fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case

* fix(javascript): share exact loader mode across import resolution

* test(process): align symlink fixture with filesystem checkpoints

* test(javascript): normalize the module resolution oracle path separators

* test(frida): assert the CLI spawn Evidence contract

* test(mcp): use an unsupported analysis-view parent

* test(browser): separate source-location line bounds from parity

* fix(javascript): preserve uncertain loader provenance

* test(javascript): cover uncertain require resolution

* fix(javascript): retain conditional Electron evidence

* fix(javascript): preserve timed semantic provenance

* fix(javascript): retain conditional builtin effects

* test(javascript): distinguish bundled host authority

* fix(javascript): preserve nested loader invocation identity

* test(javascript): qualify Electron fixture authority

* fix(javascript): preserve loader invocation authority

* fix(javascript): respect source order for resolver escapes

* fix(javascript): check nested loader callable mutations

* fix(javascript): retain conditional constructor requests

* fix(reference): retain constructor loader relationships

* fix(reference): follow nested loader callable paths

* refactor(javascript): share callable mutation interpretation

* fix(javascript): require exact package loader suffixes

* refactor(javascript): unify conditional relation evidence

* refactor(javascript): unify conditional node evidence

* fix(javascript): retain unknown authority for mixed case sources

* fix(javascript): preserve loader uncertainty for dotfiles

* fix(reference): classify javascript suffix dotfiles

* test(reference): cover suffix dotfiles through cli

* fix(javascript): retain equivalent conditional built-in origins

* fix(javascript): preserve wrapped resolver operation

* fix(javascript): retain nested conditional built-in receivers

* test(javascript): declare CommonJS in native addon fixtures

* fix(javascript): retain wrapped resolver candidates

* style: format merged native command schema

* fix(javascript): preserve uncertain loader authority

* test(javascript): require candidate preload evidence

* test(javascript): cover reference loader member writes

---------

Co-authored-by: ShuaixinHuang <1836656514@qq.com>

src/domain/javascript/electronNativeLoaderPaths.test.ts

@@ -64,6 +64,32 @@ describe("native addon type-only re-exports", () => {
   });
 });
 
+it("does not claim a native re-export from a candidate wrapper with a proven factory loader", () => {
+  const analysis = analyzeJavaScriptStaticSource(`
+    globalThis.webpackChunkApp.push([[1], {
+      "factory": function (m, e, load) {
+        const known = load("./known.node");
+        module.exports = load("./addon.node");
+      }
+    }]);
+  `);
+  expect(analysis.electron.native_addon_bindings).toContainEqual(
+    expect.objectContaining({
+      binding_kind: "require",
+      specifier: "./known.node",
+    }),
+  );
+  expect(analysis.electron.native_addon_bindings).not.toContainEqual(
+    expect.objectContaining({
+      binding_kind: "re-export",
+      specifier: "./addon.node",
+    }),
+  );
+  expect(
+    analysis.analysis_coverage?.semantics.unknown_findings,
+  ).toBeGreaterThan(0);
+});
+
 describe("native addon loader provenance", () => {
   it("does not give ESM fixtures an ambient CommonJS loader", () => {
     const analysis = analyzeJavaScriptStaticSource(`
@@ -126,3 +152,28 @@ describe("native addon loader provenance", () => {
     },
   );
 });
+
+it.each(["call", "apply"])(
+  "does not prove native bindings through a replaced require.%s",
+  (method) => {
+    const argument =
+      method === "call" ? 'null,"./addon.node"' : 'null,["./addon.node"]';
+    const replaced = analyzeCommonJsStaticFixture(
+      `require.${method}=custom;const addon=require.${method}(${argument});`,
+    );
+    expect(replaced.electron.native_addon_bindings).toEqual([]);
+    const intact = analyzeCommonJsStaticFixture(
+      `require.other=custom;const addon=require.${method}(${argument});`,
+    );
+    expect(intact.electron.native_addon_bindings).toMatchObject([
+      { specifier: "./addon.node", binding_kind: "require" },
+    ]);
+  },
+);
+
+it("does not prove native bindings through a replaced aliased loader member", () => {
+  const analysis = analyzeCommonJsStaticFixture(
+    'const load=require;load.call=custom;const addon=load.call(null,"./addon.node");',
+  );
+  expect(analysis.electron.native_addon_bindings).toEqual([]);
+});