fix(javascript): preserve runtime path bytes and Electron ownership (#4941)

* fix(javascript): preserve literal percent runtime paths

* fix(javascript): ignore resolve prefixes before the final anchor

* fix(electron): retain application roots for loadFile declarations

* fix(electron): resolve loadFile from enclosing application package

* fix(electron): retain outer application root across package scopes

* fix(electron): derive application ownership from inventoried packages

* fix(electron): retain resolved package entrypoint ownership

* fix(electron): preserve competing application ownership

* fix(electron): retain invalid and omitted runtime ownership

* fix(electron): preserve omitted module ownership and runtime paths

* fix(electron): preserve proven roots before confining page paths

* fix(electron): retain possible owners behind missing imports

* fix(electron): distinguish absent imports and owned page candidates

* fix(electron): keep unavailable JSON out of owner gaps

* fix(electron): retain exact loader formats and default entry status

* fix(electron): retain unavailable entrypoint ownership candidates

* test(ghidra): preserve Windows Node probe prerequisites

* test(ghidra): assert cancellation during profile shutdown

* fix(electron): separate examined imports from frontend ownership

* fix(electron): retain unavailable directory entrypoint owners

* test(jeb): retain Linux ownership prerequisite in isolation

* fix(javascript): retain unchecked loader ownership and literal main paths

* fix(javascript): preserve runtime paths and call-site module aliases

* fix(javascript): bound module alias traversal and preserve projections

* fix(javascript): retain host module and nested artifact path boundaries

* fix(javascript): preserve ESM and archive module loader provenance

* test(javascript): distinguish unmapped containers from missing exports

* fix: retain default module aliases and Electron builtin imports

* fix: preserve host file URL and inward ASAR ownership

* fix: preserve CommonJS file URL classification in CI fixtures

* fix: retain bound module loaders and Windows entrypoint uncertainty

* fix: retain ASAR uncertainty and invalidate changed Electron app roots

* fix(javascript): retain ownership uncertainty across loader boundaries

* fix(javascript): preserve loader sources and bound alias queries

* fix(javascript): retain destructured loader sources

* fix(javascript): preserve loader uncertainty at resolution boundaries

* fix(javascript): preserve callable and package launch ownership

* fix(javascript): preserve captured values across member reads

* test(process): assert tagged filesystem cancellation failures

* fix(javascript): preserve inventory bases and invocation read timing

* fix(javascript): preserve ownership across indirect and unread loads

* test(javascript): order fixture directory creation on Windows

* test(javascript): share ordered filesystem fixture writer

* fix(javascript): unify loader provenance and package validation

* fix(javascript): preserve captured Node require loader values

* fix(javascript): preserve loader invocation authority

* fix(javascript): verify generic loader invocation authority

* fix(javascript): preserve conditional loader method alternatives

* fix(javascript): require proven factories for source association

* fix(javascript): honor replaced Electron app path setters

* fix(javascript): prove path and assignment source ownership

* fix(javascript): retain native delegate eligibility through shared writes

* fix(process): settle stale baseline errors after confirmed absence

* fix(javascript): preserve assignment and path boundary evidence

* fix(javascript): prove source-directory resolve anchors

* fix: preserve application path provenance and portable schemas

* fix(javascript): retain CommonJS exported setter effects

* fix: isolate Linux identity observations and retain native module exports

* fix(javascript): preserve published app and helper provenance

* fix(javascript): normalize typed stores and native path fixtures

src/application/javascript/JavaScriptArtifactGraphBuilder.ts

@@ -12,6 +12,8 @@ import {
   HTML_INLINE_SCRIPT_LOCATION_COVERAGE_LIMIT,
   omittedHtmlInlineScriptLocations,
   selfReferenceOmissions,
+  dependencyManifest,
+  applicationContainerIdentity,
   type JavaScriptArtifactGraphContext,
 } from "./JavaScriptArtifactGraphContext.js";
 import {
@@ -93,6 +95,57 @@ function* buildJavaScriptArtifactGraphInputSteps(
 ): Generator<void, unknown> {
   const accumulator = new JavaScriptArtifactGraphAccumulator();
   const root = createJavaScriptArtifactRootNode(accumulator, snapshot);
+  const parsedPackages = new Set(
+    analysis.packages
+      .filter((metadata) => metadata.status === "included")
+      .map(({ path }) => path),
+  );
+  const applicationOwnershipUnknownContainers = new Set<string>();
+  const applicationModuleGapSources = new Map<string, Set<string>>();
+  const applicationModuleReferencesRetained = new Set<string>();
+  const recordModuleGap = (file: {
+    path: string;
+    container_sha256: string;
+  }) => {
+    const container = applicationContainerIdentity(fileSet, file);
+    const sources =
+      applicationModuleGapSources.get(container) ?? new Set<string>();
+    sources.add(file.path);
+    applicationModuleGapSources.set(container, sources);
+  };
+  for (const files of [fileSet.files, fileSet.unavailable_relevant_files]) {
+    for (const file of files) {
+      if (
+        file.kind === "package-json" &&
+        !dependencyManifest(file.path) &&
+        !parsedPackages.has(file.path)
+      )
+        applicationOwnershipUnknownContainers.add(
+          applicationContainerIdentity(fileSet, file),
+        );
+      if (
+        file.kind === "javascript" &&
+        (!("text" in file) || !file.text.included)
+      )
+        recordModuleGap(file);
+    }
+  }
+  // Omitted module relationships can hide another launch owner. Do not expand
+  // retained facts beyond the projection guard merely to recover ownership.
+  for (const analyzed of analysis.files) {
+    if (
+      analyzed.application_projection_failure !== undefined ||
+      analyzed.analysis_failure !== undefined ||
+      analyzed.javascript?.parse_status === "failed" ||
+      (analyzed.javascript?.parse_error_count ?? 0) > 0
+    )
+      recordModuleGap(analyzed.file);
+    else if (analyzed.javascript !== null)
+      applicationModuleReferencesRetained.add(analyzed.file.path);
+  }
+  const unavailableFilesByPath = new Map(
+    fileSet.unavailable_relevant_files.map((file) => [file.path, file]),
+  );
   const context: JavaScriptArtifactGraphContext = {
     accumulator,
     snapshot,
@@ -105,13 +158,23 @@ function* buildJavaScriptArtifactGraphInputSteps(
     ),
     root,
     filesByPath: new Map(fileSet.files.map((file) => [file.path, file])),
-    unanalyzedFiles: fileSet.unanalyzed_files,
+    unanalyzedFiles: {
+      get: (path) =>
+        unavailableFilesByPath.get(path) ?? fileSet.unanalyzed_files?.get(path),
+      hasDirectory: (path, container) =>
+        fileSet.unanalyzed_files?.hasDirectory(path, container) ?? false,
+    },
     fileNodes: new Map(),
     assetNodes: new Map(),
     sourceModuleNodes: new Map(),
     chunkNodes: new Map(),
     moduleNodes: new Map(),
     containerNodes: new Map([[snapshot.manifest.root_sha256, root]]),
+    applicationRootsBySource: new Map(),
+    applicationOwnershipUnknownContainers,
+    applicationModuleGapSources,
+    applicationModuleReferencesRetained,
+    applicationPossibleRootsByContainer: new Map(),
   };
   addJavaScriptArtifactContainers(context);
   yield;