fix(javascript): bound static getter reference expansion

Replace recursive getter histories with a query-owned worklist and memo. Bound
precise expansion at 512 states and widen growing receiver cycles; retain
escaped roots and constructed children rather than silently dropping suffixes.
Carry the resource limit through semantic coverage, worker transport and graph
Evidence while preserving direct writes, imports and unrelated literal facts.

The small source probe reduced 65/326 paths to one widened reference for five
and six getters. The original large Claude artifact was not rerun. Validate
receiver/alias/mutation controls and compiled CLI/MCP consumers.

Refs #3839, #3848

Co-authored-by: Yi Han <yhan606@aucklanduni.ac.nz>
This commit is contained in:
morluto
2026-10-16 06:06:00 +08:00
parent 461eb16128
commit 880b3a510b
17 changed files with 1308 additions and 524 deletions
@@ -7,6 +7,8 @@ import type {
export const SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT = 256;
/** Maximum active expression nesting during inert semantic evaluation. */
export const SEMANTIC_EXPRESSION_DEPTH_LIMIT = 256;
/** Distinct getter, receiver and path states retained in one precise query. */
export const SEMANTIC_GETTER_EXPANSION_LIMIT = 512;
/** Bound normalized strings and transient keys independently of transport limits. */
export const SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT = 1_048_576;
@@ -17,6 +19,8 @@ const RESOURCE_LIMIT_REASON: Record<JavaScriptSemanticResourceLimit, string> = {
"Primitive string-byte budget exceeded (maximum 1048576 estimated JSON bytes).",
"expression-depth":
"Semantic expression depth budget exceeded (maximum 256 nested expressions).",
"getter-expansion":
"Getter expansion was conservatively bounded (maximum 512 distinct states or a growing receiver cycle).",
};
/** Check UTF-16 length against worst-case JSON escaping without flattening. */