[Patrick-Erichsen]

Summary

PDFGate 1.0.0 fails static inspection because a shell-parser candidate opens inside a JavaScript Error template and consumes later host code. Use bounded JavaScript parsing and individual data-use proofs to delimit owned syntax, while raw findings continue to inspect original bytes.

JavaScript source → bounded native parse → exact binding/use proof
  proved data literal or comment → bound shell candidate
  unproved constructed value     → explicit incomplete coverage

Pin tree-sitter==0.25.2 and tree-sitter-javascript==0.25.0 for .js, .mjs and .cjs. Mutable/shadowed capabilities, escaping callbacks and Error messages, classes and captured catch bindings, unknown executable uses and exhausted analysis bounds retain conservative coverage.

Evidence

• Before: the read-only original PDFGate bundle completes 4/5 static files.
  After: installed Linux runtime completes 5/5, with zero static limitations and identical two raw LP3/E1 MEDIUM finding payloads except generated IDs. Original helper: 12,801 bytes, SHA256 7cccd56d3e8e8c1e55430af2f9002c6dc0490b363c2c40c4205ab7025be9b7fd. Existing missing-reference caveats remain.
• 648 focused controls, 997 installed Python 3.12 Linux adapter controls, full Go tests, go vet and Ruff pass. All 300 short counterexample variants across five import forms attribute opacity to the actual construction. Review regressions were reproduced against actual main before repair; short baseline completions are distinguished from newly introduced long-case regressions.
• A fresh upstream patch reconstruction matches all 136 package/dependency files, preserving the landed Bash/CSV, packed-cache, lazy-marker and pinned-image changes, including mandatory shfmt controls. Existing SDK versions are unchanged.
• Independent P0–P3 review is terminal scoped-clean/exit0. All 16 unchanged-original installed static replays complete: no genuine security finding is removed; conservative reference-warning changes and remaining group limits are retained in the incident evidence.

Refs ClawHub #4087. Production adoption, normal original-version retry and public-byte verification follow before issue closure. Other retained parser groups remain incomplete.

Merge Danger

Door: two-way; revert the source/runtime pin.

Blast Radius: scanner. New bounded syntax ownership applies only after the individual JavaScript value/use proof; unsupported constructions retain incomplete analysis. No original artifacts or security findings are rewritten.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.