Code Analysis Validation

Code Analysis 源码验证 · 2026-11-05 至 11-06

这轮用两个问题检验分析结果。内部函数加入公共入口后，能否指到正确的实现？回调通过事件名注册后，能否找到执行它的代码？先用上游的源码、差异和测试写下答案，再运行同一版本的分析器读变更前后两份源码。另取 EventEmitter3 5.0.1 复核同名回调的实际分派。Code Analysis One Page · 公开 Labs 基线 bf0a29e7

Redux 的公共入口多了什么？

#4621（85d7f27a → c9e06506）只改了 src/index.ts。变更后，第 8 行导入原有的 isPlainObject，第 48 行把它列为公共导出。原有三个内部调用方是 combineReducers、createStore 和 isAction 所在的文件。它们和函数实现的源码在两版中相同。入口导入 · 公共导出 · 函数实现

• Labs 找对了文件依赖。 仅扫描 src/ 的 17 个文件。变更前的 38 条导入和变更后的 39 条都解析到文件。指向该函数实现文件的导入方从 3 个变为 4 个，新增的正是公共入口。
• 公共名称需要核对导出语句。 导入记录里的 default 只说明入口怎样取得这个函数。用 TypeScript 5.9.3 将两份源码分别转为 CommonJS 后，直接读取入口，确认只有后版导出了 isPlainObject，而且与原函数是同一对象。本次验证读取源码入口，范围不含已发布的 npm 包和外部使用方。
• 本地双版本实验 c3dddd5c 选中了唯一变化的 index.ts。公开 Labs 的文件依赖加上上面两处源码，已足够回答本例。实验输出对读者用时或准确度的增益，需另做对照。

Commander 在哪里调用子命令钩子？

#1763（3ae30a29 → 2c7f687e）新增 preSubcommand。注册时，父命令把监听函数存入事件表。分派时，先调用监听函数，再把参数交给直接子命令。用 Node 跑同一个根命令、子命令和孙命令，旧版拒绝注册，新版只触发一次根钩子，传入直接子命令，随后才执行孙命令动作。注册 · 分派 · 回调调用处 · 上游顺序测试

• Labs 漏掉了进入库的依赖。 两版各扫描 149 个 JS/TS 文件，各记录 174 条导入。125 个文件中的 125 处相对目录 require 都由 Node 解析到根 index.js，包括 96 个测试文件和 29 个示例文件。默认配置下，Labs 对这 125 处都报告未解析。放开 .d.ts 排除后，这些运行时引用又全指向了类型声明。包分别声明了 JS 入口和类型入口。包入口声明 · 测试的实际导入
• 定位方法和认出回调对象是两个结果。 本地实验 c3dddd5c 选中了 7 个 Git 变更文件中的 4 个。两份 README 和公开声明 typings/index.d.ts 在默认扫描范围外。实验找到了新增方法的第 1202–1212 行。对第 1207 行究竟执行哪一个监听函数，它明确报告未绑定。该方法的直接引用计数为 0，但第 1058 行确有调用。调查影响时应沿注册表回查，并保留对运行时顺序的独立验证。

修复验证与协作进度

固定样本	公开 Labs 的结果	Draft #1214 的本地验证
Commander #1763，变更前后分别检查	每版 125 处目录引用均未解析。显式纳入声明时都指向类型文件	两版各 125 处均与 Node 的运行时入口一致。纳入声明后也指向 JS
dotenv v16.4.7，追加检查相邻的类型文件	7 处省略扩展名的引用均未解析	7 处均指向 lib/main.js，逐处与 Node 一致
minimist v1.2.8，追加检查已能解析的目录入口	16 处均指向 index.js	同样 16 处逐一吻合

上层 d2754f100 继承下层条件导入修复 5df422692。它利用本轮已捕获的文件区分相对 CommonJS 引用和类型入口。Commander 单版的已解析导入由 16/174 增至 141/174，剩余 30 条外部依赖和 3 条未知项。该变化集中于测试和示例。233 项模块测试通过。解压后用 CLI 重跑 Commander 和 dotenv，原始分析结果均与源码版相同。修复已提交审查，详见条件导入 Draft #1213和运行时入口 Draft #1214。表中的 Labs 列可以直接按下方命令复现。dotenv 配置入口 · dotenv 测试使用处 · minimist 示例

