docs: add JavaScript language-status doc, first tree-sitter-based §9 pass - #1223
Merged
Conversation
…length RISK_SCHEMA galaxyscope.py's CRITICAL LEAKS synthetic-node path (forces a file flagged by the Aperture secrets scanner onto the 3D map even though it never went through normal parsing) built risk_vector as a hardcoded literal: `[0.0] * 13 + [0.0, 0.0, 0.0, 0.0, 100.0]` -- an 18-element vector with a comment claiming "Index 17 is secrets_risk". RISK_SCHEMA is actually 13 elements now (secrets_risk at index 12), so this path has been emitting a 5-element-too-long risk_vector for a while. Harmless on its own, but record_keeper.py's SQLite INSERT builds its column list from the live RISK_SCHEMA length -- any file taking this path made record_mission() raise `sqlite3.OperationalError: N values for M columns` and abort `--db-only` output entirely for the whole scan, not just that one file. Found while building a tree-sitter-based ground-truth accuracy pass for JavaScript (mirroring ast_accuracy_audit.py's Python methodology, #1200): `galaxyscope <path> --db-only` crashed on expressjs/express because its committed `.npmrc` trips the hardcoded-secrets detector. Reproduced, isolated to this exact literal via a cursor.execute proxy that dumped the column/value counts at the failing INSERT, confirmed by reverting it. Fix: size risk_vector from `len(SignalProcessor.RISK_SCHEMA)` (matching the sibling AI-MODEL-WEIGHTS synthetic-node path a few lines down, which already did this correctly) and set the secrets_risk slot by name lookup instead of a hardcoded index, mirroring the hit_vector/sec_hardcoded_secrets pattern already used right below it. tests/core_engine/test_galaxyscope.py::test_synthetic_node_generation asserted `risk_vector[17] == 100.0` -- also stale, and silently correct by coincidence since the old 18-length hardcoded vector still had a real value at index 17. Updated to assert against the live RISK_SCHEMA length and the schema-resolved secrets_risk index, so a future RISK_SCHEMA resize can't silently reintroduce this drift. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…pass Follows python.md's structure (language-status skill), extending its §9 "measured accuracy" methodology beyond Python for the first time using tree-sitter-language-pack against real code -- exactly the path python.md's own §9 proposed for scaling past Python's stdlib `ast`. Measured against two corpora with different shapes (expressjs/express v5.2.1: small, mostly top-level functions and middleware callbacks; and GitGalaxy's own site/js/ WebGPU visualizer: heavily class-based). Confirms #1209/#1216's args capture-group fix works on real code (100% args-count exact match on every function found, both corpora) and surfaces: - A blocking infra bug that crashed --db-only on any repo with a flagged secret (fixed same-day in #1220, needed before this measurement could run at all -- express's own committed .npmrc trips the detector). - #1221 (open): func_start's method-shorthand branch has no trailing-`{` requirement, unlike args' own "Invocation Shield" for the same shape -- bare call statements (`next();`) get misidentified as definitions. Confirmed to also affect typescript/java/csharp/apex/dart/groovy. - #1222 (open): real, differently-named functions can be silently dropped from function_data even though func_start's regex finds them correctly -- most severe for ES6 class methods (one file lost 9 of 10 real methods). Likely the same _slice_by_braces mechanism #789 diagnosed and left unfixed for csharp. Neither new defect fixed here (docs-only pass, per the language-status skill's scope discipline) -- both need the fuller harden-language-extraction treatment given they touch shared detector.py slicing logic. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
This was referenced Aug 10, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
docs/language_status/javascript.md, followingpython.md's structure (thelanguage-statusskill). This is the first time python.md's own §9 "measured accuracy" methodology has been repeated for a non-Python language, usingtree-sitter-language-packin place of Python's stdlibast— exactly the path python.md's own §9 close-out proposed for scaling this beyond Python.Stacked on #1220 — this branch includes that PR's commit because the measurement in §9 literally could not run without it (see below). Fine to merge either order; if #1220 lands first, this will show as a clean single-commit diff automatically once GitHub re-resolves the base.
Measured accuracy (§9) findings
Measured against two real corpora with deliberately different shapes:
expressjs/express@v5.2.1(small, mostly top-level functions/middleware callbacks, no classes)site/js/WebGPU visualizer (heavily class-based)Confirms #1209/#1216's
argsfix works on real code: 100% args-count exact match on every function found, both corpora — not just the syntheticARGS_COUNT_FIXTURES.Found three real issues along the way:
risk_vectoringalaxyscope.py's credential-leak path crashed--db-onlyon any repo with a flagged secret — express's own.npmrctrips it. This blocked the measurement entirely until fixed → fix(core): critical-leak synthetic risk_vector hardcoded to stale 18-length RISK_SCHEMA #1220 (already merged/mergeable, included in this branch).func_start's method-shorthand branch has no trailing-{requirement (unlikeargs' own "Invocation Shield" for the identical shape), so bare call statements (next();) get misidentified as function definitions. ~15% precision loss on the express corpus. Confirmed to also affecttypescript,java,csharp,apex,dart,groovy.function_dataeven thoughfunc_start's regex finds them correctly — mild in express (one sibling function), severe insite/js/(one class lost 9 of its 10 real methods, keeping onlyconstructor). Likely the same_slice_by_bracesmechanism issue csharp func_start never matches expression-bodied methods, and can hallucinate bare calls as functions with no enclosing brace #789 diagnosed for csharp over a year ago and left unfixed.Neither #1221 nor #1222 is fixed in this PR — docs-only pass, per the
language-statusskill's own scope discipline ("if gathering material surfaces a real gap, that's a finding forharden-language-extraction/an issue, not an inline fix"). Both touch shareddetector.pyslicing logic and need the fuller hardening-epic treatment (ReDoS sweep, golden-master diff, per-language verification) rather than a quick patch here.Test plan
crucible_check.py/audit_check.pyneeded for the doc itselfdocs/language_status/README.mdindex updated (javascript row now links to the new doc, plus a callout summarizing the §9 findings)🤖 Generated with Claude Code