[N0zoM1z0]

Fix JavaScript application analysis that exhausts the CLI/MCP heap on a real public Bun module (#1563). Parse and project each inert source in a reusable owned Node worker with an independent heap limit and deadline. Negotiate parent admission after validated static checkpoints, retain observed facts when deeper projection does not fit, and keep cancellation, timeout, cleanup failures and unexamined relationships explicit.

Preserve the default complete-result contract. Oversized MCP responses use existing retained Evidence delivery; interrupted analyses return a directly usable partial Evidence reference after successful recording. CLI JSON retains the complete partial observation. Fix duplicate-content node merges retaining historical observation arrays and reuse privately immutable JSON properties during graph validation.

MCP controls are optional and leave omitted values out of Evidence parameters:

{"input_path":"/absolute/path/to/application","max_heap_mb":512,"analysis_timeout_ms":300000}

A recorded timeout/cancellation partial result exposes the original analysis directly:

{"partial_observation":{"kind":"retained-evidence","evidence_id":"ev_..."}}

Verification:

• Integrated latest affected main changes, including caller-owned artifact cleanup scopes and indexed structured observations.

• 154 focused tests passed: real worker reuse/startup deadline, SDK cancellation and subsequent work, 1500 identical-content paths, raw findings through public module views, nested reader cleanup, large literal CLI/MCP, schema dialect validity and module boundaries.

• Complete feedback directory, 768 MiB parent and worker: 2346 parsed JavaScript files, all 2589 input digests unchanged, no parent fatal heap or leftover owned roots. Partial graph coverage remains explicit. Selected summary/page/item/trace, close/stale and subsequent analysis all passed; sampled process-family peak 1.70 GiB.

• Actual semantic worker heap failure on a 1.6 MB dense source with a 512 MiB worker: completed static facts survived, the MCP parent remained usable, and subsequent work passed.

• Real Notion ASAR at the same heap limits: 69 JavaScript files parsed across 121 relevant files, partial coverage explicit, unchanged input digest; 98 control pings, maximum 13.31 ms. Summary/page/item/trace and close passed.

• Actual CLI SIGINT while analyzing the second dense source: exit 130, complete JSON partial Evidence retained the first source, no syntax-failure inflation or leftover owned roots.

• npm run check:ci, npm run docs:check, npm run mcp-catalog:check, and discovery of all 794 test files passed.

• npm run verify:package passed on a production-only installation, including JavaScript dedicated/generic CLI, 170 MCP tools, setup/update, evidence and cleanup workflows.

Remaining verification before merge: native Windows installation/workflow and exact-head CI. No real Hopper/Ghidra/IDA authority was exercised by this JavaScript change.

Fixes #1563. Fixes #1565. Follow-up to #1065; #1065 remains open.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.