v1.4.1-alpha.9

1.4.1-alpha.9 - 2026-07-15

Fixed

• Homebrew: brew install js-recon now always installs the latest stable release instead of whichever version (including alphas/betas) was most recently promoted. promote-js-recon.yml's Homebrew tap job is now channel-aware — it updates Formula/js-recon-alpha.rb / Formula/js-recon-beta.rb for prerelease promotions and leaves the main Formula/js-recon.rb (stable) formula untouched. Alpha/beta channels are now available via brew install shriyanss/tap/js-recon-alpha / js-recon-beta, mirroring the existing :alpha/:beta Docker/GHCR tags. (ci, homebrew)
• run (batch mode, -u <file>): the generated OpenAPI spec and Postman collection (mapped-openapi.json, mapped-openapi.postman_collection.json) are no longer contaminated with endpoints from previously-processed targets in the same batch run. openapiOutput in utility/globals.ts is an accumulator that every map resolver pushes into, and it was never cleared between targets — so target N's output silently inherited every endpoint discovered for targets 1..N-1. A new clearOpenapiOutput() is now called alongside the existing clearJsUrls()/clearJsonUrls() reset at the start of each target's pipeline. (run, utility)
• refactor: when the remote CS-MAST-S signature lookup for the active tech/scat/branch combination comes back empty (e.g. a non-default --scat value not yet covered by the dataset), the run's final summary now prints an explicit, high-visibility recap block (LIBRARY STRIPPING WAS SKIPPED FOR THIS RUN, naming the tech/scat/branch) in addition to the existing inline warning. Previously this was a single line that could scroll by unnoticed mid-run, so batch/automated invocations could silently lose library stripping with no easy signal that the output still contains library code. (refactor)
• refactor -t next-webpack: chunks whose module wrapper is a named function declaration (function webpack_<id>(...), synthesized whenever the original bundle module was itself a function expression — the dominant form on real-world bundles) are now correctly recovered. Previously the traversal only visited ArrowFunctionExpression nodes, so these chunks were reported as No module function found, and in the rare cases where a nested arrow function's immediate parent happened to be an assignment, that unrelated inner fragment was captured as a false-positive "recovered" module. Both wrapper forms are now supported and the top-level check requires the wrapper to be a direct child of Program. Also fixes next/validator.ts's _generator import, which was missing the ?? _generator ESM interop fallback present in the react validator and broke under Vitest, blocking unit test coverage of this module. (refactor)
• refactor: the per-file signature cache's 7-day age-based TTL had no way to detect that the upstream HuggingFace dataset content changed within that window, so a stale-but-not-expired (or emptied/corrupted) cache entry was silently trusted, producing non-deterministic chunks_library_skip/files_recovered results across otherwise identical runs. Each bucket file's content hash is now fetched from the HF tree API once per branch per run and compared against the hash recorded when the entry was cached (remote_hash.txt); a mismatch invalidates the cache immediately regardless of age, and an unavailable remote hash falls back to the pre-existing age-based check. The hash-fetch call is wrapped in try/catch so a transient failure (e.g. HF API rate-limiting under concurrent invocations) degrades gracefully to the age-based check instead of throwing an unhandled rejection that silently aborted the whole run (chunks_total: 0, no visible error). (refactor)