• 已有分工继续按原讨论推进。稳定 finding ID 修复已开 Draft PR。配置无效时的错误提示、解析失败与跳过语言的披露，由原协作者按 A1、A2 分别推进。稳定 ID #1212 · A1/A2 范围

• 间接调用的两个对照分别跟踪了EventEmitter3 的同名监听器和pluggy 的跨文件注册与排除。两个案例都区分了源码调用位置与实际选中的对象。

• Ansible 同名包与模块核对了标为已解析的导入是否指对文件。SymPy 全库与同名导出核对了 1,572 个 Python 文件的覆盖，以及 simplify 导入对象的身份。两个 Python 修复已分别提交审查。包入口 #1216 · 整库扫描 #1217 Follow-up in the same Draft now checks parent-package paths and namespace portions: five authored probe corrections and two false targets removed from adapted Pyright cases; Ansible, pluggy and pytest controls preserve all 4,409 references. Reproduction

• SLF4J 的 Java 服务选择用两个版本、十次独立 JVM 运行，区分接口依赖、服务描述文件和运行时选中的实现。Guava 的两套源码里，六处同名导入在合扫时都保留未解析，按 JRE、Android 分开扫描后全部与 JDK 指向的文件一致。两套源码各有七个文件因 Unicode 转义被跳过。后续验证与修复恢复了这 14 个文件，并与 JDK 逐条核对了 863 个声明位置，代码已提交审查。Draft #1218

• Node package loading conditions compares import/require targets with Node and TypeScript, studies dependency-cruiser’s resolver choices, and records unchanged real-project controls plus two remaining source/runtime gaps. The loading-mode correction is under review in Draft #1219; Draft #1220 corrects 19 JavaScript implementation targets in dependency-cruiser and chalk, each independently checked against Node.

复现公开 Labs 对 Redux 和 Commander 的结果

在临时目录准备 Git 和 Node 22。下面固定三个仓库版本。npm ci 只给临时的分析器副本安装锁定依赖。两个被分析的仓库均不需要安装依赖。这里使用 --fail-on never 收集分析结果，逐条比较导入目标。最后一段使用 Node 的 require.resolve，不执行被解析的模块。Node.js CommonJS 解析规则

set -eu
w=$(mktemp -d)
pin() {
  git init -q "$w/$1"
  git -C "$w/$1" fetch -q --no-tags --depth=2 "https://github.com/$2.git" "$3"
  git -C "$w/$1" checkout -q --detach FETCH_HEAD
}
pin archify tt-a1i/archify bf0a29e7664f52973d06a8e6a608df2db1ecbd39
pin redux reduxjs/redux c9e06506f88926e252daf5275495eba0c04bf8e3
pin commander tj/commander.js 2c7f687eaea6e7b29b917db8d71a06fe6fbfb53e
(cd "$w/archify/archify/modules/code-analysis" && npm ci --ignore-scripts --no-audit --no-fund)
cli="$w/archify/archify/bin/archify.mjs"
for project in redux commander; do
  git -C "$w/$project" worktree add -q --detach "$w/$project-base" 'HEAD^1'
  for side in base head; do
    root="$w/$project"
    if [ "$side" = base ]; then root="$w/$project-base"; fi
    if [ "$project" = redux ]; then root="$root/src"; fi
    node "$cli" code-analysis check "$root" --language ts --fail-on never --json \
      --out "$w/$project-$side-out" > "$w/$project-$side-receipt.json"
  done
done
node - "$w" <<'JS'
const fs = require('node:fs');
const path = require('node:path');
const { createRequire } = require('node:module');
const w = process.argv[2];
for (const side of ['base', 'head']) {
  const facts = name => require(path.join(w, name + '-' + side + '-out', 'raw-facts.json'));
  const helper = facts('redux').imports.filter(e => e.to === 'utils/isPlainObject.ts');
  const repo = fs.realpathSync(path.join(w, side === 'base' ? 'commander-base' : 'commander'));
  const loads = facts('commander').imports.filter(e => e.kind === 'require' && ['../', '../../'].includes(e.specifier));
  const agree = loads.filter(e => {
    const target = createRequire(path.join(repo, e.from)).resolve(e.specifier);
    return e.to === path.relative(repo, target).split(path.sep).join('/');
  });
  console.log(side, { reduxImporters: helper.map(e => e.from), commanderAgreed: agree.length, commanderChecked: loads.length });
}
JS

