rea-agents 6.3.0 → 6.5.0

package/dist/domain/javascript/javascriptRuntimeStaticCandidates.js

@@ -1,4 +1,5 @@
-import { posix, relative, win32 } from "node:path";
+import { posix, win32 } from "node:path";
+import { logicalPathEscapesRoot, normalizeJoinedLogicalPath, } from "../artifactIdentity.js";
 import { uniqueSorted } from "../canonicalOrdering.js";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Index statically reconstructed entities that can receive runtime matches. */
@@ -9,10 +10,19 @@ export const collectStaticRuntimeCandidates = (layers) => layers
 /** Translate one already-authorized runtime location into artifact paths. */
 export const mappedRuntimePaths = (layer, entity) => {
     const paths = [];
+    const fileStyle = entity.location.kind === "file"
+        ? absoluteFilePathStyle(entity.location.value)
+        : null;
     if (entity.location.kind === "file" && layer.result.format === "directory") {
         const path = pathBelowRoot(layer.result.input_path, entity.location.value);
         if (path !== null)
-            paths.push({ path, basis: "artifact-path" });
+            paths.push({
+                path,
+                fileStyle,
+                nativeRelativePath: path,
+                artifactPrefix: "",
+                basis: "artifact-path",
+            });
     }
     for (const mapping of layer.runtimeMappings) {
         const suffix = mapping.kind === "file-root" && entity.location.kind === "file"
@@ -27,6 +37,9 @@ export const mappedRuntimePaths = (layer, entity) => {
             continue;
         paths.push({
             path,
+            fileStyle,
+            nativeRelativePath: mapping.kind === "file-root" ? suffix : null,
+            artifactPrefix: normalizeArtifactPrefix(mapping.artifact_prefix),
             basis: mapping.kind === "file-root"
                 ? "operator-file-mapping"
                 : "operator-url-mapping",
@@ -54,6 +67,7 @@ const candidatesForLayer = (layer) => {
                 node,
                 category,
                 paths: pathsByNodeId.get(node.node_id) ?? [],
+                nativeDeclarationPaths: nativeDeclarationPaths(node),
                 digests: candidateDigests(node),
             },
         ];
@@ -91,7 +105,9 @@ const indexStaticPaths = (graph) => {
         node.node_id,
         uniqueSorted([
             ...nodePaths(node),
-            ...(relatedBySource.get(node.node_id) ?? []).flatMap(nodePaths),
+            ...(usesApplicationFileDeclaration(node)
+                ? []
+                : (relatedBySource.get(node.node_id) ?? []).flatMap(nodePaths)),
         ]),
     ]));
 };
@@ -100,17 +116,91 @@ const nodePaths = (node) => {
     if (node.identity.strategy === "canonical-path")
         paths.push(node.identity.path);
     for (const observation of node.observations) {
-        for (const property of ["path", "resolved_path", "declared_path"])
-            if (typeof observation.properties[property] === "string")
-                paths.push(observation.properties[property]);
+        const rawApplicationFile = node.kind === "electron-renderer" &&
+            isRawApplicationFileObservation(observation);
+        if (typeof observation.properties.path === "string")
+            paths.push(observation.properties.path);
+        if (rawApplicationFile)
+            continue;
+        if (typeof observation.properties.resolved_path === "string")
+            paths.push(observation.properties.resolved_path);
+        const declaration = observation.properties.declared_path;
+        if (!hasOwnedArtifactPath(node) &&
+            typeof declaration === "string" &&
+            !declaration.includes("\\"))
+            paths.push(declaration);
         if (observation.evidence.location.available &&
             observation.evidence.location.value.kind === "artifact-path")
             paths.push(observation.evidence.location.value.path);
     }
     return paths
-        .map(normalizeArtifactPath)
+        .map(relativeLogicalPath)
         .filter((path) => path !== null && path !== "artifact-root");
 };
+// Raw filesystem expressions have host syntax only when a captured file location
+// establishes that format. Genuinely owned artifact facts take precedence.
