ipk-verify: service language-version check + advisory runtime-API detection#5
Merged
Merged
Conversation
Two follow-ups after the merged web-app work. Service language-version check (gating): a service's own .js is tokenized for its ES syntax level and checked against each firmware's bundled Node.js version (EsLevel::min_node_version). This is the trustworthy, code-derived Node requirement that replaces the untrusted engines.node — a service using optional chaining now correctly fails on Node 12 and passes on Node 16. Runtime-API detection (advisory, polyfill-aware): unambiguous namespaced APIs (Object.assign, Object.entries/fromEntries, Array.from, Promise.allSettled, globalThis, Reflect.*, ...) are detected from the token stream and flagged when newer than the target engine/Node — a "may need polyfills" note that never gates. Prototype methods are excluded (ambiguous receiver). Crucially, testing real packages showed bundles ship core-js/babel-runtime that merely *reference* every API, so the advisory is suppressed when a polyfill library is detected; the component is instead noted as self-polyfilling. JS token analysis (ES features + APIs + polyfill sniffing) is factored into a shared js module used by both web-app and service detection. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WNiK747P4W8C2M9RRhRFS3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #4 (web-app / service technology detection). Adds two detection capabilities to
ipk-verify, both driven by testing against real webosbrew packages.Service language-version check (gating)
Previously, non-native JS/Node services only reported dependencies + the firmware's Node.js version (informational), because
engines.nodeis not trustworthy and was disregarded.Now the service's own
.jscode is tokenized for its ES syntax level and checked against each firmware's bundled Node.js version (EsLevel::min_node_version, frompackages.json). This is a code-derived, trustworthy requirement (syntax can't be polyfilled), unlikeengines.node.?., ES2020) correctly fails on Node 12 and passes on Node 16.Runtime-API detection (advisory, polyfill-aware)
Unambiguous namespaced APIs (
Object.assign,Object.entries/fromEntries,Array.from,Promise.allSettled,globalThis,Reflect.*, …) are detected from the token stream and flagged as "may need polyfills" when newer than the target engine/Node. This is advisory only — it never gates compatibility, since runtime APIs (unlike syntax) can be polyfilled. Prototype methods (.includes/.flat) are excluded because their receiver type is unknowable from tokens.Polyfill awareness: testing real bundles showed they ship core-js /
@babel/runtime/ regenerator, which merely reference every API (feature-detect/define), so a naive advisory flags the polyfill library itself. When a polyfill library is detected the component is noted as self-polyfilling and the API advisory is suppressed.Object.entries/fromEntries→ advisory showspolyfill?on Chromium <73,nativeon 79+.Internals
JS token analysis (ES features + static APIs + polyfill sniffing) is factored into a shared
common/webdetect/src/js.rsmodule used by both web-app and service detection.ress/tlremain the only new dependencies (from #4).Tests
webdetect32,fw-lib2,ipk-lib3,ipk-verifyintegration 2 (+global_scope2) — all green, no warnings. Verified end-to-end against the real Homebrew Channel package and synthetic fixtures.🤖 Generated with Claude Code
https://claude.ai/code/session_01WNiK747P4W8C2M9RRhRFS3
Generated by Claude Code