Python: CALLS / trace_path blind to import aliases (import scan_bash as _scan_bash) #875

Summary

When a Python module imports a function under an alias (from … import scan_bash as _scan_bash) and calls the alias (_scan_bash(command)), trace_path inbound callers for the original symbol are empty (or under-reported), even though production call sites exist.

This nearly caused a false “scanner is dead scaffolding” finding in our security audit — the graph reported test-only callers for scan_bash because production sites call _scan_bash.

Environment

• Binary: codebase-memory-mcp 0.8.1
• Project: home-sean-campbell-github-willow-2.0 (public)
• Related audit: docs/audits/KART_SCANNER_BWRAP_GAP_AUDIT_2026-06-15.md Finding 2

Reproduction

Import / call site (willow/fylgja/events/pre_tool.py):

from willow.fylgja.security_scan import (
    scan_bash as _scan_bash,
    ...
)
...
issues = _scan_bash(command)  # line ~845, PreToolUse Bash branch

Graph query:

trace_path(function_name="scan_bash", direction="inbound", depth=2)

Production caller via _scan_bash is not attributed as an inbound caller of scan_bash. Grep finds the alias call; graph CALLS resolution does not bridge alias → canonical name.

Same class as hook-layer heavy import X as _X style (security scanner, MCP shims).

Expected

CALLS edges (or trace_path traversal) should resolve through Python import aliases so inbound callers of the definition are visible when the call site uses the alias binding.

Impact

• Dead-code / blast-radius audits under-report production usage.
• “Zero production callers” conclusions require grep verification for any aliased-import codebase (common in hooks and facades).

Related issues

Not the same as #763 (file-node fallback) or #871 (CommonJS require), but same symptom: empty inbound callers despite real call sites.

Confirmations

• Searched open issues for Python import alias / as _ — no exact duplicate.
• Public OSS reproduction (willow-2.0).