+const hasOwnedArtifactPath = (node) => node.identity.strategy === "canonical-path" ||
+    node.observations.some(({ properties }) => typeof properties.path === "string") ||
+    node.observations.some((observation) => !isRawApplicationFileObservation(observation) &&
+        typeof observation.properties.resolved_path === "string");
+// loadFile receives a raw literal here: the syntax producer does not retain
+// computed __dirname expressions. Electron resolves this relative to the app
+// root, so its source-relative inference is not an owned runtime target.
+const isRawApplicationFileObservation = (observation) => observation.properties.resolution_context === "filesystem-expression" &&
+    typeof observation.properties.mechanism === "string" &&
+    observation.properties.mechanism.startsWith("call:") &&
+    observation.properties.mechanism.endsWith("loadFile");
+const usesApplicationFileDeclaration = (node) => node.kind === "electron-renderer" &&
+    !hasOwnedArtifactPath(node) &&
+    node.observations.some(isRawApplicationFileObservation);
+const nativeDeclarationPaths = (node) => {
+    if (hasOwnedArtifactPath(node))
+        return { posix: [], windows: [] };
+    const declarations = node.observations.flatMap((observation) => {
+        const { properties } = observation;
+        return properties.resolution_context === "filesystem-expression" &&
+            typeof properties.declared_path === "string" &&
+            (isRawApplicationFileObservation(observation) ||
+                properties.declared_path.includes("\\"))
+            ? [
+                {
+                    path: properties.declared_path,
+                    sourcePath: nativeDeclarationSource(observation),
+                },
+            ]
+            : [];
+    });
+    const normalized = (windows) => {
+        const values = declarations.flatMap(({ path, sourcePath }) => {
+            if (windows && (win32.isAbsolute(path) || /^[a-z]:/iu.test(path)))
+                return [];
+            const normalizedPath = relativeLogicalPath(windows ? path.replaceAll("\\", "/") : path);
+            return normalizedPath === null
+                ? []
+                : [{ path: normalizedPath, sourcePath }];
+        });
+        return [
+            ...new Map(values.map((value) => [JSON.stringify(value), value])).values(),
+        ].sort((left, right) => compareUnicodeCodePoints(left.path, right.path) ||
+            compareUnicodeCodePoints(left.sourcePath ?? "", right.sourcePath ?? ""));
+    };
+    return { posix: normalized(false), windows: normalized(true) };
+};
+// A source anchor constrains the selected application namespace; it does not
+// supply a module-relative base for the raw filesystem declaration.
+const nativeDeclarationSource = (observation) => {
+    const location = observation.evidence.location;
+    if (!location.available)
+        return null;
+    const source = location.value.kind === "source-range"
+        ? location.value.source
+        : location.value.kind === "artifact-path"
+            ? location.value.path
+            : null;
+    return source === null || source === "artifact-root"
+        ? null
+        : relativeLogicalPath(source);
+};
 const candidateDigests = (node) => {
     const values = [];
     if (node.kind === "javascript-asset" &&
@@ -135,14 +225,14 @@ const pathBelowRoot = (root, value) => {
         return null;
     const remainder = rootStyle === "windows"
         ? win32.relative(root, value)
-        : relative(root, value);
-    const portableRemainder = remainder.replaceAll("\\", "/");
+        : posix.relative(root, value);
+    const portableRemainder = rootStyle === "windows" ? remainder.replaceAll("\\", "/") : remainder;
     if (remainder === "" ||
         (rootStyle === "windows" && win32.isAbsolute(remainder)) ||
         portableRemainder === ".." ||
         portableRemainder.startsWith("../"))
         return null;
-    return normalizeArtifactPath(portableRemainder);
+    return relativeLogicalPath(portableRemainder);
 };
 const absoluteFilePathStyle = (path) => {
     if (/^[a-z]:[\\/]/iu.test(path) ||
@@ -166,7 +256,7 @@ const pathBelowUrlPrefix = (prefix, value) => {
         !candidate.pathname.startsWith(base.pathname))
         return null;
     try {
-        return normalizeArtifactPath(decodeURIComponent(candidate.pathname.slice(base.pathname.length)));
+        return relativeLogicalPath(decodeURIComponent(candidate.pathname.slice(base.pathname.length)));
     }
     catch (cause) {
         // Undecodable path segments are represented by the null return.
