feat: analyze JavaScript — discovery, dynamic method idioms, and a loud jelly failure

[rahlk]

Closes #84. Closes #85. Closes #88.

Two related gaps that together meant JavaScript projects were unanalyzable, plus one fix to stop a silent degradation.

Targets the 0.x line (release/0.x, off v0.5.0), not main — python-sdk pins codeanalyzer-typescript==0.4.3 and its model layer is the v1 flat TSApplication, so nothing released on the v2 line reaches a consumer. Planning context: roadmap.

1 — Discovery never offered a JavaScript file (#84)

src/syntactic_analysis/discovery.ts:5 restricted discovery to .ts/.tsx/.mts/.cts, so a JS-only project emitted an empty symbol table and exited 0 with no warning. On OWASP NodeGoat: 0 modules, an 84-byte analysis.json.

Nothing downstream needed changing — defaultCompilerOptions() already set allowJs and Jelly already accepts .js/.mjs/.cjs; both were simply never handed a file.

• SOURCE_EXTS += .js/.jsx/.mjs/.cjs
• isTestFile regex covers the same four, so .test.js is skipped like .test.ts
• buildSymbolTable warns when discovery finds nothing, instead of succeeding silently

2 — Two method idioms were never callables (#85)

Edges are gated to allSignatures, built from the symbol table, so a method that isn't a callable can never be a call target:

• this.<name> = fn inside a constructor function — landed in local_variables
• object-literal members ({ foo(){} }, { foo: function(){} }) — dropped entirely

Language-neutral, not a JavaScript gap: NodeGoat renamed .js → .ts yielded the same 24 callables before this change.

Five sites: contributorName names both forms (and lets a variable bound to an object literal contribute its name); namedBoundary treats them as callable boundaries; walkBody's dispatch becomes a callableOf helper; buildStatemented walks module-level object literals, which no function body covers; and resolveCalleeSignature gains a matching branch — the checker returns these as BinaryExpression/PropertyAssignment declarations, which isCallableDecl does not cover, so edges were still dropped after the symbol table was already correct.

3 — A jelly failure was silent on JS

The union provider degrades to tsc-only when the jelly leg throws, and reported it at info, which is not printed at default verbosity. On JS that is a ~81% edge loss with no signal. Now reported at error level when most analyzed modules are JavaScript; the reason is truncated, since execFileSync inlines the whole command line (27 file paths on NodeGoat).

The default stays union deliberately: measured with and without node_modules, union − jelly is the same 5 edges and jelly − union is empty. Two are library phantoms including needle.get, NodeGoat's SSRF sink, which stays tsc-only even once jelly can see node_modules.

Results on unmodified NodeGoat (deps installed, -a 2)

	before	after #84	after #85
modules	0	27	27
callables	0	24	59
tsc resolved call sites	0	28	51
union edges	0	161	184
named graph nodes	0	32	62
call-site resolution	—	11%	20%

59 callables matches parser-derived ground truth exactly — 115 function-like nodes in source, of which 59 are nameable.

The module key set exactly equals the set of .js files outside node_modules, vendor and test trees (27/27, diff empty).

Security-scoped reachability

The DAO method layer now appears in the graph, which it did not before:

app/routes/allocations.AllocationsHandler.displayAllocations
  → app/data/allocations-dao.AllocationsDAO.getByUserIdAndThreshold
       call_site: find(...) receiver_expr='allocationsCol' line=86
       local_variables: allocationsCol initializer='db.collection("allocations")'
       parameters: [db]

So "does user input from POST /allocations reach a Mongo query?" is answerable from the output. A machine-checkable edge into mongodb still does not exist — that needs interprocedural points-to and is tracked in #87, deliberately not faked here.

4 — Neo4j labels and relationship types are namespaced per source language (#88)

BREAKING. Node labels carried a TS twin; relationship types carried nothing at all. A database holding output from more than one analyzer therefore mingled edges — codeanalyzer-python already namespaces all 18 of its relationship types (PY_CALLS, PY_DECLARES, …) while this analyzer emitted bare CALLS/DECLARES.

Now namespaced by source language, not by analyzer:

labels : n:JSModule  n:JSCallSite  n:JSVariable      ← language-bearing
         n:TSApplication  n:TSPackage               ← language-less, analyzer namespace
rels   : JS_CALLS  JS_DECLARES  JS_DECLARES_VAR  JS_HAS_CALLSITE
         JS_HAS_MODULE  JS_RESOLVES_TO  TS_MEMBER_OF

Rules: a node carrying _module takes that module's language; nodes with none of their own (application root, packages, external library symbols) take the analyzer's TS namespace, since a sibling analyzer emits its own; an edge takes its source module's language, falling back to its target's — so application→module on a JavaScript project is JS_HAS_MODULE.

Implemented at the two hooks RowBuilder already exposed rather than at the 21 edge call sites: expand now receives the node's props, and a new retype runs in finish() where both endpoints' props are known. REL_TYPES stays the single source of truth and REL_TYPES_NS derives both namespaces, so catalog and projection cannot drift.

Also fixes a latent bug this change would otherwise have introduced: wipe() and bolt's DESCENDANTS are hand-written traversals over bare relationship types. Once edges were namespaced they matched nothing — the wipe would have silently deleted zero rows and left stale data. Both now derive from nsAlt().

Migration

Neo4j schema version 1.1.0 → 2.0.0. Every stored query must move:

MATCH ()-[:CALLS]->()          →  MATCH ()-[:TS_CALLS|JS_CALLS]->()

The version change forces a full re-upsert on the next incremental push.

Verification

• 15 new tests across 3 files, each watched fail before implementing; the end-to-end ones re-proven RED by stashing src/
• sample-app analysis.json byte-identical to v0.5.0 — no signature churn for code that already resolved
• Error path verified against a real forced failure (JELLY_BIN=/nonexistent) at default verbosity: loud on NodeGoat, silent on sample-app

Known gaps, not addressed

• CommonJS require/module.exports module-level modeling — imports/exports stay empty on CJS input. Relative require() call targets do resolve.
• No mongodb edge — feat(call-graph): attribute method calls on untyped receivers so DB sinks are reachable #87, needs points-to.
• Anonymous callbacks remain positional; 61% of graph nodes (down from 75%).