From 75268cbddc088c88e40fe1df07424589d8ccbbc0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 21 Oct 2026 15:39:06 +0000
Subject: [PATCH] Split the tests into unit and integration, and add tests for
 what had none

tests/test_code_node.py (1,341 lines, 55 tests) is now one file per part:
tests/unit/ (project, reader, graph, platforms, libraries, deploys, report,
picker, history) and tests/integration/ (cli, serve, examples), with what
they share in tests/support.py. conftest.py marks each test by its folder,
so `pytest -m unit` and `-m integration` run one kind (make test-unit,
make test-integration, and the same in makefile.py).

New tests (24):
- imports inside a function: followed, startup=False, scoped to that
  function; optional imports, relative and star imports
- partial maps instead of tracebacks: a bad entry, a file that doesn't
  parse, a reader that raises
- entry_file, entries_in_file, functions_matching, project_root
- the deploy helpers: allowed, statement_actions, resolve_handler,
  load_yaml with CloudFormation tags, line_of
- the code read is never run, through main() and python -m code_node
- the command as its own process: -o, the cache folder, --help, bad args
- --list, a missing folder, an entry point that matches no file
- every entry point of each example read to the end; each example's page
  balanced HTML with nothing fetched from elsewhere; the CI smoke lines
- --serve's /events stream over a real connection, through a broken edit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0135RUJGyhafwLiULmpTn7G4
---
 .claude/commands/map.md            |    2 +-
 CLAUDE.md                          |   18 +-
 Makefile                           |   10 +-
 makefile.py                        |   15 +
 pyproject.toml                     |    6 +
 tests/conftest.py                  |   18 +
 tests/integration/test_cli.py      |  215 +++++
 tests/integration/test_examples.py |  160 ++++
 tests/integration/test_serve.py    |  117 +++
 tests/support.py                   |  115 +++
 tests/test_code_node.py            | 1341 ----------------------------
 tests/unit/test_deploys.py         |  192 ++++
 tests/unit/test_graph.py           |  149 ++++
 tests/unit/test_history.py         |   69 ++
 tests/unit/test_libraries.py       |   79 ++
 tests/unit/test_picker.py          |   56 ++
 tests/unit/test_platforms.py       |  218 +++++
 tests/unit/test_project.py         |  112 +++
 tests/unit/test_reader.py          |  243 +++++
 tests/unit/test_report.py          |  158 ++++
 20 files changed, 1944 insertions(+), 1349 deletions(-)
 create mode 100644 tests/conftest.py
 create mode 100644 tests/integration/test_cli.py
 create mode 100644 tests/integration/test_examples.py
 create mode 100644 tests/integration/test_serve.py
 create mode 100644 tests/support.py
 delete mode 100644 tests/test_code_node.py
 create mode 100644 tests/unit/test_deploys.py
 create mode 100644 tests/unit/test_graph.py
 create mode 100644 tests/unit/test_history.py
 create mode 100644 tests/unit/test_libraries.py
 create mode 100644 tests/unit/test_picker.py
 create mode 100644 tests/unit/test_platforms.py
 create mode 100644 tests/unit/test_project.py
 create mode 100644 tests/unit/test_reader.py
 create mode 100644 tests/unit/test_report.py

diff --git a/.claude/commands/map.md b/.claude/commands/map.md
index 828c143..3f1e3a3 100644
--- a/.claude/commands/map.md
+++ b/.claude/commands/map.md
@@ -15,4 +15,4 @@ Then review the result against the code:
    dispatch it can't follow, the depth limit. List what it **got wrong**, if anything.
 3. For each miss that's a pattern many codebases use (a framework's decorators, dependency injection, a dispatch
    dict), propose where in `src/code_node/analysis/reader.py` (or `project.py` for entry points) it would be
-   followed, with a test for `tests/test_code_node.py`. Don't change code unless asked.
+   followed, with a test for `tests/unit/test_reader.py` (or `tests/unit/test_project.py`). Don't change code unless asked.
diff --git a/CLAUDE.md b/CLAUDE.md
index 16474cf..418aacc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -17,7 +17,7 @@ command is `code-node` and the import is `code_node`.
 
 ```bash
 uv sync                                                   # .venv with every dependency group
-uv run pytest                                             # tests
+uv run pytest                                             # tests (-m unit, -m integration for one kind)
 uv run ruff check .                                       # lint
 uv run ruff format .                                      # format (examples/ and docs/ are left as they are)
 uv run code-node examples/orders-service --no-open -o /tmp/page.html   # try it
@@ -124,10 +124,18 @@ rendering and I/O (it uses `platforms/`, which is pure too) so another front end
 
 ## Tests
 
-`tests/test_code_node.py` writes small projects into `tmp_path` and checks entry point discovery, the map (functions,
-AWS calls, imports), the graph's limits, plain Python against `platform="lambda"`, a plugin platform, and the
-command end to end (`main([...])` with `--no-open -o`). Add a test
-there for each new kind of entry point or anything new the reader follows.
+Small projects written into `tmp_path` (or passed to `map_code` as a dict), checked by what the map, graph and page
+say. `tests/support.py` has what they share: `write(root, files)` and the small projects (`HANDLER`, `PACKAGE`,
+`STORES`...). `pytest -m unit` or `-m integration` runs one kind (`make test-unit`, `make test-integration`); the
+folder marks them, in `tests/conftest.py`.
+
+| Path | What it checks |
+|---|---|
+| `tests/unit/` | One part on its own, in memory: `test_project.py` (files, module names, import paths, entry points), `test_reader.py` (what the reader follows and what names hold, imports inside functions, partial maps), `test_graph.py`, `test_platforms.py` (Lambda, FastAPI, Flask, Django, a plugin platform), `test_libraries.py`, `test_deploys.py` (SAM, serverless.yml, the IAM and YAML helpers), `test_report.py` (boxes, code panels, the walk, logos, editor links), `test_picker.py`, `test_history.py` |
+| `tests/integration/` | End to end, with real files, processes and HTTP: `test_cli.py` (`main([...])` with `--no-open -o`, and `python -m code_node` as its own process; that the code read is never run, and broken code still gives a page), `test_serve.py` (the live page and its `/events` stream), `test_examples.py` (each example against `tests/snapshots/`, every entry point read to the end, each page whole and self-contained) |
+
+Add a unit test for each new kind of entry point or anything new the reader follows, in the file for that part. A
+new example gets a line in `SMOKE` in `test_examples.py`. `UPDATE_SNAPSHOTS=1 uv run pytest` rewrites the snapshots.
 
 ## Releasing
 
diff --git a/Makefile b/Makefile
index 58240a5..5124a15 100644
--- a/Makefile
+++ b/Makefile
@@ -8,14 +8,14 @@ OUT    ?= /tmp/code-node-page.html
 PORT   ?= 8765
 
 .DEFAULT_GOAL := help
-.PHONY: help install test lint fix try serve mermaid shots site-graph logos figures docs docs-serve package check \
+.PHONY: help install test test-unit test-integration lint fix try serve mermaid shots site-graph logos figures docs docs-serve package check \
 	tool clean
 
 help:  # list the targets, by group
 	@printf "\033[1mcode-node\033[0m  make <target>\n"
 	@awk 'BEGIN {FS = ":.*## "} \
 		/^##@ / {printf "\n\033[1;35m%s\033[0m\n", substr($$0, 5); next} \
-		/^[a-z-]+:.*## / {printf "  \033[1;36m%-13s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+		/^[a-z-]+:.*## / {printf "  \033[1;36m%-17s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
 	@echo ""
 	@echo "  REPO=<folder> picks the code for try, serve and mermaid (default $(REPO))"
 
@@ -44,6 +44,12 @@ fix: ## ruff check --fix and ruff format
 test: ## run the tests
 	$(RUN) pytest -q
 
+test-unit: ## run the unit tests (tests/unit/): each part on its own, in memory
+	$(RUN) pytest -q -m unit
+
+test-integration: ## run the integration tests (tests/integration/): the command, the server and the examples
+	$(RUN) pytest -q -m integration
+
 check: lint test try docs package ## everything CI runs
 
 ##@ Run
diff --git a/makefile.py b/makefile.py
index 47798d9..4027714 100644
--- a/makefile.py
+++ b/makefile.py
@@ -203,6 +203,21 @@ def test(options: Options) -> None:
     python("-m", "pytest", "-q")
 
 
+@task("test-unit", "🧩", "run the unit tests (tests/unit/): each part on its own, in memory", "Check")
+def test_unit(options: Options) -> None:
+    python("-m", "pytest", "-q", "-m", "unit")
+
+
+@task(
+    "test-integration",
+    "🔗",
+    "run the integration tests (tests/integration/): the command, the server and the examples",
+    "Check",
+)
+def test_integration(options: Options) -> None:
+    python("-m", "pytest", "-q", "-m", "integration")
+
+
 TASKS["check"] = Task(
     "check",
     "✅",
diff --git a/pyproject.toml b/pyproject.toml
index 8cc025f..f53c51e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -76,3 +76,9 @@ include = ["src/code_node", "tests", "README.md", "CHANGELOG.md", "LICENSE"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
+pythonpath = ["tests"]  # for tests/support.py
+addopts = ["--strict-markers"]
+markers = [
+    "unit: one part on its own, in memory (tests/unit/)",
+    "integration: the command, the server or an example end to end, with real files, processes or HTTP (tests/integration/)",
+]
diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..d3f7b77
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,18 @@
+"""
+Marks each test by its folder, so `pytest -m unit` and `pytest -m integration` run one kind.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+HERE = Path(__file__).parent
+
+
+def pytest_collection_modifyitems(items: list[pytest.Item]) -> None:
+    for item in items:
+        kind = item.path.relative_to(HERE).parts[0] if item.path.is_relative_to(HERE) else ""
+        if kind in ("unit", "integration"):
+            item.add_marker(kind)
diff --git a/tests/integration/test_cli.py b/tests/integration/test_cli.py
new file mode 100644
index 0000000..35fe00f
--- /dev/null
+++ b/tests/integration/test_cli.py
@@ -0,0 +1,215 @@
+"""
+The command end to end, through main(): what it prints and the page it saves.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from code_node.analysis.mapping import map_code
+from code_node.cli import main
+from code_node.project import read_project
+
+from support import EXAMPLES, FAN, HANDLER, IMPORTED_FROM_SRC, PACKAGE, write
+
+
+def test_the_page_opens_a_box_s_calls_with_javascript_and_works_without(tmp_path: Path) -> None:
+    write(tmp_path / "code", {"app.py": FAN})
+    out = tmp_path / "page.html"
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out), "--functions", "4"]) == 0
+    page = out.read_text()
+    # each graph a box's calls open is a template the script swaps in, with the path down to it
+    assert '<div class="cgw" data-group="cn-graph0">' in page and page.count("<script>") == 1
+    assert '<template id="cn-graph0-v1">' in page and '<a class="dr" href="#cn-graph0-v' in page
+    assert '<a class="cgcb" href="#cn-graph0-main">← The whole graph</a>' in page
+    assert '<template id="cn-graph0-all">' in page and '<a class="cgta oj" href="#cn-graph0-all"' in page
+    # without JavaScript the links are hidden and the legend says where the rest are, as before
+    assert 'class="kp kh nj"' in page and "the Step by step tab has them all" in page
+    assert ".cnd .cgw:not(.js) :is(.oj,.dr),.cnd .cgw.js .nj{display:none}" in page
+    # a function drawn in several graphs has one panel of code
+    panels = re.findall(r'<aside class="cside" id="([^"]+)"', page)
+    assert len(panels) == len(set(panels)) and len(panels) < 2 * len(re.findall(r'<a class="cl" href="#cn-code-', page))
+    step = re.search(r'<aside class="cside" id="([^"]+)" aria-label="The code of step3\(\)"', page)
+    assert step is not None and page.count(f'href="#{step.group(1)}"') > 1
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out), "--all"]) == 0
+    assert '<div class="cgw">' in out.read_text() and "<template id=" not in out.read_text()  # nothing left out
+
+
+def test_the_command_saves_a_page(tmp_path: Path, capsys) -> None:
+    write(tmp_path / "code", {"app.py": HANDLER})
+    out = tmp_path / "page.html"
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
+    page = out.read_text()
+    assert "How app.lambda_handler works" in page and "<svg" in page
+    # the page is its tabs, the entry point beside them, with no cards or findings
+    assert '<div class="cnd"><div class="tabs">' in page and "<code>app.lambda_handler</code>" in page
+    assert all(f">{tab}<small>" in page for tab in ("Graph", "Step by step"))
+    assert (
+        'class="cards"' not in page
+        and 'class="fd"' not in page
+        and ">Findings<" not in page
+        and 'class="t"' not in page
+    )
+    assert main([str(tmp_path / "code"), "--mermaid"]) == 0
+    assert "flowchart LR" in capsys.readouterr().out
+
+
+def test_starting_from_a_file(tmp_path: Path, capsys) -> None:
+    root = write(tmp_path / "repo", {**PACKAGE, ".git/HEAD": "ref: main\n"})
+    out = tmp_path / "page.html"
+    assert main([str(root / "src/tool/cli.py"), "--no-open", "-o", str(out)]) == 0
+    assert "tool.cli.main: 3 functions" in capsys.readouterr().out
+    assert main([f"{root / 'src/tool/store.py'}:Store.save", "--no-open", "-o", str(out)]) == 0
+    assert "tool.store.Store.save: 2 functions" in capsys.readouterr().out
+    assert main([str(root), "-e", str(root / "src/tool/store.py"), "--no-open", "-o", str(out)]) == 0
+    assert "tool.store.Store.save" in capsys.readouterr().out
+
+
+def test_the_command_lists_its_plugins(capsys) -> None:
+    assert main(["--plugins"]) == 0
+    out = capsys.readouterr().out
+    assert all(re.search(row, out) for row in (r"lambda +AWS Lambda", r"redis +Redis +redis", r"sam +AWS SAM"))
+
+
+@pytest.mark.parametrize(
+    ("name", "text"),
+    [
+        ("pyproject.toml", '[tool.pyright]\nextraPaths = ["src"]\n'),
+        ("pyproject.toml", '[tool.pytest.ini_options]\npythonpath = "src"\n'),
+        ("pyproject.toml", '[tool.mypy]\nmypy_path = "src"\n'),
+        ("pyproject.toml", '[tool.setuptools.packages.find]\nwhere = ["src"]\n'),
+        ("pyproject.toml", '[tool.setuptools.package-dir]\n"" = "src"\n'),
+        ("pyproject.toml", '[tool.poetry]\npackages = [{ include = "common", from = "src" }]\n'),
+        ("pyproject.toml", '[[tool.poetry.packages]]\ninclude = "common"\nfrom = "src"\n'),
+        ("pyrightconfig.json", '{"extraPaths": ["./src"]}'),
+        (".vscode/settings.json", '{\n  // Pylance\n  "python.analysis.extraPaths": ["${workspaceFolder}/src"],\n}\n'),
+    ],
+)
+def test_imports_from_a_folder_the_project_puts_on_the_path(tmp_path: Path, name: str, text: str, capsys) -> None:
+    root = write(tmp_path / "repo", {**IMPORTED_FROM_SRC, name: text, ".git/HEAD": "ref: main\n"})
+    project = read_project(root)
+    assert project.paths == ["src/"] and "common" not in project.libraries()
+    out = tmp_path / "page.html"
+    assert main([str(root / "src/handlers/orders/app.py:handler"), "--no-open", "-o", str(out)]) == 0
+    assert "app.handler: 2 functions, 1 AWS calls" in capsys.readouterr().out
+
+
+def test_imports_from_a_folder_given_with_path(tmp_path: Path, capsys) -> None:
+    root = write(tmp_path / "repo", {**IMPORTED_FROM_SRC, ".git/HEAD": "ref: main\n"})
+    out = tmp_path / "page.html"
+    file = str(root / "src/handlers/orders/app.py:handler")
+    assert main([file, "--no-open", "-o", str(out)]) == 0
+    assert "app.handler: 1 functions, 0 AWS calls" in capsys.readouterr().out  # common.db read as a library
+    assert main([file, "--path", str(root / "src"), "--no-open", "-o", str(out)]) == 0
+    assert "app.handler: 2 functions, 1 AWS calls" in capsys.readouterr().out
+    assert main([file, "--path", str(tmp_path), "--no-open", "-o", str(out)]) == 2
+    assert "isn't a folder in" in capsys.readouterr().err
+    cmap = map_code(
+        {path: text for path, text in IMPORTED_FROM_SRC.items()},
+        "app.handler",
+        file="src/handlers/orders/app.py",
+        paths=["src/"],
+    )
+    assert {f.name for f in cmap.functions} >= {"app.handler", "common.db.save"}
+
+
+def test_the_command_lists_entry_points_and_says_what_s_wrong(tmp_path: Path, capsys) -> None:
+    root = write(tmp_path / "code", {"app.py": HANDLER})
+    assert main([str(root), "--list"]) == 0
+    assert "app.lambda_handler" in capsys.readouterr().out
+    assert not list(root.glob("*.html"))  # --list stops before drawing
+    assert main([str(tmp_path / "missing"), "--no-open"]) == 2
+    assert "isn't a folder or a .py file" in capsys.readouterr().err
+    out = tmp_path / "page.html"
+    assert main([str(root), "-e", "nope.nothing", "--no-open", "-o", str(out)]) == 0  # said, and a page that says so
+    assert "No file matches the entry point nope.nothing" in capsys.readouterr().out and out.exists()
+
+
+# Each line would leave a file behind (or stop the process) if anything ran it
+RUNS_IF_IMPORTED = {
+    "app.py": (
+        "import os\nimport subprocess\nimport sys\n\nopen('ran-at-import', 'w').write('x')\n"
+        "os.system('touch ran-os-system')\n\n\ndef lambda_handler(event, context):\n"
+        "    open('ran-handler', 'w').write('x')\n    subprocess.run(['touch', 'ran-subprocess'])\n    helper.go()\n"
+        "    sys.exit(3)\n\n\nimport helper\n"
+    ),
+    "helper.py": "open('ran-helper', 'w').write('x')\n\n\ndef go():\n    raise SystemExit(4)\n",
+    "setup.py": "open('ran-setup', 'w').write('x')\n",
+    "conftest.py": "open('ran-conftest', 'w').write('x')\n",
+}
+
+
+def test_the_code_it_reads_is_never_run(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    root = write(tmp_path / "code", RUNS_IF_IMPORTED)
+    monkeypatch.chdir(root)  # where the code's relative paths would land
+    out = tmp_path / "page.html"
+    assert main([str(root), "--no-open", "-o", str(out)]) == 0
+    done = subprocess.run(
+        [sys.executable, "-m", "code_node", str(root), "--no-open", "-o", str(out)],
+        cwd=root,
+        capture_output=True,
+        text=True,
+        timeout=60,
+    )
+    assert done.returncode == 0, done.stderr
+    assert sorted(p.name for p in root.iterdir()) == sorted(RUNS_IF_IMPORTED)  # nothing it would have made
+    assert "app.helper" not in sys.modules and "helper" not in sys.modules
+    page = out.read_text()
+    assert "How app.lambda_handler works" in page and "go()" in page  # read, and followed into helper.py
+
+
+def test_code_that_doesn_t_parse_still_gives_a_page(tmp_path: Path, capsys) -> None:
+    root = write(
+        tmp_path / "code",
+        {
+            "app.py": HANDLER.replace("import requests", "import requests\nimport broken"),
+            "broken.py": "def oops(:\n",
+            "binary.py": "\x00\x01not python",
+        },
+    )
+    out = tmp_path / "page.html"
+    assert main([str(root), "--no-open", "-o", str(out)]) == 0
+    assert "Traceback" not in capsys.readouterr().err
+    assert "How app.lambda_handler works" in out.read_text()
+
+
+def test_the_command_runs_as_its_own_process(tmp_path: Path) -> None:
+    """
+    `python -m code_node` as a user runs it, in a process of its own: no state shared with the tests.
