fix(javascript): preserve selected inputs and completed source evidence

src/javascript/recovery/RecoveryFiles.test.ts

@@ -1,5 +1,12 @@
 import { execFile } from "node:child_process";
-import { mkdir, stat, writeFile } from "node:fs/promises";
+import {
+  mkdir,
+  readFile,
+  realpath,
+  stat,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { expect, it, vi } from "vitest";
@@ -191,6 +198,61 @@ it("reports one file selected twice as an input error", async () => {
   });
 });
 
+it.skipIf(process.platform === "win32")(
+  "keeps distinct filesystem selections whose lexical paths collapse together",
+  async () => {
+    const root = await realpath(
+      await createTestTempDirectory("rea-recovery-selected-layout-"),
+    );
+    await mkdir(join(root, "target/child"), { recursive: true });
+    await symlink("target/child", join(root, "link"));
+    const selected = `${root}/link/../input.js`;
+    const sibling = join(root, "input.js");
+    await writeFile(selected, "export const selected = 1;\n");
+    await writeFile(sibling, "export const sibling = 2;\n");
+    const snapshots = await snapshotRecoveryInputs(
+      [selected, sibling],
+      join(root, "snapshots"),
+    );
+    expect(
+      snapshots.map(({ path, relative_path }) => ({ path, relative_path })),
+    ).toEqual([
+      { path: selected, relative_path: "target/input.js" },
+      { path: sibling, relative_path: "input.js" },
+    ]);
+    expect(await readFile(snapshots[0].snapshot_path, "utf8")).toBe(
+      "export const selected = 1;\n",
+    );
+    expect(await readFile(snapshots[1]!.snapshot_path, "utf8")).toBe(
+      "export const sibling = 2;\n",
+    );
+    await writeFile(selected, "export const selected = 3;\n");
+    const refreshed = await snapshotRecoveryInputs(
+      [selected, sibling],
+      join(root, "refreshed"),
+    );
+    expect(refreshed[0].sha256).not.toBe(snapshots[0].sha256);
+    expect(refreshed[1]!.sha256).toBe(snapshots[1]!.sha256);
+    expect(await readFile(snapshots[0].snapshot_path, "utf8")).toBe(
+      "export const selected = 1;\n",
+    );
+  },
+);
+
+it.skipIf(process.platform === "win32")(
+  "refuses a regular-file/.. traversal before deriving the snapshot layout",
+  async () => {
+    const root = await createTestTempDirectory("rea-recovery-invalid-parent-");
+    await writeFile(join(root, "file"), "not a directory");
+    await writeFile(join(root, "input.js"), "export const sibling = 1;\n");
+    const snapshots = join(root, "snapshots");
+    await expect(
+      snapshotRecoveryInputs([`${root}/file/../input.js`], snapshots),
+    ).rejects.toMatchObject({ _tag: "AnalysisInputError" });
+    await expect(stat(snapshots)).rejects.toMatchObject({ code: "ENOENT" });
+  },
+);
+
 it("reports a file and directory name clash as an input error", async () => {
   const clash = filesystemError("ENOTDIR");
 

src/javascript/recovery/RecoveryFiles.ts

@@ -9,8 +9,15 @@ import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import { ArtifactResourceScope } from "../../artifacts/ArtifactResourceScope.js";
 import { OwnedDirectoryHandle } from "../../filesystem/OwnedDirectoryHandle.js";
 import { createHash } from "node:crypto";
-import { lstat, mkdir, opendir, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import {
+  lstat,
+  mkdir,
+  opendir,
+  realpath,
+  stat,
+  writeFile,
+} from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
 import { TextDecoder } from "node:util";
 import { normalizeArtifactPath } from "../../artifacts/ArtifactPaths.js";
 import {
@@ -175,11 +182,6 @@ const snapshotRecoveryInput = async (
   signal?: AbortSignal,
   resources?: ArtifactResourceScope,
 ): Promise<RecoveryInputSnapshot> => {
-  if (!isAbsolute(path))
-    throw recoveryInputFailure(
-      "path",
-      "Select an absolute JavaScript file path",
-    );
   let bytes: Buffer;
   try {
     bytes = await readRecoveryFile(path, maximum, signal, resources);
@@ -254,17 +256,69 @@ const snapshotRecoveryInput = async (
   };
 };
 
