fix(javascript): preserve runtime path bytes and Electron ownership (#4941)

* fix(javascript): preserve literal percent runtime paths

* fix(javascript): ignore resolve prefixes before the final anchor

* fix(electron): retain application roots for loadFile declarations

* fix(electron): resolve loadFile from enclosing application package

* fix(electron): retain outer application root across package scopes

* fix(electron): derive application ownership from inventoried packages

* fix(electron): retain resolved package entrypoint ownership

* fix(electron): preserve competing application ownership

* fix(electron): retain invalid and omitted runtime ownership

* fix(electron): preserve omitted module ownership and runtime paths

* fix(electron): preserve proven roots before confining page paths

* fix(electron): retain possible owners behind missing imports

* fix(electron): distinguish absent imports and owned page candidates

* fix(electron): keep unavailable JSON out of owner gaps

* fix(electron): retain exact loader formats and default entry status

* fix(electron): retain unavailable entrypoint ownership candidates

* test(ghidra): preserve Windows Node probe prerequisites

* test(ghidra): assert cancellation during profile shutdown

* fix(electron): separate examined imports from frontend ownership

* fix(electron): retain unavailable directory entrypoint owners

* test(jeb): retain Linux ownership prerequisite in isolation

* fix(javascript): retain unchecked loader ownership and literal main paths

* fix(javascript): preserve runtime paths and call-site module aliases

* fix(javascript): bound module alias traversal and preserve projections

* fix(javascript): retain host module and nested artifact path boundaries

* fix(javascript): preserve ESM and archive module loader provenance

* test(javascript): distinguish unmapped containers from missing exports

* fix: retain default module aliases and Electron builtin imports

* fix: preserve host file URL and inward ASAR ownership

* fix: preserve CommonJS file URL classification in CI fixtures

* fix: retain bound module loaders and Windows entrypoint uncertainty

* fix: retain ASAR uncertainty and invalidate changed Electron app roots

* fix(javascript): retain ownership uncertainty across loader boundaries

* fix(javascript): preserve loader sources and bound alias queries

* fix(javascript): retain destructured loader sources

* fix(javascript): preserve loader uncertainty at resolution boundaries

* fix(javascript): preserve callable and package launch ownership

* fix(javascript): preserve captured values across member reads

* test(process): assert tagged filesystem cancellation failures

* fix(javascript): preserve inventory bases and invocation read timing

* fix(javascript): preserve ownership across indirect and unread loads

* test(javascript): order fixture directory creation on Windows

* test(javascript): share ordered filesystem fixture writer

* fix(javascript): unify loader provenance and package validation

* fix(javascript): preserve captured Node require loader values

* fix(javascript): preserve loader invocation authority

* fix(javascript): verify generic loader invocation authority

* fix(javascript): preserve conditional loader method alternatives

* fix(javascript): require proven factories for source association

* fix(javascript): honor replaced Electron app path setters

* fix(javascript): prove path and assignment source ownership

* fix(javascript): retain native delegate eligibility through shared writes

* fix(process): settle stale baseline errors after confirmed absence

* fix(javascript): preserve assignment and path boundary evidence

* fix(javascript): prove source-directory resolve anchors

* fix: preserve application path provenance and portable schemas

* fix(javascript): retain CommonJS exported setter effects

* fix: isolate Linux identity observations and retain native module exports

* fix(javascript): preserve published app and helper provenance

* fix(javascript): normalize typed stores and native path fixtures

src/application/javascript/JavaScriptArtifactGraphStructure.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import { createHash } from "node:crypto";
 
 import type { ArtifactInventorySnapshot } from "../../domain/artifactInventorySnapshot.js";
 import type { JavaScriptArtifactFile } from "../../domain/javascript/javascriptArtifactFiles.js";
@@ -14,6 +15,8 @@ import {
   addJavaScriptArtifactFiles,
   createJavaScriptArtifactRootNode,
 } from "./JavaScriptArtifactGraphStructure.js";
+import { addJavaScriptStaticFindingsSteps } from "./JavaScriptArtifactGraphFindings.js";
+import { applicationContainerIdentity } from "./JavaScriptArtifactGraphContext.js";
 
 const SHA256 = "a".repeat(64);
 const REASON =
@@ -98,6 +101,11 @@ const contextFor = (
     chunkNodes: new Map(),
     moduleNodes: new Map(),
     containerNodes: new Map(),
+    applicationRootsBySource: new Map(),
+    applicationOwnershipUnknownContainers: new Set(),
+    applicationModuleGapSources: new Map(),
+    applicationPossibleRootsByContainer: new Map(),
+    applicationModuleReferencesRetained: new Set(),
   };
 };
 
