underscores, and dots into a single hyphen, per PEP 503.

src/test/java/io/github/guacsec/trustifyda/providers/PythonProviderFactoryLockFileTest.java

@@ -116,6 +116,29 @@ void testStopsAtUvWorkspaceRootBoundary(@TempDir Path tempDir) throws IOExceptio
     assertThat(provider).isInstanceOf(PythonPyprojectProvider.class);
   }
 
+  /** When manifestDir itself is a workspace root without uv.lock, don't walk up to parent. */
+  @Test
+  void testStartDirIsWorkspaceRootDoesNotWalkUp(@TempDir Path tempDir) throws IOException {
+    // Parent has uv.lock (unrelated workspace)
+    Files.writeString(tempDir.resolve("uv.lock"), "version = 1");
+    Files.writeString(
+        tempDir.resolve("pyproject.toml"),
+        "[project]\nname = \"parent-ws\"\nversion = \"1.0.0\"\n\n"
+            + "[tool.uv.workspace]\nmembers = [\"child-ws\"]\n");
+
+    // Child is itself a workspace root, but has no uv.lock
+    Path childWs = tempDir.resolve("child-ws");
+    Files.createDirectories(childWs);
+    Files.writeString(
+        childWs.resolve("pyproject.toml"),
+        "[project]\nname = \"child-ws\"\nversion = \"1.0.0\"\n\n"
+            + "[tool.uv.workspace]\nmembers = [\"packages/*\"]\n");
+
+    // Should NOT pick up the parent's uv.lock — should fall back to pip
+    var provider = PythonProviderFactory.create(childWs.resolve("pyproject.toml"));
+    assertThat(provider).isInstanceOf(PythonPyprojectProvider.class);
+  }
+
   /** validateLockFile passes for workspace member when uv.lock is in parent directory. */
   @Test
   void testValidateLockFilePassesWithLockInParent(@TempDir Path tempDir) throws IOException {

src/test/java/io/github/guacsec/trustifyda/providers/Python_Uv_Provider_Test.java

@@ -18,6 +18,7 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalStateException;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 import io.github.guacsec.trustifyda.Api;
 import io.github.guacsec.trustifyda.ExhortTest;
@@ -28,6 +29,7 @@
 import java.nio.file.Path;
 import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 class Python_Uv_Provider_Test extends ExhortTest {
 
@@ -238,6 +240,171 @@ void test_ignored_dependencies_in_uv_project() throws IOException {
     }
   }
 