-/** Preserve each selected file and its relative input layout without concatenation. */
+/** Resolve native parent traversal while keeping the selected final filename. */
+const recoveryInputLayoutPath = async (
+  path: string,
+  signal?: AbortSignal,
+): Promise<string> => {
+  if (!isAbsolute(path))
+    throw recoveryInputFailure(
+      "path",
+      "Select an absolute JavaScript file path",
+    );
+  try {
+    checkRecoveryCancellation(signal);
+    const parent = dirname(path);
+    // Native lookup must accept the parent before realpath can collapse it:
+    // Darwin realpath(file/..) otherwise succeeds despite ENOTDIR on reads.
+    if (!(await stat(parent)).isDirectory())
+      throw new NonRegularFileReadError(path, false);
+    const canonicalParent = await realpath(parent);
+    checkRecoveryCancellation(signal);
+    return join(canonicalParent, basename(path));
+  } catch (cause: unknown) {
+    if (cause instanceof AnalysisCancelledError) throw cause;
+    if (
+      cause instanceof Error &&
+      "code" in cause &&
+      (cause.code === "EACCES" || cause.code === "EPERM")
+    )
+      throw new AnalysisAccessDeniedError(OPERATION, path, cause.code, {
+        cause,
+      });
+    throw recoveryInputFailure(
+      "path",
+      `Cannot resolve selected JavaScript input parent ${path}: ${recoveryFailureMessage(cause)}`,
+      cause,
+    );
+  }
+};
+
+/** Own selected path interpretation, native collisions and sequential snapshots. */
 export const snapshotRecoveryInputs = async (
   paths: readonly [string, ...string[]],
   directory: string,
   signal?: AbortSignal,
   resources?: ArtifactResourceScope,
 ): Promise<readonly [RecoveryInputSnapshot, ...RecoveryInputSnapshot[]]> => {
-  let commonDirectory = dirname(resolve(paths[0]));
-  for (const path of paths) {
+  const selections: [
+    { readonly path: string; readonly layoutPath: string },
+    ...{ readonly path: string; readonly layoutPath: string }[],
+  ] = [
+    {
+      path: paths[0],
+      layoutPath: await recoveryInputLayoutPath(paths[0], signal),
+    },
+  ];
+  for (const path of paths.slice(1))
+    selections.push({
+      path,
+      layoutPath: await recoveryInputLayoutPath(path, signal),
+    });
+  let commonDirectory = dirname(selections[0].layoutPath);
+  for (const { layoutPath } of selections) {
     while (true) {
-      const fromCommon = relative(commonDirectory, resolve(path));
+      const fromCommon = relative(commonDirectory, layoutPath);
       if (
         fromCommon !== ".." &&
         !fromCommon.startsWith(`..${sep}`) &&
@@ -282,11 +336,11 @@ export const snapshotRecoveryInputs = async (
   }
   const snapshots: RecoveryInputSnapshot[] = [];
   let remaining = RECOVERY_LIMITS.inputBytes;
-  for (const path of paths) {
+  for (const { path, layoutPath } of selections) {
     const relativePath =
-      paths.length === 1
+      selections.length === 1
         ? "bundle.js"
-        : relative(commonDirectory, resolve(path)).split(sep).join("/");
+        : relative(commonDirectory, layoutPath).split(sep).join("/");
     try {
       // Wakaru's multi-input public paths interpret backslashes as separators.
       if (relativePath.includes("\\"))

src/javascript/sourceMaps/SourceMapCommand.test.ts

@@ -10,13 +10,34 @@ import {
   ProviderProcessSupervisor,
   spawnOwnedProviderProcess,
 } from "../../process/ProviderProcess.js";
-import { WEB_SOURCE_MAP_LIMITS } from "../../domain/webSourceLocation.js";
+import {
+  WEB_SOURCE_MAP_LIMITS,
+  type WebSourceMapReport,
+} from "../../domain/webSourceLocation.js";
+import { traceSourceMap } from "./TraceSourceMap.js";
 import {
   runSourceMapCommand,
   SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES,
   type SourceMapCleanupRetention,
 } from "./SourceMapCommand.js";
 
