Cursor Agent
881aec416a
fix(javascript): keep source accessors known after a copied value escapes
...
An unknown computed getter makes accessor lookup consider every property.
A spread copy already records a value escape, and that escape was treated
as an unknown getter on the source, so the next read escaped the whole
object. Accessor lookup still fails closed for unknown writes and calls.
2026-11-11 01:18:58 +00:00
morluto
cb4e5cfbff
feat(analysis): make resource budgets recoverable across CLI and MCP ( #9706 )
...
* refactor(analysis): centralize resource budgets and recovery facts
* feat(analysis): expose ASAR and Ghidra runtime admission controls
* feat(artifacts): expose reader admission and preserve limited recognition
* feat(javascript): expose recoverable semantic precision budgets
* feat(web): add recoverable source-map budgets and compact retained views
* feat(web): make historical capture decoding budgets recoverable
* fix(desktop): enforce selected view policies across capture and export
* feat(runtime): make Frida and LLDB retention budgets selectable
* feat(native): expose diagnostic budgets and preserve exhaustion causes
* feat(managed): expose recoverable snapshot and representation budgets
* feat(metadata): make Go and Rust inspection budgets recoverable
* feat(wasm): expose representation and producer admissions
* feat(evm): expose per-call worker resource budgets
* feat(android): make resource and string-pool omissions recoverable
* feat(producers): expose command and recorded-capture budgets
* docs(analysis): record recovery contracts and integrated validation
* fix(docs): link calibration oracle from published verification pages
* fix(docs): restore desktop task anchors and receipt links
* test(analysis): align fixtures with selectable budget contracts
* fix(analysis): remove source-location projector dependency cycle
* test(analysis): refresh budget recovery and verifier regressions
* test(analysis): preserve format and publication recovery expectations
* test(windows): align conformance with owned runtime admission
* fix(desktop): preserve selected alias kinds in exported state
* test(analysis): align provider fixtures with recoverable budgets
* test(desktop): validate emitted alias metadata structurally
* fix(ghidra): classify bounded Windows endpoint refusals
* test(cli): assert selectable artifact admission recovery
* fix(cli): preserve capture provenance in environment builds
2026-11-10 05:11:20 -05:00
ShuaixinHuang
a2134b3a74
fix(javascript): resolve module-level Electron options in functions ( #8960 )
...
* fix(javascript): resolve module-level Electron options in functions
* fix(javascript): limit module option ancestry walk
* fix(javascript): preserve uncertain captured argument ordering
* fix(javascript): retain hoisted activation uncertainty
* fix(javascript): retain function ownership through loops
* fix(javascript): account for classic global activations
* fix(javascript): bind first activations to lexical identities
* fix(javascript): retain uncertain global activation timing
* fix(javascript): isolate receiver facts and share computed reads
* fix(javascript): retain projected and opaque global activations
* fix(javascript): refresh activation bounds as opaque effects grow
* fix(ci): format website watch directories without changing configuration
* fix(javascript): share source reads across opaque-effect updates
* fix(javascript): retain constructed-code global activation bounds
* fix(javascript): share runtime activation and receiver facts
* fix(javascript): reuse pattern reads and function positions
* fix(javascript): isolate copied paths and preserve runtime reads
* style(javascript): format migrated reference imports
* fix(javascript): normalize constructor activation and receiver effects
* fix(javascript): retain aliased receiver timing and lexical global this
* fix(javascript): preserve effect-free receiver identity across activations
* fix(javascript): retain outer activation and prototype effects
* fix(javascript): index implicit reads without deep path rescans
* fix(javascript): retain aliased prototype and parameter read uncertainty
* fix(javascript): index reflected reads through intrinsic invocation facts
* fix(javascript): retain unresolved global activation reads
* chore: refresh PR branch after review fix publication
* fix(javascript): retain projected receiver reads and cache method facts
* fix(javascript): retain inherited and implicit activation reads
* fix(javascript): retain caller-owned this uncertainty
* fix(javascript): retain reflected reads with unresolved spread arguments
* fix(javascript): preserve enclosing activation for decorators
* fix(javascript): track intrinsic literal prototype effects
* fix(javascript): retain catch activation from implicit reads
* perf(javascript): reuse effective keys for projected reads
* fix(javascript): retain possible caller-owned ambient effects
2026-11-05 16:52:19 +08:00
Kaoru0822 and Claude Opus 5.5
767f6afc18
perf(javascript): index member-effect paths for projected reads ( #8108 )
...
* perf(javascript): index member-effect paths for projected reads
Each projected read scanned every member-write record of its binding and
tested the record path against the selection. On the #7774 reproducer
only 3.7% of scanned records pass that test. Index each binding's
append-only records by path in a lazily built trie that extends itself
with newly appended records, and visit only records whose exact keys a
selected choice names or whose keys are wildcards. Candidates come back
in record order and still pass the exact predicate, now owned next to
the index as semanticEffectPathMatches.
The semantic IR and the complete analyze-javascript-application Evidence
are byte-identical. On the full reproducer each worker phase drops from
about 80 s to 29 s, and to 8 s together with #8103 .
