fix(cli): validate --entrypoint-rules before analysis starts

detect_entrypoints ran after the symbol table, venv build, Jedi and
PyCG, so a malformed --entrypoint-rules file cost minutes on a large
repo before failing with a raw traceback. Load the rules once options
are built (before the --emit schema short-circuit and well before
Codeanalyzer.analyze()) and exit cleanly on RulesError. The existing
load_rules call inside detect_entrypoints stays as-is -- loading twice
is cheap and keeps the entrypoints pipeline self-contained.

Author: rahlk

codeanalyzer/__main__.py

@@ -398,6 +398,20 @@ def main(
 
     _set_log_level(options.verbosity)
 
+    # Entrypoint rules are configuration, validated before any analysis work
+    # starts (#122 review) -- a typo must fail in milliseconds, not after the
+    # symbol table, venv build, Jedi and PyCG have all run. `detect_entrypoints`
+    # loads the rules again at its own call site; that second load is cheap
+    # and keeps the entrypoints pipeline self-contained.
+    if options.entrypoint_rules:
+        from codeanalyzer.entrypoints.rules import RulesError, load_rules
+
+        try:
+            load_rules(options.entrypoint_rules)
+        except RulesError as exc:
+            logger.error(f"Invalid --entrypoint-rules: {exc}")
+            raise typer.Exit(code=1)
+
     # The schema contract is a static artifact — no project analysis required.
     if options.emit == EmitTarget.SCHEMA:
         from codeanalyzer.neo4j.emit import emit_schema

test/test_entrypoints_e2e.py

@@ -47,3 +47,30 @@ def test_decorated_function_flagged_and_helper_not(tmp_path):
     report = data["application"]["entrypoint_report"]
     assert "inhouse" in report["frameworks_detected"]
     assert report["errors"] == []
+
+
+def test_malformed_entrypoint_rules_fails_fast_before_analysis(tmp_path):
+    """A malformed ``--entrypoint-rules`` file must exit BEFORE the symbol
+    table, venv build, Jedi and PyCG run -- not deep in the pipeline
+    (#122 review, IMPORTANT 1). Proven by wall-clock: a real analysis of
+    even this tiny fixture takes noticeably longer than the sub-second
+    failure this must produce."""
+    bad_rules = tmp_path / "bad.yml"
+    bad_rules.write_text("frameworks: [not, a, mapping]\n")
+
+    result = subprocess.run(
+        [
+            "uv", "run", "canpy",
+            "-i", str(FIXTURE),
+            "-a", "1",
+            "-o", str(tmp_path / "out"),
+            "--no-venv",
+            "--cache-dir", str(tmp_path / "cache"),
+            "--entrypoint-rules", str(bad_rules),
+        ],
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode != 0
+    assert not (tmp_path / "out" / "analysis.json").exists()
+    assert "entrypoint-rules" in (result.stderr + result.stdout).lower()