+const report = traceSourceMap(
+  JSON.stringify({ version: 3, sources: [], names: [], mappings: "" }),
+  "https://app.test/app.map",
+  { line: 1, column: 0 },
+);
+const completedReport: WebSourceMapReport = {
+  ...report,
+  runtime:
+    report.runtime.id === "node-v8"
+      ? { ...report.runtime, v8_heap_limit_bytes: 200 * 1024 * 1024 }
+      : {
+          ...report.runtime,
+          process_memory_limit_bytes: SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES,
+        },
+};
+const completedCodec = `process.stdout.write(${JSON.stringify(JSON.stringify({ state: "success", report: completedReport }))})`;
+
 const unexpectedCleanup: SourceMapCleanupRetention = {};
 afterEach(async () => {
   const owner = unexpectedCleanup.owner;
@@ -114,7 +135,7 @@ it.each([null, { caller: "late source-map cancellation" }])(
           launcher: async (options) =>
             spawnOwnedProviderProcess({
               ...options,
-              arguments: ["-e", 'process.stdout.write("complete")'],
+              arguments: ["-e", completedCodec],
             }),
         },
         retainedCleanup,
@@ -141,8 +162,8 @@ it.each([null, { caller: "late source-map cancellation" }])(
 );
 
 it("returns completed codec output after successful cleanup", async () => {
-  const result = await runChild(undefined, 'process.stdout.write("complete")');
-  expect(result).toEqual({ ok: true, value: "complete" });
+  const result = await runChild(undefined, completedCodec);
+  expect(result).toEqual({ ok: true, value: completedReport });
 });
 
 it("preserves exact caller reason when cancellation precedes process exit", async () => {

src/javascript/sourceMaps/SourceMapCommand.ts

@@ -14,13 +14,15 @@ import {
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { ProviderCleanupError } from "../../domain/providerCleanupError.js";
 import type { JsonValue } from "../../domain/jsonValue.js";
-import { err, ok, type Result } from "../../domain/result.js";
+import { err, type Result } from "../../domain/result.js";
 import { noRuntimeOverrideSentence } from "../../domain/browserDeadline.js";
 import {
   DEFAULT_WEB_SOURCE_MAP_DECODE_TIMEOUT_MS,
   WEB_SOURCE_MAP_LIMITS,
   webSourceMapDecodeTimeoutRecovery,
+  type WebSourceMapReport,
 } from "../../domain/webSourceLocation.js";
+import { parseSourceMapReply } from "./SourceMapReply.js";
 import { PrivateRuntimeRoot } from "../../process/PrivateRuntimeRoot.js";
 import {
   RuntimeControlUnavailableError,
@@ -99,7 +101,7 @@ export class SourceMapCleanupFailure extends ProviderCleanupError {
   }
 }
 
-/** Run a trusted codec command and release its process/root before returning output. */
+/** Interpret a trusted codec reply, then release its process and private root. */
 export const runSourceMapCommand = async (
   request: string,
   path: string,
@@ -107,7 +109,7 @@ export const runSourceMapCommand = async (
   dependencies: SourceMapDecoderDependencies,
   retainedCleanup: SourceMapCleanupRetention,
   decodeTimeoutMs: number = DEFAULT_WEB_SOURCE_MAP_DECODE_TIMEOUT_MS,
-): Promise<Result<string, AnalysisError>> => {
+): Promise<Result<WebSourceMapReport, AnalysisError>> => {
   try {
     await (dependencies.prepareOwnership ?? prepareProcessOwnershipInspection)(
       options?.signal,
@@ -135,10 +137,14 @@ export const runSourceMapCommand = async (
     options?.signal,
   );
   const command = new OwnedCodec(path, dependencies, deadline, decodeTimeoutMs);
-  let result: Result<string, AnalysisError>;
+  let result: Result<WebSourceMapReport, AnalysisError>;
   try {
     await command.start(request);
-    result = ok(await command.collect());
+    result = parseSourceMapReply(
+      await command.collect(),
+      path,
+      SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES,
+    );
   } catch (cause: unknown) {
     result = err(command.failure(cause));
   } finally {
@@ -146,15 +152,18 @@ export const runSourceMapCommand = async (
     deadline.dispose();
   }
   const cleanup = await command.close();
+  const observation = result.ok ? result.value : undefined;
   const completed =
     result.ok && options?.signal?.aborted
       ? err(
           new AnalysisCancelledError(OPERATION, {
             cause: options.signal.reason,
+            partialObservation: observation,
           }),
         )
       : result;
   if (cleanup === undefined) return completed;
+  if (observation !== undefined) cleanup.retainPartialObservation(observation);
   retainedCleanup.owner = command;
   return completed.ok
     ? err(cleanup)

