fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case

* fix(javascript): share exact loader mode across import resolution

* test(process): align symlink fixture with filesystem checkpoints

* test(javascript): normalize the module resolution oracle path separators

* test(frida): assert the CLI spawn Evidence contract

* test(mcp): use an unsupported analysis-view parent

* test(browser): separate source-location line bounds from parity

* fix(javascript): preserve uncertain loader provenance

* test(javascript): cover uncertain require resolution

* fix(javascript): retain conditional Electron evidence

* fix(javascript): preserve timed semantic provenance

* fix(javascript): retain conditional builtin effects

* test(javascript): distinguish bundled host authority

* fix(javascript): preserve nested loader invocation identity

* test(javascript): qualify Electron fixture authority

* fix(javascript): preserve loader invocation authority

* fix(javascript): respect source order for resolver escapes

* fix(javascript): check nested loader callable mutations

* fix(javascript): retain conditional constructor requests

* fix(reference): retain constructor loader relationships

* fix(reference): follow nested loader callable paths

* refactor(javascript): share callable mutation interpretation

* fix(javascript): require exact package loader suffixes

* refactor(javascript): unify conditional relation evidence

* refactor(javascript): unify conditional node evidence

* fix(javascript): retain unknown authority for mixed case sources

* fix(javascript): preserve loader uncertainty for dotfiles

* fix(reference): classify javascript suffix dotfiles

* test(reference): cover suffix dotfiles through cli

* fix(javascript): retain equivalent conditional built-in origins

* fix(javascript): preserve wrapped resolver operation

* fix(javascript): retain nested conditional built-in receivers

* test(javascript): declare CommonJS in native addon fixtures

* fix(javascript): retain wrapped resolver candidates

* style: format merged native command schema

* fix(javascript): preserve uncertain loader authority

* test(javascript): require candidate preload evidence

* test(javascript): cover reference loader member writes

---------

Co-authored-by: ShuaixinHuang <1836656514@qq.com>

src/domain/javascript/javascriptStaticAnalysisInvocationIteration.test.ts

@@ -1,7 +1,15 @@
 import { runInNewContext } from "node:vm";
+import * as t from "@babel/types";
+import { indexJavaScriptBindingsWithReceiversSteps } from "./javascriptSemanticAnalysis.js";
+import { completeSemanticSteps } from "./javascriptSemanticTraversal.js";
+import { semanticRequireCallAt } from "./javascriptSemanticRequireOrigin.js";
 import { expect, it } from "vitest";
 
-import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js";
+import {
+  analyzeJavaScriptStaticSource,
+  analyzeParsedJavaScriptStaticSource,
+} from "./javascriptStaticAnalysis.js";
+import { parseJavaScriptSource } from "./javascriptSourceParser.js";
 
 const changedIterator =
   "Array.prototype[Symbol.iterator]=function*(){yield '../shared/window.cjs'};";
@@ -116,7 +124,103 @@ it.each(cases)(
     const analysis = analyzeJavaScriptStaticSource(source);
     expect(analysis.parse_error_count).toBe(0);
     expect(analysis.references).toEqual([
-      expect.objectContaining({ kind: "require", specifier }),
+      expect.objectContaining({
+        kind: "require",
+        specifier,
+        ...(specifier === null ? {} : { loader_authority: "candidate" }),
+      }),
     ]);
   },
 );
+
+it.each(["call", "apply"])(
+  "keeps overwritten require.%s unresolved",
+  (method) => {
+    for (const path of ["fixture.MJS", "fixture.cjs"]) {
+      const argument =
+        method === "call" ? 'null,"./a.cjs"' : 'null,["./a.cjs"]';
+      const source = `require.${method}=custom;require.${method}(${argument});`;
+      const unrelated = `require.other=custom;require.${method}(${argument});`;
+      const parse = (text: string) => {
+        const parsed = parseJavaScriptSource(text, path);
+        if (parsed === null) throw new Error("fixture did not parse");
+        return analyzeParsedJavaScriptStaticSource(text, parsed).references.at(
+          -1,
+        );
+      };
+      expect(parse(source)).toMatchObject({ kind: "require", specifier: null });
+      expect(parse(unrelated)).toMatchObject({
+        kind: "require",
+        specifier: "./a.cjs",
+        ...(path === "fixture.MJS"
+          ? { loader_authority: "candidate" }
+          : { loader: "commonjs-loader" }),
+      });
+    }
+  },
+);
+
+it("does not prove invocation members before the mutation index is complete", () => {
+  const source = 'require.call=custom;require?.call(null,"./a.cjs");';
+  const parsed = parseJavaScriptSource(source, "fixture.cjs");
+  if (parsed === null) throw new Error("fixture did not parse");
+  const index = completeSemanticSteps(
+    indexJavaScriptBindingsWithReceiversSteps(parsed.program),
+  );
+  const statement = parsed.program.body[1];
+  if (
+    !t.isExpressionStatement(statement) ||
+    !t.isOptionalCallExpression(statement.expression)
+  )
+    throw new Error("expected optional call");
+  const fact = semanticRequireCallAt(
+    statement.expression,
+    index.bindings,
+    new Set(),
+    index,
+  );
+  expect(fact).toMatchObject({ loader: "unknown", memberUnproven: true });
+});
+
+it("does not turn a mutated local callable into a loader candidate", () => {
+  const source =
+    'const f=()=>0;f.call=()=>0;const addon=f.call(null,"./x.node");';
+  const parsed = parseJavaScriptSource(source, "fixture.cjs");
+  if (parsed === null) throw new Error("fixture did not parse");
+  const result = analyzeParsedJavaScriptStaticSource(source, parsed);
+  expect(result.references).toEqual([]);
+  expect(result.electron.native_addon_bindings).toEqual([]);
+  expect(result.parse_status).toBe("complete");
+});
+
+it.each(["fixture.cjs", "fixture.MJS"])(
+  "does not invent nested loader requests after an inner invocation member is replaced: %s",
+  (path) => {
+    const parse = (source: string) => {
+      const parsed = parseJavaScriptSource(source, path);
+      if (parsed === null) throw new Error("fixture did not parse");
+      return analyzeParsedJavaScriptStaticSource(source, parsed);
+    };
+    const changed = parse(
+      'require.call=custom;const addon=require.call.call(require,"./receiver.cjs","./actual.node");',
+    );
+    expect(
+      changed.references.every(
+        (ref) =>
+          ref.specifier !== "./actual.node" &&
+          ref.specifier !== "./receiver.cjs",
+      ),
+    ).toBe(true);
+    expect(changed.electron.native_addon_bindings).toEqual([]);
+    const intact = parse('require.call.call(require,null,"./actual.node");');
+    expect(intact.references).toContainEqual(
+      expect.objectContaining({
+        kind: "require",
+        specifier: "./actual.node",
+        ...(path.endsWith(".MJS")
+          ? { loader_authority: "candidate" }
+          : { loader: "commonjs-loader" }),
+      }),
+    );
+  },
+);