[PR #890] [MERGED] fix(javascript): resolve bare source-map and worker URLs next to the script #2322

New issue

Closed

opened 2026-10-16 21:17:15 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:15 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/890
Author: @jayhemnani9910
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: fix/resolve-source-map-urls-relative

📝 Commits (2)

7c82226 fix(javascript): resolve bare source-map and worker URLs next to the script
832fd40 fix(javascript): tighten url-reference resolution edge cases

📊 Changes

4 files changed (+143 additions, -20 deletions)

View changed files

📝 src/application/javascript/JavaScriptArtifactGraphFindings.ts (+26 -16)
📝 src/application/javascript/JavaScriptArtifactPathResolution.test.ts (+55 -0)
📝 src/application/javascript/JavaScriptArtifactPathResolution.ts (+5 -3)
📝 tests/boundary/filesystem/javascriptSourceMapLocations.test.ts (+57 -1)

📄 Description

Summary

analyze-javascript-application never links a bundle to its source map when the sourceMappingURL is a plain file name, which is what webpack, esbuild, rollup, Vite and rolldown write by default (//# sourceMappingURL=main.js.map). The same happens for new Worker("worker.js") and navigator.serviceWorker.register("sw.js").

Problem and expected behavior

Trigger: dist/main.js ending in //# sourceMappingURL=main.js.map, with dist/main.js.map next to it.

Before: the maps_to edge has resolved_path: null and points to a stand-in artifact-local-key source-map node marked unavailable ("The declared source map was not present in the inventoried artifact."). The real dist/main.js.map node, which owns the source modules, is left unlinked, so trace-application-feature from the asset doesn't reach the original modules, and compare-application-versions reports the stand-in nodes as added/removed. Writing ./main.js.map instead resolves correctly.

Expected: per ECMA-426 the source-map URL is relative to the script, so main.js.map resolves to dist/main.js.map. Worker and service-worker script URLs are likewise relative to the script.

Change and scope

addSourceMapEdge and the worker/service-worker branch of resolveReference used resolveArtifactPath, which always resolves in the module-specifier context, where a name without ./ is treated as a bare npm package and looked up under node_modules. They now resolve in a new internal url-reference context: query and fragment are stripped, URLs with a scheme and protocol-relative URLs stay external, and other paths are joined to the declaring script's directory (or the artifact root for /-absolute paths), then confined and checked as before. Imports and require are unchanged.

Contract and boundary impact

Semantic owner and earliest changed stage: static JavaScript artifact graph construction (JavaScriptArtifactPathResolution, JavaScriptArtifactGraphFindings).
CLI and MCP/tool-catalog contract: none (resolved_path already exists; it is now filled in these cases).
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: maps_to edges for bare source-map and worker URLs now target the inventoried file node instead of an unavailable stand-in.
Process execution, authorization, cleanup, or containment impact: none; resolution stays artifact-confined.
Generated metadata (docs/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated: resolves a bare source-map file name and worker URL next to the script in tests/boundary/filesystem/javascriptSourceMapLocations.test.ts. It fails on current main (dd114d3) and passes with this change.
Base reproduction or other evidence: executed. A rolldown bundle of two modules (default output, sources: ["../src/a.js","../src/main.js"]) on f9eaf05 and rea-agents 4.1.0 gives {'declared_url': 'main.js.map', 'resolved_path': None} with the stand-in node; with this change {'declared_url': 'main.js.map', 'resolved_path': 'dist/main.js.map'} targeting the content-digest node, with no limitations.
User-visible CLI/MCP output: the graph edge and node above.
npm run check:fast passes. npm test: 4157 passed; the 8 failures are firmware boundary tests that fail the same way on untouched main here (firmware tools not installed).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/890 **Author:** [@jayhemnani9910](https://github.com/jayhemnani9910) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/resolve-source-map-urls-relative` --- ### 📝 Commits (2) - [`7c82226`](https://github.com/morluto/rea/commit/7c8222608dae3af6ccb7775318df0f952b115329) fix(javascript): resolve bare source-map and worker URLs next to the script - [`832fd40`](https://github.com/morluto/rea/commit/832fd401451e6f6f3942962d31074ca69187af62) fix(javascript): tighten url-reference resolution edge cases ### 📊 Changes **4 files changed** (+143 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `src/application/javascript/JavaScriptArtifactGraphFindings.ts` (+26 -16) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.test.ts` (+55 -0) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.ts` (+5 -3) 📝 `tests/boundary/filesystem/javascriptSourceMapLocations.test.ts` (+57 -1) </details> ### 📄 Description ## Summary `analyze-javascript-application` never links a bundle to its source map when the `sourceMappingURL` is a plain file name, which is what webpack, esbuild, rollup, Vite and rolldown write by default (`//# sourceMappingURL=main.js.map`). The same happens for `new Worker("worker.js")` and `navigator.serviceWorker.register("sw.js")`. ## Problem and expected behavior Trigger: `dist/main.js` ending in `//# sourceMappingURL=main.js.map`, with `dist/main.js.map` next to it. Before: the `maps_to` edge has `resolved_path: null` and points to a stand-in `artifact-local-key` source-map node marked unavailable ("The declared source map was not present in the inventoried artifact."). The real `dist/main.js.map` node, which owns the source modules, is left unlinked, so `trace-application-feature` from the asset doesn't reach the original modules, and `compare-application-versions` reports the stand-in nodes as added/removed. Writing `./main.js.map` instead resolves correctly. Expected: per ECMA-426 the source-map URL is relative to the script, so `main.js.map` resolves to `dist/main.js.map`. Worker and service-worker script URLs are likewise relative to the script. ## Change and scope `addSourceMapEdge` and the worker/service-worker branch of `resolveReference` used `resolveArtifactPath`, which always resolves in the `module-specifier` context, where a name without `./` is treated as a bare npm package and looked up under `node_modules`. They now resolve in a new internal `url-reference` context: query and fragment are stripped, URLs with a scheme and protocol-relative URLs stay external, and other paths are joined to the declaring script's directory (or the artifact root for `/`-absolute paths), then confined and checked as before. Imports and `require` are unchanged. ## Contract and boundary impact - Semantic owner and earliest changed stage: static JavaScript artifact graph construction (`JavaScriptArtifactPathResolution`, `JavaScriptArtifactGraphFindings`). - CLI and MCP/tool-catalog contract: none (`resolved_path` already exists; it is now filled in these cases). - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: `maps_to` edges for bare source-map and worker URLs now target the inventoried file node instead of an unavailable stand-in. - Process execution, authorization, cleanup, or containment impact: none; resolution stays artifact-confined. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: `resolves a bare source-map file name and worker URL next to the script` in `tests/boundary/filesystem/javascriptSourceMapLocations.test.ts`. It fails on current main (dd114d3) and passes with this change. - Base reproduction or other evidence: executed. A rolldown bundle of two modules (default output, `sources: ["../src/a.js","../src/main.js"]`) on f9eaf05 and rea-agents 4.1.0 gives `{'declared_url': 'main.js.map', 'resolved_path': None}` with the stand-in node; with this change `{'declared_url': 'main.js.map', 'resolved_path': 'dist/main.js.map'}` targeting the `content-digest` node, with no limitations. - User-visible CLI/MCP output: the graph edge and node above. - `npm run check:fast` passes. `npm test`: 4157 passed; the 8 failures are firmware boundary tests that fail the same way on untouched main here (firmware tools not installed). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:15 +00:00