@@ -186,24 +276,33 @@ const activeArtifactPrefixes = (layer, entities) => {
             : mapping.kind === "url-prefix" && location.kind === "url"
                 ? pathBelowUrlPrefix(mapping.prefix, location.value) !== null
                 : false))
-            prefixes.add(mapping.artifact_prefix);
+            prefixes.add(normalizeArtifactPrefix(mapping.artifact_prefix));
     return [...prefixes].sort(compareUnicodeCodePoints);
 };
+const normalizeArtifactPrefix = (prefix) => prefix === "" ? "" : normalizeJoinedLogicalPath(prefix);
 const pathWithinPrefix = (path, prefix) => prefix === "" || path === prefix || path.startsWith(`${prefix}/`);
-const safeArtifactPath = (prefix, suffix) => normalizeArtifactPath(prefix === "" ? suffix : posix.join(prefix, suffix));
-const normalizeArtifactPath = (value) => {
-    const normalized = posix
-        .normalize(value.replaceAll("\\", "/"))
-        .replace(/^\.\//u, "");
+const safeArtifactPath = (prefix, suffix) => relativeLogicalPath(prefix === "" ? suffix : posix.join(prefix, suffix));
+const relativeLogicalPath = (value) => {
+    // These are artifact names or already parsed runtime paths, not declarations.
+    const normalized = normalizeJoinedLogicalPath(value);
     return normalized !== "" &&
         normalized !== "." &&
-        normalized !== ".." &&
-        !normalized.startsWith("/") &&
-        !normalized.startsWith("../")
+        !logicalPathEscapesRoot(normalized)
         ? normalized
         : null;
 };
 const uniqueMappedPaths = (values) => [
-    ...new Map(values.map((value) => [`${value.basis}:${value.path}`, value])).values(),
+    ...new Map(values.map((value) => [
+        JSON.stringify([
+            value.basis,
+            value.path,
+            value.fileStyle,
+            value.nativeRelativePath,
+            value.artifactPrefix,
+        ]),
+        value,
+    ])).values(),
 ].sort((left, right) => compareUnicodeCodePoints(left.path, right.path) ||
-    compareUnicodeCodePoints(left.basis, right.basis));
+    compareUnicodeCodePoints(left.basis, right.basis) ||
+    compareUnicodeCodePoints(left.nativeRelativePath ?? "", right.nativeRelativePath ?? "") ||
+    compareUnicodeCodePoints(left.artifactPrefix, right.artifactPrefix));

package/dist/domain/javascript/javascriptSemanticAmbientWrites.js

@@ -0,0 +1,251 @@
+import * as t from "@babel/types";
+import { semanticStaticPropertyKey, unwrapJavaScriptExpression, } from "./javascriptAstValues.js";
+import { collectJavaScriptIdentityWritesSteps, electronMemberPath, } from "./javascriptElectronMemberWrites.js";
+import { createSemanticModuleInterop } from "./javascriptModuleInterop.js";
+import { isUnshadowedGlobal, resolveSemanticBindingState, semanticStableInitializer, } from "./javascriptSemanticState.js";
+import { isImportMetaUrl } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticMutationInitializers } from "./javascriptSemanticMutationInitializers.js";
+const GLOBAL_OBJECT_NAMES = ["globalThis", "global", "window", "self"];
+const globalObjectName = (node, state) => GLOBAL_OBJECT_NAMES.find((name) => isUnshadowedGlobal(node, state, name));
+/** Global self references retain object identity, rather than adding a property. */
+const canonicalAmbientPath = (path) => {
+    if (path[0] !== "global")
+        return path;
+    let firstProperty = 1;
+    while (GLOBAL_OBJECT_NAMES.includes(path[firstProperty] ?? ""))
+        firstProperty += 1;
+    return ["global", ...path.slice(firstProperty)];
+};
+/**
+ * Follow local object identities without equating shallow copies with their
+ * sources. Write lookup retains every visible initializer: reassigning an alias
+ * later cannot erase a possible earlier mutation. Intrinsic reads stay strict.
+ */
+const createAmbientPathResolver = (state, possibleWrites) => {
+    const cached = new WeakMap();
+    return (node, capture) => {
+        const prior = possibleWrites ? undefined : cached.get(node);
+        if (prior !== undefined)
+            return prior;
+        const result = new Map();
+        // The caller's write site selects initializers for the written target.