@@ -146,3 +154,225 @@ describe("skipped JavaScript parse reporting", () => {
     expect(fileObservation(context).parse_status).toBe(javascript.parse_status);
   });
 });
+
+it.each([false, true])(
+  "retains possible setter owners independently of proven imports (possible owner: %s)",
+  (possibleOwner) => {
+    const window: JavaScriptArtifactFile = {
+      ...skippedFile(),
+      path: "b/window.cjs",
+      sha256: "b".repeat(64),
+    };
+    const setter: JavaScriptArtifactFile = {
+      ...skippedFile(),
+      path: "shared/change.cjs",
+      sha256: "c".repeat(64),
+    };
+    const page: JavaScriptArtifactFile = {
+      ...skippedFile(),
+      path: "b/index.html",
+      sha256: "d".repeat(64),
+      kind: "html",
+    };
+    const analysis = analysisFor([
+      {
+        file: setter,
+        javascript: analyzeJavaScriptStaticSource(
+          'const { app } = require("electron"); app.setAppPath("/changed");',
+        ),
+        semantic: null,
+      },
+      {
+        file: window,
+        javascript: analyzeJavaScriptStaticSource(
+          'const { BrowserWindow } = require("electron"); new BrowserWindow().loadFile("index.html");',
+        ),
+        semantic: null,
+      },
+      { file: page, javascript: null, semantic: null },
+    ]);
+    const base = contextFor(window, analysis);
+    const files = [setter, window, page];
+    const context: JavaScriptArtifactGraphContext = {
+      ...base,
+      fileSet: { ...base.fileSet, files },
+      filesByPath: new Map(files.map((file) => [file.path, file])),
+    };
+    context.applicationRootsBySource.set(setter.path, new Set(["a"]));
+    context.applicationRootsBySource.set(window.path, new Set(["b"]));
+    if (possibleOwner)
+      context.applicationPossibleRootsByContainer.set(
+        applicationContainerIdentity(context.fileSet, setter),
+        new Set(["b"]),
+      );
+    addJavaScriptArtifactFiles(context);
+    const steps = addJavaScriptStaticFindingsSteps(context);
+    let step = steps.next();
+    while (!step.done) step = steps.next();
+    const role = context.accumulator
+      .nodes()
+      .find(({ kind }) => kind === "electron-renderer");
+    expect(role?.observations).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          properties: expect.objectContaining({
+            resolved_path: possibleOwner ? null : "b/index.html",
+            resolution_status: possibleOwner ? "unavailable" : "resolved",
+          }),
+        }),
+      ]),
+    );
+  },
+);
+
+it.each([
+  "unselected",
+  "transitive-unselected",
+  "invalid-utf8",
+  "worker-failure",
+  "parse-failed",
+  "opaque",
+  "unknown-loader",
+  "read-inert",
+  "unreferenced",
+  "json",
+  "missing",
+] as const)(
+  "does not prove an unchanged application path across a reachable %s load gap",
+  (gap) => {
+    const makeFile = (
+      path: string,
+      kind: JavaScriptArtifactFile["kind"] = "javascript",
+    ): JavaScriptArtifactFile => ({
+      ...skippedFile(),
+      path,
+      sha256: createHash("sha256").update(path).digest("hex"),
+      kind,
+    });
+    const main = makeFile("a/main.cjs");
+    const other = makeFile("b/main.cjs");
+    const target = makeFile(
+      gap === "json" ? "a/change.json" : "a/change.cjs",
+      gap === "json" ? "json" : "javascript",
+    );
+    const page = makeFile("a/index.html", "html");
+    const otherPage = makeFile("b/index.html", "html");
+    const window =
+      'const {BrowserWindow}=require("electron");new BrowserWindow().loadFile("index.html");';
+    const statement =
+      gap === "unknown-loader"
+        ? "require(process.env.CHANGE);"
+        : gap === "transitive-unselected"
+          ? 'require("./middle.cjs");'
+          : gap === "unreferenced"
+            ? ""
+            : `require("./${gap === "json" ? "change.json" : "change.cjs"}");`;
