fix(javascript): preserve runtime path bytes and Electron ownership (#4941)

* fix(javascript): preserve literal percent runtime paths * fix(javascript): ignore resolve prefixes before the final anchor * fix(electron): retain application roots for loadFile declarations * fix(electron): resolve loadFile from enclosing application package * fix(electron): retain outer application root across package scopes * fix(electron): derive application ownership from inventoried packages * fix(electron): retain resolved package entrypoint ownership * fix(electron): preserve competing application ownership * fix(electron): retain invalid and omitted runtime ownership * fix(electron): preserve omitted module ownership and runtime paths * fix(electron): preserve proven roots before confining page paths * fix(electron): retain possible owners behind missing imports * fix(electron): distinguish absent imports and owned page candidates * fix(electron): keep unavailable JSON out of owner gaps * fix(electron): retain exact loader formats and default entry status * fix(electron): retain unavailable entrypoint ownership candidates * test(ghidra): preserve Windows Node probe prerequisites * test(ghidra): assert cancellation during profile shutdown * fix(electron): separate examined imports from frontend ownership * fix(electron): retain unavailable directory entrypoint owners * test(jeb): retain Linux ownership prerequisite in isolation * fix(javascript): retain unchecked loader ownership and literal main paths * fix(javascript): preserve runtime paths and call-site module aliases * fix(javascript): bound module alias traversal and preserve projections * fix(javascript): retain host module and nested artifact path boundaries * fix(javascript): preserve ESM and archive module loader provenance * test(javascript): distinguish unmapped containers from missing exports * fix: retain default module aliases and Electron builtin imports * fix: preserve host file URL and inward ASAR ownership * fix: preserve CommonJS file URL classification in CI fixtures * fix: retain bound module loaders and Windows entrypoint uncertainty * fix: retain ASAR uncertainty and invalidate changed Electron app roots * fix(javascript): retain ownership uncertainty across loader boundaries * fix(javascript): preserve loader sources and bound alias queries * fix(javascript): retain destructured loader sources * fix(javascript): preserve loader uncertainty at resolution boundaries * fix(javascript): preserve callable and package launch ownership * fix(javascript): preserve captured values across member reads * test(process): assert tagged filesystem cancellation failures * fix(javascript): preserve inventory bases and invocation read timing * fix(javascript): preserve ownership across indirect and unread loads * test(javascript): order fixture directory creation on Windows * test(javascript): share ordered filesystem fixture writer * fix(javascript): unify loader provenance and package validation * fix(javascript): preserve captured Node require loader values * fix(javascript): preserve loader invocation authority * fix(javascript): verify generic loader invocation authority * fix(javascript): preserve conditional loader method alternatives * fix(javascript): require proven factories for source association * fix(javascript): honor replaced Electron app path setters * fix(javascript): prove path and assignment source ownership * fix(javascript): retain native delegate eligibility through shared writes * fix(process): settle stale baseline errors after confirmed absence * fix(javascript): preserve assignment and path boundary evidence * fix(javascript): prove source-directory resolve anchors * fix: preserve application path provenance and portable schemas * fix(javascript): retain CommonJS exported setter effects * fix: isolate Linux identity observations and retain native module exports * fix(javascript): preserve published app and helper provenance * fix(javascript): normalize typed stores and native path fixtures
2026-10-26 22:28:27 -04:00 · 2026-10-20 17:25:19 +08:00
parent d532b18123
commit e9fc8fb30c
149 changed files with 16881 additions and 988 deletions
@@ -2,16 +2,54 @@ import * as t from "@babel/types";