Refs #7774
Co-Authored-By: Claude Opus 5.5 <[email protected] [email protected] [email protected]
2026-10-30 17:52:46 +08:00
Kaoru0822 and Claude Opus 5.5
a47dcca010
perf(javascript): keep one member-effect record per stored fact ( #8103 )
...
Member-mutation indexing appended a binding write or escape record for
every traversal state that reached it. States that differ only in
coverage fields the record never stores (origin, owner initializer,
getter widening) produced identical records, and each later receiver
query rescanned all of them. Record each stored fact once, alongside the
existing required-module effect deduplication. Propagation is unchanged.
Effect ordering also re-walked the same top-level statement ancestry for
every candidate record. Cache it with the other initializer positions,
and test the selected path before the costlier receiver comparison.
On the #7774 reproducer the semantic IR and the complete
analyze-javascript-application Evidence are byte-identical, while the
CLI run drops from 146 s to 40 s.
Refs #7774
Co-authored-by: Claude Opus 5.5 <[email protected]
2026-10-30 02:26:01 -07:00
morluto
31de177404
perf(javascript): preselect captured prefix replacements
2026-10-24 09:11:30 +08:00
morluto
446333cb7f
fix(javascript): deduplicate shared projected source facts
2026-10-24 09:11:30 +08:00
morluto
2ff85c0e4c
fix(javascript): separate stored receiver and initializer traversal
2026-10-24 08:22:14 +08:00
morluto
eb721ebbf1
fix(javascript): retain stored receiver capture authority
2026-10-24 08:22:14 +08:00
gensokyo-dev
7d0efef62d
feat(javascript): retain queryable static route inventories ( #6019 )
2026-10-22 16:54:14 +08:00
morluto
247c8f4eab
refactor(javascript): own property capture translation
2026-10-22 08:52:56 +08:00
ShuaixinHuang
e9fc8fb30c
fix(javascript): preserve runtime path bytes and Electron ownership ( #4941 )
...
* fix(javascript): preserve literal percent runtime paths
* fix(javascript): ignore resolve prefixes before the final anchor
* fix(electron): retain application roots for loadFile declarations
* fix(electron): resolve loadFile from enclosing application package
* fix(electron): retain outer application root across package scopes
* fix(electron): derive application ownership from inventoried packages
* fix(electron): retain resolved package entrypoint ownership
* fix(electron): preserve competing application ownership
* fix(electron): retain invalid and omitted runtime ownership
* fix(electron): preserve omitted module ownership and runtime paths
* fix(electron): preserve proven roots before confining page paths
* fix(electron): retain possible owners behind missing imports
* fix(electron): distinguish absent imports and owned page candidates
* fix(electron): keep unavailable JSON out of owner gaps
* fix(electron): retain exact loader formats and default entry status
* fix(electron): retain unavailable entrypoint ownership candidates
* test(ghidra): preserve Windows Node probe prerequisites
* test(ghidra): assert cancellation during profile shutdown
* fix(electron): separate examined imports from frontend ownership
* fix(electron): retain unavailable directory entrypoint owners
* test(jeb): retain Linux ownership prerequisite in isolation
* fix(javascript): retain unchecked loader ownership and literal main paths
* fix(javascript): preserve runtime paths and call-site module aliases
* fix(javascript): bound module alias traversal and preserve projections
* fix(javascript): retain host module and nested artifact path boundaries
* fix(javascript): preserve ESM and archive module loader provenance
* test(javascript): distinguish unmapped containers from missing exports
* fix: retain default module aliases and Electron builtin imports
* fix: preserve host file URL and inward ASAR ownership
* fix: preserve CommonJS file URL classification in CI fixtures
* fix: retain bound module loaders and Windows entrypoint uncertainty
* fix: retain ASAR uncertainty and invalidate changed Electron app roots
* fix(javascript): retain ownership uncertainty across loader boundaries
* fix(javascript): preserve loader sources and bound alias queries
* fix(javascript): retain destructured loader sources
* fix(javascript): preserve loader uncertainty at resolution boundaries
* fix(javascript): preserve callable and package launch ownership
* fix(javascript): preserve captured values across member reads
* test(process): assert tagged filesystem cancellation failures
* fix(javascript): preserve inventory bases and invocation read timing
* fix(javascript): preserve ownership across indirect and unread loads
* test(javascript): order fixture directory creation on Windows
* test(javascript): share ordered filesystem fixture writer
* fix(javascript): unify loader provenance and package validation
* fix(javascript): preserve captured Node require loader values
* fix(javascript): preserve loader invocation authority
* fix(javascript): verify generic loader invocation authority
* fix(javascript): preserve conditional loader method alternatives
* fix(javascript): require proven factories for source association
* fix(javascript): honor replaced Electron app path setters
* fix(javascript): prove path and assignment source ownership
* fix(javascript): retain native delegate eligibility through shared writes
* fix(process): settle stale baseline errors after confirmed absence
* fix(javascript): preserve assignment and path boundary evidence
* fix(javascript): prove source-directory resolve anchors
* fix: preserve application path provenance and portable schemas
* fix(javascript): retain CommonJS exported setter effects
* fix: isolate Linux identity observations and retain native module exports
* fix(javascript): preserve published app and helper provenance
* fix(javascript): normalize typed stores and native path fixtures
2026-10-20 17:25:19 +08:00
Cursor Agent