+    """
+    out = tmp_path / "page.html"
+    env = {**os.environ, "NO_COLOR": "1", "XDG_CACHE_HOME": str(tmp_path / "cache")}
+    done = subprocess.run(
+        [sys.executable, "-m", "code_node", str(EXAMPLES / "orders-service"), "--no-open", "-o", str(out)],
+        capture_output=True,
+        text=True,
+        env=env,
+        timeout=60,
+    )
+    assert done.returncode == 0, done.stderr
+    assert "orders.handler.lambda_handler" in done.stdout and "Saved" in done.stdout
+    assert (
+        out.read_text().startswith("<!doctype html>") and "How orders.handler.lambda_handler works" in out.read_text()
+    )
+    # without -o it saves to the cache folder
+    done = subprocess.run(
+        [sys.executable, "-m", "code_node", str(EXAMPLES / "orders-service"), "--no-open"],
+        capture_output=True,
+        text=True,
+        env=env,
+        timeout=60,
+    )
+    assert done.returncode == 0, done.stderr
+    assert [p.suffix for p in (tmp_path / "cache" / "code-node").iterdir()] == [".html"]
+    helped = subprocess.run([sys.executable, "-m", "code_node", "--help"], capture_output=True, text=True, timeout=60)
+    assert helped.returncode == 0 and "--serve" in helped.stdout
+    wrong = subprocess.run(
+        [sys.executable, "-m", "code_node", "--depth", "lots"], capture_output=True, text=True, timeout=60
+    )
+    assert wrong.returncode == 2 and "invalid int value" in wrong.stderr
diff --git a/tests/integration/test_examples.py b/tests/integration/test_examples.py
new file mode 100644
index 0000000..ebab5a3
--- /dev/null
+++ b/tests/integration/test_examples.py
@@ -0,0 +1,160 @@
+"""
+The examples in examples/, end to end: each page as text against tests/snapshots/ (so a change to what a page says
+shows as a readable diff), every entry point read to the end, and each page whole and self-contained.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from html.parser import HTMLParser
+from pathlib import Path
+
+import pytest
+
+from code_node.cli import main
+from code_node.project import entry_points, read_project
+
+from support import EXAMPLES, SNAPSHOTS
+
+
+SNAPSHOT = SNAPSHOTS / "orders-service.txt"
+
+
+def test_the_example_page_matches_its_snapshot(monkeypatch) -> None:
+    """
+    The example's page as text, against tests/snapshots/orders-service.txt, so a change to what the page says shows
+    as a readable diff. UPDATE_SNAPSHOTS=1 uv run pytest writes it anew.
+    """
+    from code_node.kit.render import _render_text
+    from code_node.pages import PageOptions, map_entry
+    from code_node.report.build import page_blocks
+
+    root = EXAMPLES / "orders-service"
+    entry = entry_points(read_project(root))[0]
+    cmap, project = map_entry(root, entry, PageOptions(git=False))
+    text = (
+        _render_text(page_blocks(cmap, project=root.name, max_functions=24, max_depth=5, sources=project.files), 100)
+        + "\n"
+    )
+    if os.environ.get("UPDATE_SNAPSHOTS"):
+        SNAPSHOT.parent.mkdir(exist_ok=True)
+        SNAPSHOT.write_text(text)
+    # code is shown as ast.unparse writes it, whose quotes differ between Pythons (f'{a['b']}' from 3.12 only)
+    assert text.replace("'", '"') == SNAPSHOT.read_text().replace("'", '"')
+
+
+def _matches_snapshot(example: str) -> None:
+    """
+    An example's page as text, then its findings, against tests/snapshots/<example>.txt.
+    UPDATE_SNAPSHOTS=1 uv run pytest writes it anew.
+    """
+    from code_node.analysis.findings import code_map_findings
+    from code_node.kit.render import _render_text
+    from code_node.pages import PageOptions, map_entry
+    from code_node.report.build import page_blocks
+
+    root = EXAMPLES / example
+    snapshot = SNAPSHOTS / f"{example}.txt"
+    entry = entry_points(read_project(root))[0]
+    cmap, project = map_entry(root, entry, PageOptions(git=False))
+    text = _render_text(page_blocks(cmap, project=root.name, max_functions=24, max_depth=5, sources=project.files), 100)
+    text += "\n\n-- Findings --\n" + "\n".join(f"{level}: {message}" for level, message in code_map_findings(cmap))
+    text += "\n"
+    if os.environ.get("UPDATE_SNAPSHOTS"):
+        snapshot.write_text(text)
+    assert text.replace("'", '"') == snapshot.read_text().replace("'", '"')
+
+
+def test_the_cart_example_matches_its_snapshot() -> None:
+    """
+    The cart example, which every kind of plugin reads: its SAM template, Redis, PostgreSQL, OpenAI and boto3 on
+    Lambda.
+    """
+    _matches_snapshot("cart-service")
+
+
+def test_the_books_example_matches_its_snapshot() -> None:
+    """
+    The books example, a FastAPI app on the web platform: its routes' parameters are the request, followed into
+    PostgreSQL, a shell command, S3 and an async route that blocks.
+    """
+    _matches_snapshot("books-api")
+
+
+_VOID = {"area", "base", "br", "col", "embed", "hr", "img", "input", "link", "meta", "source", "track", "wbr"}
+
+
+class _Tags(HTMLParser):
+    """
+    Each tag the page opens, closed in order: what a browser would otherwise guess at.
+    """
+
+    def __init__(self) -> None:
+        super().__init__()
+        self.open: list[str] = []
+        self.wrong: list[tuple[str, tuple[int, int]]] = []
+
+    def handle_starttag(self, tag: str, attrs: list) -> None:
+        if tag not in _VOID:
+            self.open.append(tag)
+
+    def handle_endtag(self, tag: str) -> None:
+        if tag in _VOID:
+            return
+        if self.open and self.open[-1] == tag:
+            self.open.pop()
+        else:
+            self.wrong.append((tag, self.getpos()))
+
+
+EXAMPLE_NAMES = sorted(p.name for p in EXAMPLES.iterdir() if p.is_dir())
+
+
+@pytest.mark.parametrize("example", EXAMPLE_NAMES)
+def test_every_entry_point_of_each_example_is_read_to_the_end(example: str) -> None:
+    from code_node.pages import PageOptions, map_entry
+
+    root = EXAMPLES / example
+    found = entry_points(read_project(root))
+    assert found
+    for entry in found:
+        cmap, _ = map_entry(root, entry, PageOptions(git=False))
+        assert not cmap.limited and not cmap.note, (entry.name, cmap.limited, cmap.note)
+        assert cmap.functions
+
+
+@pytest.mark.parametrize("example", EXAMPLE_NAMES)
+def test_each_example_s_page_is_whole_and_self_contained(example: str) -> None:
+    from code_node.pages import PageOptions, make_page
+
+    root = EXAMPLES / example
+    page, _ = make_page(root, entry_points(read_project(root))[0], PageOptions(git=False))
+    tags = _Tags()
+    tags.feed(page)
+    tags.close()
+    assert tags.open == [] and tags.wrong == []
+    # one file, opened anywhere: no script, style or image fetched from elsewhere
+    assert not re.search(r'<(script|img|iframe)[^>]* src=|<link[^>]* rel="stylesheet"', page)
+    assert page.count("<script>") == 1  # the graph's; the page works without it
+    assert "EventSource" not in page  # the live script is only for --serve
+
+
+SMOKE = {
+    "orders-service": "orders.handler.lambda_handler",
+    "cart-service": "Deployed as CheckoutFunction in template.yaml",
+    "books-api": "books.main.app",
+}
+
+
+@pytest.mark.parametrize(("example", "said"), sorted(SMOKE.items()))
+def test_the_command_on_each_example(example: str, said: str, tmp_path: Path, capsys) -> None:
+    out = tmp_path / "page.html"
+    assert main([str(EXAMPLES / example), "--no-open", "--no-git", "-o", str(out)]) == 0
+    assert said in capsys.readouterr().out and out.stat().st_size > 10_000
+    assert main([str(EXAMPLES / example), "--mermaid", "--no-git"]) == 0
+    assert capsys.readouterr().out.startswith("flowchart LR")
+
+
+def test_every_example_has_a_smoke_test() -> None:
+    assert sorted(SMOKE) == EXAMPLE_NAMES
diff --git a/tests/integration/test_serve.py b/tests/integration/test_serve.py
new file mode 100644
index 0000000..1839c95
--- /dev/null
+++ b/tests/integration/test_serve.py
@@ -0,0 +1,117 @@
+"""
+--serve: the live page over real HTTP, redrawn when the code changes.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from support import HANDLER, write
+
+
+def test_the_live_server_redraws_when_the_code_changes(tmp_path: Path, monkeypatch) -> None:
+    import threading
+    import urllib.request
+
+    from code_node import serve as servemod
+    from code_node.pages import PageOptions
+    from code_node.project import EntryPoint
+
+    monkeypatch.setattr(servemod, "POLL_SECONDS", 0.05)
+    monkeypatch.setattr(servemod, "SETTLE_SECONDS", 0.05)
+    root = write(tmp_path, {"app.py": HANDLER})
+    live = servemod.LivePage(
+        root, EntryPoint("app.lambda_handler", "", "app.py", 0, "lambda"), PageOptions(), log=lambda line: None
+    )
+    live.build()
+    assert live.version == 1 and "EventSource" in live.page and "GetObject" in live.page
+    server = servemod.ThreadingHTTPServer(("127.0.0.1", 0), servemod._handler(live))
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    threading.Thread(target=live.watch, daemon=True).start()
+    try:
+        url = f"http://127.0.0.1:{server.server_address[1]}"
+        assert "GetObject" in urllib.request.urlopen(url).read().decode()
+        (root / "app.py").write_text(HANDLER.replace("s3.get_object", "s3.head_object"))
+        assert live.wait_for_change(1, timeout=5) == 2
+        page = urllib.request.urlopen(url).read().decode()
+        assert "HeadObject" in page  # its IAM permission is still s3:GetObject
+        assert f"<title>{root.name} · " in page and 'rel="icon"' in page
+        icon = urllib.request.urlopen(url + "/favicon.ico")
+        assert icon.headers["Content-Type"] == "image/svg+xml" and b"<svg" in icon.read()
+    finally:
+        live.stop()
+        server.shutdown()
+        server.server_close()
+
+
+def test_a_second_server_takes_the_next_free_port() -> None:
+    from code_node import serve as servemod
+
+    first = servemod.listen(servemod.BaseHTTPRequestHandler)
+    try:
+        second = servemod.listen(servemod.BaseHTTPRequestHandler)
+        try:
+            assert second.server_address[1] != first.server_address[1]
+        finally:
+            second.server_close()
+    finally:
+        first.server_close()
+
+
+def test_a_broken_build_shows_in_the_page(tmp_path: Path, monkeypatch) -> None:
+    from code_node import serve as servemod
+    from code_node.pages import PageOptions
+    from code_node.project import EntryPoint
+
+    def broken(*args, **kwargs):
+        raise RuntimeError("boom")
+
+    monkeypatch.setattr(servemod, "make_page", broken)
+    live = servemod.LivePage(tmp_path, EntryPoint("app.main", "", "app.py", 0), PageOptions(), log=lambda line: None)
+    live.build()
+    assert "Couldn't draw app.main" in live.page and "RuntimeError: boom" in live.page
+
+
+def test_the_page_s_event_stream_says_each_new_version(tmp_path: Path, monkeypatch) -> None:
+    """
+    /events over a real connection, as the served page's EventSource reads it: the version now, then each new one.
+    """
+    import http.client
+    import threading
+
+    from code_node import serve as servemod
+    from code_node.pages import PageOptions
+    from code_node.project import EntryPoint
+
+    monkeypatch.setattr(servemod, "POLL_SECONDS", 0.05)
+    monkeypatch.setattr(servemod, "SETTLE_SECONDS", 0.05)
+    root = write(tmp_path, {"app.py": HANDLER})
+    live = servemod.LivePage(
+        root, EntryPoint("app.lambda_handler", "", "app.py", 0, "lambda"), PageOptions(git=False), log=lambda line: None
+    )
+    live.build()
+    server = servemod.listen(servemod._handler(live), port=0)
+    assert server.server_address[0] == "127.0.0.1"  # never on another interface
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    threading.Thread(target=live.watch, daemon=True).start()
+    connection = http.client.HTTPConnection("127.0.0.1", server.server_address[1], timeout=10)
+    try:
+        connection.request("GET", "/events")
+        response = connection.getresponse()
+        assert response.status == 200 and response.headers["Content-Type"] == "text/event-stream"
+        assert response.readline() == b"data: 1\n"
+        (root / "app.py").write_text(HANDLER + "\n\ndef more():\n    pass\n")
+        response.readline()  # the blank line that ends an event
+        assert response.readline() == b"data: 2\n"
+        (root / "app.py").write_text("def lambda_handler(event, context):\n    return (\n")  # mid-edit
+        response.readline()
+        assert response.readline() == b"data: 3\n"  # still serving, with the error as the page
+        other = http.client.HTTPConnection("127.0.0.1", server.server_address[1], timeout=10)
+        other.request("GET", "/nothing-here")
+        assert other.getresponse().status == 404
+        other.close()
+    finally:
+        connection.close()
+        live.stop()
+        server.shutdown()
+        server.server_close()
diff --git a/tests/support.py b/tests/support.py
new file mode 100644
index 0000000..a13e362
--- /dev/null
+++ b/tests/support.py
@@ -0,0 +1,115 @@
+"""
+What the tests share: write() puts a small project in a folder, and the projects they write.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from code_node.analysis.mapping import map_code
+
+
+def write(root: Path, files: dict[str, str]) -> Path:
+    for name, text in files.items():
+        path = root / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text)
+    return root
+
+
+HANDLER = """
+import os
+import boto3
+import requests
+
+s3 = boto3.client("s3")
+
+
+def load(bucket, key):
+    return s3.get_object(Bucket=bucket, Key=key)["Body"].read()
+
+
+def lambda_handler(event, context):
+    for record in event["Records"]:
+        load(record["s3"]["bucket"]["name"], record["s3"]["object"]["key"])
+    requests.post(os.environ["HOOK"], json={})
+"""
+
+
+PACKAGE = {
+    "pyproject.toml": '[project]\nname = "tool"\n[project.scripts]\ntool = "tool.cli:main"\n',
+    "src/tool/__init__.py": "",
+    "src/tool/cli.py": "from .store import Store\n\n\ndef main():\n    Store().save('x')\n",
+    "src/tool/store.py": (
+        "class Store:\n    def save(self, item):\n        self._write(item)\n\n"
+        "    def _write(self, item):\n        open('out.txt', 'w').write(item)\n"
+    ),
+    "tests/test_cli.py": "def main():\n    pass\n",
+}
+
+
+STORES = """
+import json
+import os
+import subprocess
+
+import pymongo
+import redis
+import sqlite3
+from anthropic import Anthropic
+
+cache = redis.Redis(host="cache")
+mongo = pymongo.MongoClient(os.environ["MONGO_URL"])
+orders = mongo.shop["orders"]
+claude = Anthropic(timeout=20)
+LOOKUP = "SELECT name FROM users WHERE id = ?"
+
+
+def handler(event, context):
+    body = json.loads(event["body"])
+    user = body["user"]
+    db = sqlite3.connect("/tmp/app.db")
+    name = db.execute(LOOKUP, (user,)).fetchone()
+    query = "DELETE FROM sessions WHERE user = '" + user + "'"
+    db.execute(query)
+    for key in cache.keys("session:*"):
+        cache.delete(key)
+    orders.insert_one({"user": user})
+    found = mongo.get_database("shop").users.find_one({"id": user})
+    claude.messages.create(model="claude-sonnet-5-5", max_tokens=200, messages=[])
+    subprocess.run(f"echo {body['note']}", shell=True)
+    return name, found
+"""
+
+
+FAN = (
+    "import os\nimport boto3\n\n\ndef lambda_handler(event, context):\n    route(event)\n\n\n"
+    "def route(event):\n"
+    + "".join(f"    step{i}()\n" for i in range(8))
+    + "\n\n"
+    + "".join(f"def step{i}():\n    leaf{i}()\n\n\n" for i in range(8))
+    + "".join(f"def leaf{i}():\n    pass\n\n\n" for i in range(8))
+    + "def leaf7():\n    boto3.client('s3').put_object(Bucket=os.environ['BUCKET'], Key='k', Body=b'')\n"
+)
+
+
+IMPORTED_FROM_SRC = {
+    "src/common/__init__.py": "",
+    "src/common/db.py": (
+        'import boto3\n\ntable = boto3.resource("dynamodb").Table("orders")\n\n\n'
+        "def save(item):\n    table.put_item(Item=item)\n"
+    ),
+    "src/handlers/orders/app.py": "from common.db import save\n\n\ndef handler(event, context):\n    save(event)\n",
+}
+
+
+def page_blocks_for(project, entry: str) -> list:
+    from code_node.report.build import page_blocks
+
+    cmap = map_code(project.files, entry, libraries=project.libraries(), platform="lambda")
+    return page_blocks(cmap, project="x", max_functions=24, max_depth=5, sources=project.files)
+
+
+TESTS = Path(__file__).parent
+SNAPSHOTS = TESTS / "snapshots"
+EXAMPLES = TESTS.parent / "examples"
diff --git a/tests/test_code_node.py b/tests/test_code_node.py
deleted file mode 100644
index 8e8198a..0000000
--- a/tests/test_code_node.py
+++ /dev/null
@@ -1,1341 +0,0 @@
-"""
-code-node end to end on small folders written into tmp_path: entry points found, the map, the graph and the page.
