[PR #715] [MERGED] fix(trace): match typed seeds against member arrays #2196

New issue

Closed

opened 2026-10-16 21:15:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:32 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/715
Author: @kaoru0822-kitauji
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/typed-seed-array-members

📝 Commits (1)

38ebd54 fix(trace): match typed seeds against member arrays

📊 Changes

2 files changed (+468 additions, -9 deletions)

View changed files

➕ src/domain/javascriptFeatureSeed.array_members.test.ts (+432 -0)
📝 src/domain/javascriptFeatureSeed.ts (+36 -9)

📄 Description

Summary

Match supported API, module and native-export member values when their graph properties contain arrays.

No separate issue: this is a reproduced mismatch between retained producer properties and typed seed selection.

Problem and expected behavior

Parsing contextBridge.exposeInMainWorld("desktopApi", { openProject() {}, closeProject() {} }) produces complete members ["closeProject", "openProject"].

An API seed for openProject returns no matches because the flattened property path ends in .members[1], while the selector requires the suffix .members. A generic string seed finds that exact same value. Through traceApplicationFeature, the typed query consequently returns no-match and no graph despite the retained literal member.

The same mismatch affects existing array-bearing fields for module and native-export seeds.

Change and scope

Carry a separate structural selection path while traversing properties:

Actual array traversal adds indices only to the existing displayed path.
Object traversal extends both paths, preserving literal property names.
Use the structural path only for the existing .members, .methods, .exports and .requested_members allowlist entries.

Preserve returned indexed paths, first-match behavior, ordering, node-kind restrictions, matching modes and generic string selection. Other scalar-only fields and route/channel selection keep their existing indexed-field behavior.

This does not strip bracket text with a regex. Literal keys such as members[0] remain distinct from actual arrays. Existing scalar suffix behavior for dotted keys is retained.

Contract and boundary impact

Semantic owner: pure typed seed selection before graph tracing.
CLI/MCP: their shared trace workflow can find already-retained supported literal members; no tool/schema/catalog changes.
Evidence/provenance: exact matched field paths and existing graph evidence are preserved; selectionPath stays internal.
Coverage: no-match changes to a matched trace only when the requested supported literal exists. Traversal and uncertainty rules are unchanged.
Provider/process/authorization/cleanup: unchanged; no execution added.
Generated metadata/package/installation: unchanged.

Evidence and regression coverage

On unchanged main af48fe8, the identical final four-suite run has 55 failures and 130 passing controls. The fixed run passes all 185.

The new 96-case suite covers API members/methods, module exports across allowed node kinds, native-export members/requested_members, exact/default/contains and case modes, scalar parity, nested arrays, null/non-string values, no mutation and exact indexed output paths.

Negative and compatibility cases cover wrong node kinds, near-field names, literal brackets, object descendants, scalar-only fields and route/channel arrays. Actual contextBridge parser output is passed into a valid in-memory graph and the public domain trace; generic and scalar controls remain unchanged.

Validation performed

Focused seed, public domain trace, static-location and Electron option suites: 185 tests passed across four files.
Build and npm run check: passed; all five check tasks succeeded (109 warnings, zero errors; none in changed files).
npm run jscpd, npm run scan:todos, and git diff --check: passed.
Independent review completed before publication with no blocking findings.

Node.js 24.19.0, npm 11.9.0, exact locked dependencies. Optional Turbo telemetry was disabled for local verification. Hosted CI is tracked separately; no full local-suite pass is claimed.

Compatibility, safety, and release

No schema, dependency, package, provider or matching-language expansion. Tests exercise inert source parsing and pure graph tracing; no filesystem reconstruction, actual CLI/MCP process, real Electron, browser, Hopper/Ghidra or native provider was run.

Prepared with AI assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/715 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/typed-seed-array-members` --- ### 📝 Commits (1) - [`38ebd54`](https://github.com/morluto/rea/commit/38ebd54776d661ced2e6cc2c5e4b260653a086d9) fix(trace): match typed seeds against member arrays ### 📊 Changes **2 files changed** (+468 additions, -9 deletions) <details> <summary>View changed files</summary> ➕ `src/domain/javascriptFeatureSeed.array_members.test.ts` (+432 -0) 📝 `src/domain/javascriptFeatureSeed.ts` (+36 -9) </details> ### 📄 Description ## Summary Match supported API, module and native-export member values when their graph properties contain arrays. No separate issue: this is a reproduced mismatch between retained producer properties and typed seed selection. ## Problem and expected behavior Parsing `contextBridge.exposeInMainWorld("desktopApi", { openProject() {}, closeProject() {} })` produces complete members `["closeProject", "openProject"]`. An API seed for `openProject` returns no matches because the flattened property path ends in `.members[1]`, while the selector requires the suffix `.members`. A generic string seed finds that exact same value. Through `traceApplicationFeature`, the typed query consequently returns `no-match` and no graph despite the retained literal member. The same mismatch affects existing array-bearing fields for module and native-export seeds. ## Change and scope Carry a separate structural selection path while traversing properties: - Actual array traversal adds indices only to the existing displayed path. - Object traversal extends both paths, preserving literal property names. - Use the structural path only for the existing `.members`, `.methods`, `.exports` and `.requested_members` allowlist entries. Preserve returned indexed paths, first-match behavior, ordering, node-kind restrictions, matching modes and generic string selection. Other scalar-only fields and route/channel selection keep their existing indexed-field behavior. This does not strip bracket text with a regex. Literal keys such as `members[0]` remain distinct from actual arrays. Existing scalar suffix behavior for dotted keys is retained. ## Contract and boundary impact - Semantic owner: pure typed seed selection before graph tracing. - CLI/MCP: their shared trace workflow can find already-retained supported literal members; no tool/schema/catalog changes. - Evidence/provenance: exact matched field paths and existing graph evidence are preserved; selectionPath stays internal. - Coverage: no-match changes to a matched trace only when the requested supported literal exists. Traversal and uncertainty rules are unchanged. - Provider/process/authorization/cleanup: unchanged; no execution added. - Generated metadata/package/installation: unchanged. ## Evidence and regression coverage On unchanged main `af48fe8`, the identical final four-suite run has 55 failures and 130 passing controls. The fixed run passes all 185. The new 96-case suite covers API members/methods, module exports across allowed node kinds, native-export members/requested_members, exact/default/contains and case modes, scalar parity, nested arrays, null/non-string values, no mutation and exact indexed output paths. Negative and compatibility cases cover wrong node kinds, near-field names, literal brackets, object descendants, scalar-only fields and route/channel arrays. Actual contextBridge parser output is passed into a valid in-memory graph and the public domain trace; generic and scalar controls remain unchanged. ## Validation performed - Focused seed, public domain trace, static-location and Electron option suites: 185 tests passed across four files. - Build and `npm run check`: passed; all five check tasks succeeded (109 warnings, zero errors; none in changed files). - `npm run jscpd`, `npm run scan:todos`, and `git diff --check`: passed. - Independent review completed before publication with no blocking findings. Node.js 24.19.0, npm 11.9.0, exact locked dependencies. Optional Turbo telemetry was disabled for local verification. Hosted CI is tracked separately; no full local-suite pass is claimed. ## Compatibility, safety, and release No schema, dependency, package, provider or matching-language expansion. Tests exercise inert source parsing and pure graph tracing; no filesystem reconstruction, actual CLI/MCP process, real Electron, browser, Hopper/Ghidra or native provider was run. Prepared with AI assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:32 +00:00