Commit Graph

79 Commits

Author SHA1 Message Date
morluto e714fb027a fix(inspector): bound retained metadata and preserve cancellation 2026-10-09 05:15:23 +08:00
morluto ffd9611308 test: consolidate failure guards and trim unused fixture APIs 2026-10-09 03:13:43 +08:00
morluto a1b7d40bb0 test: remove duplicate result assertions before throwing guards 2026-10-09 02:58:03 +08:00
morluto 5945915f91 test: prune redundant cases and promote configuration lifecycle coverage 2026-10-09 02:58:03 +08:00
Ysopwnable ec6db0f063
perf(javascript): reuse validated immutable graphs (#1112)
* perf(javascript): reuse validated immutable graphs

* fix(ci): follow the moved process CLI boundary test
2026-10-09 02:40:21 +08:00
morluto d6cc9ca3a6 fix(javascript): preserve lexical open and exact template semantics 2026-10-09 01:55:12 +08:00
Rudy Mizrahi Celekli 3db46813f8
fix(javascript): parse plain TypeScript artifact dialects (#1102)
* test(javascript): reproduce TypeScript source dialect loss

Add native directory/ASAR and built public CLI owners with actual locked native TypeScript syntax/emit and independent Babel source-range oracles. Production and every workflow remain unchanged.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* test(javascript): admit isolated native compiler inputs

Use the actual TypeScript7 producer-requested --ignoreConfig flag when supplying isolated source filenames. Preserve every graph input, owning assertion, control and production file.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(javascript): parse plain TypeScript artifacts without JSX

Select the plain .ts dialect using the artifact source path so valid angle-bracket assertions retain syntax-derived graph facts. Preserve existing JSX defaults and all other dialects. Document the inert artifact parser contract.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

---------

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-09 01:24:47 +08:00
Ysopwnable cc0ee2edc6
fix(javascript): honor cancellation before evidence publication (#1098) 2026-10-09 01:15:50 +08:00
morluto 4a1837d9d5 fix(javascript): bound primitive string growth and repeated evaluation 2026-10-09 00:49:31 +08:00
morluto 16f4609d68 fix(javascript): bound semantic expansion and resolve lexical receivers 2026-10-09 00:49:30 +08:00
morluto 65a6288257 refactor(input): share schema issue error construction 2026-10-09 00:49:30 +08:00
Rudy Mizrahi Celekli 23862af1b5
fix(javascript): preserve HTML carriage return source ranges (#1092)
* test(javascript): reproduce HTML carriage return source coordinates

Compare actual resolved and unresolved artifact graph evidence with parse5 source locations across HTML line terminators and UTF-16 columns. Exercise both public built CLI analysis commands. Tests only; production and workflows unchanged.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(javascript): preserve HTML carriage return source ranges

Treat LF, CRLF, and bare CR as HTML line endings when projecting actual script opening-tag offsets to retained source ranges. Preserve UTF-16 column semantics and document the source-coordinate contract.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

---------

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-09 00:15:24 +08:00
Ysopwnable a1ed4232de
fix(mcp): retain complete application results across response limits
Retain complete authenticated application Evidence when the repeated MCP representation exceeds the default receive frame or Node string limit. Return a typed transport constraint, keep useful followup queries available, and stream full canonical bundles to atomic destinations.

Verify complete Notion and Obsidian workflows on Linux and native Windows, full CLI/Evidence parity, and real large Chrome screenshot recovery. Preserve complete success contracts and caller-selected evidence paths.

Refs #1065, #1053.
2026-10-08 23:46:02 +08:00
Rudy Mizrahi Celekli 170600541b
fix: select Node legacy package entry fields for import and require (#1035)
fix(javascript): use Node legacy package entry fields

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-08 20:47:01 +08:00
Ysopwnable b9fb438835
fix(javascript): complete large-ASAR analysis with file-local projection (#1055) 2026-10-08 16:15:35 +08:00
Rudy Mizrahi Celekli 8d5c88f17c
fix(javascript): resolve module URLs and reject invalid exports targets (#1031)
Resolve module URL paths once and reject invalid root package exports targets before normalization. Preserve actionable graph diagnostics and array selection behavior.