-"""
-
-from __future__ import annotations
-
-import io
-import os
-import re
-from pathlib import Path
-
-import pytest
-
-from code_node.analysis.graph import code_graph, everything_graph, graph_views
-from code_node.analysis.mapping import map_code
-from code_node.cli import main
-from code_node.project import entry_points, read_project
-from code_node.report.style import render_page
-from code_node.report.walk import _Walk, walk_stops
-
-HANDLER = """
-import os
-import boto3
-import requests
-
-s3 = boto3.client("s3")
-
-
-def load(bucket, key):
-    return s3.get_object(Bucket=bucket, Key=key)["Body"].read()
-
-
-def lambda_handler(event, context):
-    for record in event["Records"]:
-        load(record["s3"]["bucket"]["name"], record["s3"]["object"]["key"])
-    requests.post(os.environ["HOOK"], json={})
-"""
-
-PACKAGE = {
-    "pyproject.toml": '[project]\nname = "tool"\n[project.scripts]\ntool = "tool.cli:main"\n',
-    "src/tool/__init__.py": "",
-    "src/tool/cli.py": "from .store import Store\n\n\ndef main():\n    Store().save('x')\n",
-    "src/tool/store.py": (
-        "class Store:\n    def save(self, item):\n        self._write(item)\n\n"
-        "    def _write(self, item):\n        open('out.txt', 'w').write(item)\n"
-    ),
-    "tests/test_cli.py": "def main():\n    pass\n",
-}
-
-
-def write(root: Path, files: dict[str, str]) -> Path:
-    for name, text in files.items():
-        path = root / name
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(text)
-    return root
-
-
-def test_a_lambda_handler_is_found_and_mapped(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path, {"app.py": HANDLER}))
-    found = entry_points(project)
-    assert [(e.name, e.platform) for e in found] == [("app.lambda_handler", "lambda")]
-    cmap = map_code(project.files, "app.lambda_handler", libraries=project.libraries(), platform="lambda")
-    assert [c.operation for c in cmap.aws] == ["GetObject"]
-    assert [e.name for e in cmap.env] == ["HOOK"]
-    assert {i.top: i.source for i in cmap.imports}["requests"] == "package"
-    kinds = {n.kind for n in code_graph(cmap).nodes}
-    assert {"event", "env", "handler", "function", "aws", "http"} <= kinds
-
-
-def test_a_console_script_in_a_src_layout_follows_methods(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path, PACKAGE))
-    found = entry_points(project)
-    assert found[0].name == "tool.cli.main"
-    assert all("tests/" not in e.file for e in found)
-    cmap = map_code(project.files, found[0].name, file=found[0].file)
-    assert [f.name for f in cmap.functions] == ["tool.cli.main", "tool.store.Store.save", "tool.store.Store._write"]
-    assert not any(n.kind == "event" for n in code_graph(cmap).nodes)
-
-
-def test_a_method_can_be_the_entry_point(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path, PACKAGE))
-    cmap = map_code(project.files, "tool.store.Store.save")
-    assert cmap.entry == "tool.store.Store.save"
-    assert [f.name for f in cmap.functions] == ["tool.store.Store.save", "tool.store.Store._write"]
-
-
-def test_modules_beside_the_entry_point_are_its_own_code(tmp_path: Path) -> None:
-    # a Lambda function's folder: its handler imports the files beside it by their own names, though the folder is
-    # also a package from the project's root
-    project = read_project(
-        write(
-            tmp_path,
-            {
-                "src/app/__init__.py": "",
-                "src/app/handler.py": "from helpers import load\n\n\ndef lambda_handler(event, context):\n    load()\n",
-                "src/app/helpers.py": (
-                    "import boto3\n\n\ndef load():\n    boto3.client('s3').get_object(Bucket='b', Key='k')\n"
-                ),
-            },
-        )
-    )
-    cmap = map_code(project.files, "app.handler.lambda_handler", libraries=project.libraries())
-    assert [f.name for f in cmap.functions] == ["app.handler.lambda_handler", "helpers.load"]
-    assert [(c.service, c.operation) for c in cmap.aws] == [("s3", "GetObject")]
-    assert next(i for i in cmap.imports if i.module == "helpers").source == "own"
-    assert cmap.other_files == 0  # helpers.py is read, though it has two names
-
-
-def test_graph_limits_and_all(tmp_path: Path) -> None:
-    chain = "\n".join(f"def f{i}():\n    f{i + 1}()\n" for i in range(12)) + "\ndef f12():\n    pass\n"
-    project = read_project(write(tmp_path, {"deep.py": chain}))
-    cmap = map_code(project.files, "deep.f0")
-    assert code_graph(cmap).hidden > 0
-    assert code_graph(cmap, max_functions=100, max_depth=100).hidden == 0
-
-
-FAN = (
-    "import os\nimport boto3\n\n\ndef lambda_handler(event, context):\n    route(event)\n\n\n"
-    "def route(event):\n"
-    + "".join(f"    step{i}()\n" for i in range(8))
-    + "\n\n"
-    + "".join(f"def step{i}():\n    leaf{i}()\n\n\n" for i in range(8))
-    + "".join(f"def leaf{i}():\n    pass\n\n\n" for i in range(8))
-    + "def leaf7():\n    boto3.client('s3').put_object(Bucket=os.environ['BUCKET'], Key='k', Body=b'')\n"
-)
-
-
-def test_a_function_whose_calls_are_left_out_has_a_graph_of_its_own(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path, {"app.py": FAN}))
-    cmap = map_code(project.files, "app.lambda_handler", platform="lambda")
-    graph = code_graph(cmap, max_functions=4)
-    route = next(n for n in graph.nodes if n.name == "app.route")
-    assert route.more and graph.hidden and not graph.too_deep
-    # from route(): every call it makes, though that's past max_functions, and nothing from above it
-    opened = code_graph(cmap, max_functions=4, focus="app.route")
-    names = {n.name for n in opened.nodes if n.kind in ("handler", "function")}
-    assert {"app.route", *(f"app.step{i}" for i in range(8))} <= names and "app.lambda_handler" not in names
-    assert next(n for n in opened.nodes if n.name == "app.route").kind == "handler"
-    assert not any(n.kind in ("event", "start") for n in opened.nodes)
-    assert [n.label for n in opened.nodes if n.kind == "aws"] == ["S3"]  # what's below it still reaches S3
-    views = graph_views(cmap, graph, max_functions=4)
-    assert views[0].name == "app.route" and views[0].path == ["app.lambda_handler", "app.route"]
-    everything = everything_graph(cmap, graph)
-    assert everything is not None and everything.hidden == 0
-
-
-def test_the_page_opens_a_box_s_calls_with_javascript_and_works_without(tmp_path: Path) -> None:
-    write(tmp_path / "code", {"app.py": FAN})
-    out = tmp_path / "page.html"
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out), "--functions", "4"]) == 0
-    page = out.read_text()
-    # each graph a box's calls open is a template the script swaps in, with the path down to it
-    assert '<div class="cgw" data-group="cn-graph0">' in page and page.count("<script>") == 1
-    assert '<template id="cn-graph0-v1">' in page and '<a class="dr" href="#cn-graph0-v' in page
-    assert '<a class="cgcb" href="#cn-graph0-main">← The whole graph</a>' in page
-    assert '<template id="cn-graph0-all">' in page and '<a class="cgta oj" href="#cn-graph0-all"' in page
-    # without JavaScript the links are hidden and the legend says where the rest are, as before
-    assert 'class="kp kh nj"' in page and "the Step by step tab has them all" in page
-    assert ".cnd .cgw:not(.js) :is(.oj,.dr),.cnd .cgw.js .nj{display:none}" in page
-    # a function drawn in several graphs has one panel of code
-    panels = re.findall(r'<aside class="cside" id="([^"]+)"', page)
-    assert len(panels) == len(set(panels)) and len(panels) < 2 * len(re.findall(r'<a class="cl" href="#cn-code-', page))
-    step = re.search(r'<aside class="cside" id="([^"]+)" aria-label="The code of step3\(\)"', page)
-    assert step is not None and page.count(f'href="#{step.group(1)}"') > 1
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out), "--all"]) == 0
-    assert '<div class="cgw">' in out.read_text() and "<template id=" not in out.read_text()  # nothing left out
-
-
-def test_the_command_saves_a_page(tmp_path: Path, capsys) -> None:
-    write(tmp_path / "code", {"app.py": HANDLER})
-    out = tmp_path / "page.html"
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
-    page = out.read_text()
-    assert "How app.lambda_handler works" in page and "<svg" in page
-    # the page is its tabs, the entry point beside them, with no cards or findings
-    assert '<div class="cnd"><div class="tabs">' in page and "<code>app.lambda_handler</code>" in page
-    assert all(f">{tab}<small>" in page for tab in ("Graph", "Step by step"))
-    assert (
-        'class="cards"' not in page
-        and 'class="fd"' not in page
-        and ">Findings<" not in page
-        and 'class="t"' not in page
-    )
-    assert main([str(tmp_path / "code"), "--mermaid"]) == 0
-    assert "flowchart LR" in capsys.readouterr().out
-
-
-def test_clicking_a_box_shows_its_code(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path / "code", {"app.py": HANDLER}))
-    cmap = map_code(project.files, "app.lambda_handler", libraries=project.libraries(), platform="lambda")
-    graph = code_graph(cmap)
-    load = next(n for n in graph.nodes if n.label == "load()")
-    assert [(s.file, s.start, s.end, s.lit) for s in load.code] == [("app.py", 9, 10, [10])]
-    s3 = next(n for n in graph.nodes if n.kind == "aws")
-    assert [(s.start, s.end, s.lit) for s in s3.code] == [(9, 10, [10])]  # kept within load()
-    out = tmp_path / "page.html"
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
-    page = out.read_text()
-    assert f'<a class="cl" href="#cn-code-{load.id}"' in page and f'id="cn-code-{load.id}"' in page
-    assert '<span class="sl lit"><span class="sn">10</span>' in page
-    # a click outside the panel closes it, as its × does; without JavaScript the × still does
-    assert page.count("<script>") == 1 and 'location.hash = "cn-closed"' in page and 'href="#cn-closed"' in page
-
-
-def test_the_steps_are_walked_in_the_order_the_code_runs(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path / "code", {"app.py": HANDLER}))
-    cmap = map_code(project.files, "app.lambda_handler", libraries=project.libraries(), platform="lambda")
-    walk = _Walk(cmap.startup, cmap.steps, functions=cmap.functions, sources=project.files)
-    assert [(line, stack) for line, _, stack in walk_stops(walk)] == [
-        (6, ["app.py, imported"]),  # s3 = boto3.client("s3"), when it's imported
-        (13, ["lambda_handler()"]),
-        (14, ["lambda_handler()"]),  # for record in event["Records"]:
-        (15, ["lambda_handler()"]),  # load(...)
-        (9, ["lambda_handler()", "load()"]),  # into load()
-        (10, ["lambda_handler()", "load()"]),
-        (16, ["lambda_handler()"]),  # back out: requests.post(...)
-    ]
-    html = render_page([walk], "walk")
-    assert 'id="cw0" checked' in html and html.count('name="cnd-walk"') == 7
-    assert '<label class="wbt" for="cw6" title="Run what this line calls without going in' in html  # Skip call
-    assert (
-        '<label class="wbt" for="cw6" title="Run the rest of load() and go back to where it was called">'
-        "Finish <code>load()</code>"
-    ) in html  # from inside load()
-    assert '<div class="whead">Makes an S3 client</div>' in html  # each step said in plain words
-    assert 'id="cx1"' in html and 'id="cx0"' not in html  # lambda_handler() folds; the import line has nothing under it
-    assert "#cx1:checked~.wu1" in html and 'class="wil k-def wu1 wu2 wu3"' in html  # load(), inside its caller's fold
-    assert '<span class="wtx">Goes through each <code>record</code> in <code>event[&#x27;Records&#x27;]</code>' in html
-    assert '<label class="sl" for="cw5"><span class="sn">10</span>' in html  # load()'s line 10 jumps to its step
-    assert ".cnd #cw5:checked~.wf2{--k:1}" in html  # and lights the second line of load()
-    out = tmp_path / "page.html"
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
-    page = out.read_text()
-    assert '<input type="radio" class="tr" name="cnd-tab0" id="cnd-tab0-0" checked>' in page
-    assert "Step by step<small>7 steps</small>" in page and page.count("<script>") == 1
-
-
-def test_starting_from_a_file(tmp_path: Path, capsys) -> None:
-    root = write(tmp_path / "repo", {**PACKAGE, ".git/HEAD": "ref: main\n"})
-    out = tmp_path / "page.html"
-    assert main([str(root / "src/tool/cli.py"), "--no-open", "-o", str(out)]) == 0
-    assert "tool.cli.main: 3 functions" in capsys.readouterr().out
-    assert main([f"{root / 'src/tool/store.py'}:Store.save", "--no-open", "-o", str(out)]) == 0
-    assert "tool.store.Store.save: 2 functions" in capsys.readouterr().out
-    assert main([str(root), "-e", str(root / "src/tool/store.py"), "--no-open", "-o", str(out)]) == 0
-    assert "tool.store.Store.save" in capsys.readouterr().out
-
-
-def test_the_picker_walks_folders_and_searches_files(tmp_path: Path) -> None:
-    from rich.console import Console
-
-    from code_node.browse import FILES, _match, _Picker
-
-    project = read_project(write(tmp_path / "repo", PACKAGE))
-    picker = _Picker(project, entry_points(project), mode=FILES)
-
-    def keys(*pressed: str):
-        picked = None
-        for key in pressed:
-            picked = picker.press(key)
-        return picked
-
-    def listed() -> list[str]:
-        return [row.key for row in picker.rows()]
-
-    assert listed() == ["src", "tests"] and keys("enter") is None and picker.folder == "src"
-    assert listed() == ["", "src/tool"] and picker.cursor == 1  # past '..'
-    assert keys("right") is None and listed()[1:] == ["src/tool/__init__.py", "src/tool/cli.py", "src/tool/store.py"]
-    assert "★" in str(picker.rows()[2].note)  # cli.py holds the console script
-    assert (
-        keys("left") is None and picker.folder == "src" and listed()[picker.cursor] == "src/tool"
-    )  # back where it was
-    keys("s", "t", "o")  # typing searches every file
-    assert listed()[0] == "src/tool/store.py" and keys("enter") is None and picker.mode == "functions"
-    assert [row.key for row in picker.rows()] == ["tool.store.Store.save", "tool.store.Store._write"]
-    assert keys("down", "enter").name == "tool.store.Store._write"
-    assert keys("esc") is None and picker.mode == FILES and listed()[picker.cursor] == "src/tool/store.py"
-    keys("backspace", "backspace", "tab")
-    assert picker.mode == "entries" and keys("enter").name == "tool.cli.main"
-    assert keys("tab", "c", "l", "i", "enter").name == "tool.cli.main"  # a file with one function picks it
-    assert keys("esc", "esc").name == ""  # Esc clears what's typed, then quits
-    assert _match("hdlr", "orders/handler.py") == (3, [7, 10, 11, 13]) and _match("zz", "a.py") is None
-    assert _match("orders", "orders/orders.py")[0] == 0 and _match("ders", "orders/x.py")[0] == 2
-    screen = Console(width=120, height=30, file=io.StringIO())
-    with screen.capture() as seen:
-        screen.print(picker.draw(120, 30))
-    assert all(text in seen.get() for text in ("Search", "Entry points 1", "src/", "★ tool.cli.main", "3 Python files"))
-    assert "repo /" not in seen.get()
-    assert main([str(tmp_path / "repo"), "-i", "--no-open"]) == 2  # no terminal to pick in
-
-
-def test_cli_commands_are_followed_from_the_app(tmp_path: Path) -> None:
-    source = (
-        "import typer\n\napp = typer.Typer()\n\n\ndef helper():\n    pass\n\n\n@app.command()\n"
-        'def sync_all():\n    helper()\n\n\n@app.command("show")\ndef display():\n    pass\n\n\n'
-        "def main():\n    app()\n"
-    )
-    project = read_project(write(tmp_path, {"pyproject.toml": '[project.scripts]\nt = "cli:main"\n', "cli.py": source}))
-    assert entry_points(project)[0].name == "cli.app"
-    cmap = map_code(project.files, "cli.app")
-    assert [(method, path) for method, path, _ in cmap.routes] == [("CLI", "sync-all"), ("CLI", "show")]
-    assert "cli.helper" in {f.name for f in cmap.functions}
-
-
-def test_the_live_server_redraws_when_the_code_changes(tmp_path: Path, monkeypatch) -> None:
-    import threading
-    import urllib.request
-
-    from code_node import serve as servemod
-    from code_node.pages import PageOptions
-    from code_node.project import EntryPoint
-
-    monkeypatch.setattr(servemod, "POLL_SECONDS", 0.05)
-    monkeypatch.setattr(servemod, "SETTLE_SECONDS", 0.05)
-    root = write(tmp_path, {"app.py": HANDLER})
-    live = servemod.LivePage(
-        root, EntryPoint("app.lambda_handler", "", "app.py", 0, "lambda"), PageOptions(), log=lambda line: None
-    )
-    live.build()
-    assert live.version == 1 and "EventSource" in live.page and "GetObject" in live.page
-    server = servemod.ThreadingHTTPServer(("127.0.0.1", 0), servemod._handler(live))
-    threading.Thread(target=server.serve_forever, daemon=True).start()
-    threading.Thread(target=live.watch, daemon=True).start()
-    try:
-        url = f"http://127.0.0.1:{server.server_address[1]}"
-        assert "GetObject" in urllib.request.urlopen(url).read().decode()
-        (root / "app.py").write_text(HANDLER.replace("s3.get_object", "s3.head_object"))
-        assert live.wait_for_change(1, timeout=5) == 2
-        page = urllib.request.urlopen(url).read().decode()
-        assert "HeadObject" in page  # its IAM permission is still s3:GetObject
-        assert f"<title>{root.name} · " in page and 'rel="icon"' in page
-        icon = urllib.request.urlopen(url + "/favicon.ico")
-        assert icon.headers["Content-Type"] == "image/svg+xml" and b"<svg" in icon.read()
-    finally:
-        live.stop()
-        server.shutdown()
-        server.server_close()
-
-
-def test_a_second_server_takes_the_next_free_port() -> None:
-    from code_node import serve as servemod
-
-    first = servemod.listen(servemod.BaseHTTPRequestHandler)
-    try:
-        second = servemod.listen(servemod.BaseHTTPRequestHandler)
-        try:
-            assert second.server_address[1] != first.server_address[1]
-        finally:
-            second.server_close()
-    finally:
-        first.server_close()
-
-
-def test_a_broken_build_shows_in_the_page(tmp_path: Path, monkeypatch) -> None:
-    from code_node import serve as servemod
-    from code_node.pages import PageOptions
-    from code_node.project import EntryPoint
-
-    def broken(*args, **kwargs):
-        raise RuntimeError("boom")
-
-    monkeypatch.setattr(servemod, "make_page", broken)
-    live = servemod.LivePage(tmp_path, EntryPoint("app.main", "", "app.py", 0), PageOptions(), log=lambda line: None)
-    live.build()
-    assert "Couldn't draw app.main" in live.page and "RuntimeError: boom" in live.page
-
-
-def test_plain_python_has_no_lambda_checks_until_asked(tmp_path: Path) -> None:
-    source = 'import requests\n\n\ndef main():\n    open("out.txt", "w")\n    requests.get("https://example.com")\n'
-    project = read_project(write(tmp_path / "code", {"app.py": source}))
-    plain = map_code(project.files, "app.main", libraries=project.libraries())
-    as_lambda = map_code(project.files, "app.main", libraries=project.libraries(), platform="lambda")
-    from code_node.analysis.findings import code_map_findings
-
-    said = " ".join(message for _, message in code_map_findings(plain))
-    assert "Lambda" not in said and "/tmp" not in said and "hangs" in said
-    assert not any(n.kind == "event" for n in code_graph(plain).nodes)
-    said = " ".join(message for _, message in code_map_findings(as_lambda))
-    assert "Lambda passes two" in said and "outside /tmp" in said
-    assert any(n.kind == "event" for n in code_graph(as_lambda).nodes)
-    out = tmp_path / "page.html"
-    assert main([str(tmp_path / "code"), "-e", "app.main", "--platform", "lambda", "--no-open", "-o", str(out)]) == 0
-    assert "Lambda passes two" in out.read_text()
-
-
-def _commit(root: Path, author: str, when: str, message: str) -> None:
-    import subprocess
-
-    env = {
-        **os.environ,
-        "GIT_AUTHOR_NAME": author,
-        "GIT_AUTHOR_EMAIL": f"{author.lower()}@example.com",
-        "GIT_AUTHOR_DATE": when,
-        "GIT_COMMITTER_NAME": author,
-        "GIT_COMMITTER_EMAIL": f"{author.lower()}@example.com",
-        "GIT_COMMITTER_DATE": when,
-    }
-    for command in (["add", "-A"], ["commit", "-q", "-m", message]):
-        subprocess.run(["git", "-C", str(root), *command], check=True, env=env)
-
-
-def test_each_function_says_what_git_says_about_it(tmp_path: Path) -> None:
-    import subprocess
-
-    from code_node.history import read_history
-
-    root = write(tmp_path / "code", {"app.py": HANDLER})
-    subprocess.run(["git", "init", "-q", str(root)], check=True)
-    subprocess.run(["git", "-C", str(root), "remote", "add", "origin", "git@github.com:ana/app.git"], check=True)
-    _commit(root, "Ana", "2024-01-01T12:00:00Z", "First")
-    (root / "app.py").write_text(HANDLER.replace('Key=key)["Body"]', 'Key=key, VersionId="1")["Body"]'))
-    _commit(root, "Ben", "2024-03-01T12:00:00Z", "Read the first version")
-    (root / "app.py").write_text(
-        (root / "app.py").read_text().replace("for record", "for one in [1]:\n        pass\n    for record")
-    )
-    project = read_project(root)
-    cmap = map_code(project.files, "app.lambda_handler", libraries=project.libraries(), platform="lambda")
-    assert read_history(root, cmap.functions) == 2
-    load = next(f for f in cmap.functions if f.name == "app.load").history
-    handler = next(f for f in cmap.functions if f.name == "app.lambda_handler").history
-    assert load and load.last and (load.last.author, load.last.subject) == ("Ben", "Read the first version")
-    assert load.commits == 2 and load.authors == ["Ana", "Ben"] and load.uncommitted == 0
-    assert load.last.url == f"https://github.com/ana/app/commit/{load.last.sha}"
-    assert handler and handler.last and handler.last.author == "Ana" and handler.uncommitted == 2
-    out = tmp_path / "page.html"
-    assert main([str(root), "--no-open", "-o", str(out)]) == 0
-    page = out.read_text()
-    assert "by Ben in" in page and f'href="{load.last.url}"' in page and "2 lines changed since the last commit" in page
-    # the code's panel says beside each line who changed it, and in its last row what git says about all of it
