[PR #712] [MERGED] fix(javascript): preserve path.resolve reset semantics #2192

New issue

Closed

opened 2026-10-16 21:15:28 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:28 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/712
Author: @kaoru0822-kitauji
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/javascript-resolve-path-semantics

📝 Commits (1)

4177377 fix(javascript): preserve path.resolve reset semantics

📊 Changes

3 files changed (+331 additions, -3 deletions)

View changed files

📝 src/application/JavaScriptArtifactPathResolution.test.ts (+34 -1)
📝 src/domain/javascriptStaticAnalysisHelpers.ts (+33 -2)
➕ src/domain/javascriptStaticPathResolution.test.ts (+264 -0)

📄 Description

Summary

Distinguish inert path.resolve expressions from path.join when extracting JavaScript/Electron entrypoints.

No separate issue: this is a reproduced source-projection mismatch.

Problem and expected behavior

path.posix.resolve("/app", "/shared/preload.js") resolves to /shared/preload.js. The static analyzer uses posix.join for both methods and instead reports the literal /app/shared/preload.js with complete coverage.

The same helper feeds BrowserWindow preload findings, generic preload-role findings and utility-process module paths. Later absolute paths and source-directory anchors must reset earlier segments, while target-cwd-dependent expressions must remain unknown.

Change and scope

Separate resolve handling from unchanged join handling:

Validate every argument using the existing inert syntax evaluator.
Select the last absolute literal or direct symbolic source-directory anchor.
Normalize only the selected suffix, retaining source-relative projection for __dirname and the existing CommonJS/ESM directory forms.
Remove resolve-only trailing separators except the root.
Preserve unknowns for all-relative, unresolved/spread and explicitly unsupported win32.resolve expressions.
Classify supported resolve results, including absolute templates/concatenations, as filesystem expressions.

No analyzer cwd is consulted. Standalone imported resolve(...) remains unrecognized; no binding or alias evaluator is added. Unknown earlier arguments remain conservative even when a later absolute segment exists.

Contract and boundary impact

Semantic owner: pure AST path projection before JavaScript/Electron findings are produced.
CLI/MCP: shared findings use corrected paths or existing dynamic/unknown output; no tool/schema/catalog changes.
Provider/platform: POSIX-style static projection and existing source-directory context; explicit Windows resolve expressions remain unsupported.
Evidence/provenance: original unresolved expressions and source locations remain intact.
Process/authorization/cleanup: unchanged; no code execution.
Generated metadata/package/installation: unchanged.

Known existing limitation: nested join(__dirname, "sub") loses symbolic source identity in the string-only evaluator. This patch handles direct anchors and nested absolute-literal expressions; it does not claim general nested symbolic-path resolution.

Evidence and regression coverage

On unchanged main 9bab553, the new domain suite has 21 failures and 37 passing controls. The existing contextual extraction test also fails.

Tests use Node's posix.resolve as the oracle for absolute literal cases. They cover multiple absolute resets, source-directory resets, trailing separators/root/parent segments, unchanged join behavior, relative/dynamic/spread inputs, explicit win32, absolute template/concatenation context, all three consumers and exact locations/unknown source expressions.

Validation performed

New path suite plus existing location suite: 69 tests passed.
Contextual syntax test: one passed; 27 unrelated cases in that file were skipped.
Build and npm run check: passed; all five check tasks succeeded (109 warnings, zero errors).
npm run jscpd (2.36%), npm run scan:todos, and git diff --check: passed.
Combined with pending #710 in a separate worktree: 145 AST/domain/location tests and the contextual extraction test passed (27 unrelated cases skipped).
Independent review completed before publication with no blocking findings.

Node.js 24.19.0, npm 11.9.0, exact locked dependencies. Optional Turbo telemetry was disabled for local verification. Hosted CI is tracked separately; no full local-suite pass is claimed.

Compatibility, safety, and release

No schemas, dependencies, package or execution-authority changes. These are source-only static tests; no filesystem-inventory, compiled CLI, real Electron, Hopper/Ghidra, browser or package-install lane was run.

