fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case

* fix(javascript): share exact loader mode across import resolution

* test(process): align symlink fixture with filesystem checkpoints

* test(javascript): normalize the module resolution oracle path separators

* test(frida): assert the CLI spawn Evidence contract

* test(mcp): use an unsupported analysis-view parent

* test(browser): separate source-location line bounds from parity

* fix(javascript): preserve uncertain loader provenance

* test(javascript): cover uncertain require resolution

* fix(javascript): retain conditional Electron evidence

* fix(javascript): preserve timed semantic provenance

* fix(javascript): retain conditional builtin effects

* test(javascript): distinguish bundled host authority

* fix(javascript): preserve nested loader invocation identity

* test(javascript): qualify Electron fixture authority

* fix(javascript): preserve loader invocation authority

* fix(javascript): respect source order for resolver escapes

* fix(javascript): check nested loader callable mutations

* fix(javascript): retain conditional constructor requests

* fix(reference): retain constructor loader relationships

* fix(reference): follow nested loader callable paths

* refactor(javascript): share callable mutation interpretation

* fix(javascript): require exact package loader suffixes

* refactor(javascript): unify conditional relation evidence

* refactor(javascript): unify conditional node evidence

* fix(javascript): retain unknown authority for mixed case sources

* fix(javascript): preserve loader uncertainty for dotfiles

* fix(reference): classify javascript suffix dotfiles

* test(reference): cover suffix dotfiles through cli

* fix(javascript): retain equivalent conditional built-in origins

* fix(javascript): preserve wrapped resolver operation

* fix(javascript): retain nested conditional built-in receivers

* test(javascript): declare CommonJS in native addon fixtures

* fix(javascript): retain wrapped resolver candidates

* style: format merged native command schema

* fix(javascript): preserve uncertain loader authority

* test(javascript): require candidate preload evidence

* test(javascript): cover reference loader member writes

---------

Co-authored-by: ShuaixinHuang <1836656514@qq.com>

src/domain/javascript/javascriptStaticAnalysisLoaderInvocations.test.ts

@@ -3,11 +3,37 @@ import * as path from "node:path";
 import { runInNewContext } from "node:vm";
 import { expect, it } from "vitest";
 
-import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js";
+import {
+  analyzeJavaScriptStaticSource,
+  analyzeParsedJavaScriptStaticSource,
+} from "./javascriptStaticAnalysis.js";
+import { analyzeCommonJsStaticFixture } from "../../../tests/fixtures/javascriptCommonJsAnalysis.js";
 import { parseJavaScriptSource } from "./javascriptSourceParser.js";
 import { referenceSourceRequireCalls } from "../referenceSourceRequireBindings.js";
 import { parseReferenceSourceImports } from "../referenceSourceImportParsing.js";
 
+it.each([
+  '(require.resolve as any)("./dep.cjs");',
+  '(require as any).resolve("./dep.cjs");',
+  '(require as any)?.["resolve"]("./dep.cjs");',
+])(
+  "retains an unknown-host resolver through TypeScript wrappers: %s",
+  (source) => {
+    const parsed = parseJavaScriptSource(source, "entry.TS");
+    if (parsed === null) throw new Error("Expected TypeScript fixture");
+    expect(
+      analyzeParsedJavaScriptStaticSource(source, parsed).references,
+    ).toContainEqual(
+      expect.objectContaining({
+        kind: "require",
+        specifier: "./dep.cjs",
+        operation: "resolve",
+        loader_authority: "candidate",
+      }),
+    );
+  },
+);
+
 it.each([
   ["require", "load"],
   ["require?.", "load"],
@@ -70,9 +96,60 @@ it.each([
 );
 
 const imported = "import {createRequire as make} from 'node:module';";
+it.each([
+  ["call", 'null,"./valid.cjs"', 'null,"./invented.cjs"'],
+  ["apply", 'null,["./valid.cjs"]', 'null,["./invented.cjs"]'],
+])(
+  "distinguishes nested loader-%s replacement from a child property write",
+  (method, valid, invented) => {
+    const references = (source: string) =>
+      analyzeCommonJsStaticFixture(source).references.map(
+        ({ operation, specifier }) => ({ operation, specifier }),
+      );
+    expect(
+      references(
+        `const box={load:require};box.load.${method}.extra=1;box.load.${method}(${valid});`,
+      ),
+    ).toContainEqual({ operation: "load", specifier: "./valid.cjs" });
+    expect(
+      references(
+        `const box={load:require};box.load.${method}=custom;box.load.${method}(${invented});`,
+      ),
+    ).not.toContainEqual({ operation: "load", specifier: "./invented.cjs" });
+  },
+);
+it("preserves a native resolver before a later loader receiver escape", () => {
+  const references = (source: string) =>
+    analyzeCommonJsStaticFixture(source).references.map(
+      ({ operation, specifier }) => ({ operation, specifier }),
+    );
+  expect(
+    references(
+      'require.resolve.paths=custom;require.resolve("./first.cjs");require.call.extra=1;require.call(null,"./second.cjs");',
+    ),
+  ).toEqual([
+    { operation: "resolve", specifier: "./first.cjs" },
+    { operation: "load", specifier: "./second.cjs" },
+  ]);
+  expect(
+    references('opaque(require);require.resolve("./unsafe.cjs");').at(-1),
+  ).toEqual({
+    operation: "load",
+    specifier: null,
+  });
+  for (const source of [
+    'function run(){require.resolve("./unsafe.cjs");opaque(require);}run();run();',
+    'function mutate(){opaque(require)}mutate();require.resolve("./unsafe.cjs");',
+  ]) {
+    expect(references(source)).not.toContainEqual({
+      operation: "resolve",
+      specifier: "./unsafe.cjs",
+    });
+  }
+});
 it("retains consecutive native resolver calls while keeping replaced or escaped loaders uncertain", () => {
   const references = (source: string) =>
-    analyzeJavaScriptStaticSource(source).references.map(
+    analyzeCommonJsStaticFixture(source).references.map(
       ({ operation, specifier }) => ({ operation, specifier }),
     );
   expect(
@@ -293,7 +370,7 @@ it.each([
       require: (request: string) => module.require(request),
     });
     expect(result.join === path.join).toBe(host);
-    const analysis = analyzeJavaScriptStaticSource(source);
+    const analysis = analyzeCommonJsStaticFixture(source);
     expect(analysis.parse_error_count).toBe(0);
     expect(analysis.references).toEqual(
       specifier === undefined
@@ -493,3 +570,23 @@ it("retains unknown historical .js loader scope until a package manifest establi
       }),
     ]);
 });
+
+it.each(["main.cjs", "main.MJS"])(
+  "does not use an unproven invocation receiver as a dependency: %s",
+  (path) => {
+    for (const source of [
+      'require.call=custom;require.call("./receiver.cjs","./actual.cjs");',
+      'require.call=custom;require.call.call(require,"./receiver.cjs","./actual.cjs");',
+      'require.call=custom;require.call.apply(require,["./receiver.cjs","./actual.cjs"]);',
+    ]) {
+      const result = parseReferenceSourceImports(
+        path,
+        new TextEncoder().encode(source),
+        "JavaScript",
+      );
+      expect(
+        result.relationships.filter(({ kind }) => kind === "requires"),
+      ).toEqual([]);
+    }
+  },
+);