Fixes #1040.

Co-authored-by: Rudy Mizrahi Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Ysopwnable <161784452+N0zoM1z0@users.noreply.github.com>
2026-10-08 14:00:34 +08:00
Rudy Mizrahi Celekli 1154f2f03c
fix(javascript): reconstruct HTML script loads accurately (#1042)
* fix: parse HTML script references with HTML semantics

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>

* test(javascript): cover exact HTML script resource identity

---------

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 13:24:24 +08:00
Alex 53409ab196
fix(javascript): resolve root package exports arrays (#1046)
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 12:45:21 +08:00
Alex 03424ae91e
fix(javascript): recognize digits in artifact URI schemes (#1045) 2026-10-08 12:28:34 +08:00
Ysopwnable 6e4535c101
refactor(artifacts): move inventory and extraction into provider owners (#1032) 2026-10-08 05:51:14 +08:00
morluto f517a5a1d7 test(javascript): consolidate source analysis and export regressions 2026-10-08 04:03:23 +08:00
Ysopwnable 984fc27ce1
test(javascript): cover plain long-line loader identities (#1025) 2026-10-08 03:56:10 +08:00
Ysopwnable 7b18c58140
fix(javascript): report application analysis progress on the CLI (#1008)
* fix(javascript): report application analysis progress on the CLI

* test(cli): preserve progress in filtered output checks
2026-10-08 03:19:37 +08:00
DLME2024 96a46ada0a
fix(javascript): bound semantic node projection for resource safety (#966)
* fix(javascript): bound semantic node projection for resource safety

analyze_javascript_application exhausted the heap or failed serialization on
ordinary inputs. A small extracted tree crashed outright, and a larger
application tree failed at both the default heap and an 8 GB heap.

Cause: the semantic projection emits one node per AST expression, call site,
binding and property slot, with no ceiling. A five-file tree already yields on
the order of 170,000 nodes, and the whole result is serialized after the object
graph is built and validated. Result ceilings were deliberately removed upstream,
so nothing bounded this growth.

Apply two resource-safety ceilings and report them through the graph's own
coverage contract rather than dropping data silently:

- SEMANTIC_GRAPH_NODE_CEILING bounds retained nodes per tree (100,000, roughly
  300 MB serialized, below V8's 512 MB string limit).
- SEMANTIC_GRAPH_FILE_NODE_CEILING bounds each source file (20,000) so one
  bundled library cannot starve the application's own modules.

Exhausting either marks coverage truncated with a partial status and records the
ceiling in coverage.limits. A small application stays complete and untruncated.

Verified: a previously-crashing application tree now returns Evidence in under a
minute, while a small tree stays complete. Existing tests and check:fast pass.

* fix(javascript): report semantic graph truncation accurately

---------

Co-authored-by: REA Contributor <contributor@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-08 01:22:10 +08:00
ysopwnable 28713f9b4d
refactor(managed): group capability workflows and verification (#926) 2026-10-07 19:22:04 +08:00
Jay Hemnani 45fcd28b40
fix(javascript): resolve bare source-map and worker URLs next to the script (#890)
* fix(javascript): resolve bare source-map and worker URLs next to the script

A sourceMappingURL like `main.js.map` (the default of webpack, esbuild,
rollup, Vite and rolldown) and `new Worker("worker.js")` were resolved as
module specifiers, so the bare name was looked up as an npm package and the
map or worker script was never linked. Resolve them as URLs relative to the
declaring script.

* fix(javascript): tighten url-reference resolution edge cases

Use looksExternal for non-module contexts so protocol-relative URLs
cannot be misread as root-absolute paths, cover url-reference unit
cases, and assert bare service-worker script resolution.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-10-07 19:04:15 +08:00
ysopwnable f0a68dce60
refactor(artifacts): isolate JavaScript file acquisition (#916) 2026-10-07 17:57:33 +08:00
ysopwnable f6a58f1062
refactor(javascript): group domain semantics and contracts (#907) 2026-10-07 17:16:58 +08:00
ysopwnable 0804722cdf
refactor(javascript): group application workflows and verification (#896) 2026-10-07 16:03:37 +08:00