fix(javascript): preserve CommonJS lookup and analysis provenance (#2306)

* fix(javascript): preserve CommonJS directory and ancestor lookup

* test(apple): bound cold archive fixture compilation

* test(release): scope preflight schema to selected jobs

* fix(javascript): retain requested analysis limits in Evidence

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

src/application/javascript/JavaScriptApplicationEvidence.ts

@@ -100,4 +100,10 @@ const parameters = (
   ...(input.source_paths === undefined
     ? {}
     : { source_paths: input.source_paths }),
+  ...(input.max_heap_mb === undefined
+    ? {}
+    : { max_heap_mb: input.max_heap_mb }),
+  ...(input.analysis_timeout_ms === undefined
+    ? {}
+    : { analysis_timeout_ms: input.analysis_timeout_ms }),
 });

src/application/javascript/JavaScriptApplicationService.ts

@@ -62,26 +62,7 @@ export const analyzeJavaScriptApplicationValidated = async (
     });
     await checkpointJavaScriptAnalysis(options.signal);
     reconstructed = await reconstructJavaScriptArtifact(
-      {
-        input_path: input.input_path,
-        format: input.format,
-        integrity_policy: input.integrity_policy,
-        ...(input.max_semantic_nodes === undefined
-          ? {}
-          : { max_semantic_nodes: input.max_semantic_nodes }),
-        ...(input.max_semantic_nodes_per_file === undefined
-          ? {}
-          : { max_semantic_nodes_per_file: input.max_semantic_nodes_per_file }),
-        ...(input.source_paths === undefined
-          ? {}
-          : { source_paths: input.source_paths }),
-        ...(input.max_heap_mb === undefined
-          ? {}
-          : { max_heap_mb: input.max_heap_mb }),
-        ...(input.analysis_timeout_ms === undefined
-          ? {}
-          : { analysis_timeout_ms: input.analysis_timeout_ms }),
-      },
+      input,
       scope,
       options.signal,
       options.progress,

src/application/javascript/JavaScriptArtifactPathResolution.ts

@@ -457,9 +457,8 @@ const bareModuleCandidate = (
     dependencyDirectory = posix.dirname(confined);
   }
   const source = input.files.get(input.sourcePath);
-  let directory = posix.dirname(input.sourcePath);
   let nearestNotFound: CandidateResolution | null = null;
-  while (true) {
+  for (const directory of packageLookupDirectories(input)) {
     const candidate = posix.join(directory, dependencyDirectory);
     const metadata = readPackageMetadata(input, candidate);
     const continueCommonJsLookup =
@@ -487,8 +486,6 @@ const bareModuleCandidate = (
         nearestNotFound ??= packageResolution;
       } else return packageResolution;
     }
-    if (directory === "." || directory === "") break;
-    directory = posix.dirname(directory);
   }
   if (nearestNotFound !== null) return nearestNotFound;
   return unresolvedCandidate("external", [
@@ -496,6 +493,21 @@ const bareModuleCandidate = (
   ]);
 };
 
+function* packageLookupDirectories(
+  input: ResolveArtifactPathInput,
+): Generator<string> {
+  let directory = posix.dirname(input.sourcePath);
+  while (true) {
+    if (
+      input.moduleKind !== "require" ||
+      posix.basename(directory) !== "node_modules"
+    )
+      yield directory;
+    if (directory === "." || directory === "") return;
+    directory = posix.dirname(directory);
+  }
+}
+
 /**
  * Nearest same-container package.json, stopping at a `node_modules` directory
  * so a nested package cannot inherit an ancestor's map.
@@ -960,15 +972,29 @@ const resolveCandidate = (
   candidate: string,
   packageChain: ReadonlySet<string>,
   emittedSourceCandidates: readonly TypeScriptEmittedSourceCandidate[] = [],
-): CandidateResolution =>
-  resolveFileCandidates(input, fileCandidates(candidate, input.moduleKind)) ??
-  resolveRuntimeSourceCandidates(input, candidate, emittedSourceCandidates) ??
-  resolveDirectory(
+): CandidateResolution => {
+  if (!commonJsDirectoryRequest(input)) {
+    const file =
+      resolveFileCandidates(
+        input,
+        fileCandidates(candidate, input.moduleKind),
+      ) ??
+      resolveRuntimeSourceCandidates(input, candidate, emittedSourceCandidates);
+    if (file !== null) return file;
+  }
+  return resolveDirectory(
     input,
     candidate,
     readPackageMetadata(input, candidate),
     packageChain,
   );
+};
+
+const commonJsDirectoryRequest = (input: ResolveArtifactPathInput): boolean =>
+  input.context === "module-specifier" &&
+  input.moduleKind === "require" &&
+  (input.declaredPath.endsWith("/") ||
+    /(?:^|\/)\.{1,2}$/u.test(input.declaredPath));
 
 const resolveDirectory = (
   input: ResolveArtifactPathInput,

src/application/javascript/JavaScriptArtifactReconstruction.ts

@@ -277,15 +277,9 @@ export const reconstructJavaScriptArtifact = async (
             limitations: completed.graph.limitations,
           }),
         );
-        const { max_heap_mb, analysis_timeout_ms, ...coreInput } = input;
-        const parameters = {
-          ...coreInput,
-          ...(max_heap_mb === undefined ? {} : { max_heap_mb }),
-          ...(analysis_timeout_ms === undefined ? {} : { analysis_timeout_ms }),
-        };
         const evidence =
           await createOwnedJavaScriptApplicationEvidenceCooperatively(
-            parameters,
+            input,
             partial,
           );
         throw interruption.retainPartialObservation(evidence);