 import {
  semanticStaticPropertyKey,
+  semanticFinalObjectProperty,
  semanticWriteTargets,
  unwrapJavaScriptExpression,
 } from "./javascriptAstValues.js";
 import {
  isUnshadowedGlobal,
+  resolveSemanticBindingState,
  type JavaScriptSemanticAnalysisState,
 } from "./javascriptSemanticState.js";
 import { isUnmodifiedGlobalReference } from "./javascriptSemanticAmbientWrites.js";
 import { traverseJavaScriptAstSteps } from "./javascriptSemanticTraversal.js";
 import { semanticPropertyPathKeyMatches } from "./javascriptSemanticPropertyPaths.js";
+import { createSemanticModuleInterop } from "./javascriptModuleInterop.js";
+import { evaluateSemanticExpression } from "./javascriptSemanticValues.js";
+import type { JavaScriptSemanticPropertyPath } from "./javascriptSemanticPropertyPaths.js";
+import { semanticProjectedSourcesAtRead } from "./javascriptSemanticProjectedSources.js";
+import { semanticEffectTiming } from "./javascriptSemanticMutationInitializers.js";
+import { SEMANTIC_ALIAS_SELECTION_LIMIT } from "./javascriptSemanticResourceLimits.js";
+
+const exportInvocations = new WeakMap<
+  JavaScriptSemanticAnalysisState,
+  ReturnType<typeof createSemanticModuleInterop>
+>();
+
+/** Share the intrinsic owner's positional and capture proofs across CJS consumers. */
+const commonJsExportInvocation = (
+  node: t.CallExpression,
+  state: JavaScriptSemanticAnalysisState,
+) => {
+  let interop = exportInvocations.get(state);
+  if (interop === undefined) {
+    interop = createSemanticModuleInterop(state);
+    for (const { node: write, path } of state.ambientWriteEffects)
+      if (write !== undefined && path[0] === "global")
+        interop.retainWrite(write, [
+          "intrinsic",
+          ...path
+            .slice(1)
+            .map((key) =>
+              typeof key === "string" || typeof key === "number"
+                ? String(key)
+                : null,
+            ),
+        ]);
+    exportInvocations.set(state, interop);
+  }
+  return interop.intrinsicInvocation(node);
+};

 export type CommonJsExportReceiverEffect =
  | "connected"
@@ -21,6 +59,111 @@ export type CommonJsExportReceiverEffect =
 /** A CommonJS export assignment or `Object.defineProperty` export call. */
 export type CommonJsExportSite = t.AssignmentExpression | t.CallExpression;

+interface CopiedOwnFields {
+  readonly definite: ReadonlySet<string>;
+  readonly complete: boolean;
+}
+
+/** Definite own fields survive aliases, but not a possible prior shape change. */
+const copiedOwnFields = (
+  source: t.Node,
+  state: JavaScriptSemanticAnalysisState,
+): CopiedOwnFields => {
+  const unknown = { definite: new Set<string>(), complete: false };
+  const pending = [source];
+  const seen = new Set<t.Node>();
+  let common: Set<string> | undefined;
+  let complete = true;
+  while (pending.length > 0) {
+    const node = unwrapJavaScriptExpression(pending.pop()!).node;
+    if (seen.has(node)) continue;
+    if (seen.size >= SEMANTIC_ALIAS_SELECTION_LIMIT) {
+      state.valueResourceLimits.add("alias-selections");
+      return unknown;
+    }
+    seen.add(node);
+    if (t.isIdentifier(node)) {
+      const binding = resolveSemanticBindingState(state, node, node.name);
+      if (binding === undefined) return unknown;
+      if (
+        binding.memberWrites.some(
+          (effect) =>
+            semanticEffectTiming(source, effect.node, state) !== "after",
+        ) ||
+        binding.escapedPaths.some(
+          (effect) =>
+            effect.node !== undefined &&
+            !(
+              (effect.node.start ?? -1) <= (source.start ?? -1) &&
+              (effect.node.end ?? -1) >= (source.end ?? -1)
+            ) &&
+            semanticEffectTiming(source, effect.node, state) !== "after",
+        )
+      )
+        return unknown;
+      const selected = semanticProjectedSourcesAtRead(
+        binding,
+        node,
+        [],
+        state,
+        false,
+        source,
+      );
+      if (
+        selected === undefined ||
+        selected.length === 0 ||
+        selected.some((value) => value.path.length !== 0)
+      )
+        return unknown;
+      if (
+        seen.size + pending.length + selected.length >
+        SEMANTIC_ALIAS_SELECTION_LIMIT
+      ) {
+        state.valueResourceLimits.add("alias-selections");
+        return unknown;
+      }
+      for (const value of selected) pending.push(value.node);
+      continue;
+    }
+    // A getter can remove a later own slot while Object.assign is copying.
+    // Its initial presence cannot prove an earlier source was overwritten.
+    if (
+      t.isObjectExpression(node) &&
+      node.properties.some(
+        (property) => t.isObjectMethod(property) && property.kind !== "method",
+      )
+    )
+      return unknown;
+    const selected = evaluateSemanticExpression(node, state, source);
+    const fields =
+      selected.status === "object"
+        ? selected.properties
+        : selected.status === "array"
+          ? selected.items
+          : [];
+    const own = new Set(
+      fields
+        .filter((field) => field.presence === "present")
+        .map((field) => field.name),
+    );
+    const exact =
+      selected.status === "object"
+        ? !selected.unknownProperties
+        : selected.status === "array"
+          ? !selected.unknownItems
+          : selected.status === "literal" && selected.value === null;
+    complete &&=
+      exact &&
+      (common === undefined ||
+        (common.size === own.size && [...common].every((key) => own.has(key))));
+    common =
+      common === undefined
+        ? own
+        : new Set([...common].filter((key) => own.has(key)));
+  }
+  return { definite: common ?? new Set(), complete };
+};
+
 const isCommonJsModuleExports = (
  node: t.Node,
  state: JavaScriptSemanticAnalysisState,
@@ -90,6 +233,103 @@ export const commonJsDefinedExport = (
  };
 };