+  @Test
+  void test_parseUvExport_includes_editable_installs(@TempDir Path tempDir) throws IOException {
+    // Create a workspace member with its own pyproject.toml
+    Path memberDir = tempDir.resolve("packages").resolve("my-lib");
+    Files.createDirectories(memberDir);
+    Files.writeString(
+        memberDir.resolve("pyproject.toml"),
+        "[project]\nname = \"my-lib\"\nversion = \"2.0.0\"\ndependencies = []\n");
+
+    Path pyprojectPath = Path.of(UV_FIXTURE, "pyproject.toml");
+    var provider = new PythonUvProvider(pyprojectPath);
+
+    // Simulate uv export output with an editable install
+    String exportOutput =
+        "# This file was autogenerated by uv\n"
+            + "-e file://"
+            + memberDir.toUri().getPath()
+            + "\n"
+            + "    # via test-project\n"
+            + "anyio==3.6.2\n"
+            + "    # via my-lib\n";
+
+    var data = provider.parseUvExport(exportOutput);
+
+    // The editable install should be in the graph with name/version from pyproject.toml
+    assertThat(data.graph()).containsKey("my-lib");
+    assertThat(data.graph().get("my-lib").name()).isEqualTo("my-lib");
+    assertThat(data.graph().get("my-lib").version()).isEqualTo("2.0.0");
+
+    // It should be identified as a direct dependency (via test-project)
+    assertThat(data.directDeps()).contains("my-lib");
+
+    // anyio should be a child of my-lib
+    assertThat(data.graph().get("my-lib").children()).contains("anyio");
+  }
+
+  @Test
+  void test_parseUvExport_editable_skips_self_reference(@TempDir Path tempDir) throws IOException {
+    // Create a member whose name matches the root project (test-project)
+    Path memberDir = tempDir.resolve("packages").resolve("self");
+    Files.createDirectories(memberDir);
+    Files.writeString(
+        memberDir.resolve("pyproject.toml"),
+        "[project]\nname = \"test-project\"\nversion = \"0.1.0\"\ndependencies = []\n");
+
+    Path pyprojectPath = Path.of(UV_FIXTURE, "pyproject.toml");
+    var provider = new PythonUvProvider(pyprojectPath);
+
+    String exportOutput =
+        "# This file was autogenerated by uv\n"
+            + "-e file://"
+            + memberDir.toUri().getPath()
+            + "\n"
+            + "anyio==3.6.2\n"
+            + "    # via test-project\n";
+
+    var data = provider.parseUvExport(exportOutput);
+
+    // The root project should NOT appear in the graph as its own dependency
+    assertThat(data.graph()).doesNotContainKey("test-project");
+    // anyio should still be a direct dep
+    assertThat(data.directDeps()).contains("anyio");
+  }
+
+  @Test
+  void test_parseUvExport_editable_skips_missing_version(@TempDir Path tempDir) throws IOException {
+    // Create a member with no version
+    Path memberDir = tempDir.resolve("packages").resolve("no-version");
+    Files.createDirectories(memberDir);
+    Files.writeString(
+        memberDir.resolve("pyproject.toml"),
+        "[project]\nname = \"no-version-lib\"\ndependencies = []\n");
+
+    Path pyprojectPath = Path.of(UV_FIXTURE, "pyproject.toml");
+    var provider = new PythonUvProvider(pyprojectPath);
+
+    String exportOutput =
+        "# This file was autogenerated by uv\n"
+            + "-e file://"
+            + memberDir.toUri().getPath()
+            + "\n"
+            + "    # via test-project\n"
+            + "anyio==3.6.2\n"
+            + "    # via test-project\n";
+
+    var data = provider.parseUvExport(exportOutput);
+
+    // Package with no version should be skipped
+    assertThat(data.graph()).doesNotContainKey("no-version-lib");
+    // anyio should still be parsed
+    assertThat(data.graph()).containsKey("anyio");
+  }
+
+  @Test
+  void test_parseUvExport_editable_falls_back_to_poetry_name(@TempDir Path tempDir)
+      throws IOException {
+    // Create a member with Poetry-style name/version only
+    Path memberDir = tempDir.resolve("packages").resolve("poetry-lib");
+    Files.createDirectories(memberDir);
+    Files.writeString(
+        memberDir.resolve("pyproject.toml"),
+        "[tool.poetry]\nname = \"poetry-lib\"\nversion = \"1.5.0\"\n");
+
+    Path pyprojectPath = Path.of(UV_FIXTURE, "pyproject.toml");
+    var provider = new PythonUvProvider(pyprojectPath);
+
+    String exportOutput =
+        "# This file was autogenerated by uv\n"
+            + "-e file://"
+            + memberDir.toUri().getPath()
+            + "\n"
+            + "    # via test-project\n"
+            + "anyio==3.6.2\n"
+            + "    # via poetry-lib\n";
+
+    var data = provider.parseUvExport(exportOutput);
+
+    // Poetry name/version should be used as fallback
+    assertThat(data.graph()).containsKey("poetry-lib");
+    assertThat(data.graph().get("poetry-lib").name()).isEqualTo("poetry-lib");
+    assertThat(data.graph().get("poetry-lib").version()).isEqualTo("1.5.0");
+
+    // It should be a direct dep and anyio should be its child
+    assertThat(data.directDeps()).contains("poetry-lib");
+    assertThat(data.graph().get("poetry-lib").children()).contains("anyio");
+  }
+
+  @Test
+  void test_parseUvExport_via_skips_non_bare_package_names() throws IOException {
+    Path pyprojectPath = Path.of(UV_FIXTURE, "pyproject.toml");
+    var provider = new PythonUvProvider(pyprojectPath);
+
+    String exportOutput =
+        "# This file was autogenerated by uv\n"
+            + "anyio==3.6.2\n"
+            + "    # via test-project\n"
+            + "idna==3.4\n"
+            + "    # via foo (>=1.0)\n"
+            + "sniffio==1.3.0\n"
+            + "    # via foo[extra]\n";
+
+    var data = provider.parseUvExport(exportOutput);
+
+    // anyio is direct (via test-project)
+    assertThat(data.directDeps()).contains("anyio");
+    // idna and sniffio should be in the graph but with no parent edges
+    assertThat(data.graph()).containsKey("idna");
+    assertThat(data.graph()).containsKey("sniffio");
+    // No package should have children since the via names were invalid
+    assertThat(data.graph().values().stream().allMatch(p -> p.children().isEmpty())).isTrue();
+  }
+
+  @Test
+  void test_parseUvExport_throws_on_unpinned_version() {
+    Path pyprojectPath = Path.of(UV_FIXTURE, "pyproject.toml");
+    var provider = new PythonUvProvider(pyprojectPath);
+
+    String exportOutput =
+        "# This file was autogenerated by uv\n" + "anyio>=3.6.2\n" + "    # via test-project\n";
+
+    assertThatThrownBy(() -> provider.parseUvExport(exportOutput))
+        .isInstanceOf(IOException.class)
+        .hasMessageContaining("has no pinned version");
+  }
+
   @Test
   void test_canonicalize() {
     assertThat(PyprojectTomlUtils.canonicalize("charset_normalizer"))