Prepared with AI assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/712 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/javascript-resolve-path-semantics` --- ### 📝 Commits (1) - [`4177377`](https://github.com/morluto/rea/commit/417737748aa96ba38ced7b0b22dbb972187f2ee0) fix(javascript): preserve path.resolve reset semantics ### 📊 Changes **3 files changed** (+331 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/application/JavaScriptArtifactPathResolution.test.ts` (+34 -1) 📝 `src/domain/javascriptStaticAnalysisHelpers.ts` (+33 -2) ➕ `src/domain/javascriptStaticPathResolution.test.ts` (+264 -0) </details> ### 📄 Description ## Summary Distinguish inert `path.resolve` expressions from `path.join` when extracting JavaScript/Electron entrypoints. No separate issue: this is a reproduced source-projection mismatch. ## Problem and expected behavior `path.posix.resolve("/app", "/shared/preload.js")` resolves to `/shared/preload.js`. The static analyzer uses `posix.join` for both methods and instead reports the literal `/app/shared/preload.js` with complete coverage. The same helper feeds BrowserWindow preload findings, generic preload-role findings and utility-process module paths. Later absolute paths and source-directory anchors must reset earlier segments, while target-cwd-dependent expressions must remain unknown. ## Change and scope Separate resolve handling from unchanged join handling: - Validate every argument using the existing inert syntax evaluator. - Select the last absolute literal or direct symbolic source-directory anchor. - Normalize only the selected suffix, retaining source-relative projection for `__dirname` and the existing CommonJS/ESM directory forms. - Remove resolve-only trailing separators except the root. - Preserve unknowns for all-relative, unresolved/spread and explicitly unsupported `win32.resolve` expressions. - Classify supported resolve results, including absolute templates/concatenations, as filesystem expressions. No analyzer cwd is consulted. Standalone imported `resolve(...)` remains unrecognized; no binding or alias evaluator is added. Unknown earlier arguments remain conservative even when a later absolute segment exists. ## Contract and boundary impact - Semantic owner: pure AST path projection before JavaScript/Electron findings are produced. - CLI/MCP: shared findings use corrected paths or existing dynamic/unknown output; no tool/schema/catalog changes. - Provider/platform: POSIX-style static projection and existing source-directory context; explicit Windows resolve expressions remain unsupported. - Evidence/provenance: original unresolved expressions and source locations remain intact. - Process/authorization/cleanup: unchanged; no code execution. - Generated metadata/package/installation: unchanged. Known existing limitation: nested `join(__dirname, "sub")` loses symbolic source identity in the string-only evaluator. This patch handles direct anchors and nested absolute-literal expressions; it does not claim general nested symbolic-path resolution. ## Evidence and regression coverage On unchanged main `9bab553`, the new domain suite has 21 failures and 37 passing controls. The existing contextual extraction test also fails. Tests use Node's `posix.resolve` as the oracle for absolute literal cases. They cover multiple absolute resets, source-directory resets, trailing separators/root/parent segments, unchanged join behavior, relative/dynamic/spread inputs, explicit win32, absolute template/concatenation context, all three consumers and exact locations/unknown source expressions. ## Validation performed - New path suite plus existing location suite: 69 tests passed. - Contextual syntax test: one passed; 27 unrelated cases in that file were skipped. - Build and `npm run check`: passed; all five check tasks succeeded (109 warnings, zero errors). - `npm run jscpd` (2.36%), `npm run scan:todos`, and `git diff --check`: passed. - Combined with pending #710 in a separate worktree: 145 AST/domain/location tests and the contextual extraction test passed (27 unrelated cases skipped). - Independent review completed before publication with no blocking findings. Node.js 24.19.0, npm 11.9.0, exact locked dependencies. Optional Turbo telemetry was disabled for local verification. Hosted CI is tracked separately; no full local-suite pass is claimed. ## Compatibility, safety, and release No schemas, dependencies, package or execution-authority changes. These are source-only static tests; no filesystem-inventory, compiled CLI, real Electron, Hopper/Ghidra, browser or package-install lane was run. Prepared with AI assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:28 +00:00