fix(javascript): preserve semantic effects and graph evidence (#9900)

* fix(javascript): preserve semantic facts across writes and implicit effects

* fix(javascript): preserve bundler identities and helper bindings

* fix(javascript): retain semantic graph evidence and coverage

* test(javascript): include the request link in endpoint traces

Response consumers now also link the originating request to the response, so an endpoint trace reports both that association and the response's json consumer.

* fix(javascript): keep source accessors known after a copied value escapes

An unknown computed getter makes accessor lookup consider every property.
A spread copy already records a value escape, and that escape was treated
as an unknown getter on the source, so the next read escaped the whole
object. Accessor lookup still fails closed for unknown writes and calls.

* fix(javascript): keep Object.defineProperty identified at its own call

The call that escapes Object was treated as a prior replacement of
defineProperty, so a descriptor value never replaced the exported sender
and bundled IPC paths were dropped.

* fix(javascript): keep Vite preload calls that precede reassignment

Helper identity used every write to the binding, so a later assignment
erased a call that had already read the canonical helper. Use the binding
value at the call when that order is known.

* fix(javascript): apply Vite cache mutations before a later reassignment

A later helper write made the whole-binding initializer check ignore an earlier cache mutation. Identity at that mutation uses the same ordered read as the call.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

src/domain/javascript/javascriptSemanticAmbientWrites.ts

@@ -902,37 +902,92 @@ export const createGlobalReferenceReader = (
   state: JavaScriptSemanticAnalysisState,
   path: readonly [string, ...string[]],
 ): ((callee: t.Node) => GlobalReferenceRead) => {
-  const selected = ["global", ...path];
-  let generation = -1;
-  const byNamespace = new Map<
-    string | null,
-    typeof state.ambientWriteEffects
-  >();
+  const read = createGlobalPathRead(state, path);
   return (callee) => {
     const namespace = globalReferenceNamespace(callee, state, path);
-    if (namespace === undefined) return { status: "unrelated" };
+    return namespace === undefined
+      ? { status: "unrelated" }
+      : read(callee, namespace);
+  };
+};
+
+/** Read an implicit intrinsic property at its actual source site, without inventing a callee. */
+export const createGlobalPathReader = (
+  state: JavaScriptSemanticAnalysisState,
+  path: readonly [string, ...string[]],
+): ((site: t.Node) => GlobalReferenceRead) => {
+  const read = createGlobalPathRead(state, path);
+  return (site) => read(site, null);
+};
+
+const createGlobalPathRead = (
+  state: JavaScriptSemanticAnalysisState,
+  path: readonly [string, ...string[]],
+): ((site: t.Node, namespace: string | null) => GlobalReferenceRead) => {
+  const selected = ["global", ...path];
+  let writesGeneration = -1;
+  let escapesGeneration = -1;
+  const byNamespace = new Map<
+    string | null,
+    {
+      writes: typeof state.ambientWriteEffects;
+      escapes: typeof state.ambientEscapeEffects;
+    }
+  >();
+  return (site, namespace) => {
+    const covered = (paths: typeof state.ambientWrites): boolean =>
+      paths.covers(selected) ||
+      (namespace !== null && paths.covers(["global", namespace]));
+    const writesCovered = covered(state.ambientWrites);
+    const escapesCovered = covered(state.ambientEscapes);
+    if (!writesCovered && !escapesCovered) return { status: "unmodified" };
     if (
-      !state.ambientWrites.covers(selected) &&
-      (namespace === null || !state.ambientWrites.covers(["global", namespace]))
-    )
-      return { status: "unmodified" };
-    if (generation !== state.ambientWriteEffects.length) {
-      generation = state.ambientWriteEffects.length;
+      writesGeneration !== state.ambientWriteEffects.length ||
+      escapesGeneration !== state.ambientEscapeEffects.length
+    ) {
+      writesGeneration = state.ambientWriteEffects.length;
+      escapesGeneration = state.ambientEscapeEffects.length;
       byNamespace.clear();
     }
     let effects = byNamespace.get(namespace);
     if (effects === undefined) {
-      effects = state.ambientWriteEffects.filter(
-        (effect) =>
-          ambientEffectCovers(effect, selected) ||
-          (namespace !== null &&
-            ambientEffectCovers(effect, ["global", namespace])),
-      );
+      const matches = (
+        effect: (typeof state.ambientWriteEffects)[number],
+      ): boolean =>
+        ambientEffectCovers(effect, selected) ||
+        (namespace !== null &&
+          ambientEffectCovers(effect, ["global", namespace]));