+    const entry: AnalyzedJavaScriptArtifactFile =
+      gap === "worker-failure"
+        ? skippedEntry(target)
+        : {
+            file:
+              gap === "invalid-utf8"
+                ? {
+                    ...target,
+                    text: { included: false, reason: "invalid-utf8" },
+                  }
+                : target,
+            javascript:
+              gap === "read-inert"
+                ? analyzeJavaScriptStaticSource("module.exports=42;")
+                : gap === "parse-failed"
+                  ? {
+                      ...analyzeJavaScriptStaticSource(""),
+                      parse_status: "failed",
+                      parse_error_count: 1,
+                    }
+                  : null,
+            semantic: null,
+          };
+    const entries: AnalyzedJavaScriptArtifactFile[] = [
+      {
+        file: main,
+        javascript: analyzeJavaScriptStaticSource(statement + window),
+        semantic: null,
+      },
+      {
+        file: other,
+        javascript: analyzeJavaScriptStaticSource(window),
+        semantic: null,
+      },
+      ...(gap === "transitive-unselected"
+        ? [
+            {
+              file: makeFile("a/middle.cjs"),
+              javascript: analyzeJavaScriptStaticSource(
+                'require("./change.cjs");',
+              ),
+              semantic: null,
+            },
+          ]
+        : []),
+      ...(gap === "missing" || gap === "opaque" ? [] : [entry]),
+      { file: page, javascript: null, semantic: null },
+      { file: otherPage, javascript: null, semantic: null },
+    ];
+    const analysis = analysisFor(entries);
+    const base = contextFor(main, analysis);
+    const files = entries.map(({ file }) => file);
+    const context: JavaScriptArtifactGraphContext = {
+      ...base,
+      fileSet: { ...base.fileSet, files },
+      filesByPath: new Map(files.map((file) => [file.path, file])),
+      unanalyzedFiles:
+        gap === "opaque"
+          ? {
+              get: (path) => (path === target.path ? target : undefined),
+              hasDirectory: () => false,
+            }
+          : undefined,
+      applicationModuleReferencesRetained: new Set([
+        main.path,
+        other.path,
+        ...(gap === "transitive-unselected" ? ["a/middle.cjs"] : []),
+        ...(gap === "read-inert" ? [target.path] : []),
+      ]),
+    };
+    context.applicationRootsBySource.set(main.path, new Set(["a"]));
+    context.applicationRootsBySource.set(other.path, new Set(["b"]));
+    addJavaScriptArtifactFiles(context);
+    const steps = addJavaScriptStaticFindingsSteps(context);
+    while (!steps.next().done) {}
+    const roles = context.accumulator
+      .nodes()
+      .filter(({ kind }) => kind === "electron-renderer");
+    expect(roles).toHaveLength(2);
+    const changed = !["read-inert", "unreferenced", "json", "missing"].includes(
+      gap,
+    );
+    for (const [path, expected] of [
+      [main.path, changed ? null : "a/index.html"],
+      // Existing loader ownership also allows an unchecked source to import
+      // the other app's module; no process isolation has been established.
+      [other.path, changed ? null : "b/index.html"],
+    ] as const) {
+      const role = roles.find(({ observations }) =>
+        observations.some(
+          ({ evidence }) =>
+            evidence.location.available &&
+            evidence.location.value.kind === "source-range" &&
+            evidence.location.value.source === path,
+        ),
+      );
+      expect(role?.observations).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            properties: expect.objectContaining({
+              resolved_path: expected,
+              resolution_status: expected === null ? "unavailable" : "resolved",
+            }),
+          }),
+        ]),
+      );
+    }
+  },
+);