fix(typescript/javascript): stop dropping bodyless overload signatures

[squid-protocol]

Summary

Fixes #2278. TypeScript allows multiple bodyless function-overload signatures sharing a name, followed by one real body-bearing implementation. func_start's regex correctly matched every overload (confirmed via struct_func_start's raw signal count), but detector.py's terminator-scanning loop (the #1629 brace-less/expression-bodied arrow scanner, gated to typescript/javascript only) silently dropped any match that never found a real terminator in its search window -- exactly the shape of a bodyless overload signature, whose own return-type expression can contain literal {}/=> tokens that aren't a real body or terminator at all.

Fix

Three changes, all scoped to the typescript/javascript branch of _slice_by_braces:

1. When the scan reaches a {, check whether it's preceded (skipping whitespace) by a type-level operator (&|:?=) -- if so it's a type literal's own brace (e.g. fp-ts's : {}) & empty-object-type intersection members), not a real body opener; skip past its matching close and keep scanning.
2. When no terminator is ever found, give the match a real function_data row bounded by the next match -- but only when a genuine parameter list immediately follows the name (optionally after <generics>). This guard is required: an earlier draft without it turned real Flow type-level fields (callback: A => T,, const task: Task = ...) into phantom function matches in react/ReactFlightServer.js -- caught and fixed during this PR's own verification.
3. Loosen the min-2-lines-of-body filter to also allow single-line bodies for typescript/javascript, since a recovered overload's body (bounded by the next match) can be very short.

Verification

• fp-ts/pipeable.ts: struct_func_start/function_count now match exactly at 224/224 (was 224/217) -- all 8 pipeable overloads recovered.
• Full corpus diff (typescript): missing-function count 131 → 123 (this fix's own isolated contribution).
• Full corpus diff (javascript): zero missing, zero new false-positive/phantom matches -- every new "extra" entry traced to a real function in an already Flow-broken file tree-sitter can't parse (same class as the pre-existing 198-entry baseline), not a regression. Confirmed via direct source reading of every new/changed entry, not assumed from the diff alone.
• pytest on typescript/javascript/detector suites: 463 passed. Cross-language sanity spot-check (java/csharp/python/rust, since this touches a nominally shared file even though the changed branch itself is language-gated): 262 passed.
• tests/ruff_audit.py --ci / tests/mypy_audit.py --ci: no new findings beyond baseline.
• ReDoS pathological-input timing probe: no slowdown.

This is the highest-risk of a batch of 4 TypeScript fixes (the only one touching shared detector.py rather than an isolated per-language regex). A first draft was dispatched to a Gemini/agy subagent per this repo's tree-sitter-accuracy-sweep-style workflow; independent verification in the main session caught a real precision regression that draft's own narrow testing missed, root-caused it, and landed a scoped, evidenced fix directly.

Test plan

• struct_func_start/function_count before/after (pipeable.ts)
• Full-corpus tri-comparison diff, both typescript and javascript (before/after)
• Every new "extra" entry manually traced to real source, not assumed
• test_typescript.py / test_typescript_strict.py / test_javascript.py / test_javascript_strict.py / test_detector.py
• Cross-language sanity spot-check (java/csharp/python/rust)
• ruff/mypy baseline audits
• ReDoS sanity check

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab