fix: integrate 24 reviewed browser/native/semantics corrections (#815)

* fix(reference): resolve emitted extensions to TypeScript source Signed-off-by: Rudy Celekli <rudy@gradiahq.com> * test(reference): retain legitimate declaration import counterparts Signed-off-by: Rudy Celekli <rudy@gradiahq.com> * fix(mcp): recognize implicit form elicitation capability Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com> * fix(ghidra): reject contradictory NativeAOT reports * fix(native): preserve thin architectures across echoed filename lines Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> * fix(native): preserve app bundle executable filename whitespace Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> * fix(doctor): validate Node-wrapped client policy Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com> * fix(reference): preserve observed entry failure reasons Signed-off-by: Rudy Celekli <rudy@gradiahq.com> * fix(artifacts): verify opaque bytes before reusing inventory identities Signed-off-by: Rudy Celekli <rudy@gradiahq.com> * fix(browser): resolve DOM destinations against document base URL Signed-off-by: Rudy Celekli <rudy@gradiahq.com> * fix: recover serialized native NIB view hierarchy Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com> * ci: exercise native compiled NIB hierarchy regressions Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com> * fix(deps): remediate reachable archive-parsing advisories Two high-severity advisories are reachable from untrusted target content: - @xmldom/xmldom 0.9.10 (via plist) parses XML plist bytes from analyzed app bundles in the keyed-archive reader. Refreshed to 0.9.12. - brace-expansion 5.0.7 (via @electron/asar -> minimatch) is reached while analyzing untrusted ASAR archives. Refreshed to 5.0.12. Both are in-range patch updates (plist declares ^0.9.10, minimatch declares ^5.0.5), so no source or API change is required and no direct dependency declaration moves. Lockfile-only change. The remaining smol-toml advisory is not included: it parses operator-owned client configuration rather than untrusted target content, and its fix moves outside the declared range and changes leading-BOM handling. * fix(semantics): link wrapped arrow Promise returns * fix(reconstruction): preserve unknown graph limitations * fix(native): preserve exact code signing identifiers Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> * fix(native): recognize only whole otool command headers Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> * fix(native): retain nm-proven literal export names Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> * fix(javascript): project decoded file URL paths Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> * fix: preserve explicit source-relative URL observation spelling Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> * fix(native): project Mach-O evidence into container file offsets Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> * fix(browser): normalize referrer policy fallback lists Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> --------- Signed-off-by: Rudy Celekli <rudy@gradiahq.com> Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com> Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> Co-authored-by: Rudy Celekli <rudy@gradiahq.com> Co-authored-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com> Co-authored-by: Kaoru0822 <aisakamimaki@gmail.com> Co-authored-by: DeryFerd <deryferdikao125@gmail.com>
2026-10-27 06:33:32 -04:00 · 2026-10-07 10:33:10 +08:00
parent 2572e1eb2f
commit 3af3811ab0
43 changed files with 2032 additions and 82 deletions
@@ -349,3 +349,40 @@ it.each([
    );
  },
 );
+it.each([
+  "Promise.resolve(1)",
+  "(Promise.resolve(1) as Promise<number>)",
+  "(Promise.resolve(1) satisfies Promise<number>)",
+  "Promise.resolve(1)!",
+  "((Promise.resolve(1) as Promise<number>)!)",
+  "(new Promise(resolve => resolve(1)) as Promise<number>)",
+  "(Promise.all([Promise.resolve(1)]) as Promise<number[]>)",
+  "(Promise.resolve(1).then(value => value) as Promise<number>)",
+])("projects a traversable returned-task link for %s", (expression) => {
+  const graph = graphFor(`const run = () => ${expression};`);
+  const promise = graph.nodes.find(
+    ({ kind, properties }) =>
+      kind === "promise" && properties.ownership === "returned",
+  );
+  const relation = graph.relations.find(
+    ({ relation: kind }) => kind === "returns-task",
+  );
+  expect(promise).toBeDefined();
+  expect(relation).toMatchObject({
+    target_node_id: promise?.node_id,
+    resolution: "resolved",
+  });
+  const returnNode = graph.nodes.find(
+    ({ node_id }) => node_id === relation?.source_node_id,
+  );
+  expect(returnNode?.kind).toBe("return-site");
+  if (returnNode === undefined)
+    throw new Error("Expected the linked return site");
+  const query = queryJavaScriptSemanticGraph(graph, {
+    seed: { kind: "semantic-node", node_id: returnNode.node_id },
+    direction: "forward-influence",
+    allowed_relations: ["returns-task"],
+  });
+  expect(query.relations).toContainEqual(relation);
+  expect(query.nodes.map(({ node_id }) => node_id)).toContain(promise?.node_id);
+});