-    assert '<pre class="csc blame">' in page and ">Ben · " in page and '<span class="sb au" data-k="u"' in page
-    assert "commits by 2 people" in page and 'class="csg" checked' in page
-    assert handler.lines and None in handler.lines.values() and load.lines[min(load.lines)] is not None
-    assert main([str(root), "--no-open", "--no-git", "-o", str(out)]) == 0
-    assert "Last changed" not in out.read_text() and 'class="csg"' not in out.read_text()
-    # a folder not in git, or whose own config would have git run a filter, has no history
-    assert read_history(write(tmp_path / "plain", {"app.py": HANDLER}), cmap.functions[:1]) == 0
-    subprocess.run(["git", "-C", str(root), "config", "filter.x.clean", "touch ran"], check=True)
-    assert read_history(root, cmap.functions) == 0
-
-
-FASTAPI = """
-import sqlite3
-import time
-from typing import Annotated, Optional
-
-import requests
-from fastapi import Depends, FastAPI, Query, Request
-from pydantic import BaseModel
-
-app = FastAPI()
-db = sqlite3.connect("shop.db")
-
-
-class OrderIn(BaseModel):
-    item: str
-
-
-def user():
-    return "me"
-
-
-@app.get("/orders/{order_id}")
-def get_order(order_id: int, fields: str = "id", who=Depends(user)):
-    return db.execute(f"SELECT {fields} FROM orders WHERE id = {order_id}").fetchone()
-
-
-@app.get("/search")
-async def search(q: Annotated[str, Query(alias="term")], limit: Optional[int] = None):
-    requests.get("https://example.com/search", timeout=5)
-    time.sleep(1)
-
-
-@app.post("/orders")
-async def create(order: OrderIn, request: Request):
-    note = (await request.json())["note"]
-    db.execute("INSERT INTO orders (item, note) VALUES (?, ?)", (order.item, note))
-"""
-
-
-def test_a_fastapi_routes_parameters_are_the_request(tmp_path: Path) -> None:
-    from code_node.analysis.findings import code_map_findings
-
-    project = read_project(write(tmp_path / "code", {"main.py": FASTAPI}))
-    assert [(e.name, e.platform) for e in entry_points(project)] == [("main.app", "web")]
-    cmap = map_code(project.files, "main.app", libraries=project.libraries(), platform="web")
-    assert {f.label: f.required for f in cmap.event} == {
-        "path.order_id": True,
-        "query.fields": False,
-        "query.term": True,
-        "query.limit": False,
-        "body": True,
-        "body.item": True,
-        "json": True,
-        "json.note": True,
-    }  # who=Depends(...) isn't from the request
-    said = [message for _, message in code_map_findings(cmap)]
-    assert any("puts request query.fields, request path.order_id into the SQL text itself" in m for m in said)
-    assert any(
-        "requests.get() at main.py line 29 and time.sleep() at main.py line 30 wait without await inside "
-        "async def search()" in m
-        for m in said
-    )
-    assert not any("create()" in m for m in said)  # its SQL takes parameters
-    assert next(n for n in code_graph(cmap).nodes if n.kind == "event").label == "The request"
-    assert next(n for n in code_graph(cmap).nodes if n.kind == "handler").icon == "fastapi-icon"  # the app's logo
-    plain = map_code(project.files, "main.app", libraries=project.libraries())  # plain Python: no request
-    assert not plain.event and not any("SQL injection" in m for _, m in code_map_findings(plain))
-
-
-def test_a_flask_views_url_values_and_request_are_the_input(tmp_path: Path) -> None:
-    from code_node.analysis.findings import code_map_findings
-
-    source = (
-        "import os\nimport sqlite3\nfrom flask import Flask, request\n\napp = Flask(__name__)\n"
-        'db = sqlite3.connect("x.db")\n\n\n@app.route("/users/<int:user_id>")\ndef user(user_id):\n'
-        '    return db.execute("SELECT * FROM users WHERE id = %s" % user_id).fetchone()\n\n\n'
-        '@app.post("/search")\ndef search():\n    q = request.args.get("q", "")\n'
-        '    team = request.get_json()["team"]\n'
-        "    db.execute(f\"SELECT * FROM users WHERE name = '{q}' AND team = '{team}'\")\n"
-        '    os.system("grep " + request.form["pattern"] + " app.log")\n'
-    )
-    project = read_project(write(tmp_path / "code", {"app.py": source}))
-    entry = entry_points(project)[0]
-    assert (entry.name, entry.platform) == ("app.app", "web")
-    cmap = map_code(project.files, entry.name, libraries=project.libraries(), platform=entry.platform)
-    assert [f.label for f in cmap.event] == [
-        "path.user_id",
-        "args",
-        "args.q",
-        "json",
-        "json.team",
-        "form",
-        "form.pattern",
-    ]
-    said = [message for _, message in code_map_findings(cmap)]
-    assert any("puts request path.user_id into the SQL text" in m for m in said)
-    assert any("puts request args.q, request json.team into the SQL text" in m for m in said)
-    assert any("shell command with request form.pattern in it" in m for m in said)
-
-
-def test_django_urls_are_followed_through_include_views_and_routers(tmp_path: Path) -> None:
-    from code_node.analysis.findings import code_map_findings
-
-    views = (
-        "import json\nfrom django.db import connection\nfrom django.views import View\n"
-        "from django.views.decorators.http import require_GET\nfrom rest_framework import viewsets\n\n\n"
-        '@require_GET\ndef order_list(request):\n    status = request.GET.get("status")\n'
-        "    with connection.cursor() as cursor:\n"
-        "        cursor.execute(f\"SELECT * FROM orders WHERE status = '{status}'\")\n\n\n"
-        "class OrderDetail(View):\n    def get(self, request, pk):\n        return pk\n\n"
-        '    def post(self, request, pk):\n        note = json.loads(request.body)["note"]\n\n\n'
-        "class ItemViewSet(viewsets.ViewSet):\n    def retrieve(self, request, pk=None):\n        return pk\n"
-    )
-    urls = (
-        "from django.urls import include, path\nfrom rest_framework.routers import DefaultRouter\n"
-        'from . import views\n\nrouter = DefaultRouter()\nrouter.register("items", views.ItemViewSet)\n\n'
-        'urlpatterns = [\n    path("orders/", views.order_list),\n'
-        '    path("orders/<int:pk>/", views.OrderDetail.as_view()),\n    path("", include(router.urls)),\n]\n'
-    )
-    project = read_project(
-        write(
-            tmp_path / "code",
-            {
-                "shop/__init__.py": "",
-                "shop/urls.py": (
-                    'from django.urls import include, path\n\nurlpatterns = [path("api/", include("orders.urls"))]\n'
-                ),
-                "orders/__init__.py": "",
-                "orders/urls.py": urls,
-                "orders/views.py": views,
-            },
-        )
-    )
-    found = entry_points(project)  # the site's URLs first: they include the app's
-    assert [(e.name, e.platform) for e in found] == [
-        ("shop.urls.urlpatterns", "web"),
-        ("orders.urls.urlpatterns", "web"),
-    ]
-    cmap = map_code(project.files, found[0].name, libraries=project.libraries(), platform="web")
-    assert [(method, path) for method, path, _ in cmap.routes] == [
-        ("GET", "/api/items/<pk>/"),
-        ("GET", "/api/orders/"),
-        ("GET", "/api/orders/<int:pk>/"),
-        ("POST", "/api/orders/<int:pk>/"),
-    ]
-    assert {"path.pk", "GET.status", "body (JSON).note"} <= {f.label for f in cmap.event}
-    said = [message for _, message in code_map_findings(cmap)]
-    assert any("puts request GET.status into the SQL text" in m for m in said)
-    assert next(n for n in code_graph(cmap).nodes if n.kind == "handler").icon == "django-icon"
-
-
-def test_a_platform_plugin_finds_its_entry_points_and_adds_findings(tmp_path: Path, monkeypatch) -> None:
-    import ast
-
-    from code_node import platforms as platformsmod
-    from code_node.platforms import Platform
-
-    class Worker(Platform):
-        name = "worker"
-        title = "Job runner"
-        inputs = ("event",)
-        input_name = "the job"
-
-        def find_entries(self, module: str, tree: ast.Module) -> list[tuple[str, int, str]]:
-            return [
-                (n.name, n.lineno, "a job")
-                for n in tree.body
-                if isinstance(n, ast.FunctionDef) and n.name.startswith("job_")
-            ]
-
-        def findings(self, cmap) -> list[tuple[str, str]]:
-            return [("info", f"{len(cmap.event)} fields of the job are read.")]
-
-    platformsmod.platforms()  # the built-in ones first
-    monkeypatch.setitem(platformsmod._platforms, "worker", Worker())
-    project = read_project(write(tmp_path, {"jobs.py": "def job_resize(job):\n    return job['size']\n"}))
-    found = entry_points(project)
-    assert [(e.name, e.platform) for e in found] == [("jobs.job_resize", "worker")]
-    cmap = map_code(project.files, found[0].name, platform=found[0].platform)
-    assert [f.label for f in cmap.event] == ["size"]
-    from code_node.analysis.findings import _code_summary, code_map_findings
-
-    assert ("info", "1 fields of the job are read.") in code_map_findings(cmap)
-    assert "It reads size from the job." in _code_summary(cmap)
-
-
-SNAPSHOT = Path(__file__).parent / "snapshots" / "orders-service.txt"
-
-
-def test_the_example_page_matches_its_snapshot(monkeypatch) -> None:
-    """
-    The example's page as text, against tests/snapshots/orders-service.txt, so a change to what the page says shows
-    as a readable diff. UPDATE_SNAPSHOTS=1 uv run pytest writes it anew.
-    """
-    from code_node.kit.render import _render_text
-    from code_node.pages import PageOptions, map_entry
-    from code_node.report.build import page_blocks
-
-    root = Path(__file__).parent.parent / "examples" / "orders-service"
-    entry = entry_points(read_project(root))[0]
-    cmap, project = map_entry(root, entry, PageOptions(git=False))
-    text = (
-        _render_text(page_blocks(cmap, project=root.name, max_functions=24, max_depth=5, sources=project.files), 100)
-        + "\n"
-    )
-    if os.environ.get("UPDATE_SNAPSHOTS"):
-        SNAPSHOT.parent.mkdir(exist_ok=True)
-        SNAPSHOT.write_text(text)
-    # code is shown as ast.unparse writes it, whose quotes differ between Pythons (f'{a['b']}' from 3.12 only)
-    assert text.replace("'", '"') == SNAPSHOT.read_text().replace("'", '"')
-
-
-ENGINE = """
-def main():
-    tidy()
-    note()
-    run()
-
-
-def tidy():
-    pass
-
-
-def note():
-    pass
-
-
-def run():
-    work()
-
-
-def work():
-""" + "".join(f"    step{i} = {i}\n" for i in range(30))
-
-
-def test_the_graph_draws_the_functions_that_do_the_work(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path, {"app.py": ENGINE}))
-    cmap = map_code(project.files, "app.main")
-    graph = code_graph(cmap, max_functions=3)
-    # run() only passes on to work(): work() takes the box, joined to main() through it, and tidy() the one left
-    assert [n.label for n in graph.nodes if n.kind in ("handler", "function")] == ["main()", "tidy()", "work()"]
-    labels = {n.id: n.label for n in graph.nodes}
-    via = [(labels[e.source], labels[e.target], e.label) for e in graph.edges if e.indirect]
-    assert via == [("main()", "work()", "via run()")]
-    main_box = next(n for n in graph.nodes if n.label == "main()")
-    assert main_box.more == ["note()"]  # said in its box, rather than looking like it does nothing
-    everything = code_graph(cmap)  # when they all fit, none is passed through
-    assert "run()" in [n.label for n in everything.nodes] and not any(e.indirect for e in everything.edges)
-
-
-def test_pointing_at_a_box_keeps_the_paths_through_it(tmp_path: Path) -> None:
-    from code_node.report.graph import _g_lineage
-
-    code = (
-        "import os\nimport boto3\n\n\ndef main():\n    load()\n    other()\n\n\ndef load():\n    os.environ['A']\n"
-        "    save()\n\n\ndef save():\n    boto3.client('s3').put_object(Bucket='b', Key='k', Body=b'')\n\n\n"
-        "def other():\n    pass\n"
-    )
-    project = read_project(write(tmp_path / "code", {"app.py": code}))
-    graph = code_graph(map_code(project.files, "app.main"))
-    ids = {n.label: n.id for n in graph.nodes}
-    boxes, arrows = _g_lineage(graph)
-    # S3: every box on the way down to it, but not other(), nor the environment past the box that reads it
-    assert boxes[ids["S3"]] == {ids["main()"], ids["load()"], ids["save()"]}
-    assert ids["Environment"] in boxes[ids["load()"]] and ids["Environment"] not in boxes[ids["save()"]]
-    on_path = {(e.source, e.target) for e, lit in zip(graph.edges, arrows) if ids["S3"] in lit}
-    assert on_path == {(ids["main()"], ids["load()"]), (ids["load()"], ids["save()"]), (ids["save()"], ids["S3"])}
-
-
-RUNS = """
-import boto3
-
-s3 = boto3.client("s3")
-
-
-def main(items):
-    setup()
-    for x in items:
-        if x:
-            work(x)
-        tidy(x)
-    s3.put_object(Bucket="b", Key="k", Body=b"")
-    s3.put_object(Bucket="b", Key="j", Body=b"")
-
-
-def setup():
-    pass
-
-
-def work(x):
-    pass
-
-
-def tidy(x):
-    pass
-"""
-
-
-def test_a_function_box_lists_what_it_does_in_the_order_it_runs(tmp_path: Path) -> None:
-    from code_node.report.graph import _g_cards, _g_rows, _graph_layout
-
-    project = read_project(write(tmp_path, {"app.py": RUNS}))
-    graph = code_graph(map_code(project.files, "app.main"))
-    box = next(n for n in graph.nodes if n.label == "main()")
-    rows = [(s.text, s.depth, s.loop, s.when) for s in box.steps]
-    assert rows == [
-        ("setup()", 0, False, ""),
-        ("work()", 2, True, "x"),  # in the loop, under its if
-        ("tidy()", 1, True, ""),
-        ("S3 PutObject (+1)", 0, False, ""),  # two in a row to one service, one row
-    ]
-    ids = {n.label: n.id for n in graph.nodes}
-    assert [s.target for s in box.steps] == [ids["setup()"], ids["work()"], ids["tidy()"], ids["S3"]]
-    cards = _g_cards(graph)
-    boxes, *_ = _graph_layout(graph, cards)
-    called = sorted(["setup()", "work()", "tidy()"], key=lambda label: boxes[ids[label]][1])
-    assert called == ["setup()", "work()", "tidy()"]  # the boxes it calls, top to bottom in the order it calls them
-    to_work = next(e for e in graph.edges if e.target == ids["work()"])
-    assert _g_rows(cards[box.id], to_work) == [cards[box.id].rows[1]]  # its arrow leaves from its row
-
-
-def test_arrows_from_one_box_run_together_and_the_graph_zooms(tmp_path: Path) -> None:
-    from code_node.report.graph import _g_cards, _graph_layout
-
-    chain = (
-        "import os\n\n\ndef main():\n    a()\n\n\ndef a():\n    b()\n\n\ndef b():\n    os.environ['B']\n    c()\n\n\n"
-        "def c():\n    os.environ['C']\n"
-    )
-    project = read_project(write(tmp_path / "code", {"app.py": chain}))
-    graph = code_graph(map_code(project.files, "app.main"))
-    _, routes, *_ = _graph_layout(graph, _g_cards(graph))
-    env = [routes[i] for i, e in enumerate(graph.edges) if e.kind == "env"]
-    assert len(env) == 2 and env[0][:2] == env[1][:2]  # one line through the columns both cross, then they part
-    out = tmp_path / "page.html"
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
-    page = out.read_text()
-    assert 'class="cgs cgz-auto" name="cn-graph0-zoom" id="cn-graph0-auto" checked' in page
-    assert 'class="cgs cgfs" id="cn-graph0-full"' in page and ">Full screen<" in page and page.count("<script>") == 1
-    # with JavaScript it pans and zooms like a canvas, and says so; without it, it scrolls
-    assert (
-        'box.addEventListener("wheel"' in page
-        and 'class="cgtm pzo"' in page
-        and 'class="zi"' in page
-        and "Drag to move about" in page
-    )
-    assert ".cnd .cgw:not(.pz) .pzo{display:none}" in page
-
-
-def test_a_box_says_what_it_is_in_a_card_on_hover(tmp_path: Path) -> None:
-    write(tmp_path / "code", {"app.py": HANDLER})
-    out = tmp_path / "page.html"
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
-    page = out.read_text()
-    assert '<g class="cn ' in page and not re.search(r'<g class="cn [^>]*><title>', page)  # not the plain tooltip
-    assert '<foreignObject class="ctip tp-f0' in page and ":hover) .tp-f0{display:inline}" in page
-    # its def as written, in colour
-    assert (
-        '<pre class="ctc"><span class="pk">def</span> <span class="pf">lambda_handler</span>(event, context):' in page
-    )
-
-
-def test_line_links_open_the_editor(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    from code_node.report.editor import editor_link, open_at
-
-    monkeypatch.delenv("WSL_DISTRO_NAME", raising=False)
-
-    link = editor_link("vscode", "/home/me/my code")
-    assert open_at(link, "app/main.py", 12) == "vscode://file/home/me/my%20code/app/main.py:12"
-    assert open_at(editor_link("cursor", "/home/me/code", wsl="Ubuntu"), "a.py", 3) == (
-        "cursor://vscode-remote/wsl+Ubuntu/home/me/code/a.py:3"
-    )
-    assert open_at(editor_link("vscode", "C:\\code"), "a.py", 1) == "vscode://file/C:/code/a.py:1"
-    assert editor_link("none", "/home/me/code") == ""
-    write(tmp_path / "code", {"app.py": HANDLER})
-    out = tmp_path / "page.html"
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
-    assert f'href="vscode://file{(tmp_path / "code").as_posix()}/app.py:' in out.read_text()
-    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out), "--editor", "none"]) == 0
-    assert "vscode://" not in out.read_text()
-
-
-IDIOMS = """
-class Base:
-    def __init__(self, name):
-        self.setup(name)
-
-    def setup(self, name):
-        open(name, "w").write("x")
-
-
-class Repo(Base):
-    def __init__(self, name):
-        super().__init__(name)
-
-    @property
-    def size(self):
-        return count()
-
-    @size.setter
-    def size(self, value):
-        pass
-
-    def __enter__(self):
-        return self
-
-    def __exit__(self, *exc):
-        close()
-
-    def save(self, item):
-        pass
-
-
-def count():
-    pass
-
-
-def close():
-    pass
-
-
-def main(item):
-    repo = Repo("x")
-    n = repo.size
-    with Repo("y") as r:
-        r.save(item)
-"""
-
-
-def test_super_properties_and_with_blocks_are_followed(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path, {"app.py": IDIOMS}))
-    cmap = map_code(project.files, "app.main")
-    reached = {f.name for f in cmap.functions}
-    assert {"app.Base.__init__", "app.Base.setup"} <= reached  # through super().__init__()
-    assert {"app.Repo.size", "app.count"} <= reached  # repo.size runs its getter, not its setter
-    # r is what __enter__ returns, and __exit__ runs after the block
-    assert {"app.Repo.__enter__", "app.Repo.save", "app.Repo.__exit__", "app.close"} <= reached
-    with_step = next(s for s in cmap.steps[0].steps if s.kind == "with")
-    assert [s.code for s in with_step.steps] == ["r.save(item)", "# leaving the with block: __exit__ runs"]
-    assert [c.name for c in with_step.calls] == ["app.Repo.__init__", "app.Repo.__enter__"]
-
-
-def test_syntax_warnings_stay_out_of_the_terminal(tmp_path: Path) -> None:
-    import warnings
-
-    code = 'import re\n\n\ndef main():\n    return re.match("\\d+", "1")\n'  # '\\d' in a plain string: a SyntaxWarning
-    project = read_project(write(tmp_path, {"app.py": code}))
-    with warnings.catch_warnings(record=True) as caught:
-        warnings.simplefilter("always")
-        assert "app.py" in project.trees
-        map_code(project.files, "app.main")
-    assert not caught
-
-
-def test_console_scripts_come_from_every_pyproject(tmp_path: Path) -> None:
-    project = read_project(
-        write(
-            tmp_path,
-            {
-                "pyproject.toml": '[project]\nname = "workspace"\n',
-                "libs/cli/pyproject.toml": '[project]\nname = "tool"\n[project.scripts]\ntool = "tool.main:run"\n',
-                "libs/cli/tool/__init__.py": "",
-                "libs/cli/tool/main.py": "def run():\n    pass\n",
-                "scripts/release.py": "def main():\n    pass\n\n\nif __name__ == '__main__':\n    main()\n",
-            },
-        )
-    )
-    assert project.configs == ["pyproject.toml", "libs/cli/pyproject.toml"]
-    first = entry_points(project)[0]
-    assert (first.name, first.why) == ("tool.main.run", "the tool command in libs/cli/pyproject.toml")
-
-
-DISPATCH = """
-import os
-import boto3
-
-s3 = boto3.client("s3")
-
-
-def init():
-    pass
-
-
-def deploy(name):
-    s3.put_object(Bucket=os.environ["BUCKET"], Key=f"apps/{name}", Body=b"")
-
-
-def main(command, names):
-    if command == "init":
-        init()
-    elif command == "deploy":
-        for name in names:
-            if not name:
-                continue
-            deploy(name)
-"""
-
-
-def test_what_names_hold_where_arguments_come_from_and_when_calls_run(tmp_path: Path) -> None:
-    project = read_project(write(tmp_path, {"app.py": DISPATCH}))
-    cmap = map_code(project.files, "app.main")
-    steps = list(cmap.steps[0].walk())
-    calls = {s.name: s.when for s in steps if s.kind == "def" and s.name != "app.main"}
-    # the if around each call; `if not name: continue` makes the rest of the loop run only when name
-    assert calls == {"app.init": ["command == 'init'"], "app.deploy": ["command == 'deploy'", "name"]}
-    put = next(c for c in cmap.aws if c.operation == "PutObject")
-    assert put.args == [("Bucket", "env BUCKET"), ("Key", "f'apps/{name}'"), ("Body", "b''")]
-    line = next(s for s in steps if s.given)
-    assert line.given[:2] == [("S3 PutObject Bucket", "env BUCKET"), ("S3 PutObject Key", "f'apps/{name}'")]
-    holds = next(s for s in cmap.startup[0].walk() if s.holds)
-    assert holds.holds == [("s3", "an S3 client")]
-    graph = code_graph(cmap)
-    deploy = next(n for n in graph.nodes if n.label == "deploy()")
-    assert deploy.when == "command == 'deploy'"  # the graph says the if nearest around the call
-    assert any(e.kind == "call" and e.when == deploy.when for e in graph.edges)
-    assert "|\"when command == 'deploy'\"|" in graph.mermaid()
-
-
-STORES = """
-import json
-import os
-import subprocess
-
-import pymongo
-import redis
-import sqlite3
-from anthropic import Anthropic
-
-cache = redis.Redis(host="cache")
-mongo = pymongo.MongoClient(os.environ["MONGO_URL"])
-orders = mongo.shop["orders"]
-claude = Anthropic(timeout=20)
-LOOKUP = "SELECT name FROM users WHERE id = ?"