+        // Reads reached through an initializer occur at their own position.
+        const pending = [{ node, suffix: [] }];
+        // Join projections at their producing expression, rather than enumerating
+        // alias histories. Each key can only widen to a wildcard, and conflicting
+        // depths widen to unknown, so diamonds and cycles have finite state.
+        const expanded = new WeakMap();
+        const retain = (path) => {
+            let canonical = canonicalAmbientPath(path);
+            for (;;) {
+                result.set(JSON.stringify(canonical), canonical);
+                // An unknown key may select a global self reference as well as a
+                // distinct property. Retain both possible object identities for writes.
+                if (!possibleWrites ||
+                    canonical[0] !== "global" ||
+                    canonical[1] !== null)
+                    break;
+                canonical = canonicalAmbientPath(["global", ...canonical.slice(2)]);
+            }
+        };
+        while (pending.length > 0) {
+            const current = pending.pop();
+            if (current === undefined)
+                break;
+            const { root, members } = electronMemberPath(current.node);
+            let suffix = current.suffix === undefined
+                ? undefined
+                : [...members, ...current.suffix];
+            if (expanded.has(root)) {
+                const previous = expanded.get(root);
+                if (previous === undefined)
+                    continue;
+                if (suffix !== undefined && previous.length === suffix.length) {
+                    const joined = previous.map((key, index) => key === suffix?.[index] ? key : null);
+                    if (joined.every((key, index) => key === previous[index]))
+                        continue;
+                    suffix = joined;
+                }
+                else
+                    suffix = undefined;
+                if (!possibleWrites) {
+                    cached.set(node, []);
+                    return [];
+                }
+            }
+            expanded.set(root, suffix);
+            // A widened projection is a possible write, never proof of an intrinsic.
+            if (suffix === undefined && !possibleWrites)
+                continue;
+            const continueWith = (node, path = suffix) => pending.push({
+                node,
+                suffix: path,
+                ...(current.readsAtSelf && { readsAtSelf: true }),
+            });
+            if (t.isMetaProperty(root) &&
+                root.meta.name === "import" &&
+                root.property.name === "meta") {
+                retain(["import-meta", ...(suffix ?? [])]);
+                continue;
+            }
+            if (t.isIdentifier(root)) {
+                if (globalObjectName(root, state) !== undefined) {
+                    retain(["global", ...(suffix ?? [])]);
+                    continue;
+                }
+                if (isUnshadowedGlobal(root, state, root.name)) {
+                    retain(["global", root.name, ...(suffix ?? [])]);
+                    continue;
+                }
+                const binding = resolveSemanticBindingState(state, root, root.name);
+                if (binding === undefined)
+                    continue;
+                const stable = semanticStableInitializer(binding, state);
+                const readAt = current.readsAtSelf ? root : capture;
+                const initializers = possibleWrites
+                    ? readAt === undefined
+                        ? binding.initializers
+                        : semanticMutationInitializers(binding, readAt, state.parentsByNode)
+                            .initializers
+                    : stable === undefined
+                        ? []
+                        : [stable];
+                for (const initializer of initializers)
+                    pending.push({
+                        node: initializer.node,
+                        readsAtSelf: true,
+                        suffix: suffix === undefined
+                            ? undefined
+                            : [
+                                ...initializer.projection.map((key) => key === null ? null : String(key)),
+                                ...suffix,
+                            ],
+                    });
+                continue;
+            }
+            if (possibleWrites && t.isConditionalExpression(root)) {
+                continueWith(root.consequent);
+                continueWith(root.alternate);
+                continue;
+            }
+            if (possibleWrites && t.isLogicalExpression(root)) {
+                continueWith(root.left);
+                continueWith(root.right);
+                continue;
+            }
+            const key = suffix?.[0];
+            if (suffix !== undefined && key === undefined)
+                continue;
+            if (t.isObjectExpression(root)) {
+                if (possibleWrites) {
+                    for (const property of root.properties) {
+                        if (t.isSpreadElement(property))
+                            continueWith(property.argument);
