javascript:function scope

What matters is where the function is instantiated. In this case, "Run" is instantiated inside the "foo" constructor, and in that context the private method is definitely visible. It becomes part of the closure around the "Run" function, in other words.

Think of it like this: the code for the "Run" function appears inside the "foo" constructor. The code in "Run" can "see" all the local variables inside "foo", and if "foo" were inside yet another function, it could see all those variables too. Because the definition only takes effect when "foo" has been called, then all those local variables will always be available to the code in "Run", at any time that it's called later. That's what's meant by the term "closure".

Scope and visibility in JavaScript are much different from the way things work in more static languages with classes, like Java or C++ or C#. In those languages, you explicitly construct objects and then start calling functions via those object references. In JavaScript, closures are sort-of like automatic on-the-fly objects that are implicitly wrapped around functions that "escape" from function calls. You can't directly access those objects, but they're real nevertheless.

Scope concerns the name system, and says nothing about access rights. For example, in Java there are three keywords known as access modifiers: public, private and protected. Javascript doesn't define any access modifier, so all names are public.

Let's put it this way: to read a file from the filesystem you need two things:

1. First, the filename. When you request the OS to give you a file pointer, it first checks if the file name exists, maybe after constructing an absolute pathname from the relative filename and the current directory, and then, only if the files exists
2. It checks if you have the right to read from it, finally giving you a handler to the stream.

Javascript scoping are the rules to determine if a name means something in the current context. If the name has a meaning, you can always access it, because Javascript doesn't define non-public modifiers.

In your case, you request to access bar.Run. The Javascript interpreters, using the current context (which we assume is the global objects) asks the "javascript filesystem" for an object "called" .bar.Run (the first dot is intentional and denotes the root). Once the name is found, it means it exists, and you'll always be able to access it (in this case call the function). BTW, there's nothing like a javascript filesystem, is just to convey the idea without a techincal jargon and using an intuitive analogy.

Similarly, the scoping rules are checked to resolve names throughout your code. Inside this.Run, the name privateAlert can be resolved, and this is the only rule that matters: global can see bar, global can access bar.Run and the function assigned to it can access privateAlert. This is the chain

I guess Raffaele already answered most of your question. But, for your convenience, let my try to express it differently and add some code for you to follow.

I think, there are two things you can learn here to understand why your code behaves the way it does.

1. JavaScript has a late binding of this. Only when you call a method the runtime decides "on" what object it will be invoked. The default is the global object (e.g., window in the browser, global in node.js, etc.). To get another this than the global one, you need to assign the function as property of the desired object, as you did via this.publicAlert = privateAlert;. And after that it makes a difference if you call privateAlert() directly (on the global this) or if you call it on the local this via this.publicAlert(), even if it is the same function.

2. As already pointed out in the other answer. Javascript has no public, private, etc. you need to "model" private vars they way you did using smart scoping. In your example the privateVal is private in a sense that nobody can read or write it from outside. The same holds true for privateAlert. Only via statements in the constructor Foo and the run method you can access them.

I augmented your example to show you what is going on (ps: using console.log is usually much more advisable than alert):

function Foo() {
    var privateVal = "Private Val";
    var that = this;
    this.publicVal = "Public Val";

    var privateAlert = function (str) {
        console.log("---" + str + "---")
        console.log("isLocalThis? ", this == that)
        console.log("isGlobalThis?", this == globalThis)
        console.log("private:     ", privateVal)
        console.log("public:      ", this.publicVal || "publicVal not available on 'this'")
    }

    this.run = function () {
        console.log("scope of run:", that, bar, privateAlert)
        console.log("isLocalThis? ", this == that)
        console.log("isGlobalThis?", this == globalThis)

        privateAlert("Private Call: ");

        this.publicAlert = privateAlert;
        this.publicAlert("Public Call: ");

        privateAlert = this.publicAlert;
        privateAlert("Private Call: ");
        this.publicAlert("Public Call: ");
    }
}

var bar = new Foo();
bar.run();

Btw: console and alert are properties of the global this (i.e., window).