-
-
-def handler(event, context):
-    body = json.loads(event["body"])
-    user = body["user"]
-    db = sqlite3.connect("/tmp/app.db")
-    name = db.execute(LOOKUP, (user,)).fetchone()
-    query = "DELETE FROM sessions WHERE user = '" + user + "'"
-    db.execute(query)
-    for key in cache.keys("session:*"):
-        cache.delete(key)
-    orders.insert_one({"user": user})
-    found = mongo.get_database("shop").users.find_one({"id": user})
-    claude.messages.create(model="claude-sonnet-5-5", max_tokens=200, messages=[])
-    subprocess.run(f"echo {body['note']}", shell=True)
-    return name, found
-"""
-
-
-def test_library_plugins_follow_their_clients_and_flag_what_the_input_reaches(tmp_path: Path) -> None:
-    from code_node.analysis.findings import code_map_findings
-
-    project = read_project(write(tmp_path, {"app.py": STORES}))
-    cmap = map_code(project.files, "app.handler", libraries=project.libraries(), platform="lambda")
-    calls = {(c.service, c.operation, c.target): c for c in cmap.library_calls}
-    assert set(calls) == {
-        ("SQLite", "SELECT", "users"),
-        ("SQLite", "DELETE", "sessions"),
-        ("Redis", "KEYS", "session:*"),
-        ("Redis", "DELETE", "key"),
-        ("MongoDB", "insert_one", "orders"),
-        ("MongoDB", "find_one", "users"),
-        ("Anthropic", "messages.create", "claude-sonnet-5-5"),
-    }
-    # the user id went from the event, through a name and a + on text, into the SQL: flagged where it's run
-    assert calls[("SQLite", "DELETE", "sessions")].flag == "SQL injection"
-    assert not calls[("SQLite", "SELECT", "users")].flag  # a parameter, in a constant statement
-    assert calls[("Redis", "KEYS", "session:*")].flag == "KEYS blocks Redis"
-    assert calls[("Redis", "DELETE", "key")].loop == "for key in cache.keys('session:*'):"
-    assert cmap.plugins == ["SQL", "Redis", "MongoDB", "OpenAI and Anthropic"]
-    said = " ".join(message for _, message in code_map_findings(cmap))
-    assert "puts event body (JSON).user into the SQL text itself" in said
-    assert "shell command with event body (JSON).note in it" in said
-    assert "The Redis client made at app.py line 11 has no timeout" in said  # Anthropic's has one
-    assert "a new SQLite connection" not in said  # a file on disk: nothing to reuse
-    graph = code_graph(cmap)
-    boxes = {n.label: n for n in graph.nodes if n.kind == "service"}
-    assert set(boxes) == {"SQLite", "Redis", "MongoDB", "Anthropic"}
-    assert boxes["SQLite"].flags == {"DELETE sessions": "SQL injection"} and boxes["SQLite"].tone == "warn"
-    assert boxes["Anthropic"].icon == "spark" and boxes["Anthropic"].sub == "runs"
-    step = next(s for s in cmap.steps[0].walk() if s.code.startswith("query ="))
-    assert step.holds == [("query", "text built from event body (JSON).user")]
-
-
-def test_a_library_plugin_from_another_package(tmp_path: Path, monkeypatch) -> None:
-    from code_node import libraries as librariesmod
-    from code_node.libraries import Handle, Library, Use
-
-    class Kafka(Library):
-        name = "kafka"
-        title = "Kafka"
-        modules = ("kafka",)
-        icon = "queue"
-
-        def make(self, name, call):
-            return Handle("producer", "Kafka", opens=True) if name == "kafka.KafkaProducer" else None
-
-        def call(self, handle, method, call):
-            return Use("send", "sends", call.shown(0, "topic")) if method == "send" else None
-
-    librariesmod.libraries()
-    monkeypatch.setitem(librariesmod._libraries, "kafka", Kafka())
-    code = (
-        "from kafka import KafkaProducer\n\nproducer = KafkaProducer()\n\n\n"
-        "def main():\n    producer.send('orders', b'1')\n"
-    )
-    project = read_project(write(tmp_path, {"app.py": code}))
-    cmap = map_code(project.files, "app.main", libraries=project.libraries())
-    assert [(c.service, c.operation, c.access, c.target) for c in cmap.library_calls] == [
-        ("Kafka", "send", "sends", "orders")
-    ]
-    box = next(n for n in code_graph(cmap).nodes if n.kind == "service")
-    assert (box.label, box.icon, box.lines) == ("Kafka", "queue", ["send orders"])
-
-
-SAM = {
-    "template.yaml": """
-Transform: AWS::Serverless-2016-10-31
-Globals:
-  Function:
-    Runtime: python3.13
-    Environment:
-      Variables:
-        STAGE: prod
-Resources:
-  ResizeFunction:
-    Type: AWS::Serverless::Function
-    Properties:
-      CodeUri: src/
-      Handler: images.resize.run
-      Timeout: 20
-      Layers:
-        - !Ref PillowLayer
-      Policies:
-        - S3ReadPolicy:
-            BucketName: !Ref Uploads
-        - Statement:
-            - Effect: Allow
-              Action: sqs:SendMessage
-              Resource: "*"
-  Uploads:
-    Type: AWS::S3::Bucket
-""",
-    "src/images/__init__.py": "",
-    "src/images/resize.py": """
-import os
-import boto3
-import PIL
-
-s3 = boto3.client("s3")
-
-
-def run(event, context):
-    s3.get_object(Bucket=os.environ["BUCKET"], Key="a")
-    s3.put_object(Bucket=os.environ["STAGE"], Key="b", Body=b"")
-    boto3.client("sqs").send_message(QueueUrl="q", MessageBody="done")
-""",
-}
-
-
-def test_a_sam_template_names_the_entry_point_and_what_its_role_allows(tmp_path: Path) -> None:
-    from code_node.analysis.findings import code_map_findings
-    from code_node.pages import PageOptions, map_entry
-
-    root = write(tmp_path, SAM)
-    project = read_project(root)
-    assert list(project.deploy_files) == ["template.yaml"]
-    found = entry_points(project)
-    # run() isn't named like a handler: the template is what says it is one
-    assert [(e.name, e.why, e.platform) for e in found] == [
-        ("images.resize.run", "ResizeFunction in template.yaml", "lambda")
-    ]
-    cmap, _ = map_entry(root, found[0], PageOptions())
-    fn = cmap.function
-    assert (fn.name, fn.runtime, fn.timeout, fn.env_names, fn.layers) == (
-        "ResizeFunction",
-        "python3.13",
-        20,
-        {"STAGE"},
-        ["PillowLayer"],
-    )
-    assert {i.top: i.source for i in cmap.imports}["PIL"] == "package"
-    said = " ".join(message for _, message in code_map_findings(cmap))
-    assert "BUCKET isn't set on ResizeFunction" in said and "STAGE isn't" not in said
-    assert (
-        "ResizeFunction's role in template.yaml (it has S3ReadPolicy and an inline statement) doesn't allow "
-        "s3:PutObject"
-    ) in said
-    assert "Add S3WritePolicy to ResizeFunction's Policies in template.yaml" in said
-    s3 = next(n for n in code_graph(cmap).nodes if n.label == "S3")
-    assert s3.flags == {"PutObject": "not allowed"} and s3.tone == "warn"
-    assert next(n for n in code_graph(cmap).nodes if n.label == "SQS").tone == ""  # the inline statement allows it
-
-
-def test_a_role_it_cant_read_leaves_permissions_unchecked(tmp_path: Path) -> None:
-    from code_node.analysis.findings import code_map_findings
-    from code_node.pages import PageOptions, map_entry
-
-    files = dict(SAM)
-    files["template.yaml"] = files["template.yaml"].replace(
-        "      Policies:", "      Role: arn:aws:iam::123456789012:role/shared\n      Policies:"
-    )
-    root = write(tmp_path, files)
-    cmap, _ = map_entry(root, entry_points(read_project(root))[0], PageOptions())
-    assert cmap.function.permissions is None
-    assert "doesn't allow" not in " ".join(message for _, message in code_map_findings(cmap))
-
-
-def test_serverless_yml_names_the_entry_point(tmp_path: Path) -> None:
-    from code_node.analysis.findings import code_map_findings
-    from code_node.pages import PageOptions, map_entry
-
-    root = write(
-        tmp_path,
-        {
-            "serverless.yml": """
-service: jobs
-provider:
-  name: aws
-  runtime: python3.12
-  environment:
-    TABLE: jobs
-  iam:
-    role:
-      statements:
-        - Effect: Allow
-          Action: [dynamodb:GetItem, dynamodb:Query]
-          Resource: "*"
-functions:
-  sweep:
-    handler: jobs/sweep.go
-""",
-            "jobs/__init__.py": "",
-            "jobs/sweep.py": (
-                "import os\nimport boto3\n\n\ndef go(event, context):\n"
-                '    boto3.resource("dynamodb").Table(os.environ["TABLE"]).delete_item(Key={})\n'
-            ),
-        },
-    )
-    found = entry_points(read_project(root))
-    assert [(e.name, e.why) for e in found] == [("jobs.sweep.go", "sweep in serverless.yml")]
-    cmap, _ = map_entry(root, found[0], PageOptions())
-    assert (cmap.function.timeout, cmap.function.env_names) == (6, {"TABLE"})
-    said = " ".join(message for _, message in code_map_findings(cmap))
-    assert "sweep's role in serverless.yml" in said and "dynamodb:DeleteItem" in said
-    assert "Add a statement that allows dynamodb:DeleteItem to provider.iam.role.statements" in said
-
-
-def test_the_command_lists_its_plugins(capsys) -> None:
-    assert main(["--plugins"]) == 0
-    out = capsys.readouterr().out
-    assert all(re.search(row, out) for row in (r"lambda +AWS Lambda", r"redis +Redis +redis", r"sam +AWS SAM"))
-
-
-def _matches_snapshot(example: str) -> None:
-    """
-    An example's page as text, then its findings, against tests/snapshots/<example>.txt.
-    UPDATE_SNAPSHOTS=1 uv run pytest writes it anew.
-    """
-    from code_node.analysis.findings import code_map_findings
-    from code_node.kit.render import _render_text
-    from code_node.pages import PageOptions, map_entry
-    from code_node.report.build import page_blocks
-
-    root = Path(__file__).parent.parent / "examples" / example
-    snapshot = Path(__file__).parent / "snapshots" / f"{example}.txt"
-    entry = entry_points(read_project(root))[0]
-    cmap, project = map_entry(root, entry, PageOptions(git=False))
-    text = _render_text(page_blocks(cmap, project=root.name, max_functions=24, max_depth=5, sources=project.files), 100)
-    text += "\n\n-- Findings --\n" + "\n".join(f"{level}: {message}" for level, message in code_map_findings(cmap))
-    text += "\n"
-    if os.environ.get("UPDATE_SNAPSHOTS"):
-        snapshot.write_text(text)
-    assert text.replace("'", '"') == snapshot.read_text().replace("'", '"')
-
-
-def test_the_cart_example_matches_its_snapshot() -> None:
-    """
-    The cart example, which every kind of plugin reads: its SAM template, Redis, PostgreSQL, OpenAI and boto3 on
-    Lambda.
-    """
-    _matches_snapshot("cart-service")
-
-
-def test_the_books_example_matches_its_snapshot() -> None:
-    """
-    The books example, a FastAPI app on the web platform: its routes' parameters are the request, followed into
-    PostgreSQL, a shell command, S3 and an async route that blocks.
-    """
-    _matches_snapshot("books-api")
-
-
-def test_services_show_their_real_logos(tmp_path: Path) -> None:
-    from code_node.report.brands import logo, logo_names
-    from code_node.report.graph import _g_logo
-
-    assert all(logo(name) is not None for name in logo_names())  # logos/ has a .svg for each one brands.py names
-    project = read_project(write(tmp_path, {"app.py": STORES}))
-    graph = code_graph(map_code(project.files, "app.handler", libraries=project.libraries(), platform="lambda"))
-    boxes = {n.label: n for n in graph.nodes}
-    assert _g_logo(boxes["Redis"]) == logo("redis") and _g_logo(boxes["SQLite"]) == logo("sqlite")
-    assert _g_logo(boxes["handler()"]) is None  # its own functions keep their line drawing, a Lambda handler too
-    page = render_page(page_blocks_for(project, "app.handler"), "x")
-    assert page.count('<svg class="logo"') == 4  # SQLite, Redis, MongoDB, Anthropic
-    assert 'id="cnl-sqlite-' in page  # each logo's gradient ids get its own prefix, so two logos never share one
-    assert 'fill="#181818"' not in page  # Anthropic's black follows the text colour, for dark mode
-
-
-def test_logos_come_in_two_sizes_as_favicons_do(tmp_path: Path) -> None:
-    from code_node.report.brands import AWS_GLYPHS, fills, logo, logo_for, small_logo
-
-    # AWS's detailed icons have a small mark for 16 to 32 px; other brands' logos are simple enough as they are
-    assert all(small_logo(name) is not None for name in AWS_GLYPHS if logo(name) is not None and fills(logo(name)))
-    assert small_logo("redis") is None and logo_for("redis", 16) == logo("redis")
-    assert logo_for("aws-s3", 24) == small_logo("aws-s3") and logo_for("aws-s3", 64) == logo("aws-s3")
-    project = read_project(write(tmp_path, {"app.py": HANDLER}))
-    page = render_page(page_blocks_for(project, "app.lambda_handler"), "x")
-    assert page.count('class="logo lgs"') == page.count('class="logo lgf"') == 1  # S3: both, the screen picks
-    assert "@media (min-resolution:2dppx)" in page
-
-
-def page_blocks_for(project, entry: str) -> list:
-    from code_node.report.build import page_blocks
-
-    cmap = map_code(project.files, entry, libraries=project.libraries(), platform="lambda")
-    return page_blocks(cmap, project="x", max_functions=24, max_depth=5, sources=project.files)
-
-
-IMPORTED_FROM_SRC = {
-    "src/common/__init__.py": "",
-    "src/common/db.py": (
-        'import boto3\n\ntable = boto3.resource("dynamodb").Table("orders")\n\n\n'
-        "def save(item):\n    table.put_item(Item=item)\n"
-    ),
-    "src/handlers/orders/app.py": "from common.db import save\n\n\ndef handler(event, context):\n    save(event)\n",
-}
-
-
-@pytest.mark.parametrize(
-    ("name", "text"),
-    [
-        ("pyproject.toml", '[tool.pyright]\nextraPaths = ["src"]\n'),
-        ("pyproject.toml", '[tool.pytest.ini_options]\npythonpath = "src"\n'),
-        ("pyproject.toml", '[tool.mypy]\nmypy_path = "src"\n'),
-        ("pyproject.toml", '[tool.setuptools.packages.find]\nwhere = ["src"]\n'),
-        ("pyproject.toml", '[tool.setuptools.package-dir]\n"" = "src"\n'),
-        ("pyproject.toml", '[tool.poetry]\npackages = [{ include = "common", from = "src" }]\n'),
-        ("pyproject.toml", '[[tool.poetry.packages]]\ninclude = "common"\nfrom = "src"\n'),
-        ("pyrightconfig.json", '{"extraPaths": ["./src"]}'),
-        (".vscode/settings.json", '{\n  // Pylance\n  "python.analysis.extraPaths": ["${workspaceFolder}/src"],\n}\n'),
-    ],
-)
-def test_imports_from_a_folder_the_project_puts_on_the_path(tmp_path: Path, name: str, text: str, capsys) -> None:
-    root = write(tmp_path / "repo", {**IMPORTED_FROM_SRC, name: text, ".git/HEAD": "ref: main\n"})
-    project = read_project(root)
-    assert project.paths == ["src/"] and "common" not in project.libraries()
-    out = tmp_path / "page.html"
-    assert main([str(root / "src/handlers/orders/app.py:handler"), "--no-open", "-o", str(out)]) == 0
-    assert "app.handler: 2 functions, 1 AWS calls" in capsys.readouterr().out
-
-
-def test_imports_from_a_folder_given_with_path(tmp_path: Path, capsys) -> None:
-    root = write(tmp_path / "repo", {**IMPORTED_FROM_SRC, ".git/HEAD": "ref: main\n"})
-    out = tmp_path / "page.html"
-    file = str(root / "src/handlers/orders/app.py:handler")
-    assert main([file, "--no-open", "-o", str(out)]) == 0
-    assert "app.handler: 1 functions, 0 AWS calls" in capsys.readouterr().out  # common.db read as a library
-    assert main([file, "--path", str(root / "src"), "--no-open", "-o", str(out)]) == 0
-    assert "app.handler: 2 functions, 1 AWS calls" in capsys.readouterr().out
-    assert main([file, "--path", str(tmp_path), "--no-open", "-o", str(out)]) == 2
-    assert "isn't a folder in" in capsys.readouterr().err
-    cmap = map_code(
-        {path: text for path, text in IMPORTED_FROM_SRC.items()},
-        "app.handler",
-        file="src/handlers/orders/app.py",
-        paths=["src/"],
-    )
-    assert {f.name for f in cmap.functions} >= {"app.handler", "common.db.save"}
-
-
-def test_a_pyproject_in_a_subfolder_names_paths_from_there(tmp_path: Path) -> None:
-    files = {f"services/orders/{name}": text for name, text in IMPORTED_FROM_SRC.items()}
-    files["services/orders/pyproject.toml"] = '[tool.pyright]\nextraPaths = ["src", "../../missing"]\n'
-    assert read_project(write(tmp_path, files)).paths == ["services/orders/src/"]
-
-
-def test_pyproject_paths_without_tomllib(monkeypatch) -> None:
-    from code_node.project import _pyproject_paths
-
-    text = (
-        '[project]\nname = "x"\n[tool.pyright]\nextraPaths = [\n  "src",\n  "lib",\n]\n'
-        '[tool.mypy]\nmypy_path = "a:b"\n[tool.setuptools.package-dir]\n"" = "pkgs"\n'
-        '[[tool.poetry.packages]]\ninclude = "app"\nfrom = "apps"\n'
-    )
-    expected = ["src", "lib", "a", "b", "pkgs", "apps"]
-    assert _pyproject_paths(text) == expected
-    monkeypatch.setitem(__import__("sys").modules, "tomllib", None)  # as on Python 3.10
-    assert _pyproject_paths(text) == expected
diff --git a/tests/unit/test_deploys.py b/tests/unit/test_deploys.py
new file mode 100644
index 0000000..8ae4557
--- /dev/null
+++ b/tests/unit/test_deploys.py
@@ -0,0 +1,192 @@
+"""
+Deploy files: SAM and serverless.yml, and the roles they give.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from code_node.analysis.graph import code_graph
+from code_node.project import entry_points, read_project
+
+from support import write
+
+
+SAM = {
+    "template.yaml": """
+Transform: AWS::Serverless-2016-10-31
+Globals:
+  Function:
+    Runtime: python3.13
+    Environment:
+      Variables:
+        STAGE: prod
+Resources:
+  ResizeFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: src/
+      Handler: images.resize.run
+      Timeout: 20
+      Layers:
+        - !Ref PillowLayer
+      Policies:
+        - S3ReadPolicy:
+            BucketName: !Ref Uploads
+        - Statement:
+            - Effect: Allow
+              Action: sqs:SendMessage
+              Resource: "*"
+  Uploads:
+    Type: AWS::S3::Bucket
+""",
+    "src/images/__init__.py": "",
+    "src/images/resize.py": """
+import os
+import boto3
+import PIL
+
+s3 = boto3.client("s3")
+
+
+def run(event, context):
+    s3.get_object(Bucket=os.environ["BUCKET"], Key="a")
+    s3.put_object(Bucket=os.environ["STAGE"], Key="b", Body=b"")
+    boto3.client("sqs").send_message(QueueUrl="q", MessageBody="done")
+""",
+}
+
+
+def test_a_sam_template_names_the_entry_point_and_what_its_role_allows(tmp_path: Path) -> None:
+    from code_node.analysis.findings import code_map_findings
+    from code_node.pages import PageOptions, map_entry
+
+    root = write(tmp_path, SAM)
+    project = read_project(root)
+    assert list(project.deploy_files) == ["template.yaml"]
+    found = entry_points(project)
+    # run() isn't named like a handler: the template is what says it is one
+    assert [(e.name, e.why, e.platform) for e in found] == [
+        ("images.resize.run", "ResizeFunction in template.yaml", "lambda")
+    ]
+    cmap, _ = map_entry(root, found[0], PageOptions())
+    fn = cmap.function
+    assert (fn.name, fn.runtime, fn.timeout, fn.env_names, fn.layers) == (
+        "ResizeFunction",
+        "python3.13",
+        20,
+        {"STAGE"},
+        ["PillowLayer"],
+    )
+    assert {i.top: i.source for i in cmap.imports}["PIL"] == "package"
+    said = " ".join(message for _, message in code_map_findings(cmap))
