candor-ts 0.28.2 → 0.29.1

package/scan-core.mjs

@@ -60,7 +60,13 @@ export const KAPPA_RULES = [
   // `receiveMessageOnPort` reads it. Covers `worker.postMessage`, `parentPort.postMessage`, and a
   // `MessagePort`'s `.postMessage` (all typed from this module). `new Worker(...)` spawns the thread but
   // construction is inert here (like the net-cluster ctors) — the message verbs are the IPC boundary.
-  [/^(node:)?worker_threads$/, /^(postMessage|receiveMessageOnPort)$/, "Ipc"],
+  // …AND `postMessageToThread`, node 22's MODULE-LEVEL send. The name is anchored, so the newer API
+  // slipped past a rule that already covered every other spelling: `parentPort.postMessage`,
+  // `worker.postMessage`, a `MessagePort`'s `.postMessage` and `receiveMessageOnPort` were all Ipc while
+  // `postMessageToThread(id, value)` — the same channel, addressed by thread id — read PURE. Found by
+  // enumerating each builtin's EXPORTS and diffing them against what the table charges, rather than by
+  // testing the spellings someone already thought of.
+  [/^(node:)?worker_threads$/, /^(postMessage|postMessageToThread|receiveMessageOnPort)$/, "Ipc"],
   // node:cluster — `fork()` spawns a worker PROCESS and wires its IPC channel.
   [/^(node:)?cluster$/, /^fork$/, "Ipc"],
   // node:vm executes a runtime-supplied code STRING in-process — `runInThisContext`/`runInContext`/
@@ -162,7 +168,15 @@ export const KAPPA_RULES = [
   // node:os identity reads — userInfo (the OS user record) and hostname (the machine name) are
   // environment/host reads (Env), like System.getenv's host-identity cousins. The rest of node:os
   // (platform/arch/cpus/totalmem/…) is inert host introspection, left pure.
-  [/^(node:)?os$/, /^(userInfo|hostname)$/, "Env"],
+  // …AND `tmpdir`/`homedir`, which this list read as pure until a cross-engine parity sweep asked why.
+  // They are not introspection: node resolves `homedir()` from `$HOME` and `tmpdir()` from
+  // `$TMPDIR`/`$TMP`/`$TEMP`, so they are ENVIRONMENT VARIABLE READS behind a convenience name — the
+  // rule this line already applies to `userInfo`/`hostname`, and the reason `platform`/`arch` stay out.
+  // candor-rust charges the identical operations (`std::env::temp_dir`, `env::var("HOME")`,
+  // `env::current_dir`) as Env, so ts was the outlier AND inconsistent with ITSELF: `os.hostname()` was
+  // Env while `os.homedir()` was pure. MEASURED 2026-08-18: `deny Env` answered exit 0 over
+  // `os.homedir()`. `platform`/`arch`/`cpus` are untouched — they read no variable.
+  [/^(node:)?os$/, /^(userInfo|hostname|tmpdir|homedir)$/, "Env"],
   [/^(argon2|bcrypt|bcryptjs)$/, null, "Rand"],
   // The ORM tier — VERB-PRECISE (the CLASSIFIER discipline: tag the execution boundary, not
   // builders; `createQueryBuilder` is pure, its `getMany`/`execute` is the I/O). Found on the