fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case * fix(javascript): share exact loader mode across import resolution * test(process): align symlink fixture with filesystem checkpoints * test(javascript): normalize the module resolution oracle path separators * test(frida): assert the CLI spawn Evidence contract * test(mcp): use an unsupported analysis-view parent * test(browser): separate source-location line bounds from parity * fix(javascript): preserve uncertain loader provenance * test(javascript): cover uncertain require resolution * fix(javascript): retain conditional Electron evidence * fix(javascript): preserve timed semantic provenance * fix(javascript): retain conditional builtin effects * test(javascript): distinguish bundled host authority * fix(javascript): preserve nested loader invocation identity * test(javascript): qualify Electron fixture authority * fix(javascript): preserve loader invocation authority * fix(javascript): respect source order for resolver escapes * fix(javascript): check nested loader callable mutations * fix(javascript): retain conditional constructor requests * fix(reference): retain constructor loader relationships * fix(reference): follow nested loader callable paths * refactor(javascript): share callable mutation interpretation * fix(javascript): require exact package loader suffixes * refactor(javascript): unify conditional relation evidence * refactor(javascript): unify conditional node evidence * fix(javascript): retain unknown authority for mixed case sources * fix(javascript): preserve loader uncertainty for dotfiles * fix(reference): classify javascript suffix dotfiles * test(reference): cover suffix dotfiles through cli * fix(javascript): retain equivalent conditional built-in origins * fix(javascript): preserve wrapped resolver operation * fix(javascript): retain nested conditional built-in receivers * test(javascript): declare CommonJS in native addon fixtures * fix(javascript): retain wrapped resolver candidates * style: format merged native command schema * fix(javascript): preserve uncertain loader authority * test(javascript): require candidate preload evidence * test(javascript): cover reference loader member writes --------- Co-authored-by: ShuaixinHuang <1836656514@qq.com>
2026-11-10 00:36:35 +00:00 · 2026-11-09 13:21:24 +08:00
1 parent 78a84d75c0
commit b46f4fcebd
@@ -147,3 +147,80 @@ cliTest(
    expect(mcpTrace.nodes).toContainEqual(read);
  },
 );
+
+cliTest(
+  "retains candidate Electron loader evidence through semantic traces",
+  async ({ cli }) => {
+    const root = await createTestTempDirectory(
+      "rea-conditional-electron-trace-",
+    );
+    await writeFile(
+      join(root, "main.MJS"),
+      'const { contextBridge, ipcRenderer } = require("electron"); contextBridge.exposeInMainWorld("api", { ping: () => ipcRenderer.invoke("ping") });',
+    );
+    const analysis = await cli.run({
+      arguments: ["analyze-javascript-application", root, "--format", "json"],
+    });
+    expect(analysis.exitCode, analysis.stderr).toBe(0);
+    const application = parseEvidence(analysis.json);
+    const graph = javascriptApplicationAnalysisResultSchema.parse(
+      application.normalized_result,
+    ).semantic_graph;
+    const seed = graph.nodes.find(
+      (node) =>
+        node.properties.loader_authority === "candidate" &&
+        node.properties.step_kind === "exposure",
+    );
+    if (seed === undefined)
+      throw new Error("Expected candidate Electron exposure");
+    const query = {
+      seed: { kind: "semantic-node", node_id: seed.node_id },
+      direction: "forward-influence",
+      include_ambiguous_dynamic_edges: true,
+    };
+    const request = join(root, "trace.json");
+    await writeFile(request, JSON.stringify({ application, query }));
+    const response = await cli.run({
+      arguments: ["trace-javascript-semantics", request, "--format", "json"],
+    });
+    expect(response.exitCode, response.stderr).toBe(0);
+    const mcpCall = await cli.sharedMcpCall?.();
+    if (mcpCall === undefined) throw new Error("Expected shared MCP session");
+    const mcp = await mcpCall("trace_javascript_semantics", {
+      application,
+      query,
+    });
+    expect(mcp.isError, JSON.stringify(mcp.content)).not.toBe(true);
+    for (const evidence of [
+      parseEvidence(response.json),
+      parseEvidence(mcp.structuredContent),
+    ]) {
+      const trace = javaScriptSemanticTraceResultSchema.parse(
+        evidence.normalized_result,
+      );
+      const node = trace.nodes.find(({ node_id }) => node_id === seed.node_id);
+      expect(node?.properties.loader_authority).toBe("candidate");
+      const context = trace.evidence_contexts.find(
+        ({ context_id }) => context_id === node?.evidence.context_id,
+      );
+      expect(context).toMatchObject({ state: "inferred", confidence: "low" });
+      expect(context?.limitations.join(" ")).toContain("loader is unknown");
+      const candidateRelations = trace.relations.filter(
+        ({ properties }) => properties.loader_authority === "candidate",
+      );
+      expect(candidateRelations.length).toBeGreaterThan(0);
+      for (const relation of candidateRelations) {
+        const relationContext = trace.evidence_contexts.find(
+          ({ context_id }) => context_id === relation.evidence.context_id,
+        );
+        expect(relationContext).toMatchObject({
+          state: "inferred",
+          confidence: "low",
+        });
+        expect(relationContext?.limitations.join(" ")).toContain(
+          "loader is unknown",
+        );
+      }
+    }
+  },
+);