candor-ts 0.7.1 → 0.7.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.7.1",
+  "version": "0.7.5",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.5)",
   "type": "module",
   "dependencies": {

package/query-core.mjs

@@ -247,8 +247,13 @@ function commonPrefixLen(fns) {
   return (best ?? []).length;
 }
 function layerOf(fn, prefixLen) {
+  // The layer = the first segment after the common prefix, the leaf excluded. candor-ts names functions
+  // with a FILE.fn (free fns) or FILE.Class.method tail — a SHALLOW 1-segment-minimum tail — so the rule is
+  // `prefixLen + 1 < length` (matching candor-rust's layer_of). candor-java uses `+2` because its names carry
+  // an extra Package.Class.method segment; copying that here collapsed every 2-segment free function to
+  // "(root)", killing the dispersion signal on real TS reports.
   const segs = fn.split(".");
-  return prefixLen + 2 < segs.length ? segs[prefixLen] : "(root)";
+  return prefixLen + 1 < segs.length ? segs[prefixLen] : "(root)";
 }
 export function containment(fns, baseFns) {
   const pl = commonPrefixLen(fns);

package/query.mjs

@@ -89,7 +89,12 @@ switch (cmd) {
     // new leak), matching candor-java / candor-query. JSON-only, like every other candor-ts query command.
     const [prefix, basePrefix] = args;
     if (basePrefix) {
-      const r = coreContainment(loadReport(prefix), loadReport(basePrefix));
+      const baseFns = loadReport(basePrefix);
+      if (baseFns.length === 0) {   // fail CLOSED (exit 2), not a wall of bogus "everything leaked" (exit 1)
+        console.error(`candor-ts: no report at baseline prefix '${basePrefix}' — check the path`);
+        process.exit(2);
+      }
+      const r = coreContainment(loadReport(prefix), baseFns);
       emit(r);
       process.exit(r.leaks.length ? 1 : 0);
     }

package/scan-core.mjs

@@ -63,6 +63,13 @@ export const KAPPA_RULES = [
   [/^(node:)?worker_threads$/, /^(postMessage|receiveMessageOnPort)$/, "Ipc"],
   // node:cluster — `fork()` spawns a worker PROCESS and wires its IPC channel.
   [/^(node:)?cluster$/, /^fork$/, "Ipc"],
+  // node:vm executes a runtime-supplied code STRING in-process — `runInThisContext`/`runInContext`/
+  // `runInNewContext`/`compileFunction`, and the same verbs on a `new vm.Script(code)`. Like `eval`,
+  // the effects are whatever the code does (opaque) → genuinely Unknown (NOT Exec: no subprocess).
+  // Was unmodeled inside the κ-covered @types/node, so `vm.runInThisContext(code)` read SILENT-PURE
+  // (a code-execution sink reported pure — found by real-world corpus testing). The why is attached at
+  // the classify site (the only κ rule that resolves to the Unknown trust-marker, SPEC §4).
+  [/^(node:)?vm$/, /^(runInThisContext|runInContext|runInNewContext|compileFunction)$/, "Unknown"],
   [/^(node:)?sqlite$/, null, "Db"],
   // the curated npm tier
   [/^(axios|got|node-fetch|undici|ws|socket\.io(-client)?|nodemailer)$/, null, "Net"],

package/scan.mjs

@@ -251,7 +251,17 @@ function declModule(decl) {
   if (m) return m[1];
   if (/typescript\/lib\/lib\..*\.d\.ts$/.test(f)) return "<es-lib>";
   m = f.match(/node_modules\/(@[^/]+\/[^/]+|[^/]+)\//);
-  if (m) return m[1];
+  if (m) {
+    // `@types/X` (DefinitelyTyped) provides types for the RUNTIME package X — map it to X so the curated κ
+    // tier (keyed by the runtime name: pg/ws/…) fires. Without this a package typed via @types resolved to
+    // "@types/pg", the `pg`→Db rule never matched, and the resolved-but-unmodeled external decl read
+    // SILENT-PURE — `pool.query()` in a real TS Postgres app (which MUST have @types/pg installed to use
+    // pg) reported pure (found by a node_modules corpus run). Scoped runtime pkgs use the `__` convention:
+    // `@types/babel__core` → `@babel/core`.
+    const tm = m[1].match(/^@types\/(.+)$/);
+    if (tm) return tm[1].includes("__") ? "@" + tm[1].replace("__", "/") : tm[1];
+    return m[1];
+  }
   return f;
 }
 
@@ -1489,7 +1499,13 @@ function visitCalls(node) {
           if (eff && (ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression))
               && rootsAtStdStream(node.expression.expression))
             eff = null;
-          if (eff) rec.direct.add(eff);
+          if (eff) {
+            rec.direct.add(eff);
+            // a κ rule that resolves to the Unknown trust-marker (node:vm code execution) is a direct
+            // Unknown SOURCE — SPEC §4 requires a why on it, like eval's `reflect:eval`. (The rest of
+            // the κ table is concrete effects, which carry no why.)
+            if (eff === "Unknown") rec.why.add(`reflect:${mod.replace(/^node:/, "")}.${member}`);
+          }
           // the literal surfaces, read only at a CLASSIFIED call (SPEC §2)
           if (eff === "Net") {
             const lit = firstStringLiteral(node);
@@ -1658,6 +1674,19 @@ function visitCalls(node) {
       const owner = enclosing(node);
       if (owner) fns.get(owner).direct.add(geff);
     }
+    // dynamic `require(<non-literal>)` — the CJS twin of `import(m)` (which already discloses Unknown):
+    // it loads an arbitrary module and runs its top-level code, so the effects are opaque → Unknown. A
+    // LITERAL `require('fs')` is a static, resolvable load (pure until a member call), so ONLY a
+    // non-literal arg is the escape. Gated like `fetch`: a bare `require` whose symbol is NOT a project
+    // declaration (a project's own `function require()` shadow never fabricates). Under-disclose Unknown,
+    // never a concrete effect. (Found by real-world corpus testing; sibling of the node:vm fix.)
+    if (ts.isIdentifier(callee) && callee.text === "require"
+        && node.arguments?.length === 1 && !ts.isStringLiteralLike(node.arguments[0])
+        && !(checker.getSymbolAtLocation(callee)?.declarations ?? [])
+             .some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)))) {
+      const owner = enclosing(node);
+      if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add("reflect:require"); }
+    }
     // Object.assign(target, ...sources) copies each SOURCE's own enumerable props → invokes their
     // getters (the object-spread twin). Enumerate the sources' local getters.
     if (callee.getText().replace(/\s+/g, "") === "Object.assign") {