morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1042] [MERGED] fix(javascript): reconstruct HTML script loads accurately #2601

New issue

Closed

opened 2026-10-17 21:08:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1042
Author: @rudycelekli
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/html-script-attributes

📝 Commits (3)

cf93114 fix: parse HTML script references with HTML semantics
5b8e670 test(javascript): cover exact HTML script resource identity
99f85ff fix(javascript): retain exact HTML resource resolution and diagnostics

📊 Changes

11 files changed (+475 additions, -22 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+6 -0)
📝 package-lock.json (+25 -0)
📝 package.json (+1 -0)
📝 src/application/javascript/JavaScriptArtifactAnalysis.ts (+8 -20)
📝 src/application/javascript/JavaScriptArtifactGraphDocuments.ts (+30 -2)
📝 src/application/javascript/JavaScriptArtifactPathResolution.test.ts (+49 -0)
📝 src/application/javascript/JavaScriptArtifactPathResolution.ts (+11 -0)
➕ src/domain/javascript/htmlArtifactReferences.test.ts (+70 -0)
➕ src/domain/javascript/htmlArtifactReferences.ts (+55 -0)
➕ tests/boundary/filesystem/javascriptHtmlEntrypoints.test.ts (+87 -0)
➕ tests/boundary/filesystem/javascriptHtmlResourcePaths.test.ts (+133 -0)

📄 Description

Summary

Fixes #1039.

Reconstruct HTML script loads from decoded document attributes and exact inventoried resource paths. Decoy attributes no longer create loads edges, valid unquoted/entity-encoded attributes retain their targets, and src="./app" no longer selects an unrelated app.js or directory entrypoint. Unresolved references retain their declaration, source location, and resolution reason in renderer observations.

Problem and expected behavior

The old regular expressions confused attribute names and quoted values, and missed comments, raw text, templates, duplicates, and entity decoding. After extraction, the shared resolver also applied Node extension/package/index fallbacks to HTML URLs. The resulting graph could identify a script that the document never requested.

Change and scope

Use locked parse5 8.0.1 in a pure domain extractor. Preserve document namespace, first duplicate attributes, inert template content, first base href, and opening-tag source ranges with iterative traversal.
Resolve HTML references to exact selected application files after base and URL-suffix handling. Keep CommonJS extension/directory resolution.
Retain unresolved references as static inference observations, with the original declaration, base href, typed resolution status, source digest/range, and failed constraint.
Preserve the contributor's implementation and ancestry; follow-up commits add the downstream resource boundary fix and integrate tested main.

Contract and boundary impact

Semantic owner and earliest changed stage: domain HTML extraction, followed by application resource resolution and graph projection.
CLI and MCP/tool-catalog contract: existing tools/schemas; corrected loads edges and additive renderer observations through the shared workflow.
Provider, bridge, target-format, or platform compatibility: local JavaScript/HTML artifact analysis; existing file admission and container confinement.
Evidence, artifact, provenance, or reconstruction contract: declared references and exact opening-tag locations remain available; resolutions stay inferred.
Process execution, authorization, cleanup, or containment impact: analysis reads artifacts without executing target code. Verification executes owned fixture scripts in an isolated browser profile.
Generated metadata, package, or installation impact: pinned parse5 dependency and locked entities 8.1.0; generated documents checked through normal generators.

Evidence and regression coverage

Seven focused files: 114 passing tests covering extraction, resource identity, filesystem reconstruction, base href, module punctuation, source ranges/digests, and a real Node CommonJS control.
Actual CLI and stdio MCP produce identical results in 22 cases; isolated Chrome 150 confirms their DOM declarations and owned-script execution outcomes.
For src="./app", Chrome requests app; a neighboring app.js, directory index, or package entrypoint is not executed. REA retains resolution_status: "not-found" and its reason instead of inventing a loads edge.
Duplicate empty src can produce an extra Chrome request without execution. The oracle records requests separately from DOM and execution; the parser retains the first attribute.
Exact extensionless files supplied to the resolver remain supported. JavaScript file-set selection of extensionless directory entries is separate existing coverage, recorded for follow-up.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Node 24.18.0/npm 11.16.0, Linux x64, fresh normal locked installation.

npm run build:cached — passed.
Seven exact focused test files — 114 passed.
npm run typecheck, npm run lint, and npm run docs:check — passed.
Actual CLI/MCP + Chrome fixture verification — 22 cases passed, including preserved unresolved-reference diagnostics.
Normal pre-commit and pre-push hooks — passed.
npm run verify:package — passed, including an isolated normal tarball installation, CLI/setup lifecycle checks, and all 134 advertised MCP tools.
Exact-head hosted CI — 27 checks passed and the metadata workflow skipped; Linux x64/arm64, macOS x64/arm64, and Windows package lanes passed.

