candor-ts 0.5.9 → 0.5.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.5.9",
+  "version": "0.5.11",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.5)",
   "type": "module",
   "dependencies": {

package/scan-core.mjs

@@ -49,6 +49,13 @@ export const KAPPA_RULES = [
   [/^(node:)?dns(\/promises)?$/,
    /^(?!(new|getServers|setServers|getDefaultResultOrder|setDefaultResultOrder)$)/, "Net"],
   [/^(node:)?child_process$/, null, "Exec"],
+  // node:worker_threads — `postMessage` crosses a thread boundary (the canonical Node worker IPC);
+  // `receiveMessageOnPort` reads it. Covers `worker.postMessage`, `parentPort.postMessage`, and a
+  // `MessagePort`'s `.postMessage` (all typed from this module). `new Worker(...)` spawns the thread but
+  // construction is inert here (like the net-cluster ctors) — the message verbs are the IPC boundary.
+  [/^(node:)?worker_threads$/, /^(postMessage|receiveMessageOnPort)$/, "Ipc"],
+  // node:cluster — `fork()` spawns a worker PROCESS and wires its IPC channel.
+  [/^(node:)?cluster$/, /^fork$/, "Ipc"],
   [/^(node:)?sqlite$/, null, "Db"],
   // the curated npm tier
   [/^(axios|got|node-fetch|undici|ws|socket\.io(-client)?|nodemailer)$/, null, "Net"],

package/scan.mjs

@@ -917,6 +917,16 @@ function visitCalls(node) {
           // entropy were invisible).
           const name = decl.name ? decl.name.getText() : "";
           const parent = decl.parent && decl.parent.name ? decl.parent.name.getText() : "";
+          // `eval(code)` executes an arbitrary code string — it can perform ANY effect, so it is genuinely
+          // Unknown (the same posture as `new Function(s)`, which already reads Unknown via the no-decl
+          // path). The es-lib declares `eval` as a top-level ambient function (parent is the global/source
+          // file, no type name), and `globalThis.eval`/`window.eval`/`self.eval` all resolve to the same
+          // `eval` declaration — so keying on the resolved name catches every access form. Without this it
+          // resolved to a benign es-lib member and read SILENT-PURE (a code-execution sink reported pure).
+          if (name === "eval" && parent !== "Math" && parent !== "JSON") {
+            rec.direct.add("Unknown");
+            rec.why.add("call:eval");
+          }
           if ((parent === "DateConstructor" && name === "now") || (parent === "Performance" && name === "now"))
             rec.direct.add("Clock");
           if (parent === "Math" && name === "random") rec.direct.add("Rand");