预期 Redux 的导入方从三个增加到四个，新增 index.ts。Commander 的 commanderChecked 在两版均为 125，公开 Labs 的 commanderAgreed 均为 0。复核上层 Draft 时，把 pin archify 一行的 SHA 换成 d2754f10066980b9ce1e7c13f2f634e6cec67447。从 GitHub 重新取得该提交后，两版均为 125/125，Redux 仍只增加 index.ts。

• Resolver design research connects the TypeScript, dependency-cruiser, Pyright and JavaParser findings to source-context choices and accuracy checks. The TypeScript 6.0.3 upgrade experiment was not adopted because a valid Node array fallback regressed; both boundaries are reproducible.

• JS/TS lexical call evidence is now isolated in Draft #1225: four fixed scopes preserve existing facts, selected direct targets agree with source, and dynamic EventEmitter3 dispatch remains unresolved. The page records the explicit call model, compatibility and output-size costs, and an executed public reproduction. Single-entry question orientation is now isolated in Draft #1226, including TypeScript entries and explicit unavailable-versus-zero receipts. Required-entry paired investigation is isolated in Draft #1229, with seven source/archive cases, a format-only control and explicit declaration coverage.

• Relative default function calls, Draft #1227, adds six source-verified Redux targets while preserving all earlier call records in EventEmitter3 and Archify Labs. It records v1/v2 compatibility and an executed source/archive reproduction.

• Relative Python namespace imports extends Draft #1216 with ordered cross-portion lookup for relative imports. Independent CPython expectations, three real repository controls and ten source/archive comparisons are recorded, with a self-contained public reproduction.

• Java static value and type namespaces, Draft #1231, restores two missing type dependencies in a JDK-verified authored case. Guava and SLF4J preserve all existing records; the page includes an executed public compiler/CLI/archive reproduction and remaining parsing limits.

• JavaScript parameter-default scopes corrects a false body-local call target in Draft #1225 and propagates it through #1226/#1227/#1229. The authored Node oracle, unchanged real-source controls, final revision/validation table and executed public replay are recorded.

• Vite configuration merge follows a changed recursive helper through an unchanged wrapper and configuration caller. Frozen source answers, an 18-case helper matrix, explicit partial capture and source/archive/public replay are recorded; no new product fix was needed.

• Current review map links the open Drafts to their dependencies, evidence and remaining review decisions, with adjacent teammate work kept separate.

• Saved Python/Java source questions, Draft #1234, reuses captured function/import evidence in SymPy and SLF4J while retaining unavailable calls and ambiguous-overload errors. Exact public capture recreation, normal CLI and unpacked-archive checks passed; no runtime selection or reader-effectiveness claim.

• Optional-chain CommonJS guards updates Draft #1213 and preserves its #1214/#1216 dependents. Eight authored cases separate short-circuited arguments/keys from eager bases/grouped boundaries; two real controls preserve facts and ten scopes match source/archive. Standalone public replay passed. No real-project trigger was found in the bounded inventory scan; current CI retains the known README baseline failure.

• pandas selection study follows three source questions through scalar/list, boolean-mask and duplicate/MultiIndex branches. Saved orientation and archive checks, 14 independent wheel cases, a shared reader interpretation error and two separate follow-up checks are recorded. The page includes a field-reading recipe, executed standalone replay and a later source audit of two cycle warnings that separates static dependencies from feasible initialization order; no new product defect or reader-effectiveness claim.

• HTTPX deferred imports follows a real change from module-scope dependencies to constructor/helper imports. Ten selected import facts and six source/archive question pairs agree with source; a separate six-process oracle shows why bypassing HTTPX’s SSL constructor still allows httpcore to import certifi. Executed standalone replay included; no requests, benchmark or new product defect.

