fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case

* fix(javascript): share exact loader mode across import resolution

* test(process): align symlink fixture with filesystem checkpoints

* test(javascript): normalize the module resolution oracle path separators

* test(frida): assert the CLI spawn Evidence contract

* test(mcp): use an unsupported analysis-view parent

* test(browser): separate source-location line bounds from parity

* fix(javascript): preserve uncertain loader provenance

* test(javascript): cover uncertain require resolution

* fix(javascript): retain conditional Electron evidence

* fix(javascript): preserve timed semantic provenance

* fix(javascript): retain conditional builtin effects

* test(javascript): distinguish bundled host authority

* fix(javascript): preserve nested loader invocation identity

* test(javascript): qualify Electron fixture authority

* fix(javascript): preserve loader invocation authority

* fix(javascript): respect source order for resolver escapes

* fix(javascript): check nested loader callable mutations

* fix(javascript): retain conditional constructor requests

* fix(reference): retain constructor loader relationships

* fix(reference): follow nested loader callable paths

* refactor(javascript): share callable mutation interpretation

* fix(javascript): require exact package loader suffixes

* refactor(javascript): unify conditional relation evidence

* refactor(javascript): unify conditional node evidence

* fix(javascript): retain unknown authority for mixed case sources

* fix(javascript): preserve loader uncertainty for dotfiles

* fix(reference): classify javascript suffix dotfiles

* test(reference): cover suffix dotfiles through cli

* fix(javascript): retain equivalent conditional built-in origins

* fix(javascript): preserve wrapped resolver operation

* fix(javascript): retain nested conditional built-in receivers

* test(javascript): declare CommonJS in native addon fixtures

* fix(javascript): retain wrapped resolver candidates

* style: format merged native command schema

* fix(javascript): preserve uncertain loader authority

* test(javascript): require candidate preload evidence

* test(javascript): cover reference loader member writes

---------

Co-authored-by: ShuaixinHuang <1836656514@qq.com>

src/domain/javascript/javascriptStaticAnalysis.ts

@@ -17,7 +17,7 @@ import {
 } from "./javascriptSemanticTraversal.js";
 
 import {
-  isElectronRendererLoad,
+  electronRendererLoadAuthority,
   resolveElectronBrowserWindowReceiver,
 } from "./electronStaticRenderer.js";
 import { finishElectronNativeBindingsSteps } from "./electronStaticAnalysisNative.js";
@@ -121,7 +121,7 @@ export function* analyzeParsedJavaScriptStaticSourceSteps(
     browserWindowReceiver: (node, site, suffix) =>
       resolveElectronBrowserWindowReceiver(node, site, suffix, findings, index),
     rendererLoad: (callee, site) =>
-      isElectronRendererLoad(callee, site, findings, index),
+      electronRendererLoadAuthority(callee, site, findings, index),
     source,
     accumulator,
     vitePreloadDependencyTable: indexVitePreloadDependencyTable(
@@ -130,9 +130,12 @@ export function* analyzeParsedJavaScriptStaticSourceSteps(
     ),
     openReceiverFacts: receivers.openReceivers,
     electronBindings: electronIdentity.bindings,
+    electronCandidateBindings: electronIdentity.candidateBindings,
     electronExportIntact: electronIdentity.intactExport,
     electronInvocationPath: electronIdentity.invocationPath,
     electronAppPathChangePossible: electronIdentity.mayChangeAppPath,
+    electronCandidateAppPathChangePossible:
+      electronIdentity.candidateMayChangeAppPath,
     rpcScan: createJavaScriptRpcScan(source, receivers.rpcClientRoots, index),
     expressionShapes: createSemanticExpressionShapeResolver(bindings),
   };
@@ -211,6 +214,7 @@ const finalizeStaticAnalysis = (
       value.operation === "load" &&
       ELECTRON_REFERENCE_KINDS.has(value.kind) &&
       ELECTRON_MODULE.test(value.specifier) &&
+      value.loader_authority !== "candidate" &&
       // A `factory-loader` reference names a recovered bundle module, so its
       // specifier is a module key inside the artifact rather than a package. A
       // real external load in the same file keeps its `commonjs-loader`
@@ -218,6 +222,14 @@ const finalizeStaticAnalysis = (
       value.loader !== "factory-loader",
   );
   const resourceLimits = [...bindings.valueResourceLimits].sort();
+  const candidateElectron = [
+    ...accumulator.browserWindows,
+    ...accumulator.contextBridgeApis,
+    ...accumulator.ipc,
+    ...accumulator.utilityProcesses,
+    ...accumulator.protocols,
+    ...accumulator.appPathChanges,
+  ].some(({ value }) => value.loader_authority === "candidate");
   const coverage: JavaScriptStaticCoverage = {
     syntax:
       parserErrors === 0
@@ -282,6 +294,11 @@ const finalizeStaticAnalysis = (
         ]
       : []),
     ...(electronObserved ? [ELECTRON_IDENTITY_LIMITATION] : []),
+    ...(candidateElectron
+      ? [
+          "Some Electron syntax depends on an unproved CommonJS loader; its Electron identity remains conditional.",
+        ]
+      : []),
     "JavaScript syntax was parsed as data and was never evaluated.",
   ];
   return {