fix(security): close the destructured server-value leak and fail closed on unstubable server hooks - #3825

Closed

kojiwakayama wants to merge 82 commits into

mainfrom

refactor/issue-112-esbuild-server-hook-dce

Commits on Aug 18, 2026

fix(security): close the destructured server-value leak and fail closed on unstubable hooks
kojiwakayama
committed
311f7cf
fix(build): ignore intra-pattern liveness reads
kojiwakayama
committed
9a23d93
fix(security): fail closed on reassigned hook bindings and verify the emitted artifact
kojiwakayama
committed
15208fc
fix(build): ignore shadowed client bindings in strip liveness
kojiwakayama
committed
9a88a21
fix(build): make stripped import liveness scope-aware
kojiwakayama
committed
b38fd7b
fix(build): bind class names during import liveness
kojiwakayama
committed
0a26945
fix(security): fail closed on hoisted var redeclarations of hook bindings
kojiwakayama
committed
4de2aa4
fix(transforms): model TypeScript and static-block scopes
kojiwakayama
committed
0417603
fix(transforms): retain decorator imports in parameter properties
kojiwakayama
committed
09ad671
fix(transforms): model switch lexical scope
kojiwakayama
committed
68cdb72
fix(transforms): compute strip liveness as reachability from surviving roots
kojiwakayama
committed
41823c1
test(transforms): pin the half-dead repeated var fail-closed path
kojiwakayama
committed
4297844
fix(transforms): track runtime TypeScript bindings
kojiwakayama
committed
c991de8
test(transforms): cover reference-only syntax
kojiwakayama
committed
2aa3fda
fix(transforms): model decorator and namespace scopes
kojiwakayama
committed
dc571b8
fix(transforms): stop dead code from pinning the hooks' closure
kojiwakayama
committed
a7dfa3b
fix(transforms): read decorators on ordinary parameters
kojiwakayama
committed
a8b2770
fix(transforms): retain ordinary parameter decorators
kojiwakayama
committed
b95f439
fix(transforms): preserve shared client initializers
kojiwakayama
committed
3a56737
fix(transforms): model private elements and parameter decorators
kojiwakayama
committed
1f8b805
fix(transforms): model auto-accessor properties
kojiwakayama
committed
4fede09
fix(transforms): separate what a declaration evaluates from what it reads
kojiwakayama
committed
0079166
fix(transforms): classify JSX tag references
kojiwakayama
committed
a346934
fix(transforms): preserve class heritage evaluation
kojiwakayama
committed
b48049b
fix(transforms): preserve mixed hoisted initializers
kojiwakayama
committed
dbd48ff
fix(transforms): defer callback initialization reads
kojiwakayama
committed
7b7161a
test(transforms): pin module binding reachability
kojiwakayama
committed
85a1efd
fix(transforms): root the names a surviving export clause publishes
kojiwakayama
committed
4e234d3
fix(transforms): recognize call and apply IIFEs
kojiwakayama
committed
6cdbd2d
fix(transforms): preserve raw client roots
kojiwakayama
committed
95f29b1
fix(transforms): root default export expressions
kojiwakayama
committed
8654195
fix(build): preserve analyzer lexical context
kojiwakayama
committed
9162148
fix(build): reject dynamic name helper keys
kojiwakayama
committed
7fc14e1
fix: tighten compiler name helper detection
kojiwakayama
committed
fd2341d
fix: reject mutated name helper intrinsics
kojiwakayama
committed
fb0c8c6
fix: reject shadowed name helper intrinsics
kojiwakayama
committed
1831933
fix(transforms): guard compiler name helper recognition
kojiwakayama
committed
a8fa844
fix: reject escaped intrinsics and hoisted helper rebinds
kojiwakayama
committed
90851f6
fix: reject indirect intrinsic writes
kojiwakayama
committed
4e7a886
fix(transforms): preserve unrelated defineProperty writes
kojiwakayama
committed
e1d6acc
fix(transforms): reject global Object replacement
kojiwakayama
committed
24673f4
fix: reject global object replacement paths
kojiwakayama
committed
40167d5
fix(transforms): resolve intrinsic writes by scope
kojiwakayama
committed
f3294cc
fix(transforms): resolve global intrinsic aliases by scope
kojiwakayama
committed
9c8771a
fix: resolve browser global object aliases
kojiwakayama
committed
fdf5bec
fix(transforms): cover transparent browser globals
kojiwakayama
committed
63fe5f1
fix(transforms): recognise compiler name metadata by allowlist
kojiwakayama
committed
cc3ec40
test(transforms): pin the shapes the allowlist must still admit
kojiwakayama
committed
d23da54
test(server): update dev dashboard error catalog counts
kojiwakayama
committed
10c6f8b
fix(transforms): resolve helper mutations lexically
kojiwakayama
committed
1be3d6b
fix(transforms): preserve exported helper rebindings
kojiwakayama
committed
c98006e
fix(transforms): close intrinsic mutation aliases
kojiwakayama
committed
1cbcae9
fix(transforms): reject unreadable descriptor maps on the intrinsic
kojiwakayama
committed
36430c6
fix(transforms): track intrinsic routes lexically
kojiwakayama
committed
e63feba
fix(transforms): resolve var aliases and nested invocation wrappers
kojiwakayama
committed
b422181
fix(transforms): close intrinsic invocation gaps
kojiwakayama
committed
6049e3c
fix(transforms): follow invoked intrinsic routes
kojiwakayama
committed
1d6ef35
fix(transforms): cover destructured intrinsic routes
kojiwakayama
committed
60ab605
docs(data): keep hook guidance self-contained
kojiwakayama
committed
8a966bd
test(errors): cover server export remediation
kojiwakayama
committed
4f88f0b
fix(transforms): follow intrinsic iterator flows
kojiwakayama
committed
dfac8e7
fix(transforms): narrow intrinsic reflection routes
kojiwakayama
committed
f8fe5be
fix(transforms): close reflection iterator review gaps
kojiwakayama
committed
8659020
fix(transforms): follow class and destructured routes
kojiwakayama
committed
2b56419
fix(transforms): follow remaining dynamic routes
kojiwakayama
committed
ac2155b
fix(transforms): follow method factories and pattern defaults
kojiwakayama
committed
cc089a1
fix(transforms): tighten callable value flow
kojiwakayama
committed
bfdfb4e
fix(transforms): follow callable owner aliases
kojiwakayama
committed
9651e9d
fix(transforms): track member owner flow by occurrence
kojiwakayama
committed
3da6e9e
fix(transforms): account for hoisted function owners
kojiwakayama
committed
e14bc69
fix(transforms): preserve execution-scope flow order
kojiwakayama
committed
9dd4cdc
fix(transforms): resolve active member values
kojiwakayama
committed
578208c
fix(transforms): retain non-direct assignment flows
kojiwakayama
committed
d085250
fix(transforms): preserve structured owner flows
kojiwakayama
committed
a398a80
fix(transforms): preserve mixed computed key flows
kojiwakayama
committed
e597cf7
fix(transforms): bound incomplete member flows
kojiwakayama
committed
2a9e3d7
fix(transforms): model computed member flows
kojiwakayama
committed
ca026f3
fix(transforms): guard recursive value traversal
kojiwakayama
committed
ff6fb95
fix(transforms): preserve uncertain member lookup
kojiwakayama
committed
919f16f
fix(transforms): bound computed key resolution
kojiwakayama
committed
d4efcce
fix(security): fail closed on unprovable compiler name registrations
kojiwakayama
committed
991e309
Merge origin/main into refactor/issue-112-esbuild-server-hook-dce
kojiwakayama
committed
8832879