src/javascript/sourceMaps/SourceMapDecoder.ts

@@ -3,25 +3,18 @@ import type { WebSourceMapPort } from "../../application/WebSourceLocationPorts.
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
 import {
   AnalysisCancelledError,
-  AnalysisCapabilityUnavailableError,
   AnalysisInputError,
-  AnalysisOutputError,
 } from "../../domain/analysisErrorCore.js";
 import { ArtifactOperationError } from "../../domain/artifactOperationError.js";
-import { err, ok, type Result } from "../../domain/result.js";
-import { javaScriptRuntime } from "../../domain/runtimeVersion.js";
+import { err, type Result } from "../../domain/result.js";
 import { noRuntimeOverrideSentence } from "../../domain/browserDeadline.js";
 import {
   DEFAULT_WEB_SOURCE_MAP_DECODE_TIMEOUT_MS,
   WEB_SOURCE_MAP_LIMITS,
   type WebSourceMapReport,
 } from "../../domain/webSourceLocation.js";
+import { sourceMapCodecInputSchema } from "./SourceMapCodecProtocol.js";
 import {
-  sourceMapCodecInputSchema,
-  sourceMapCodecReplySchema,
-} from "./SourceMapCodecProtocol.js";
-import {
-  SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES,
   runSourceMapCommand,
   type SourceMapCleanupOwner,
   type SourceMapCleanupRetention,
@@ -125,36 +118,7 @@ export class SourceMapDecoder implements WebSourceMapPort {
     );
     if (retainedCleanup.owner !== undefined)
       this.#pendingCleanup = retainedCleanup.owner;
-    if (!response.ok) return response;
-    let value: unknown;
-    try {
-      value = JSON.parse(response.value);
-    } catch (cause: unknown) {
-      return err(
-        new AnalysisOutputError(
-          OPERATION,
-          `Malformed codec JSON reply: ${cause instanceof Error ? cause.message : String(cause)}`,
-        ),
-      );
-    }
-    const reply = sourceMapCodecReplySchema.safeParse(value);
-    if (!reply.success)
-      return err(
-        new AnalysisOutputError(
-          OPERATION,
-          `Malformed codec reply: ${reply.error.message}`,
-        ),
-      );
-    if (options?.signal?.aborted)
-      return err(
-        new AnalysisCancelledError(OPERATION, { cause: options.signal.reason }),
-      );
-    if (reply.data.state === "failure")
-      return codecFailure(input.path, reply.data.reason, reply.data.message);
-    const runtimeFailure = codecRuntimeFailure(reply.data.report.runtime);
-    return runtimeFailure === undefined
-      ? ok(reply.data.report)
-      : err(new AnalysisOutputError(OPERATION, runtimeFailure));
+    return response;
   }
 
   async close(): Promise<void> {
@@ -180,55 +144,3 @@ export class SourceMapDecoder implements WebSourceMapPort {
     return undefined;
   }
 }
-/**
- * The codec runs on this process's executable. Only a V8 report carries a heap
- * limit; a Bun report must name the process limit its launcher enforced.
- */
-const codecRuntimeFailure = (
-  runtime: WebSourceMapReport["runtime"],
-): string | undefined => {
-  if (
-    runtime.id !==
-    (javaScriptRuntime(process.versions).id === "bun" ? "bun" : "node-v8")
-  )
-    return `Codec reported runtime ${runtime.id}, not the runtime that launched it.`;
-  if (
-    runtime.id === "node-v8" &&
-    runtime.v8_heap_limit_bytes > 256 * 1024 * 1024
-  )
-    return "Codec reported a V8 heap limit exceeding its independent process budget.";
-  if (
-    runtime.id === "bun" &&
-    runtime.process_memory_limit_bytes !== SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES
-  )
-    return "Codec reported a process memory limit other than the one its launcher enforced.";
-  return undefined;
-};
-const codecFailure = (
-  path: string,
-  reason: "format" | "unsupported" | "limit",
-  detail: string,
-): Result<never, AnalysisError> =>
-  err(
-    reason === "limit"
-      ? new ArtifactOperationError(
-          OPERATION,
-          "limit",
-          undefined,
-          `${path}: ${detail}`,
-        )
-      : reason === "unsupported"
-        ? new AnalysisCapabilityUnavailableError(
-            "source-map-decoder",
-            OPERATION,
-            "unsupported_source_map_profile",
-            { userMessage: `${path}: ${detail}` },
-          )
-        : new AnalysisInputError(OPERATION, undefined, [
-            {
-              path: ["source_map", "path"],
-              reason: "invalid_format",
-              message: `${path}: ${detail}`,
-            },
-          ]),
-  );