+/** Native Object.assign publishes source values only through a CJS receiver. */
+const commonJsAssignedExports = (
+  node: t.Node,
+  state: JavaScriptSemanticAnalysisState,
+):
+  | { readonly receiver: t.Node; readonly sources: readonly t.Node[] }
+  | undefined => {
+  if (!t.isCallExpression(node)) return undefined;
+  const invocation = commonJsExportInvocation(node, state);
+  if (
+    invocation?.kind !== "known" ||
+    invocation.path.length !== 3 ||
+    invocation.path[0] !== "intrinsic" ||
+    invocation.path[1] !== "Object" ||
+    invocation.path[2] !== "assign"
+  )
+    return undefined;
+  const [target, ...sources] = invocation.arguments ?? [];
+  if (!t.isExpression(target)) return undefined;
+  const receiver = unwrapJavaScriptExpression(target).node;
+  if (
+    !isUnshadowedGlobal(receiver, state, "exports") &&
+    !isCommonJsModuleExports(receiver, state)
+  )
+    return undefined;
+  return {
+    receiver,
+    sources: sources.flatMap((source) =>
+      t.isSpreadElement(source)
+        ? [source.argument]
+        : t.isExpression(source)
+          ? [source]
+          : [],
+    ),
+  };
+};
+
+/** Runtime values published by the CommonJS syntax owner, before receiver applicability. */
+export const commonJsRuntimeExportValues = (
+  node: t.Node,
+  state: JavaScriptSemanticAnalysisState,
+): readonly {
+  readonly exportedName: string;
+  readonly value: t.Node | null;
+  /** Own enumerable fields copied at this source, after later-source overwrites. */
+  readonly projection?: JavaScriptSemanticPropertyPath;
+  readonly ownEnumerable?: true;
+}[] => {
+  if (t.isAssignmentExpression(node)) {
+    const exportedName = commonJsExportName(node.left, state);
+    return exportedName === undefined
+      ? []
+      : [{ exportedName, value: node.operator === "=" ? node.right : null }];
+  }
+  const assigned = commonJsAssignedExports(node, state);
+  if (assigned !== undefined) {
+    const exported: ReturnType<typeof commonJsRuntimeExportValues>[number][] =
+      [];
+    const overwritten = new Set<string>();
+    for (let index = assigned.sources.length - 1; index >= 0; index--) {
+      const value = assigned.sources[index]!;
+      const fields = copiedOwnFields(value, state);
+      if (fields.complete) {
+        for (const name of fields.definite)
+          if (!overwritten.has(name))
+            exported.push({
+              exportedName: name,
+              value,
+              projection: [name],
+              ownEnumerable: true,
+            });
+      } else
+        exported.push({
+          exportedName: "*",
+          value,
+          projection: [{ excludedKeys: [...overwritten] }],
+          ownEnumerable: true,
+        });
+      // Copy applicability belongs to the shared own-slot inventory. Unknown
+      // later fields cannot prove that an earlier native field was replaced.
+      for (const field of fields.definite) overwritten.add(field);
+    }
+    return exported;
+  }
+  const defined = commonJsDefinedExport(node, state);
+  if (defined === undefined) return [];
+  const descriptor = unwrapJavaScriptExpression(defined.descriptor).node;
+  return [
+    {
+      exportedName: defined.exportedName,
+      value: t.isObjectExpression(descriptor)
+        ? (semanticFinalObjectProperty(descriptor, "value") ?? null)
+        : null,
+    },
+  ];
+};
+
 type Identity = t.Node | null;
 type Execution = "ordered" | "conditional" | "deferred";

@@ -217,7 +457,9 @@ export function* indexCommonJsExportReceiversSteps(
              : publicIdentity,
        );
      }
-      const defined = commonJsDefinedExport(node, state);
+      const defined =
+        commonJsDefinedExport(node, state) ??
+        commonJsAssignedExports(node, state);
      if (defined !== undefined && t.isCallExpression(node))
        captures.set(
          node,