+      effects = {
+        writes: state.ambientWriteEffects.filter(matches),
+        escapes: state.ambientEscapeEffects.filter(matches),
+      };
       byNamespace.set(namespace, effects);
     }
-    if (effects.length === 0) return { status: "unknown" };
-    const active = effects.filter(
-      (effect) => semanticEffectTiming(callee, effect.node, state) !== "after",
+    // The call that escapes a receiver contains the callee being identified.
+    // That escape cannot have replaced the callee before the call selects it.
+    const escapePrecedesRead = effects.escapes.some((effect) => {
+      const escape = effect.node;
+      if (
+        escape !== undefined &&
+        escape !== site &&
+        typeof escape.start === "number" &&
+        typeof escape.end === "number" &&
+        typeof site.start === "number" &&
+        typeof site.end === "number" &&
+        site.start >= escape.start &&
+        site.end <= escape.end
+      )
+        return false;
+      return semanticEffectTiming(site, escape, state) !== "after";
+    });
+    if (
+      (escapesCovered && effects.escapes.length === 0) ||
+      escapePrecedesRead ||
+      (writesCovered && effects.writes.length === 0)
+    )
+      return { status: "unknown" };
+    const active = effects.writes.filter(
+      (effect) => semanticEffectTiming(site, effect.node, state) !== "after",
     );
     if (active.length === 0) return { status: "unmodified" };
     if (
@@ -943,47 +998,57 @@ export const createGlobalReferenceReader = (
       )
     )
       return { status: "unknown" };
-    let replacement: t.AssignmentExpression | undefined;
-    for (const effect of active) {
-      const write = effect.node;
-      const writeNamespace = t.isAssignmentExpression(write)
-        ? globalReferenceNamespace(write.left, state, path)
-        : undefined;
-      if (
-        t.isAssignmentExpression(write, { operator: "=" }) &&
-        writeNamespace !== undefined &&
-        (writeNamespace === null ||
-          !state.ambientWrites.covers(["global", writeNamespace])) &&
-        semanticDefiniteEffectPrecedesReference(
-          write,
-          callee,
-          state.parentsByNode,
-        ) &&
-        (replacement === undefined ||
-          semanticDefiniteEffectPrecedesReference(
-            replacement,
-            write,
-            state.parentsByNode,
-          ))
-      )
-        replacement = write;
-    }
-    if (replacement === undefined) return { status: "unknown" };
-    const confirmed = replacement;
-    if (
-      active.some(
-        (effect) =>
-          effect.node !== confirmed &&
-          semanticEffectTiming(confirmed, effect.node, state) !== "before" &&
-          (effect.node === undefined ||
-            !semanticDefiniteEffectPrecedesReference(
-              effect.node,
-              confirmed,
-              state.parentsByNode,
-            )),
-      )
-    )
-      return { status: "unknown" };
-    return { status: "replacement", value: confirmed.right };
+    return globalPathReplacement(state, path, site, active);
   };
 };
+
+/** Select a definite replacement only when every competing write is proven earlier. */
+const globalPathReplacement = (
+  state: JavaScriptSemanticAnalysisState,
+  path: readonly [string, ...string[]],
+  site: t.Node,
+  effects: typeof state.ambientWriteEffects,
+): GlobalReferenceRead => {
+  let replacement: t.AssignmentExpression | undefined;
+  for (const effect of effects) {
+    const write = effect.node;
+    const writeNamespace = t.isAssignmentExpression(write)
+      ? globalReferenceNamespace(write.left, state, path)
+      : undefined;
+    if (
+      t.isAssignmentExpression(write, { operator: "=" }) &&
+      writeNamespace !== undefined &&
+      (writeNamespace === null ||
+        !state.ambientWrites.covers(["global", writeNamespace])) &&
+      semanticDefiniteEffectPrecedesReference(
+        write,
+        site,
+        state.parentsByNode,
+      ) &&
+      (replacement === undefined ||
+        semanticDefiniteEffectPrecedesReference(
+          replacement,
+          write,
+          state.parentsByNode,
+        ))
+    )
+      replacement = write;
+  }
+  if (replacement === undefined) return { status: "unknown" };
+  const confirmed = replacement;
+  if (
+    effects.some(
+      (effect) =>
+        effect.node !== confirmed &&
+        semanticEffectTiming(confirmed, effect.node, state) !== "before" &&
+        (effect.node === undefined ||
+          !semanticDefiniteEffectPrecedesReference(
+            effect.node,
+            confirmed,
+            state.parentsByNode,
+          )),
+    )
+  )
+    return { status: "unknown" };
+  return { status: "replacement", value: confirmed.right };
+};