fix(javascript): align module lookup and source evidence

Preserve CommonJS literal paths and confined ESM URL semantics, including package main fallback, directory intent, Unicode identity, and present opaque modules. Parse extraction inputs at their AST/source owner, retain skipped HTML and source-map coverage, and distinguish endpoint candidates from proven receiver facts. Version structural fingerprints with computed literal contents and propagate them through worker contracts.

Reviewed fixes include #1810, #1840, #2642, #2700, #2702, #2714, #2803, #2960, #2968, #2986, #3035, and #3036.

Validation: 158 resolver tests passed; public CLI/MCP module lookup controls, package-main/Unicode workflows, and six builtin workflows passed in the current compiled lane. Worker schema/fingerprint regressions passed. Large public pdf.js completion and real Electron analysis remain unverified.
This commit is contained in:
morluto
2026-10-14 08:46:50 +08:00
parent 04672f2b91
commit b58adafa4f
63 changed files with 4066 additions and 326 deletions
@@ -93,10 +93,7 @@ const resolveJavaScriptSourceMapPath = (
const windowsPath = /^[a-z]:\//iu.test(portable) || source.startsWith("\\\\");
// Preserve parent traversal rather than letting URL resolution clamp at '/'.
const anchor = `/${"source/".repeat(portable.split("/").length + 1)}`;
const directory = posix.join(
anchor,
posix.dirname(mapPath.replaceAll("\\", "/")),
);
const directory = posix.join(anchor, posix.dirname(mapPath));
const base = pathToFileURL(`${directory}/`, { windows: false });
const absolute = windowsPath ? windowsFileUrl(source) : URL.parse(source);
const resolved = windowsPath ? absolute : URL.parse(source, base);
@@ -116,8 +113,11 @@ const resolveJavaScriptSourceMapPath = (
kind: "unresolved",
reason: "Source reference names a directory rather than a file.",
};
// Encoded separators must not manufacture a different filesystem hierarchy.
if (/%(?:2f|5c)/iu.test(resolved.pathname))
// Reject separators in declarations, not escaped literal names in the owned base.
const declaredPath = windowsPath
? (absolute?.pathname ?? "")
: (URL.parse(source, "file:///")?.pathname ?? "");
if (/%(?:2f|5c)/iu.test(declaredPath))
return {
kind: "unresolved",
reason: "Source reference contains an encoded path separator.",
@@ -170,10 +170,11 @@ const windowsFileUrl = (path: string): URL | null => {
const decodedUrlPath = (url: URL): string | null => {
try {
if (url.protocol === "file:")
return fileURLToPath(url, {
windows: url.hostname !== "" && url.hostname !== "localhost",
}).replaceAll("\\", "/");
if (url.protocol === "file:") {
const windows = url.hostname !== "" && url.hostname !== "localhost";
const path = fileURLToPath(url, { windows });
return windows ? path.replaceAll("\\", "/") : path;
}
return `${url.host}${decodeURIComponent(url.pathname)}`;
} catch (cause: unknown) {
if (cause instanceof URIError || cause instanceof TypeError) return null;