* fix(ci): remove unused exports that fail deep static checks
Knip on main reports three analysis-view hub re-exports, two type
re-exports, an unused artifact-format guard and an alias constant. Drop
the dead re-exports and guard, and give the debugger control-reply budget
its own literal: it is a separate budget from the caller command-output
default, as its comment already states.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(config): read the Rizin control budget from its own constant
The Rizin control-reply admission limit still took its value from the
caller command-output default, while GDB used DEBUGGER_CONTROL_REPLY_BYTES.
Read the dedicated constant in both so the control budget has one owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(javascript): break the semantic analysis import cycle
Split shared semantic facts out of the analysis hub so projectors of
effects, evaluation, and identity no longer import one another in a cycle.
* refactor(javascript): share the import specifier reader
Read static imports in one module used by the boundary checker and both
cycle guards, so those rules cannot drift apart.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Retain named operations in GraphQL Source bodies with locationOffset metadata.
Use final property ownership and parsed lexical facts to suppress copies only
when a recovered document, its containers and source aliases have proven
private metadata ownership. Preserve independent observations after writes,
exports, opaque uses, classic-script global exposure or direct evaluation.
Share interpretation across application and captured-web analysis. Build
optional reference indexes once per source and checkpoint examined records,
including suppressed findings, to retain cooperative cancellation.
Fixes#3311
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Normalize exact template and bigint keys at the shared AST boundary. Keep overwritten GraphQL body literals owned by their source object so they cannot resurface as standalone operations.
Reviewed-PR: #3244
Co-authored-by: Vaishnavi220506 <vaishnaviharish2006@gmail.com>
Resolve final object writes once at the RPC endpoint producer. Unknown computed writes and spreads remain barriers; overridden properties do not invent endpoints. Source, CLI and stdio MCP regressions cover the behavior.
Co-authored-by: Vaishnavi220506 <vaishnaviharish2006@gmail.com>
Replace the whitespace-only header regex with bounded name/token scanning that consumes GraphQL comments and exact ignored characters at each boundary. Preserve anonymous, prose and incomplete input controls.
Validation: all 36 RPC endpoint tests pass. Fixes#2523.
Based on #2900.
Co-authored-by: Nikhil Jangid <161968345+nikhiljangid120@users.noreply.github.com>
Preserve CommonJS literal paths and confined ESM URL semantics, including package main fallback, directory intent, Unicode identity, and present opaque modules. Parse extraction inputs at their AST/source owner, retain skipped HTML and source-map coverage, and distinguish endpoint candidates from proven receiver facts. Version structural fingerprints with computed literal contents and propagate them through worker contracts.
Reviewed fixes include #1810, #1840, #2642, #2700, #2702, #2714, #2803, #2960, #2968, #2986, #3035, and #3036.
Validation: 158 resolver tests passed; public CLI/MCP module lookup controls, package-main/Unicode workflows, and six builtin workflows passed in the current compiled lane. Worker schema/fingerprint regressions passed. Large public pdf.js completion and real Electron analysis remain unverified.
* feat(javascript): recognize tRPC procedures and GraphQL operations
Record RPC client syntax as network endpoint candidates in both
analyze_javascript_application and analyze_web_bundle, distinguished by
mechanism:
- trpc:procedure:<method> keeps the static member path of
root.<path>.<method>(...), which tRPC proxies preserve through
identifier minification. React hooks and TanStack option factories are
recognized directly. Vanilla query/mutate need a root bound to
createTRPCClient/createTRPCProxyClient, or a tRPC source marker with a
router path of at least two segments; subscribe needs the marker and a
tRPC observer argument. `this` roots, browser globals and RTK Query
`endpoints` chains are never procedures; cache-key helpers are excluded.
- trpc🔗<link> records the literal url of documented HTTP links.
- graphql:<type> records named operations from string and cooked template
literals with a valid operation header, and from precompiled
OperationDefinition objects; a graphql-tag loc.source.body copy is not
reported twice.
Method, callback and factory names follow @trpc/client and React/TanStack
integration sources and documentation for 11.19. Carrier segments before
the router path, useUtils helpers and minifier-renamed links remain
documented limitations.
Validation: typecheck; domain tests for recognition and false positives
(Apollo, RxJS, stores, RTK Query, browser globals, prose); web bundle
analyzer test; end-to-end analysis of a minified fixture through the
built MCP server on Windows 11.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(javascript): preserve RPC binding identity and bundled calls
* style(reference-source): fix CI formatting
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
