[PR #924] [MERGED] fix(browser): preserve evidence through deep AST analysis #2350

New issue

Closed

opened 2026-10-16 21:17:41 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:41 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/924
Author: @morluto
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: codex/browser-ast-depth

📝 Commits (2)

2eec028 fix(browser): preserve evidence through deep AST analysis
c2fc38c Merge remote-tracking branch 'origin/main' into codex/browser-ast-depth

📊 Changes

8 files changed (+202 additions, -79 deletions)

View changed files

📝 src/browser/WebSourceMapFetcher.ts (+36 -35)
📝 src/domain/javascript/javascriptSemanticAnalysis.ts (+11 -0)
📝 src/domain/javascript/javascriptSemanticProjection.ts (+8 -2)
📝 src/domain/webBundleAnalyzer.test.ts (+26 -0)
📝 src/domain/webBundleAnalyzerInspection.ts (+6 -4)
📝 src/domain/webModuleImports.test.ts (+25 -0)
📝 src/domain/webModuleImports.ts (+41 -38)
📝 tests/boundary/browser/webSourceMapFetcher.test.ts (+49 -0)

📄 Description

Summary

Preserve browser module, bundle, and source-map evidence for deep syntax that Babel successfully parses. This confirmed failure was found during the whole-codebase audit; no separate issue is linked.

Problem and expected behavior

A source containing const value = root followed by 12,000 .next properties and then an import is accepted by the parser. Recursive Babel traversal overflows during native module collection and captured bundle inspection. For a source-map original, the same overflow is caught as an invalid map, dropping the valid map artifact, original source, mappings, and dependency edges.

CommonJS originals have a second failure: deciding whether require is shadowed previously ran full semantic value/provenance analysis, which has unrelated recursive member-expression passes. Valid source-map evidence should survive, and only unbound lexical require references should produce CommonJS dependency edges.

Change and scope

Use the existing iterative Babel AST walker at all three browser analysis sites, preserving preorder callbacks and existing detectors. Expose reference-only analysis by reusing canonical scope/definition/reference collection. Source-map require filtering requests only references named require, avoiding unused value/provenance evaluation and ancestor snapshots for unrelated names. Full semantic IR callers keep their existing behavior.

Contract and boundary impact

Semantic owner and earliest changed stage: domain AST walking and lexical reference collection; browser source-map normalization consumes those facts.
CLI and MCP/tool-catalog contract: schemas and inventory unchanged. Valid deep source now produces complete findings instead of execution failure or an invalid-map result.
Provider/platform compatibility: Chrome/CDP protocol and launch behavior unchanged.
Evidence/artifact/provenance contract: retain existing source locations, exact map/original bytes, mappings, import ordering, inferred findings, and unknown parser coverage.
Process execution/authorization/cleanup: unchanged.
Generated metadata/package/installation: unchanged; generated documents checked.

Evidence and regression coverage

Executed baseline and candidate against source-owned 12,000-property fixtures. Baseline module/bundle helpers throw RangeError; baseline source-map results discard valid evidence. Candidate retains imports and endpoint locations, valid map/original artifacts and mappings, and native/CommonJS edges while excluding the parameter-shadowed require.

Actual Chrome 154.0.8037.99 captured an unused deep-member function and its source map. The baseline compiled CLI exited with execution_failure. The patched compiled CLI and stdio MCP both succeed and return exactly matching map evidence, including map bytes and unbound CommonJS edges. The owned browser/profile and fixture server were cleaned up.

Across 120 ordinary fixtures, 600 exact comparisons verified complete import, bundle, source-map, and lexical-reference results. Cases include erased type-only imports, dynamic imports, with, hoisted bindings, catch bindings, destructuring, defaults, and direct eval.

A source-owned map with 1,000 functions and CommonJS references took median 76.2 → 14.7 ms over three alternating full fetchWebSourceMaps calls on macOS arm64/Node 24.18.0, with identical complete result hashes. This warmed-process measurement includes response decoding, artifacts, mappings, dependency analysis, and output validation through a local Response seam; it excludes network latency and result hashing. Profiling base was f0a68dce.

Remaining proof gaps: parser limits and recursive expression/value helpers in full semantic IR are separate from this browser consumer fix. No universal depth or whole-browser speed claim is made.

Validation performed

npm run build:cached — passed.
npm run check:fast — passed.
npm run docs:check — passed.
Focused browser, semantic, application, filesystem, CLI, and MCP suites — 13 files / 173 tests passed.
npm run verify:browser:modules with caller-supplied Chrome — passed (real loading oracle, CLI/MCP traces, cancellation and identity checks).
npm run verify:browser:source-maps with caller-supplied Chrome and isolated esbuild 0.25.10 fixture compiler — passed (real capture/export and CLI/MCP point tracing).
Standalone compiled baseline/candidate comparison and actual Chrome deep CLI/MCP reproduction — passed as described above.
Independent Standards and Spec reviews — final patch has no findings; the initially identified CommonJS regression is fixed.

Compatibility, safety, and release

Breaking changes/migrations: none.
Real Hopper/Ghidra verification: not applicable; no binary-provider changes.
Real browser coverage: Chrome on macOS arm64 as described above; no new cross-platform execution claim.
Package/release metadata: none.
Security/privacy/containment: existing exact-origin and credential policy, artifact identity checks, cancellation, and ownership boundaries preserved.