+    assert "BUCKET isn't set on ResizeFunction" in said and "STAGE isn't" not in said
+    assert (
+        "ResizeFunction's role in template.yaml (it has S3ReadPolicy and an inline statement) doesn't allow "
+        "s3:PutObject"
+    ) in said
+    assert "Add S3WritePolicy to ResizeFunction's Policies in template.yaml" in said
+    s3 = next(n for n in code_graph(cmap).nodes if n.label == "S3")
+    assert s3.flags == {"PutObject": "not allowed"} and s3.tone == "warn"
+    assert next(n for n in code_graph(cmap).nodes if n.label == "SQS").tone == ""  # the inline statement allows it
+
+
+def test_a_role_it_cant_read_leaves_permissions_unchecked(tmp_path: Path) -> None:
+    from code_node.analysis.findings import code_map_findings
+    from code_node.pages import PageOptions, map_entry
+
+    files = dict(SAM)
+    files["template.yaml"] = files["template.yaml"].replace(
+        "      Policies:", "      Role: arn:aws:iam::123456789012:role/shared\n      Policies:"
+    )
+    root = write(tmp_path, files)
+    cmap, _ = map_entry(root, entry_points(read_project(root))[0], PageOptions())
+    assert cmap.function.permissions is None
+    assert "doesn't allow" not in " ".join(message for _, message in code_map_findings(cmap))
+
+
+def test_serverless_yml_names_the_entry_point(tmp_path: Path) -> None:
+    from code_node.analysis.findings import code_map_findings
+    from code_node.pages import PageOptions, map_entry
+
+    root = write(
+        tmp_path,
+        {
+            "serverless.yml": """
+service: jobs
+provider:
+  name: aws
+  runtime: python3.12
+  environment:
+    TABLE: jobs
+  iam:
+    role:
+      statements:
+        - Effect: Allow
+          Action: [dynamodb:GetItem, dynamodb:Query]
+          Resource: "*"
+functions:
+  sweep:
+    handler: jobs/sweep.go
+""",
+            "jobs/__init__.py": "",
+            "jobs/sweep.py": (
+                "import os\nimport boto3\n\n\ndef go(event, context):\n"
+                '    boto3.resource("dynamodb").Table(os.environ["TABLE"]).delete_item(Key={})\n'
+            ),
+        },
+    )
+    found = entry_points(read_project(root))
+    assert [(e.name, e.why) for e in found] == [("jobs.sweep.go", "sweep in serverless.yml")]
+    cmap, _ = map_entry(root, found[0], PageOptions())
+    assert (cmap.function.timeout, cmap.function.env_names) == (6, {"TABLE"})
+    said = " ".join(message for _, message in code_map_findings(cmap))
+    assert "sweep's role in serverless.yml" in said and "dynamodb:DeleteItem" in said
+    assert "Add a statement that allows dynamodb:DeleteItem to provider.iam.role.statements" in said
+
+
+def test_iam_actions_match_with_their_wildcards() -> None:
+    from code_node.deploys import allowed
+
+    assert allowed("s3:GetObject", ["s3:Get*"]) and allowed("S3:getobject", ["s3:GetObject"])  # IAM ignores case
+    assert allowed("dynamodb:Query", ["*"]) and not allowed("s3:PutObject", ["s3:Get*", "sqs:*"])
+
+
+def test_a_policy_s_actions_or_none_when_they_cant_be_told() -> None:
+    from code_node.deploys import statement_actions
+
+    allow = {"Statement": [{"Effect": "Allow", "Action": ["s3:GetObject", "dynamodb:*"], "Resource": "*"}]}
+    assert statement_actions(allow) == {"s3:GetObject", "dynamodb:*"}
+    assert statement_actions([{"Effect": "Deny", "Action": "s3:*"}]) is None
+    assert statement_actions({"Effect": "Allow", "NotAction": "iam:*"}) is None
+    assert statement_actions({"Effect": "Allow", "Action": {"Ref": "Actions"}}) is None  # not written out
+
+
+def test_a_handler_setting_names_its_file() -> None:
+    from code_node.deploys import resolve_handler
+
+    assert resolve_handler("", "src/", "cart.app.on_checkout", {"src/cart/app.py"}) == (
+        "src/cart/app.py",
+        "on_checkout",
+    )
+    assert resolve_handler("infra", "../src", "a.handler", {"src/a.py"}) == ("src/a.py", "handler")
+    assert resolve_handler("", "", "pkg.handler", {"pkg/__init__.py"}) == ("pkg/__init__.py", "handler")
+    assert resolve_handler("", "", "handler", {"handler.py"}) is None  # no module
+    assert resolve_handler("", "", "gone.handler", {"handler.py"}) is None
+
+
+def test_yaml_is_read_with_cloudformation_s_tags() -> None:
+    from code_node.deploys import line_of, load_yaml
+
+    text = "a: !Ref B\nb: !GetAtt R.Arn\nc: !Sub 'x-${AWS::Region}'\nd: !Join [',', [a, b]]\ne: ${self:service}\n"
+    assert load_yaml(text) == {
+        "a": {"Ref": "B"},
+        "b": {"Fn::GetAtt": ["R", "Arn"]},
+        "c": {"Fn::Sub": "x-${AWS::Region}"},
+        "d": {"Fn::Join": [",", ["a", "b"]]},
+        "e": "${self:service}",  # serverless.yml's variables stay as text
+    }
+    assert load_yaml("a: [\n") is None
+    text = "Resources:\n  CartFunction:\n    Type: x\n  'Other': 1\n"
+    assert (line_of(text, "CartFunction"), line_of(text, "Other"), line_of(text, "Missing")) == (2, 4, 0)
+    assert line_of(text, "CartFunction", indent=0) == 0  # only at the top level
diff --git a/tests/unit/test_graph.py b/tests/unit/test_graph.py
new file mode 100644
index 0000000..d9b83e6
--- /dev/null
+++ b/tests/unit/test_graph.py
@@ -0,0 +1,149 @@
+"""
+The graph: which boxes and arrows a map draws, and its limits.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from code_node.analysis.graph import code_graph, everything_graph, graph_views
+from code_node.analysis.mapping import map_code
+from code_node.project import read_project
+
+from support import FAN, write
+
+
+def test_graph_limits_and_all(tmp_path: Path) -> None:
+    chain = "\n".join(f"def f{i}():\n    f{i + 1}()\n" for i in range(12)) + "\ndef f12():\n    pass\n"
+    project = read_project(write(tmp_path, {"deep.py": chain}))
+    cmap = map_code(project.files, "deep.f0")
+    assert code_graph(cmap).hidden > 0
+    assert code_graph(cmap, max_functions=100, max_depth=100).hidden == 0
+
+
+def test_a_function_whose_calls_are_left_out_has_a_graph_of_its_own(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path, {"app.py": FAN}))
+    cmap = map_code(project.files, "app.lambda_handler", platform="lambda")
+    graph = code_graph(cmap, max_functions=4)
+    route = next(n for n in graph.nodes if n.name == "app.route")
+    assert route.more and graph.hidden and not graph.too_deep
+    # from route(): every call it makes, though that's past max_functions, and nothing from above it
+    opened = code_graph(cmap, max_functions=4, focus="app.route")
+    names = {n.name for n in opened.nodes if n.kind in ("handler", "function")}
+    assert {"app.route", *(f"app.step{i}" for i in range(8))} <= names and "app.lambda_handler" not in names
+    assert next(n for n in opened.nodes if n.name == "app.route").kind == "handler"
+    assert not any(n.kind in ("event", "start") for n in opened.nodes)
+    assert [n.label for n in opened.nodes if n.kind == "aws"] == ["S3"]  # what's below it still reaches S3
+    views = graph_views(cmap, graph, max_functions=4)
+    assert views[0].name == "app.route" and views[0].path == ["app.lambda_handler", "app.route"]
+    everything = everything_graph(cmap, graph)
+    assert everything is not None and everything.hidden == 0
+
+
+ENGINE = """
+def main():
+    tidy()
+    note()
+    run()
+
+
+def tidy():
+    pass
+
+
+def note():
+    pass
+
+
+def run():
+    work()
+
+
+def work():
+""" + "".join(f"    step{i} = {i}\n" for i in range(30))
+
+
+def test_the_graph_draws_the_functions_that_do_the_work(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path, {"app.py": ENGINE}))
+    cmap = map_code(project.files, "app.main")
+    graph = code_graph(cmap, max_functions=3)
+    # run() only passes on to work(): work() takes the box, joined to main() through it, and tidy() the one left
+    assert [n.label for n in graph.nodes if n.kind in ("handler", "function")] == ["main()", "tidy()", "work()"]
+    labels = {n.id: n.label for n in graph.nodes}
+    via = [(labels[e.source], labels[e.target], e.label) for e in graph.edges if e.indirect]
+    assert via == [("main()", "work()", "via run()")]
+    main_box = next(n for n in graph.nodes if n.label == "main()")
+    assert main_box.more == ["note()"]  # said in its box, rather than looking like it does nothing
+    everything = code_graph(cmap)  # when they all fit, none is passed through
+    assert "run()" in [n.label for n in everything.nodes] and not any(e.indirect for e in everything.edges)
+
+
+def test_pointing_at_a_box_keeps_the_paths_through_it(tmp_path: Path) -> None:
+    from code_node.report.graph import _g_lineage
+
+    code = (
+        "import os\nimport boto3\n\n\ndef main():\n    load()\n    other()\n\n\ndef load():\n    os.environ['A']\n"
+        "    save()\n\n\ndef save():\n    boto3.client('s3').put_object(Bucket='b', Key='k', Body=b'')\n\n\n"
+        "def other():\n    pass\n"
+    )
+    project = read_project(write(tmp_path / "code", {"app.py": code}))
+    graph = code_graph(map_code(project.files, "app.main"))
+    ids = {n.label: n.id for n in graph.nodes}
+    boxes, arrows = _g_lineage(graph)
+    # S3: every box on the way down to it, but not other(), nor the environment past the box that reads it
+    assert boxes[ids["S3"]] == {ids["main()"], ids["load()"], ids["save()"]}
+    assert ids["Environment"] in boxes[ids["load()"]] and ids["Environment"] not in boxes[ids["save()"]]
+    on_path = {(e.source, e.target) for e, lit in zip(graph.edges, arrows) if ids["S3"] in lit}
+    assert on_path == {(ids["main()"], ids["load()"]), (ids["load()"], ids["save()"]), (ids["save()"], ids["S3"])}
+
+
+RUNS = """
+import boto3
+
+s3 = boto3.client("s3")
+
+
+def main(items):
+    setup()
+    for x in items:
+        if x:
+            work(x)
+        tidy(x)
+    s3.put_object(Bucket="b", Key="k", Body=b"")
+    s3.put_object(Bucket="b", Key="j", Body=b"")
+
+
+def setup():
+    pass
+
+
+def work(x):
+    pass
+
+
+def tidy(x):
+    pass
+"""
+
+
+def test_a_function_box_lists_what_it_does_in_the_order_it_runs(tmp_path: Path) -> None:
+    from code_node.report.graph import _g_cards, _g_rows, _graph_layout
+
+    project = read_project(write(tmp_path, {"app.py": RUNS}))
+    graph = code_graph(map_code(project.files, "app.main"))
+    box = next(n for n in graph.nodes if n.label == "main()")
+    rows = [(s.text, s.depth, s.loop, s.when) for s in box.steps]
+    assert rows == [
+        ("setup()", 0, False, ""),
+        ("work()", 2, True, "x"),  # in the loop, under its if
+        ("tidy()", 1, True, ""),
+        ("S3 PutObject (+1)", 0, False, ""),  # two in a row to one service, one row
+    ]
+    ids = {n.label: n.id for n in graph.nodes}
+    assert [s.target for s in box.steps] == [ids["setup()"], ids["work()"], ids["tidy()"], ids["S3"]]
+    cards = _g_cards(graph)
+    boxes, *_ = _graph_layout(graph, cards)
+    called = sorted(["setup()", "work()", "tidy()"], key=lambda label: boxes[ids[label]][1])
+    assert called == ["setup()", "work()", "tidy()"]  # the boxes it calls, top to bottom in the order it calls them
+    to_work = next(e for e in graph.edges if e.target == ids["work()"])
+    assert _g_rows(cards[box.id], to_work) == [cards[box.id].rows[1]]  # its arrow leaves from its row
diff --git a/tests/unit/test_history.py b/tests/unit/test_history.py
new file mode 100644
index 0000000..ee48b08
--- /dev/null
+++ b/tests/unit/test_history.py
@@ -0,0 +1,69 @@
+"""
+What git says about each function shown.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from code_node.analysis.mapping import map_code
+from code_node.cli import main
+from code_node.project import read_project
+
+from support import HANDLER, write
+
+
+def _commit(root: Path, author: str, when: str, message: str) -> None:
+    import subprocess
+
+    env = {
+        **os.environ,
+        "GIT_AUTHOR_NAME": author,
+        "GIT_AUTHOR_EMAIL": f"{author.lower()}@example.com",
+        "GIT_AUTHOR_DATE": when,
+        "GIT_COMMITTER_NAME": author,
+        "GIT_COMMITTER_EMAIL": f"{author.lower()}@example.com",
+        "GIT_COMMITTER_DATE": when,
+    }
+    for command in (["add", "-A"], ["commit", "-q", "-m", message]):
+        subprocess.run(["git", "-C", str(root), *command], check=True, env=env)
+
+
+def test_each_function_says_what_git_says_about_it(tmp_path: Path) -> None:
+    import subprocess
+
+    from code_node.history import read_history
+
+    root = write(tmp_path / "code", {"app.py": HANDLER})
+    subprocess.run(["git", "init", "-q", str(root)], check=True)
+    subprocess.run(["git", "-C", str(root), "remote", "add", "origin", "git@github.com:ana/app.git"], check=True)
+    _commit(root, "Ana", "2024-01-01T12:00:00Z", "First")
+    (root / "app.py").write_text(HANDLER.replace('Key=key)["Body"]', 'Key=key, VersionId="1")["Body"]'))
+    _commit(root, "Ben", "2024-03-01T12:00:00Z", "Read the first version")
+    (root / "app.py").write_text(
+        (root / "app.py").read_text().replace("for record", "for one in [1]:\n        pass\n    for record")
+    )
+    project = read_project(root)
+    cmap = map_code(project.files, "app.lambda_handler", libraries=project.libraries(), platform="lambda")
+    assert read_history(root, cmap.functions) == 2
+    load = next(f for f in cmap.functions if f.name == "app.load").history
+    handler = next(f for f in cmap.functions if f.name == "app.lambda_handler").history
+    assert load and load.last and (load.last.author, load.last.subject) == ("Ben", "Read the first version")
+    assert load.commits == 2 and load.authors == ["Ana", "Ben"] and load.uncommitted == 0
+    assert load.last.url == f"https://github.com/ana/app/commit/{load.last.sha}"
+    assert handler and handler.last and handler.last.author == "Ana" and handler.uncommitted == 2
+    out = tmp_path / "page.html"
+    assert main([str(root), "--no-open", "-o", str(out)]) == 0
+    page = out.read_text()
+    assert "by Ben in" in page and f'href="{load.last.url}"' in page and "2 lines changed since the last commit" in page
+    # the code's panel says beside each line who changed it, and in its last row what git says about all of it
+    assert '<pre class="csc blame">' in page and ">Ben · " in page and '<span class="sb au" data-k="u"' in page
+    assert "commits by 2 people" in page and 'class="csg" checked' in page
+    assert handler.lines and None in handler.lines.values() and load.lines[min(load.lines)] is not None
+    assert main([str(root), "--no-open", "--no-git", "-o", str(out)]) == 0
+    assert "Last changed" not in out.read_text() and 'class="csg"' not in out.read_text()
+    # a folder not in git, or whose own config would have git run a filter, has no history
+    assert read_history(write(tmp_path / "plain", {"app.py": HANDLER}), cmap.functions[:1]) == 0
+    subprocess.run(["git", "-C", str(root), "config", "filter.x.clean", "touch ran"], check=True)
+    assert read_history(root, cmap.functions) == 0
diff --git a/tests/unit/test_libraries.py b/tests/unit/test_libraries.py
new file mode 100644
index 0000000..e30e1b7
--- /dev/null
+++ b/tests/unit/test_libraries.py
@@ -0,0 +1,79 @@
+"""
+Library plugins: the clients they follow and what they flag.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from code_node.analysis.graph import code_graph
+from code_node.analysis.mapping import map_code
+from code_node.project import read_project
+
+from support import STORES, write
+
+
+def test_library_plugins_follow_their_clients_and_flag_what_the_input_reaches(tmp_path: Path) -> None:
+    from code_node.analysis.findings import code_map_findings
+
+    project = read_project(write(tmp_path, {"app.py": STORES}))
+    cmap = map_code(project.files, "app.handler", libraries=project.libraries(), platform="lambda")
+    calls = {(c.service, c.operation, c.target): c for c in cmap.library_calls}
+    assert set(calls) == {
+        ("SQLite", "SELECT", "users"),
+        ("SQLite", "DELETE", "sessions"),
+        ("Redis", "KEYS", "session:*"),
+        ("Redis", "DELETE", "key"),
+        ("MongoDB", "insert_one", "orders"),
+        ("MongoDB", "find_one", "users"),
+        ("Anthropic", "messages.create", "claude-sonnet-5-5"),
+    }
+    # the user id went from the event, through a name and a + on text, into the SQL: flagged where it's run
+    assert calls[("SQLite", "DELETE", "sessions")].flag == "SQL injection"
+    assert not calls[("SQLite", "SELECT", "users")].flag  # a parameter, in a constant statement
+    assert calls[("Redis", "KEYS", "session:*")].flag == "KEYS blocks Redis"
+    assert calls[("Redis", "DELETE", "key")].loop == "for key in cache.keys('session:*'):"
+    assert cmap.plugins == ["SQL", "Redis", "MongoDB", "OpenAI and Anthropic"]
+    said = " ".join(message for _, message in code_map_findings(cmap))
+    assert "puts event body (JSON).user into the SQL text itself" in said
+    assert "shell command with event body (JSON).note in it" in said
+    assert "The Redis client made at app.py line 11 has no timeout" in said  # Anthropic's has one
+    assert "a new SQLite connection" not in said  # a file on disk: nothing to reuse
+    graph = code_graph(cmap)
+    boxes = {n.label: n for n in graph.nodes if n.kind == "service"}
+    assert set(boxes) == {"SQLite", "Redis", "MongoDB", "Anthropic"}
+    assert boxes["SQLite"].flags == {"DELETE sessions": "SQL injection"} and boxes["SQLite"].tone == "warn"
+    assert boxes["Anthropic"].icon == "spark" and boxes["Anthropic"].sub == "runs"
+    step = next(s for s in cmap.steps[0].walk() if s.code.startswith("query ="))
+    assert step.holds == [("query", "text built from event body (JSON).user")]
+
+
+def test_a_library_plugin_from_another_package(tmp_path: Path, monkeypatch) -> None:
+    from code_node import libraries as librariesmod
+    from code_node.libraries import Handle, Library, Use
+
+    class Kafka(Library):
+        name = "kafka"
+        title = "Kafka"
+        modules = ("kafka",)
+        icon = "queue"
+
+        def make(self, name, call):
+            return Handle("producer", "Kafka", opens=True) if name == "kafka.KafkaProducer" else None
+
+        def call(self, handle, method, call):
+            return Use("send", "sends", call.shown(0, "topic")) if method == "send" else None
+
+    librariesmod.libraries()
+    monkeypatch.setitem(librariesmod._libraries, "kafka", Kafka())
+    code = (
+        "from kafka import KafkaProducer\n\nproducer = KafkaProducer()\n\n\n"
+        "def main():\n    producer.send('orders', b'1')\n"
+    )
+    project = read_project(write(tmp_path, {"app.py": code}))
+    cmap = map_code(project.files, "app.main", libraries=project.libraries())
+    assert [(c.service, c.operation, c.access, c.target) for c in cmap.library_calls] == [
+        ("Kafka", "send", "sends", "orders")
+    ]
+    box = next(n for n in code_graph(cmap).nodes if n.kind == "service")
+    assert (box.label, box.icon, box.lines) == ("Kafka", "queue", ["send orders"])
diff --git a/tests/unit/test_picker.py b/tests/unit/test_picker.py
new file mode 100644
index 0000000..a7c2fd0
--- /dev/null
+++ b/tests/unit/test_picker.py
@@ -0,0 +1,56 @@
+"""
+The picker the command asks with: folders, search and keys.