+                        else if (t.isObjectProperty(property) &&
+                            t.isExpression(property.value)) {
+                            const ownKey = semanticStaticPropertyKey(property.key, property.computed);
+                            if (suffix === undefined ||
+                                key === null ||
+                                ownKey === null ||
+                                ownKey === key)
+                                continueWith(property.value, suffix?.slice(1));
+                        }
+                    }
+                }
+                else if (suffix !== undefined &&
+                    key !== null &&
+                    root.properties.every((property) => t.isObjectProperty(property) &&
+                        semanticStaticPropertyKey(property.key, property.computed) !==
+                            null)) {
+                    const property = root.properties.findLast((property) => t.isObjectProperty(property) &&
+                        semanticStaticPropertyKey(property.key, property.computed) ===
+                            key);
+                    if (t.isObjectProperty(property) && t.isExpression(property.value))
+                        continueWith(property.value, suffix.slice(1));
+                }
+            }
+            else if (t.isArrayExpression(root)) {
+                if (suffix === undefined) {
+                    for (const element of root.elements)
+                        if (t.isSpreadElement(element))
+                            continueWith(element.argument);
+                        else if (t.isExpression(element))
+                            continueWith(element);
+                }
+                else if (!root.elements.some(t.isSpreadElement)) {
+                    const index = Number(key);
+                    if (key === null && possibleWrites) {
+                        for (const element of root.elements)
+                            if (t.isExpression(element))
+                                continueWith(element, suffix.slice(1));
+                    }
+                    else if (key !== null &&
+                        Number.isInteger(index) &&
+                        index >= 0 &&
+                        String(index) === key) {
+                        const element = root.elements[index];
+                        if (t.isExpression(element))
+                            continueWith(element, suffix.slice(1));
+                    }
+                }
+            }
+        }
+        const paths = [...result.values()];
+        if (!possibleWrites)
+            cached.set(node, paths);
+        return paths;
+    };
+};
+/**
+ * Index source-local writes through ambient identities and stable aliases.
+ * The shared invocation owner resolves intrinsic aliases, bind/call/apply and
+ * literal argument spreads. Runtime reachability and arbitrary call effects
+ * remain unevaluated; a visible possible write is sufficient.
+ */
+export function* indexJavaScriptAmbientWritesSteps(program, state) {
+    const ambientReads = createAmbientPathResolver(state, false);
+    const ambientWrites = createAmbientPathResolver(state, true);
+    const interop = createSemanticModuleInterop(state, {
+        intrinsicPath: (node) => {
+            const [path] = ambientReads(node);
+            return path?.[0] === "global" && path.every((key) => key !== null)
+                ? ["intrinsic", ...path.slice(1)]
+                : undefined;
+        },
+    });
+    yield* collectJavaScriptIdentityWritesSteps(program, (root, kind, writeSite) => {
+        if (kind === "opaque-call")
+            return [];
+        // Reassigning a local alias changes the binding, not the referenced object.
+        if (kind === "binding")
+            return t.isIdentifier(root) &&
+                isUnshadowedGlobal(root, state, root.name)
+                ? [["global", root.name]]
+                : [];
+        return ambientWrites(root, writeSite);
+    }, interop.intrinsicInvocation, interop.staticString, interop.isFreshObject, (node, path) => {
+        state.ambientWrites.retain(path);
+        state.ambientWriteEffects.push({ path, node });
+    });
+}
+/**
+ * Recognize an ambient name or direct global-object property without a visible
+ * source-local overwrite. This is a syntax-local identity fact, not proof that
+ * the runtime's globals have never been patched by other code.
+ */
+export const isUnmodifiedGlobalReference = (callee, state, name) => {
+    const node = unwrapJavaScriptExpression(callee).node;
+    if (state.ambientWrites.covers(["global", name]))
+        return false;
+    if (isUnshadowedGlobal(node, state, name))
+        return true;
+    if (!t.isMemberExpression(node) ||
+        semanticStaticPropertyKey(node.property, node.computed) !== name)
+        return false;
+    const root = unwrapJavaScriptExpression(node.object).node;
+    const namespace = globalObjectName(root, state);
+    return (namespace !== undefined &&
+        !state.ambientWrites.covers(["global", namespace]));
+};
+/** A module URL base is known only while its property has no visible write. */
+export const isUnmodifiedImportMetaUrl = (node, state) => isImportMetaUrl(node) && !state.ambientWrites.covers(["import-meta", "url"]);