Review checklist

One focused outcome and Conventional Commit title.
Reason for no separate issue stated above.
Regressions assert recovered public evidence and shadowing behavior.
Contracts and generated metadata checked; unchanged schemas.
Real CLI/MCP behavior verified with source-owned evidence.
Final diff checked for unrelated changes and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/924 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/browser-ast-depth` --- ### 📝 Commits (2) - [`2eec028`](https://github.com/morluto/rea/commit/2eec0289aba253d0d78de911e12ec836c2792dbb) fix(browser): preserve evidence through deep AST analysis - [`c2fc38c`](https://github.com/morluto/rea/commit/c2fc38cd0ad3e33c40c46aed91a44e6f464904f4) Merge remote-tracking branch 'origin/main' into codex/browser-ast-depth ### 📊 Changes **8 files changed** (+202 additions, -79 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/WebSourceMapFetcher.ts` (+36 -35) 📝 `src/domain/javascript/javascriptSemanticAnalysis.ts` (+11 -0) 📝 `src/domain/javascript/javascriptSemanticProjection.ts` (+8 -2) 📝 `src/domain/webBundleAnalyzer.test.ts` (+26 -0) 📝 `src/domain/webBundleAnalyzerInspection.ts` (+6 -4) 📝 `src/domain/webModuleImports.test.ts` (+25 -0) 📝 `src/domain/webModuleImports.ts` (+41 -38) 📝 `tests/boundary/browser/webSourceMapFetcher.test.ts` (+49 -0) </details> ### 📄 Description ## Summary Preserve browser module, bundle, and source-map evidence for deep syntax that Babel successfully parses. This confirmed failure was found during the whole-codebase audit; no separate issue is linked. ## Problem and expected behavior A source containing `const value = root` followed by 12,000 `.next` properties and then an import is accepted by the parser. Recursive Babel traversal overflows during native module collection and captured bundle inspection. For a source-map original, the same overflow is caught as an invalid map, dropping the valid map artifact, original source, mappings, and dependency edges. CommonJS originals have a second failure: deciding whether `require` is shadowed previously ran full semantic value/provenance analysis, which has unrelated recursive member-expression passes. Valid source-map evidence should survive, and only unbound lexical `require` references should produce CommonJS dependency edges. ## Change and scope Use the existing iterative Babel AST walker at all three browser analysis sites, preserving preorder callbacks and existing detectors. Expose reference-only analysis by reusing canonical scope/definition/reference collection. Source-map require filtering requests only references named `require`, avoiding unused value/provenance evaluation and ancestor snapshots for unrelated names. Full semantic IR callers keep their existing behavior. ## Contract and boundary impact - Semantic owner and earliest changed stage: domain AST walking and lexical reference collection; browser source-map normalization consumes those facts. - CLI and MCP/tool-catalog contract: schemas and inventory unchanged. Valid deep source now produces complete findings instead of execution failure or an invalid-map result. - Provider/platform compatibility: Chrome/CDP protocol and launch behavior unchanged. - Evidence/artifact/provenance contract: retain existing source locations, exact map/original bytes, mappings, import ordering, inferred findings, and unknown parser coverage. - Process execution/authorization/cleanup: unchanged. - Generated metadata/package/installation: unchanged; generated documents checked. ## Evidence and regression coverage Executed baseline and candidate against source-owned 12,000-property fixtures. Baseline module/bundle helpers throw `RangeError`; baseline source-map results discard valid evidence. Candidate retains imports and endpoint locations, valid map/original artifacts and mappings, and native/CommonJS edges while excluding the parameter-shadowed require. Actual Chrome 154.0.8037.99 captured an unused deep-member function and its source map. The baseline compiled CLI exited with `execution_failure`. The patched compiled CLI and stdio MCP both succeed and return exactly matching map evidence, including map bytes and unbound CommonJS edges. The owned browser/profile and fixture server were cleaned up. Across 120 ordinary fixtures, 600 exact comparisons verified complete import, bundle, source-map, and lexical-reference results. Cases include erased type-only imports, dynamic imports, `with`, hoisted bindings, catch bindings, destructuring, defaults, and direct `eval`. A source-owned map with 1,000 functions and CommonJS references took median **76.2 → 14.7 ms** over three alternating full `fetchWebSourceMaps` calls on macOS arm64/Node 24.18.0, with identical complete result hashes. This warmed-process measurement includes response decoding, artifacts, mappings, dependency analysis, and output validation through a local `Response` seam; it excludes network latency and result hashing. Profiling base was `f0a68dce`. Remaining proof gaps: parser limits and recursive expression/value helpers in full semantic IR are separate from this browser consumer fix. No universal depth or whole-browser speed claim is made. ## Validation performed - `npm run build:cached` — passed. - `npm run check:fast` — passed. - `npm run docs:check` — passed. - Focused browser, semantic, application, filesystem, CLI, and MCP suites — 13 files / 173 tests passed. - `npm run verify:browser:modules` with caller-supplied Chrome — passed (real loading oracle, CLI/MCP traces, cancellation and identity checks). - `npm run verify:browser:source-maps` with caller-supplied Chrome and isolated esbuild 0.25.10 fixture compiler — passed (real capture/export and CLI/MCP point tracing). - Standalone compiled baseline/candidate comparison and actual Chrome deep CLI/MCP reproduction — passed as described above. - Independent Standards and Spec reviews — final patch has no findings; the initially identified CommonJS regression is fixed. ## Compatibility, safety, and release - Breaking changes/migrations: none. - Real Hopper/Ghidra verification: not applicable; no binary-provider changes. - Real browser coverage: Chrome on macOS arm64 as described above; no new cross-platform execution claim. - Package/release metadata: none. - Security/privacy/containment: existing exact-origin and credential policy, artifact identity checks, cancellation, and ownership boundaries preserved. ## Review checklist - [x] One focused outcome and Conventional Commit title. - [x] Reason for no separate issue stated above. - [x] Regressions assert recovered public evidence and shadowing behavior. - [x] Contracts and generated metadata checked; unchanged schemas. - [x] Real CLI/MCP behavior verified with source-owned evidence. - [x] Final diff checked for unrelated changes and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:41 +00:00