[PR #611] [MERGED] fix(browser): release discarded source-map response bodies #2111

New issue

Closed

opened 2026-10-16 21:14:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:14:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/611
Author: @rudycelekli
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: campaign/rea-source-map-response-cleanup-20261005

📝 Commits (3)

3fe3050 fix(browser): release discarded source-map response bodies
f7a92a5 test(browser): preserve unknown with-scope loader bindings
271b7a5 Merge remote-tracking branch 'origin/main' into campaign/rea-source-map-response-cleanup-20261005

📊 Changes

2 files changed (+88 additions, -1 deletions)

View changed files

📝 src/browser/WebSourceMapFetcher.ts (+4 -1)
➕ tests/boundary/browser/webSourceMapResponseCleanup.test.ts (+84 -0)

📄 Description

Summary

Cancel each discarded redirect and unsuccessful HTTP source-map response body. Owned loopback HTTP server leaves 302 and 400 bodies unfinished; before both leak connections, after both close. No module mocks or vulnerability claim.

No tracking issue: this is a focused correctness regression found through production-seam reproduction.

Problem and expected behavior

Every discarded redirect/error body is cancelled; returned source-map result and failure classifications remain preserved.

Change and scope

The change cancels each unused redirect and unsuccessful source-map response body. It preserves the owner-added partial/unknown source-map evidence contract and conservative dependency analysis.

Contract and boundary impact

Semantic owner and earliest changed stage: Browser source-map HTTP response handling, before redirect continuation or unsuccessful-status return.
CLI and MCP/tool-catalog contract: existing schemas and tool inventory remain intact; corrected results flow through the owning operation.
Provider, bridge, target-format, or platform compatibility: Actual loopback HTTP connections were exercised without module mocks. This is connection lifecycle correctness, without a vulnerability claim.
Evidence, artifact, provenance, or reconstruction contract: Every discarded redirect/error body is cancelled; returned source-map result and failure classifications remain preserved.
Process execution, authorization, cleanup, or containment impact: Owned discarded HTTP response bodies are cancelled before proceeding.
Generated metadata, package, or installation impact: no metadata or dependency changes.

Evidence and regression coverage

Two base-revision failures with unfinished owned HTTP 302/400 response bodies; 25 focused HTTP/source-map tests pass with connection-close receipts.

Tests exercise production parsing, filesystem, HTTP, or browser seams, without module mocks. Evidence above is executed; unverified platform/provider coverage is stated explicitly.

Validation performed

Passed on signed head 271b7a5c03fd06cc23448a060d9be2ec8261ce32 under the current ordinary-fix guidelines:

npm run test:focused -- tests/boundary/browser/webSourceMapResponseCleanup.test.ts tests/boundary/browser/webSourceMapFetcher.test.ts — 25 tests passed; boundary build included
npm run check
npm run check:fast

The current main branch, including the maintainer’s fixture correction in #609, was merged normally. Its source-map recovery fixture is preserved exactly: a require inside with remains unknown, while an unbound require outside it and a static import still produce recovered dependencies. This update changes no production code in the PR’s own fix.

Full check:pr is optional for routine fixes under the current guidelines; no current-head full-suite pass is claimed. Package smoke and pack verification are not applicable because package/install outputs and dependencies are unchanged. Hosted CI is tracked separately.

Development runtime: Node.js 24.18.0 and npm 11.16.0.

Compatibility, safety, and release

No migration or package dependency changes. Real Hopper/Ghidra verification was not run; this patch does not change those providers. Remaining proof limits are stated above. The final diff contains source and tests only.

Prepared with AI assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/611 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `campaign/rea-source-map-response-cleanup-20261005` --- ### 📝 Commits (3) - [`3fe3050`](https://github.com/morluto/rea/commit/3fe30506334662872cfb4d3a7816274c6b790385) fix(browser): release discarded source-map response bodies - [`f7a92a5`](https://github.com/morluto/rea/commit/f7a92a5964075689618a747b32b7b56868621da9) test(browser): preserve unknown with-scope loader bindings - [`271b7a5`](https://github.com/morluto/rea/commit/271b7a5c03fd06cc23448a060d9be2ec8261ce32) Merge remote-tracking branch 'origin/main' into campaign/rea-source-map-response-cleanup-20261005 ### 📊 Changes **2 files changed** (+88 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/WebSourceMapFetcher.ts` (+4 -1) ➕ `tests/boundary/browser/webSourceMapResponseCleanup.test.ts` (+84 -0) </details> ### 📄 Description ## Summary Cancel each discarded redirect and unsuccessful HTTP source-map response body. Owned loopback HTTP server leaves 302 and 400 bodies unfinished; before both leak connections, after both close. No module mocks or vulnerability claim. No tracking issue: this is a focused correctness regression found through production-seam reproduction. ## Problem and expected behavior Every discarded redirect/error body is cancelled; returned source-map result and failure classifications remain preserved. ## Change and scope The change cancels each unused redirect and unsuccessful source-map response body. It preserves the owner-added partial/unknown source-map evidence contract and conservative dependency analysis. ## Contract and boundary impact - Semantic owner and earliest changed stage: Browser source-map HTTP response handling, before redirect continuation or unsuccessful-status return. - CLI and MCP/tool-catalog contract: existing schemas and tool inventory remain intact; corrected results flow through the owning operation. - Provider, bridge, target-format, or platform compatibility: Actual loopback HTTP connections were exercised without module mocks. This is connection lifecycle correctness, without a vulnerability claim. - Evidence, artifact, provenance, or reconstruction contract: Every discarded redirect/error body is cancelled; returned source-map result and failure classifications remain preserved. - Process execution, authorization, cleanup, or containment impact: Owned discarded HTTP response bodies are cancelled before proceeding. - Generated metadata, package, or installation impact: no metadata or dependency changes. ## Evidence and regression coverage Two base-revision failures with unfinished owned HTTP 302/400 response bodies; 25 focused HTTP/source-map tests pass with connection-close receipts. Tests exercise production parsing, filesystem, HTTP, or browser seams, without module mocks. Evidence above is executed; unverified platform/provider coverage is stated explicitly. ## Validation performed Passed on signed head `271b7a5c03fd06cc23448a060d9be2ec8261ce32` under the current ordinary-fix guidelines: - `npm run test:focused -- tests/boundary/browser/webSourceMapResponseCleanup.test.ts tests/boundary/browser/webSourceMapFetcher.test.ts` — 25 tests passed; boundary build included - `npm run check` - `npm run check:fast` The current main branch, including the maintainer’s fixture correction in #609, was merged normally. Its source-map recovery fixture is preserved exactly: a require inside `with` remains unknown, while an unbound require outside it and a static import still produce recovered dependencies. This update changes no production code in the PR’s own fix. Full `check:pr` is optional for routine fixes under the current guidelines; no current-head full-suite pass is claimed. Package smoke and pack verification are not applicable because package/install outputs and dependencies are unchanged. Hosted CI is tracked separately. Development runtime: Node.js 24.18.0 and npm 11.16.0. ## Compatibility, safety, and release No migration or package dependency changes. Real Hopper/Ghidra verification was not run; this patch does not change those providers. Remaining proof limits are stated above. The final diff contains source and tests only. Prepared with AI assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:14:25 +00:00