+"""
+
+from __future__ import annotations
+
+import io
+from pathlib import Path
+
+from code_node.cli import main
+from code_node.project import entry_points, read_project
+
+from support import PACKAGE, write
+
+
+def test_the_picker_walks_folders_and_searches_files(tmp_path: Path) -> None:
+    from rich.console import Console
+
+    from code_node.browse import FILES, _match, _Picker
+
+    project = read_project(write(tmp_path / "repo", PACKAGE))
+    picker = _Picker(project, entry_points(project), mode=FILES)
+
+    def keys(*pressed: str):
+        picked = None
+        for key in pressed:
+            picked = picker.press(key)
+        return picked
+
+    def listed() -> list[str]:
+        return [row.key for row in picker.rows()]
+
+    assert listed() == ["src", "tests"] and keys("enter") is None and picker.folder == "src"
+    assert listed() == ["", "src/tool"] and picker.cursor == 1  # past '..'
+    assert keys("right") is None and listed()[1:] == ["src/tool/__init__.py", "src/tool/cli.py", "src/tool/store.py"]
+    assert "★" in str(picker.rows()[2].note)  # cli.py holds the console script
+    assert (
+        keys("left") is None and picker.folder == "src" and listed()[picker.cursor] == "src/tool"
+    )  # back where it was
+    keys("s", "t", "o")  # typing searches every file
+    assert listed()[0] == "src/tool/store.py" and keys("enter") is None and picker.mode == "functions"
+    assert [row.key for row in picker.rows()] == ["tool.store.Store.save", "tool.store.Store._write"]
+    assert keys("down", "enter").name == "tool.store.Store._write"
+    assert keys("esc") is None and picker.mode == FILES and listed()[picker.cursor] == "src/tool/store.py"
+    keys("backspace", "backspace", "tab")
+    assert picker.mode == "entries" and keys("enter").name == "tool.cli.main"
+    assert keys("tab", "c", "l", "i", "enter").name == "tool.cli.main"  # a file with one function picks it
+    assert keys("esc", "esc").name == ""  # Esc clears what's typed, then quits
+    assert _match("hdlr", "orders/handler.py") == (3, [7, 10, 11, 13]) and _match("zz", "a.py") is None
+    assert _match("orders", "orders/orders.py")[0] == 0 and _match("ders", "orders/x.py")[0] == 2
+    screen = Console(width=120, height=30, file=io.StringIO())
+    with screen.capture() as seen:
+        screen.print(picker.draw(120, 30))
+    assert all(text in seen.get() for text in ("Search", "Entry points 1", "src/", "★ tool.cli.main", "3 Python files"))
+    assert "repo /" not in seen.get()
+    assert main([str(tmp_path / "repo"), "-i", "--no-open"]) == 2  # no terminal to pick in
diff --git a/tests/unit/test_platforms.py b/tests/unit/test_platforms.py
new file mode 100644
index 0000000..99809fb
--- /dev/null
+++ b/tests/unit/test_platforms.py
@@ -0,0 +1,218 @@
+"""
+Platforms: Lambda, the web frameworks, and a platform plugin.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from code_node.analysis.graph import code_graph
+from code_node.analysis.mapping import map_code
+from code_node.cli import main
+from code_node.project import entry_points, read_project
+
+from support import write
+
+
+def test_plain_python_has_no_lambda_checks_until_asked(tmp_path: Path) -> None:
+    source = 'import requests\n\n\ndef main():\n    open("out.txt", "w")\n    requests.get("https://example.com")\n'
+    project = read_project(write(tmp_path / "code", {"app.py": source}))
+    plain = map_code(project.files, "app.main", libraries=project.libraries())
+    as_lambda = map_code(project.files, "app.main", libraries=project.libraries(), platform="lambda")
+    from code_node.analysis.findings import code_map_findings
+
+    said = " ".join(message for _, message in code_map_findings(plain))
+    assert "Lambda" not in said and "/tmp" not in said and "hangs" in said
+    assert not any(n.kind == "event" for n in code_graph(plain).nodes)
+    said = " ".join(message for _, message in code_map_findings(as_lambda))
+    assert "Lambda passes two" in said and "outside /tmp" in said
+    assert any(n.kind == "event" for n in code_graph(as_lambda).nodes)
+    out = tmp_path / "page.html"
+    assert main([str(tmp_path / "code"), "-e", "app.main", "--platform", "lambda", "--no-open", "-o", str(out)]) == 0
+    assert "Lambda passes two" in out.read_text()
+
+
+FASTAPI = """
+import sqlite3
+import time
+from typing import Annotated, Optional
+
+import requests
+from fastapi import Depends, FastAPI, Query, Request
+from pydantic import BaseModel
+
+app = FastAPI()
+db = sqlite3.connect("shop.db")
+
+
+class OrderIn(BaseModel):
+    item: str
+
+
+def user():
+    return "me"
+
+
+@app.get("/orders/{order_id}")
+def get_order(order_id: int, fields: str = "id", who=Depends(user)):
+    return db.execute(f"SELECT {fields} FROM orders WHERE id = {order_id}").fetchone()
+
+
+@app.get("/search")
+async def search(q: Annotated[str, Query(alias="term")], limit: Optional[int] = None):
+    requests.get("https://example.com/search", timeout=5)
+    time.sleep(1)
+
+
+@app.post("/orders")
+async def create(order: OrderIn, request: Request):
+    note = (await request.json())["note"]
+    db.execute("INSERT INTO orders (item, note) VALUES (?, ?)", (order.item, note))
+"""
+
+
+def test_a_fastapi_routes_parameters_are_the_request(tmp_path: Path) -> None:
+    from code_node.analysis.findings import code_map_findings
+
+    project = read_project(write(tmp_path / "code", {"main.py": FASTAPI}))
+    assert [(e.name, e.platform) for e in entry_points(project)] == [("main.app", "web")]
+    cmap = map_code(project.files, "main.app", libraries=project.libraries(), platform="web")
+    assert {f.label: f.required for f in cmap.event} == {
+        "path.order_id": True,
+        "query.fields": False,
+        "query.term": True,
+        "query.limit": False,
+        "body": True,
+        "body.item": True,
+        "json": True,
+        "json.note": True,
+    }  # who=Depends(...) isn't from the request
+    said = [message for _, message in code_map_findings(cmap)]
+    assert any("puts request query.fields, request path.order_id into the SQL text itself" in m for m in said)
+    assert any(
+        "requests.get() at main.py line 29 and time.sleep() at main.py line 30 wait without await inside "
+        "async def search()" in m
+        for m in said
+    )
+    assert not any("create()" in m for m in said)  # its SQL takes parameters
+    assert next(n for n in code_graph(cmap).nodes if n.kind == "event").label == "The request"
+    assert next(n for n in code_graph(cmap).nodes if n.kind == "handler").icon == "fastapi-icon"  # the app's logo
+    plain = map_code(project.files, "main.app", libraries=project.libraries())  # plain Python: no request
+    assert not plain.event and not any("SQL injection" in m for _, m in code_map_findings(plain))
+
+
+def test_a_flask_views_url_values_and_request_are_the_input(tmp_path: Path) -> None:
+    from code_node.analysis.findings import code_map_findings
+
+    source = (
+        "import os\nimport sqlite3\nfrom flask import Flask, request\n\napp = Flask(__name__)\n"
+        'db = sqlite3.connect("x.db")\n\n\n@app.route("/users/<int:user_id>")\ndef user(user_id):\n'
+        '    return db.execute("SELECT * FROM users WHERE id = %s" % user_id).fetchone()\n\n\n'
+        '@app.post("/search")\ndef search():\n    q = request.args.get("q", "")\n'
+        '    team = request.get_json()["team"]\n'
+        "    db.execute(f\"SELECT * FROM users WHERE name = '{q}' AND team = '{team}'\")\n"
+        '    os.system("grep " + request.form["pattern"] + " app.log")\n'
+    )
+    project = read_project(write(tmp_path / "code", {"app.py": source}))
+    entry = entry_points(project)[0]
+    assert (entry.name, entry.platform) == ("app.app", "web")
+    cmap = map_code(project.files, entry.name, libraries=project.libraries(), platform=entry.platform)
+    assert [f.label for f in cmap.event] == [
+        "path.user_id",
+        "args",
+        "args.q",
+        "json",
+        "json.team",
+        "form",
+        "form.pattern",
+    ]
+    said = [message for _, message in code_map_findings(cmap)]
+    assert any("puts request path.user_id into the SQL text" in m for m in said)
+    assert any("puts request args.q, request json.team into the SQL text" in m for m in said)
+    assert any("shell command with request form.pattern in it" in m for m in said)
+
+
+def test_django_urls_are_followed_through_include_views_and_routers(tmp_path: Path) -> None:
+    from code_node.analysis.findings import code_map_findings
+
+    views = (
+        "import json\nfrom django.db import connection\nfrom django.views import View\n"
+        "from django.views.decorators.http import require_GET\nfrom rest_framework import viewsets\n\n\n"
+        '@require_GET\ndef order_list(request):\n    status = request.GET.get("status")\n'
+        "    with connection.cursor() as cursor:\n"
+        "        cursor.execute(f\"SELECT * FROM orders WHERE status = '{status}'\")\n\n\n"
+        "class OrderDetail(View):\n    def get(self, request, pk):\n        return pk\n\n"
+        '    def post(self, request, pk):\n        note = json.loads(request.body)["note"]\n\n\n'
+        "class ItemViewSet(viewsets.ViewSet):\n    def retrieve(self, request, pk=None):\n        return pk\n"
+    )
+    urls = (
+        "from django.urls import include, path\nfrom rest_framework.routers import DefaultRouter\n"
+        'from . import views\n\nrouter = DefaultRouter()\nrouter.register("items", views.ItemViewSet)\n\n'
+        'urlpatterns = [\n    path("orders/", views.order_list),\n'
+        '    path("orders/<int:pk>/", views.OrderDetail.as_view()),\n    path("", include(router.urls)),\n]\n'
+    )
+    project = read_project(
+        write(
+            tmp_path / "code",
+            {
+                "shop/__init__.py": "",
+                "shop/urls.py": (
+                    'from django.urls import include, path\n\nurlpatterns = [path("api/", include("orders.urls"))]\n'
+                ),
+                "orders/__init__.py": "",
+                "orders/urls.py": urls,
+                "orders/views.py": views,
+            },
+        )
+    )
+    found = entry_points(project)  # the site's URLs first: they include the app's
+    assert [(e.name, e.platform) for e in found] == [
+        ("shop.urls.urlpatterns", "web"),
+        ("orders.urls.urlpatterns", "web"),
+    ]
+    cmap = map_code(project.files, found[0].name, libraries=project.libraries(), platform="web")
+    assert [(method, path) for method, path, _ in cmap.routes] == [
+        ("GET", "/api/items/<pk>/"),
+        ("GET", "/api/orders/"),
+        ("GET", "/api/orders/<int:pk>/"),
+        ("POST", "/api/orders/<int:pk>/"),
+    ]
+    assert {"path.pk", "GET.status", "body (JSON).note"} <= {f.label for f in cmap.event}
+    said = [message for _, message in code_map_findings(cmap)]
+    assert any("puts request GET.status into the SQL text" in m for m in said)
+    assert next(n for n in code_graph(cmap).nodes if n.kind == "handler").icon == "django-icon"
+
+
+def test_a_platform_plugin_finds_its_entry_points_and_adds_findings(tmp_path: Path, monkeypatch) -> None:
+    import ast
+
+    from code_node import platforms as platformsmod
+    from code_node.platforms import Platform
+
+    class Worker(Platform):
+        name = "worker"
+        title = "Job runner"
+        inputs = ("event",)
+        input_name = "the job"
+
+        def find_entries(self, module: str, tree: ast.Module) -> list[tuple[str, int, str]]:
+            return [
+                (n.name, n.lineno, "a job")
+                for n in tree.body
+                if isinstance(n, ast.FunctionDef) and n.name.startswith("job_")
+            ]
+
+        def findings(self, cmap) -> list[tuple[str, str]]:
+            return [("info", f"{len(cmap.event)} fields of the job are read.")]
+
+    platformsmod.platforms()  # the built-in ones first
+    monkeypatch.setitem(platformsmod._platforms, "worker", Worker())
+    project = read_project(write(tmp_path, {"jobs.py": "def job_resize(job):\n    return job['size']\n"}))
+    found = entry_points(project)
+    assert [(e.name, e.platform) for e in found] == [("jobs.job_resize", "worker")]
+    cmap = map_code(project.files, found[0].name, platform=found[0].platform)
+    assert [f.label for f in cmap.event] == ["size"]
+    from code_node.analysis.findings import _code_summary, code_map_findings
+
+    assert ("info", "1 fields of the job are read.") in code_map_findings(cmap)
+    assert "It reads size from the job." in _code_summary(cmap)
diff --git a/tests/unit/test_project.py b/tests/unit/test_project.py
new file mode 100644
index 0000000..8fef4a6
--- /dev/null
+++ b/tests/unit/test_project.py
@@ -0,0 +1,112 @@
+"""
+Reading a folder: its files, module names, import paths and entry points.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from code_node.analysis.graph import code_graph
+from code_node.analysis.mapping import map_code
+from code_node.project import entry_points, read_project
+
+from support import IMPORTED_FROM_SRC, PACKAGE, write
+
+
+def test_a_console_script_in_a_src_layout_follows_methods(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path, PACKAGE))
+    found = entry_points(project)
+    assert found[0].name == "tool.cli.main"
+    assert all("tests/" not in e.file for e in found)
+    cmap = map_code(project.files, found[0].name, file=found[0].file)
+    assert [f.name for f in cmap.functions] == ["tool.cli.main", "tool.store.Store.save", "tool.store.Store._write"]
+    assert not any(n.kind == "event" for n in code_graph(cmap).nodes)
+
+
+def test_console_scripts_come_from_every_pyproject(tmp_path: Path) -> None:
+    project = read_project(
+        write(
+            tmp_path,
+            {
+                "pyproject.toml": '[project]\nname = "workspace"\n',
+                "libs/cli/pyproject.toml": '[project]\nname = "tool"\n[project.scripts]\ntool = "tool.main:run"\n',
+                "libs/cli/tool/__init__.py": "",
+                "libs/cli/tool/main.py": "def run():\n    pass\n",
+                "scripts/release.py": "def main():\n    pass\n\n\nif __name__ == '__main__':\n    main()\n",
+            },
+        )
+    )
+    assert project.configs == ["pyproject.toml", "libs/cli/pyproject.toml"]
+    first = entry_points(project)[0]
+    assert (first.name, first.why) == ("tool.main.run", "the tool command in libs/cli/pyproject.toml")
+
+
+def test_a_pyproject_in_a_subfolder_names_paths_from_there(tmp_path: Path) -> None:
+    files = {f"services/orders/{name}": text for name, text in IMPORTED_FROM_SRC.items()}
+    files["services/orders/pyproject.toml"] = '[tool.pyright]\nextraPaths = ["src", "../../missing"]\n'
+    assert read_project(write(tmp_path, files)).paths == ["services/orders/src/"]
+
+
+def test_pyproject_paths_without_tomllib(monkeypatch) -> None:
+    from code_node.project import _pyproject_paths
+
+    text = (
+        '[project]\nname = "x"\n[tool.pyright]\nextraPaths = [\n  "src",\n  "lib",\n]\n'
+        '[tool.mypy]\nmypy_path = "a:b"\n[tool.setuptools.package-dir]\n"" = "pkgs"\n'
+        '[[tool.poetry.packages]]\ninclude = "app"\nfrom = "apps"\n'
+    )
+    expected = ["src", "lib", "a", "b", "pkgs", "apps"]
+    assert _pyproject_paths(text) == expected
+    monkeypatch.setitem(__import__("sys").modules, "tomllib", None)  # as on Python 3.10
+    assert _pyproject_paths(text) == expected
+
+
+def test_syntax_warnings_stay_out_of_the_terminal(tmp_path: Path) -> None:
+    import warnings
+
+    code = 'import re\n\n\ndef main():\n    return re.match("\\d+", "1")\n'  # '\\d' in a plain string: a SyntaxWarning
+    project = read_project(write(tmp_path, {"app.py": code}))
+    with warnings.catch_warnings(record=True) as caught:
+        warnings.simplefilter("always")
+        assert "app.py" in project.trees
+        map_code(project.files, "app.main")
+    assert not caught
+
+
+TOOL = {
+    "pyproject.toml": "",
+    "pkg/__init__.py": "",
+    "pkg/tool.py": (
+        "def helper():\n    pass\n\n\ndef run():\n    helper()\n\n\nclass Orders:\n    def _load(self):\n"
+        '        pass\n\n    def save(self):\n        pass\n\n\nif __name__ == "__main__":\n    run()\n'
+    ),
+    "pkg/sub/deep.py": "def x():\n    pass\n",
+}
+
+
+def test_where_to_start_in_one_file_best_first(tmp_path: Path) -> None:
+    from code_node.project import entries_in_file
+
+    project = read_project(write(tmp_path, TOOL))
+    assert [(e.name, e.why) for e in entries_in_file(project, "pkg/tool.py")] == [
+        ("pkg.tool.run", 'runs under if __name__ == "__main__"'),
+        ("pkg.tool.helper", "a function in this file"),
+        ("pkg.tool.Orders.save", "a method of Orders"),  # its public methods before its private ones
+        ("pkg.tool.Orders._load", "a method of Orders"),
+    ]
+    assert [e.name for e in entries_in_file(project, "pkg/tool.py", "Orders.save")] == ["pkg.tool.Orders.save"]
+    assert entries_in_file(project, "missing.py") == []
+
+
+def test_a_partly_typed_name_and_a_file_s_project(tmp_path: Path) -> None:
+    from code_node.project import entry_in_files, functions_matching, project_root
+
+    root = write(tmp_path / "repo", TOOL)
+    project = read_project(root)
+    assert project.modules["pkg/tool.py"] == "pkg.tool"
+    assert project.modules["pkg/sub/deep.py"] == "deep"  # pkg/sub has no __init__.py: Python finds it beside itself
+    assert [e.name for e in functions_matching(project, "SAVE")] == ["pkg.tool.Orders.save"]
+    found = entry_in_files(project, "pkg.tool.Orders.save")
+    assert found is not None and (found.file, found.why) == ("pkg/tool.py", "given")
+    assert project_root(root / "pkg/sub/deep.py") == root  # the pyproject.toml above it
+    assert project_root(tmp_path / "loose" / "x.py") == tmp_path / "loose"
diff --git a/tests/unit/test_reader.py b/tests/unit/test_reader.py
new file mode 100644
index 0000000..914455e
--- /dev/null
+++ b/tests/unit/test_reader.py
@@ -0,0 +1,243 @@
+"""
+The reader: what it follows from an entry point, and what each name holds.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from code_node.analysis.graph import code_graph
+from code_node.analysis.mapping import map_code
+from code_node.project import entry_points, read_project
+
+from support import HANDLER, PACKAGE, write
+
+
+def test_a_lambda_handler_is_found_and_mapped(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path, {"app.py": HANDLER}))
+    found = entry_points(project)
+    assert [(e.name, e.platform) for e in found] == [("app.lambda_handler", "lambda")]