src/javascript/sourceMaps/SourceMapReply.ts

@@ -0,0 +1,101 @@
+import type { AnalysisError } from "../../domain/analysisErrorBase.js";
+import {
+  AnalysisCapabilityUnavailableError,
+  AnalysisInputError,
+  AnalysisOutputError,
+} from "../../domain/analysisErrorCore.js";
+import { ArtifactOperationError } from "../../domain/artifactOperationError.js";
+import { err, ok, type Result } from "../../domain/result.js";
+import { javaScriptRuntime } from "../../domain/runtimeVersion.js";
+import type { WebSourceMapReport } from "../../domain/webSourceLocation.js";
+import { sourceMapCodecReplySchema } from "./SourceMapCodecProtocol.js";
+
+const OPERATION = "trace_web_source_location";
+
+/** Interpret the complete codec reply before its command owner finalizes. */
+export const parseSourceMapReply = (
+  text: string,
+  path: string,
+  processMemoryLimitBytes: number | null,
+): Result<WebSourceMapReport, AnalysisError> => {
+  let value: unknown;
+  try {
+    value = JSON.parse(text);
+  } catch (cause: unknown) {
+    return err(
+      new AnalysisOutputError(
+        OPERATION,
+        `Malformed codec JSON reply: ${cause instanceof Error ? cause.message : String(cause)}`,
+      ),
+    );
+  }
+  const reply = sourceMapCodecReplySchema.safeParse(value);
+  if (!reply.success)
+    return err(
+      new AnalysisOutputError(
+        OPERATION,
+        `Malformed codec reply: ${reply.error.message}`,
+      ),
+    );
+  if (reply.data.state === "failure")
+    return codecFailure(path, reply.data.reason, reply.data.message);
+  const runtimeFailure = codecRuntimeFailure(
+    reply.data.report.runtime,
+    processMemoryLimitBytes,
+  );
+  return runtimeFailure === undefined
+    ? ok(reply.data.report)
+    : err(new AnalysisOutputError(OPERATION, runtimeFailure));
+};
+
+/** Only the launched Node runtime's V8 heap, or Bun's process limit, is admitted. */
+const codecRuntimeFailure = (
+  runtime: WebSourceMapReport["runtime"],
+  processMemoryLimitBytes: number | null,
+): string | undefined => {
+  if (
+    runtime.id !==
+    (javaScriptRuntime(process.versions).id === "bun" ? "bun" : "node-v8")
+  )
+    return `Codec reported runtime ${runtime.id}, not the runtime that launched it.`;
+  if (
+    runtime.id === "node-v8" &&
+    runtime.v8_heap_limit_bytes > 256 * 1024 * 1024
+  )
+    return "Codec reported a V8 heap limit exceeding its independent process budget.";
+  if (
+    runtime.id === "bun" &&
+    runtime.process_memory_limit_bytes !== processMemoryLimitBytes
+  )
+    return "Codec reported a process memory limit other than the one its launcher enforced.";
+  return undefined;
+};
+
+const codecFailure = (
+  path: string,
+  reason: "format" | "unsupported" | "limit",
+  detail: string,
+): Result<never, AnalysisError> =>
+  err(
+    reason === "limit"
+      ? new ArtifactOperationError(
+          OPERATION,
+          "limit",
+          undefined,
+          `${path}: ${detail}`,
+        )
+      : reason === "unsupported"
+        ? new AnalysisCapabilityUnavailableError(
+            "source-map-decoder",
+            OPERATION,
+            "unsupported_source_map_profile",
+            { userMessage: `${path}: ${detail}` },
+          )
+        : new AnalysisInputError(OPERATION, undefined, [
+            {
+              path: ["source_map", "path"],
+              reason: "invalid_format",
+              message: `${path}: ${detail}`,
+            },
+          ]),
+  );