[PR #588] [MERGED] fix(browser): derive source-map imports from syntax nodes #2089

New issue

Closed

opened 2026-10-16 21:14:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:14:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/588
Author: @rudycelekli
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: campaign/rea-web-more20-20261005

📝 Commits (4)

3834ee1 fix(browser): derive source-map imports from syntax nodes
f868fd8 fix(browser): recover source-map dependencies from decorated and aliased sources
32d1e6d Merge remote-tracking branch 'origin/main' into fix-588
9459380 Merge main into fix(browser): derive source-map imports from syntax nodes

📊 Changes

8 files changed (+281 additions, -50 deletions)

View changed files

📝 docs/product-catalog.json (+2 -2)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 src/browser/WebSourceMapFetcher.ts (+111 -37)
📝 src/domain/javascriptSourceParser.ts (+5 -1)
📝 src/domain/webBundleAnalysis.ts (+15 -6)
📝 src/generatedMcpToolCatalog.ts (+1 -1)
📝 tests/boundary/browser/webSourceMapFetcher.test.ts (+144 -0)

📄 Description

Summary

Parse original source map source contents as inert JavaScript/TypeScript AST. Retain literal import/export/dynamic import syntax; require edges use existing lexical IR to exclude shadowed bindings. Comments, string/template contents and malformed parser-recovered source cannot invent dependency edges. Source map artifact remains included if original source syntax cannot be parsed, but its module edge list is empty. Type-only source relationships remain syntactic; this does not claim imports actually executed.

No tracking issue: this is a focused correctness regression found through production-seam reproduction.

Problem and expected behavior

Derived module edges exclude comments, quoted content, parser recovery, and bound require calls; source paths and source-map identities remain retained.

Change and scope

The change stays in the owning adapter/application stage and corrects existing behavior without adding tools or broadening provider coverage.

Contract and boundary impact

Semantic owner and earliest changed stage: Browser source-map original dependency extraction, before artifact import edges.
CLI and MCP/tool-catalog contract: existing schemas and tool inventory remain intact; corrected results flow through the owning operation.
Provider, bridge, target-format, or platform compatibility: No real browser launch was needed: this change parses source-map original source supplied to the existing provider. Type-only relationships remain syntactic, without a runtime-execution claim.
Evidence, artifact, provenance, or reconstruction contract: Derived module edges exclude comments, quoted content, parser recovery, and bound require calls; source paths and source-map identities remain retained.
Process execution, authorization, cleanup, or containment impact: Existing execution authority, cleanup and containment remain preserved.
Generated metadata, package, or installation impact: no metadata or dependency changes.

Evidence and regression coverage

Seventeen focused source-map tests pass; the former regex invented dependencies from comments and string contents. Valid quote/template and malformed-source controls are covered.

Tests exercise production parsing, filesystem, HTTP, or browser seams, without module mocks. Evidence above is executed; unverified platform/provider coverage is stated explicitly.

Validation performed

All required local gates passed on the signed commit:

npm run check:pr
npm run check:ci
npm run verify:package
npm pack --dry-run

Development runtime: Node.js 24.18.0 and npm 11.16.0. Upstream CI is separate from these local results.

Compatibility, safety, and release

No migration or package dependency changes. Real Hopper/Ghidra verification was not run; this patch does not change those providers. Remaining proof limits are stated above. The final diff contains source and tests only.

Prepared with AI assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/588 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `campaign/rea-web-more20-20261005` --- ### 📝 Commits (4) - [`3834ee1`](https://github.com/morluto/rea/commit/3834ee1ef609c893d6500dee7ab58b2d1a5f345c) fix(browser): derive source-map imports from syntax nodes - [`f868fd8`](https://github.com/morluto/rea/commit/f868fd85fe5bf8eb68c853df1bc72f71ba7e9d35) fix(browser): recover source-map dependencies from decorated and aliased sources - [`32d1e6d`](https://github.com/morluto/rea/commit/32d1e6df3f9f9ba78cbde6b93994248952133ad1) Merge remote-tracking branch 'origin/main' into fix-588 - [`9459380`](https://github.com/morluto/rea/commit/9459380399b4c398a118a408b4d422078750deff) Merge main into fix(browser): derive source-map imports from syntax nodes ### 📊 Changes **8 files changed** (+281 additions, -50 deletions) <details> <summary>View changed files</summary> 📝 `docs/product-catalog.json` (+2 -2) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `src/browser/WebSourceMapFetcher.ts` (+111 -37) 📝 `src/domain/javascriptSourceParser.ts` (+5 -1) 📝 `src/domain/webBundleAnalysis.ts` (+15 -6) 📝 `src/generatedMcpToolCatalog.ts` (+1 -1) 📝 `tests/boundary/browser/webSourceMapFetcher.test.ts` (+144 -0) </details> ### 📄 Description ## Summary Parse original source map source contents as inert JavaScript/TypeScript AST. Retain literal import/export/dynamic import syntax; require edges use existing lexical IR to exclude shadowed bindings. Comments, string/template contents and malformed parser-recovered source cannot invent dependency edges. Source map artifact remains included if original source syntax cannot be parsed, but its module edge list is empty. Type-only source relationships remain syntactic; this does not claim imports actually executed. No tracking issue: this is a focused correctness regression found through production-seam reproduction. ## Problem and expected behavior Derived module edges exclude comments, quoted content, parser recovery, and bound require calls; source paths and source-map identities remain retained. ## Change and scope The change stays in the owning adapter/application stage and corrects existing behavior without adding tools or broadening provider coverage. ## Contract and boundary impact - Semantic owner and earliest changed stage: Browser source-map original dependency extraction, before artifact import edges. - CLI and MCP/tool-catalog contract: existing schemas and tool inventory remain intact; corrected results flow through the owning operation. - Provider, bridge, target-format, or platform compatibility: No real browser launch was needed: this change parses source-map original source supplied to the existing provider. Type-only relationships remain syntactic, without a runtime-execution claim. - Evidence, artifact, provenance, or reconstruction contract: Derived module edges exclude comments, quoted content, parser recovery, and bound require calls; source paths and source-map identities remain retained. - Process execution, authorization, cleanup, or containment impact: Existing execution authority, cleanup and containment remain preserved. - Generated metadata, package, or installation impact: no metadata or dependency changes. ## Evidence and regression coverage Seventeen focused source-map tests pass; the former regex invented dependencies from comments and string contents. Valid quote/template and malformed-source controls are covered. Tests exercise production parsing, filesystem, HTTP, or browser seams, without module mocks. Evidence above is executed; unverified platform/provider coverage is stated explicitly. ## Validation performed All required local gates passed on the signed commit: - `npm run check:pr` - `npm run check:ci` - `npm run verify:package` - `npm pack --dry-run` Development runtime: Node.js 24.18.0 and npm 11.16.0. Upstream CI is separate from these local results. ## Compatibility, safety, and release No migration or package dependency changes. Real Hopper/Ghidra verification was not run; this patch does not change those providers. Remaining proof limits are stated above. The final diff contains source and tests only. Prepared with AI assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:14:05 +00:00