+    cmap = map_code(project.files, "app.lambda_handler", libraries=project.libraries(), platform="lambda")
+    assert [c.operation for c in cmap.aws] == ["GetObject"]
+    assert [e.name for e in cmap.env] == ["HOOK"]
+    assert {i.top: i.source for i in cmap.imports}["requests"] == "package"
+    kinds = {n.kind for n in code_graph(cmap).nodes}
+    assert {"event", "env", "handler", "function", "aws", "http"} <= kinds
+
+
+def test_a_method_can_be_the_entry_point(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path, PACKAGE))
+    cmap = map_code(project.files, "tool.store.Store.save")
+    assert cmap.entry == "tool.store.Store.save"
+    assert [f.name for f in cmap.functions] == ["tool.store.Store.save", "tool.store.Store._write"]
+
+
+def test_modules_beside_the_entry_point_are_its_own_code(tmp_path: Path) -> None:
+    # a Lambda function's folder: its handler imports the files beside it by their own names, though the folder is
+    # also a package from the project's root
+    project = read_project(
+        write(
+            tmp_path,
+            {
+                "src/app/__init__.py": "",
+                "src/app/handler.py": "from helpers import load\n\n\ndef lambda_handler(event, context):\n    load()\n",
+                "src/app/helpers.py": (
+                    "import boto3\n\n\ndef load():\n    boto3.client('s3').get_object(Bucket='b', Key='k')\n"
+                ),
+            },
+        )
+    )
+    cmap = map_code(project.files, "app.handler.lambda_handler", libraries=project.libraries())
+    assert [f.name for f in cmap.functions] == ["app.handler.lambda_handler", "helpers.load"]
+    assert [(c.service, c.operation) for c in cmap.aws] == [("s3", "GetObject")]
+    assert next(i for i in cmap.imports if i.module == "helpers").source == "own"
+    assert cmap.other_files == 0  # helpers.py is read, though it has two names
+
+
+def test_cli_commands_are_followed_from_the_app(tmp_path: Path) -> None:
+    source = (
+        "import typer\n\napp = typer.Typer()\n\n\ndef helper():\n    pass\n\n\n@app.command()\n"
+        'def sync_all():\n    helper()\n\n\n@app.command("show")\ndef display():\n    pass\n\n\n'
+        "def main():\n    app()\n"
+    )
+    project = read_project(write(tmp_path, {"pyproject.toml": '[project.scripts]\nt = "cli:main"\n', "cli.py": source}))
+    assert entry_points(project)[0].name == "cli.app"
+    cmap = map_code(project.files, "cli.app")
+    assert [(method, path) for method, path, _ in cmap.routes] == [("CLI", "sync-all"), ("CLI", "show")]
+    assert "cli.helper" in {f.name for f in cmap.functions}
+
+
+IDIOMS = """
+class Base:
+    def __init__(self, name):
+        self.setup(name)
+
+    def setup(self, name):
+        open(name, "w").write("x")
+
+
+class Repo(Base):
+    def __init__(self, name):
+        super().__init__(name)
+
+    @property
+    def size(self):
+        return count()
+
+    @size.setter
+    def size(self, value):
+        pass
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        close()
+
+    def save(self, item):
+        pass
+
+
+def count():
+    pass
+
+
+def close():
+    pass
+
+
+def main(item):
+    repo = Repo("x")
+    n = repo.size
+    with Repo("y") as r:
+        r.save(item)
+"""
+
+
+def test_super_properties_and_with_blocks_are_followed(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path, {"app.py": IDIOMS}))
+    cmap = map_code(project.files, "app.main")
+    reached = {f.name for f in cmap.functions}
+    assert {"app.Base.__init__", "app.Base.setup"} <= reached  # through super().__init__()
+    assert {"app.Repo.size", "app.count"} <= reached  # repo.size runs its getter, not its setter
+    # r is what __enter__ returns, and __exit__ runs after the block
+    assert {"app.Repo.__enter__", "app.Repo.save", "app.Repo.__exit__", "app.close"} <= reached
+    with_step = next(s for s in cmap.steps[0].steps if s.kind == "with")
+    assert [s.code for s in with_step.steps] == ["r.save(item)", "# leaving the with block: __exit__ runs"]
+    assert [c.name for c in with_step.calls] == ["app.Repo.__init__", "app.Repo.__enter__"]
+
+
+DISPATCH = """
+import os
+import boto3
+
+s3 = boto3.client("s3")
+
+
+def init():
+    pass
+
+
+def deploy(name):
+    s3.put_object(Bucket=os.environ["BUCKET"], Key=f"apps/{name}", Body=b"")
+
+
+def main(command, names):
+    if command == "init":
+        init()
+    elif command == "deploy":
+        for name in names:
+            if not name:
+                continue
+            deploy(name)
+"""
+
+
+def test_what_names_hold_where_arguments_come_from_and_when_calls_run(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path, {"app.py": DISPATCH}))
+    cmap = map_code(project.files, "app.main")
+    steps = list(cmap.steps[0].walk())
+    calls = {s.name: s.when for s in steps if s.kind == "def" and s.name != "app.main"}
+    # the if around each call; `if not name: continue` makes the rest of the loop run only when name
+    assert calls == {"app.init": ["command == 'init'"], "app.deploy": ["command == 'deploy'", "name"]}
+    put = next(c for c in cmap.aws if c.operation == "PutObject")
+    assert put.args == [("Bucket", "env BUCKET"), ("Key", "f'apps/{name}'"), ("Body", "b''")]
+    line = next(s for s in steps if s.given)
+    assert line.given[:2] == [("S3 PutObject Bucket", "env BUCKET"), ("S3 PutObject Key", "f'apps/{name}'")]
+    holds = next(s for s in cmap.startup[0].walk() if s.holds)
+    assert holds.holds == [("s3", "an S3 client")]
+    graph = code_graph(cmap)
+    deploy = next(n for n in graph.nodes if n.label == "deploy()")
+    assert deploy.when == "command == 'deploy'"  # the graph says the if nearest around the call
+    assert any(e.kind == "call" and e.when == deploy.when for e in graph.edges)
+    assert "|\"when command == 'deploy'\"|" in graph.mermaid()
+
+
+LATE = {
+    "pkg/__init__.py": "",
+    "pkg/app.py": (
+        "from .util import *\nfrom . import store\ntry:\n    import ujson as json\nexcept ImportError:\n"
+        "    import json\n\n\ndef main():\n    import boto3\n    helper()\n    _hidden()\n    store.save()\n"
+        "    boto3.client('sqs').send_message(QueueUrl='q', MessageBody='x')\n    other()\n\n\n"
+        "def other():\n    boto3.client('s3').get_object(Bucket='b', Key='k')\n"
+    ),
+    "pkg/util.py": "def helper():\n    pass\n\n\ndef _hidden():\n    pass\n",
+    "pkg/store.py": "def save():\n    from pkg.db import put\n    put()\n",
+    "pkg/db.py": "import boto3\n\n\ndef put():\n    boto3.client('dynamodb').put_item(TableName='t', Item={})\n",
+}
+
+
+def test_imports_inside_a_function_are_followed_and_said_to_run_late() -> None:
+    cmap = map_code(LATE, "pkg.app.main")
+    # store.save() imports pkg.db only when it runs, and its call to DynamoDB is still followed
+    assert [f.name for f in cmap.functions] == [
+        "pkg.app.main",
+        "pkg.util.helper",
+        "pkg.store.save",
+        "pkg.db.put",
+        "pkg.app.other",
+    ]
+    aws = {(c.service, c.operation): c for c in cmap.aws}
+    assert aws[("dynamodb", "PutItem")].function == "pkg.db.put" and not aws[("dynamodb", "PutItem")].guessed
+    assert not aws[("sqs", "SendMessage")].guessed  # boto3 is what main() imported
+    # other() has no boto3 of its own: Python would raise NameError, so its call is only guessed from its shape
+    assert aws[("s3", "GetObject")].guessed
+    imports = {(i.module, i.file, i.line): i for i in cmap.imports}
+    assert not imports[("boto3", "pkg/app.py", 10)].startup and not imports[("pkg.db", "pkg/store.py", 2)].startup
+    assert imports[("boto3", "pkg/db.py", 1)].startup and imports[("pkg.util", "pkg/app.py", 1)].startup
+    assert imports[("ujson", "pkg/app.py", 4)].optional and not imports[("json", "pkg/app.py", 6)].optional
+    assert imports[("pkg.db", "pkg/store.py", 2)].source == "own"
+
+
+def test_code_it_cant_follow_gives_a_partial_map_not_a_traceback(monkeypatch: pytest.MonkeyPatch) -> None:
+    from code_node.analysis import reader
+
+    assert "doesn't name a module and a function" in map_code({"a.py": "def main():\n    pass\n"}, "main").note
+    assert "No file matches the entry point nope.main" in map_code({"a.py": ""}, "nope.main").note
+    # a module that doesn't parse is left out; what imports it is still read
+    files = {"broken.py": "def oops(:\n", "ok.py": "import broken\n\n\ndef main():\n    broken.oops()\n"}
+    cmap = map_code(files, "ok.main")
+    assert [f.name for f in cmap.functions] == ["ok.main"] and not cmap.limited
+    calls = []
+
+    def fails(self, entry: str) -> None:
+        calls.append(entry)
+        raise ValueError("something new")
+
+    monkeypatch.setattr(reader._CodeReader, "read", fails)
+    cmap = map_code(LATE, "pkg.app.main")
+    assert calls == ["pkg.app.main"]
+    assert cmap.limited == "stopped partway, at code it couldn't follow (ValueError: something new)"
+
+
+def test_the_entry_point_s_file_is_found_from_its_name() -> None:
+    from code_node.analysis.mapping import entry_file
+
+    names = ["src/tool/__init__.py", "src/tool/cli.py", "tests/tool/cli.py", "app.py"]
+    assert entry_file("tool.cli.main", names) == ("src/tool/cli.py", "src/")  # the shortest path that matches
+    assert entry_file("tool.cli.App.run", names) == ("src/tool/cli.py", "src/")  # a method
+    assert entry_file("tool.main", names) == ("src/tool/__init__.py", "src/")  # a package's __init__
+    assert entry_file("app.handler", names) == ("app.py", "")
+    assert entry_file("missing.main", names) is None
diff --git a/tests/unit/test_report.py b/tests/unit/test_report.py
new file mode 100644
index 0000000..e51587e
--- /dev/null
+++ b/tests/unit/test_report.py
@@ -0,0 +1,158 @@
+"""
+Drawing: the page's boxes, code panels, the step-by-step walk, logos and editor links.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+
+from code_node.analysis.graph import code_graph
+from code_node.analysis.mapping import map_code
+from code_node.cli import main
+from code_node.project import read_project
+from code_node.report.style import render_page
+from code_node.report.walk import _Walk, walk_stops
+
+from support import HANDLER, STORES, page_blocks_for, write
+
+
+def test_clicking_a_box_shows_its_code(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path / "code", {"app.py": HANDLER}))
+    cmap = map_code(project.files, "app.lambda_handler", libraries=project.libraries(), platform="lambda")
+    graph = code_graph(cmap)
+    load = next(n for n in graph.nodes if n.label == "load()")
+    assert [(s.file, s.start, s.end, s.lit) for s in load.code] == [("app.py", 9, 10, [10])]
+    s3 = next(n for n in graph.nodes if n.kind == "aws")
+    assert [(s.start, s.end, s.lit) for s in s3.code] == [(9, 10, [10])]  # kept within load()
+    out = tmp_path / "page.html"
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
+    page = out.read_text()
+    assert f'<a class="cl" href="#cn-code-{load.id}"' in page and f'id="cn-code-{load.id}"' in page
+    assert '<span class="sl lit"><span class="sn">10</span>' in page
+    # a click outside the panel closes it, as its × does; without JavaScript the × still does
+    assert page.count("<script>") == 1 and 'location.hash = "cn-closed"' in page and 'href="#cn-closed"' in page
+
+
+def test_the_steps_are_walked_in_the_order_the_code_runs(tmp_path: Path) -> None:
+    project = read_project(write(tmp_path / "code", {"app.py": HANDLER}))
+    cmap = map_code(project.files, "app.lambda_handler", libraries=project.libraries(), platform="lambda")
+    walk = _Walk(cmap.startup, cmap.steps, functions=cmap.functions, sources=project.files)
+    assert [(line, stack) for line, _, stack in walk_stops(walk)] == [
+        (6, ["app.py, imported"]),  # s3 = boto3.client("s3"), when it's imported
+        (13, ["lambda_handler()"]),
+        (14, ["lambda_handler()"]),  # for record in event["Records"]:
+        (15, ["lambda_handler()"]),  # load(...)
+        (9, ["lambda_handler()", "load()"]),  # into load()
+        (10, ["lambda_handler()", "load()"]),
+        (16, ["lambda_handler()"]),  # back out: requests.post(...)
+    ]
+    html = render_page([walk], "walk")
+    assert 'id="cw0" checked' in html and html.count('name="cnd-walk"') == 7
+    assert '<label class="wbt" for="cw6" title="Run what this line calls without going in' in html  # Skip call
+    assert (
+        '<label class="wbt" for="cw6" title="Run the rest of load() and go back to where it was called">'
+        "Finish <code>load()</code>"
+    ) in html  # from inside load()
+    assert '<div class="whead">Makes an S3 client</div>' in html  # each step said in plain words
+    assert 'id="cx1"' in html and 'id="cx0"' not in html  # lambda_handler() folds; the import line has nothing under it
+    assert "#cx1:checked~.wu1" in html and 'class="wil k-def wu1 wu2 wu3"' in html  # load(), inside its caller's fold
+    assert '<span class="wtx">Goes through each <code>record</code> in <code>event[&#x27;Records&#x27;]</code>' in html
+    assert '<label class="sl" for="cw5"><span class="sn">10</span>' in html  # load()'s line 10 jumps to its step
+    assert ".cnd #cw5:checked~.wf2{--k:1}" in html  # and lights the second line of load()
+    out = tmp_path / "page.html"
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
+    page = out.read_text()
+    assert '<input type="radio" class="tr" name="cnd-tab0" id="cnd-tab0-0" checked>' in page
+    assert "Step by step<small>7 steps</small>" in page and page.count("<script>") == 1
+
+
+def test_arrows_from_one_box_run_together_and_the_graph_zooms(tmp_path: Path) -> None:
+    from code_node.report.graph import _g_cards, _graph_layout
+
+    chain = (
+        "import os\n\n\ndef main():\n    a()\n\n\ndef a():\n    b()\n\n\ndef b():\n    os.environ['B']\n    c()\n\n\n"
+        "def c():\n    os.environ['C']\n"
+    )
+    project = read_project(write(tmp_path / "code", {"app.py": chain}))
+    graph = code_graph(map_code(project.files, "app.main"))
+    _, routes, *_ = _graph_layout(graph, _g_cards(graph))
+    env = [routes[i] for i, e in enumerate(graph.edges) if e.kind == "env"]
+    assert len(env) == 2 and env[0][:2] == env[1][:2]  # one line through the columns both cross, then they part
+    out = tmp_path / "page.html"
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
+    page = out.read_text()
+    assert 'class="cgs cgz-auto" name="cn-graph0-zoom" id="cn-graph0-auto" checked' in page
+    assert 'class="cgs cgfs" id="cn-graph0-full"' in page and ">Full screen<" in page and page.count("<script>") == 1
+    # with JavaScript it pans and zooms like a canvas, and says so; without it, it scrolls
+    assert (
+        'box.addEventListener("wheel"' in page
+        and 'class="cgtm pzo"' in page
+        and 'class="zi"' in page
+        and "Drag to move about" in page
+    )
+    assert ".cnd .cgw:not(.pz) .pzo{display:none}" in page
+
+
+def test_a_box_says_what_it_is_in_a_card_on_hover(tmp_path: Path) -> None:
+    write(tmp_path / "code", {"app.py": HANDLER})
+    out = tmp_path / "page.html"
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
+    page = out.read_text()
+    assert '<g class="cn ' in page and not re.search(r'<g class="cn [^>]*><title>', page)  # not the plain tooltip
+    assert '<foreignObject class="ctip tp-f0' in page and ":hover) .tp-f0{display:inline}" in page
+    # its def as written, in colour
+    assert (
+        '<pre class="ctc"><span class="pk">def</span> <span class="pf">lambda_handler</span>(event, context):' in page
+    )
+
+
+def test_line_links_open_the_editor(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    from code_node.report.editor import editor_link, open_at
+
+    monkeypatch.delenv("WSL_DISTRO_NAME", raising=False)
+
+    link = editor_link("vscode", "/home/me/my code")
+    assert open_at(link, "app/main.py", 12) == "vscode://file/home/me/my%20code/app/main.py:12"
+    assert open_at(editor_link("cursor", "/home/me/code", wsl="Ubuntu"), "a.py", 3) == (
+        "cursor://vscode-remote/wsl+Ubuntu/home/me/code/a.py:3"
+    )
+    assert open_at(editor_link("vscode", "C:\\code"), "a.py", 1) == "vscode://file/C:/code/a.py:1"
+    assert editor_link("none", "/home/me/code") == ""
+    write(tmp_path / "code", {"app.py": HANDLER})
+    out = tmp_path / "page.html"
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out)]) == 0
+    assert f'href="vscode://file{(tmp_path / "code").as_posix()}/app.py:' in out.read_text()
+    assert main([str(tmp_path / "code"), "--no-open", "-o", str(out), "--editor", "none"]) == 0
+    assert "vscode://" not in out.read_text()
+
+
+def test_services_show_their_real_logos(tmp_path: Path) -> None:
+    from code_node.report.brands import logo, logo_names
+    from code_node.report.graph import _g_logo
+
+    assert all(logo(name) is not None for name in logo_names())  # logos/ has a .svg for each one brands.py names
+    project = read_project(write(tmp_path, {"app.py": STORES}))
+    graph = code_graph(map_code(project.files, "app.handler", libraries=project.libraries(), platform="lambda"))
+    boxes = {n.label: n for n in graph.nodes}
+    assert _g_logo(boxes["Redis"]) == logo("redis") and _g_logo(boxes["SQLite"]) == logo("sqlite")
+    assert _g_logo(boxes["handler()"]) is None  # its own functions keep their line drawing, a Lambda handler too
+    page = render_page(page_blocks_for(project, "app.handler"), "x")
+    assert page.count('<svg class="logo"') == 4  # SQLite, Redis, MongoDB, Anthropic
+    assert 'id="cnl-sqlite-' in page  # each logo's gradient ids get its own prefix, so two logos never share one
+    assert 'fill="#181818"' not in page  # Anthropic's black follows the text colour, for dark mode
+
+
+def test_logos_come_in_two_sizes_as_favicons_do(tmp_path: Path) -> None:
+    from code_node.report.brands import AWS_GLYPHS, fills, logo, logo_for, small_logo
+
+    # AWS's detailed icons have a small mark for 16 to 32 px; other brands' logos are simple enough as they are
+    assert all(small_logo(name) is not None for name in AWS_GLYPHS if logo(name) is not None and fills(logo(name)))
+    assert small_logo("redis") is None and logo_for("redis", 16) == logo("redis")
+    assert logo_for("aws-s3", 24) == small_logo("aws-s3") and logo_for("aws-s3", 64) == logo("aws-s3")
+    project = read_project(write(tmp_path, {"app.py": HANDLER}))
+    page = render_page(page_blocks_for(project, "app.lambda_handler"), "x")
+    assert page.count('class="logo lgs"') == page.count('class="logo lgf"') == 1  # S3: both, the screen picks
+    assert "@media (min-resolution:2dppx)" in page