• Conditional null package targets updates Draft #1220 and its existing dependents. A frozen 16-site authored matrix corrects nine prior wrong targets, preserves type-only and array-selection boundaries, and passes a public source/archive replay. Seven fixed real scopes preserve their earlier facts; the final top passes 287 module tests. Current heads, archive identities, evidence reuse and CI outcomes are recorded separately from human review.

Fixed investigation evaluation — 7 November 2026

Seven projects, five changes, source/ZIP replay and per-unit results now compare Labs, the combined Draft baseline, Python calls and cross-language definition comparisons. These are experimental Draft results with explicit unknowns and partial coverage, not an integrated release.

Language capability table: Labs, Draft validation and unsupported scope.

Go first source/ZIP investigation: exact root-module source bindings and known callers in Draft #1256, with build/typing scope, finite score, Chi oracle correction and remote CI kept separate.

• Rust source paths and direct callers, Draft #1258, follows changed regex/serde_json definitions and real workspace/use-as paths. Six source/ZIP fact captures match byte-for-byte; both paired profiles remain partial. Local tests, remote CI, package verification and unmerged status are explicitly separate.

• Java explicit class-qualified static paths, Draft #1259, follows SLF4J and Commons source targets. Source/ZIP parity, compiler-agreed new targets and remaining compiler-known misses are separate from local tests and final remote CI.

• Stable default ordinary-function references, Draft #1260, restores Prettier source jumps and real version-pair known callers while retaining factory/callback unknowns. Signature audit diagnostics, source/ZIP parity, local tests and final remote CI are explicitly separate.

• Configured captured-alias calls, Draft #1261: Redux source-first aliases, retained known barrel miss, eleven independent signature attributions, source/ZIP parity and separate local/CI/integration states. Native JS→TS stack #1262; no Labs merge.

• Cumulative six-language candidate, Draft #1263: original Go/Rust/Java/JS/TS/Python histories,17captures/20questions source/ZIP parity,373/373local module passes, explicit archive Git-only test limitation and separate final-head CI/DSH checks. No Labs merge.

• Concrete Go methods, Draft #1264: three fixed direct targets, real Chi changed-method callers, 9,281 independently attributed new targets and 37 retained known misses. Source/ZIP parity and local/CI/merge states remain separate.

Rust 显式固有函数路径（Draft #1265）

serde_json 的 value/from.rs:60 Number::from_f64 以前停在未知目标，现在可以沿 Number 导入跳到 number.rs:183。真实版本中移除 inline 属性的定义调查，两侧各找回 3 处源码确认的引用，位置均有效；函数体没有改变，整体调查仍为 partial、退出码 1。regex 两个模块中的同名 Regex::new 分别指到自己的定义。预留 Map 泛型样本仍有 2 个实际调用点遗漏，不能算作合理未知。

本地完整模块 380/380，解包 Rust/question/change 测试 42/42，三个原始捕获与四个问题完成源码/ZIP 对比。远端 CI 与合并状态另列，未把 Draft 算入 Labs，也未发布或安装。固定版本、复现方法、工具链成本及未证明范围。

#1265 最终 head CI 已结束并通过；完整回归、浏览器、ZIP、三平台打包及 Windows 检查通过，部署任务跳过。仍是未合并 Draft。独立 rust-analyzer 复核在发布后另行开始，安装成本及工作区配置另记，不将尚未完成的审核算作准确性证据。

Rust 独立 LSP 位置复核（#1265 后续证据）

独立 rust-analyzer1.89.0 复核的 1,250 个目标观测覆盖 1,230 个实际调用点，定义位置均一致；它包含先前有限样本，不能累加成新的独立样本。预留 Map 两个实际遗漏在两个 feature 配置下也都能由 RA 定位。逐项请求、函数范围、返回位置、依赖锁与复现脚本现已公开，错误的 string/bytes 目标对照能被校验器拒绝。证据和限制。这仍不证明完整编译、运行行为或全仓召回率。

证据 head1788ace7a 的 CI 已结束并通过，实际模块日志 380/380、零跳过。发布代码和 ZIP 字节未改变，RA 复核属于另行执行的本地验证；未合并、发布或安装。