# Risk map — microsoft/TypeScript

> Canonical page: https://codevetter.com/unpack/typescript/risk-map

# Risk map — microsoft/TypeScript

Scanned commit 5f6db9c9148635b4cbf72f1193b821b9c6b42dcc (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The highest-risk surfaces are process spawning and protocol trust boundaries: the binary can exec arbitrary commands for content mappers (gated by --runExternalCode) and npm installs for ATA, and the --api server exposes the host filesystem (optionally piped through client callbacks) to whoever holds the pipe/stdio. Correctness risk concentrates in the baseline corpus: thousands of accepted diffs vs the JS compiler and an explicit skip list mean behavior parity is approximate, not exact. Platform-specific code (fswatch assembly FFI, per-OS process-alive checks) and panic-prone paths (NewServer panics on missing Cwd; per-request recover in handlers) are fragile spots. Generated files and the dual go.mod workspace create mechanical traps rather than runtime risk.
- osSys.Spawn/exec.Command is a raw process-execution boundary: spawnProcess launches command[0] with args, inheriting stderr; childProcess.Close kills and reaps the child. Used for content mappers and API-side spawning. — [tsc/cmd/tsc/sys.go#L68-122](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/cmd/tsc/sys.go#L68-L122)
- Content mappers execute arbitrary npm-package code declared in a project's tsconfig/package.json; execution is gated by the RunExternalCode option (--runExternalCode flag / js/ts.contentMappers.enabled setting) and NewContentMapperHost returns nil when disabled. — [tsc/internal/execute/tsc/compile.go#L86-98](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/execute/tsc/compile.go#L86-L98) [tsc/internal/contentmapper/contentmapper.go#L1-14](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/contentmapper/contentmapper.go#L1-L14) [tsc/cmd/tsc/api.go#L34](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/cmd/tsc/api.go#L34)
- ATA can shell out to `npm` (ServerOptions.NpmInstall runs exec.Command("npm", args...)); the LSP server implements ata.NpmExecutor, so a language server session can trigger package installation into the typings cache. — [tsc/cmd/tsc/lsp.go#L59-63](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/cmd/tsc/lsp.go#L59-L63) [tsc/internal/project/ata/ata.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/project/ata/ata.go) [tsc/internal/project/ata/installnpmpackages_test.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/project/ata/installnpmpackages_test.go)
- The --api server binds the host filesystem directly: StdioServer wraps bundled.WrapFS(osvfs.FS()) and optionally a callbackFS delegating readFile/fileExists/directoryExists/getAccessibleEntries/realpath to the client; a named-pipe/Unix-socket transport (PipePath) is an additional local attack surface. — [tsc/internal/api/server.go#L62-84](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/api/server.go#L62-L84) [tsc/internal/api/callbackfs.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/api/callbackfs.go) [tsc/internal/ipc/transport.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/ipc/transport.go)
- Thousands of behavior diffs vs the Strada compiler are accepted wholesale in submoduleAccepted.txt, and CHANGES.md documents deliberate feature removals (Closure JSDoc, constructor expandos, several options) — parity-sensitive consumers can hit silent behavioral differences. — [tsc/testdata/submoduleAccepted.txt](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/testdata/submoduleAccepted.txt) [tsc/CHANGES.md](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/CHANGES.md)
- The compiler-test skip list encodes known uncovered areas (all APISample_* tests and every test using removed options like verbatimModuleSyntax/importsNotUsedAsValues are skipped rather than ported). — [tsc/internal/testrunner/compiler_runner.go#L78-120](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/testrunner/compiler_runner.go#L78-L120)
- Platform-specific low-level code carries portability risk: fsevents_darwin_ffi_{amd64,arm64}.s hand-written assembly for FSEvents, isprocessalive_{unix,windows,other}.go for the LSP parent watchdog, and transport_{unix,windows}.go for pipes. — [tsc/internal/fswatch/fsevents_darwin_ffi_arm64.s](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/fswatch/fsevents_darwin_ffi_arm64.s) [tsc/cmd/tsc/isprocessalive_windows.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/cmd/tsc/isprocessalive_windows.go) [tsc/internal/ipc/transport_windows.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/ipc/transport_windows.go)
- Error-containment: NewServer panics when ServerOptions.Cwd is empty, and document-request handlers run under s.recover(req) so a checker crash is contained to the request; userFacingRequestFailedError distinguishes expected failures from logged errors. — [tsc/internal/lsp/server.go#L60-63](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/lsp/server.go#L60-L63) [tsc/internal/lsp/server.go#L1341-1359](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/lsp/server.go#L1341-L1359) [tsc/internal/lsp/stack_sanitizer.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/lsp/stack_sanitizer.go)
- contentMapperFallbackResponse silently returns empty/null LSP responses for unknown file types during the mapper-unregistration window — a deliberate correctness-for-availability trade that can mask real errors. (inferred) — [tsc/internal/lsp/server.go#L1194-1222](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/lsp/server.go#L1194-L1222)
- ReuseProgram's in-place file replacement has many bail-out conditions (redirect files, importHelpers/JSX-runtime imports, supplemental file shape); subtle misses here would produce stale-program bugs that only appear in long-running sessions and are hard to baseline-test. (inferred) — [tsc/internal/compiler/program.go#L323-403](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/compiler/program.go#L323-L403)
- The symbol/type handle layer in the API assumes binder symbol identity is stable snapshot-wide (global atomic IDs) but assigns types per-project; cross-project symbol queries depend on a first-writer-wins canonical project that could return subtly different results depending on call order. (inferred) — [tsc/internal/api/session.go#L46-87](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/api/session.go#L46-L87)
- Very large generated artifacts (lsproto/lsp_generated.go from the LSP meta-model, diagnostics_generated.go from diagnosticMessages.json, ast/factory/encoder generated files in the npm package) must be regenerated via hereby generate; hand edits are overwritten and CI fails on diffs. — [tsc/internal/lsp/lsproto/lsp_generated.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/lsp/lsproto/lsp_generated.go) [tsc/internal/diagnostics/generate.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/diagnostics/generate.go) [.github/workflows/ci.yml#L287-299](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/.github/workflows/ci.yml#L287-L299)
- Watch-mode correctness depends on debounce/coalescing in internal/fswatch (debounce.go) and watchmanager; watcher_race_test.go exists specifically because watch+rebuild had race conditions. (inferred) — [tsc/internal/fswatch/debounce.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/fswatch/debounce.go) [tsc/internal/execute/tsctests/watcher_race_test.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/execute/tsctests/watcher_race_test.go) [tsc/internal/execute/watchmanager/watchmanager.go](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/tsc/internal/execute/watchmanager/watchmanager.go)
- The extension warns that tsserver plugins from other extensions will not be loaded under TypeScript 7 — an ecosystem-compat gap rather than a code bug, surfaced via warnAboutTsServerPlugins. — [packages/vscode-typescript/src/extension.ts#L173-266](https://github.com/microsoft/TypeScript/blob/5f6db9c9148635b4cbf72f1193b821b9c6b42dcc/packages/vscode-typescript/src/extension.ts#L173-L266)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)