Compatibility, safety, and release

No breaking schema changes or migrations. Parser/file resolution changes can correct graph identities previously inferred incorrectly. Local work uses isolated owned fixtures/profiles, two CPUs at reduced priority, and a 2 GiB family memory budget. Real Hopper/Ghidra verification was not performed; their adapters are unchanged. Windows and macOS package lanes passed in exact-head CI.

Review checklist

One focused HTML reconstruction outcome and a Conventional Commit title.
Related resource-resolution issue linked.
Tests cover real producer/consumer behavior and meaningful controls.
Owning guide and generated-document checks updated.
Representative CLI/MCP outcome and evidence described above.
Final diff checked for credentials, host paths, unrelated changes, and build-generated catalog tracking.

Prepared with Codex assistance. The original contribution and maintainer follow-ups were independently validated before publication.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1042 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/html-script-attributes` --- ### 📝 Commits (3) - [`cf93114`](https://github.com/morluto/rea/commit/cf93114dc14a2940ce7506d087b780e19a5c0358) fix: parse HTML script references with HTML semantics - [`5b8e670`](https://github.com/morluto/rea/commit/5b8e6709a62c744a0dd5f064325eb7b519e7bcc6) test(javascript): cover exact HTML script resource identity - [`99f85ff`](https://github.com/morluto/rea/commit/99f85ff09a00da7cbcdda546f64d3b52f0b34807) fix(javascript): retain exact HTML resource resolution and diagnostics ### 📊 Changes **11 files changed** (+475 additions, -22 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+6 -0) 📝 `package-lock.json` (+25 -0) 📝 `package.json` (+1 -0) 📝 `src/application/javascript/JavaScriptArtifactAnalysis.ts` (+8 -20) 📝 `src/application/javascript/JavaScriptArtifactGraphDocuments.ts` (+30 -2) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.test.ts` (+49 -0) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.ts` (+11 -0) ➕ `src/domain/javascript/htmlArtifactReferences.test.ts` (+70 -0) ➕ `src/domain/javascript/htmlArtifactReferences.ts` (+55 -0) ➕ `tests/boundary/filesystem/javascriptHtmlEntrypoints.test.ts` (+87 -0) ➕ `tests/boundary/filesystem/javascriptHtmlResourcePaths.test.ts` (+133 -0) </details> ### 📄 Description ## Summary Fixes #1039. Reconstruct HTML script loads from decoded document attributes and exact inventoried resource paths. Decoy attributes no longer create loads edges, valid unquoted/entity-encoded attributes retain their targets, and `src="./app"` no longer selects an unrelated `app.js` or directory entrypoint. Unresolved references retain their declaration, source location, and resolution reason in renderer observations. ## Problem and expected behavior The old regular expressions confused attribute names and quoted values, and missed comments, raw text, templates, duplicates, and entity decoding. After extraction, the shared resolver also applied Node extension/package/index fallbacks to HTML URLs. The resulting graph could identify a script that the document never requested. ## Change and scope - Use locked parse5 8.0.1 in a pure domain extractor. Preserve document namespace, first duplicate attributes, inert template content, first base href, and opening-tag source ranges with iterative traversal. - Resolve HTML references to exact selected application files after base and URL-suffix handling. Keep CommonJS extension/directory resolution. - Retain unresolved references as static inference observations, with the original declaration, base href, typed resolution status, source digest/range, and failed constraint. - Preserve the contributor's implementation and ancestry; follow-up commits add the downstream resource boundary fix and integrate tested main. ## Contract and boundary impact - Semantic owner and earliest changed stage: domain HTML extraction, followed by application resource resolution and graph projection. - CLI and MCP/tool-catalog contract: existing tools/schemas; corrected loads edges and additive renderer observations through the shared workflow. - Provider, bridge, target-format, or platform compatibility: local JavaScript/HTML artifact analysis; existing file admission and container confinement. - Evidence, artifact, provenance, or reconstruction contract: declared references and exact opening-tag locations remain available; resolutions stay inferred. - Process execution, authorization, cleanup, or containment impact: analysis reads artifacts without executing target code. Verification executes owned fixture scripts in an isolated browser profile. - Generated metadata, package, or installation impact: pinned parse5 dependency and locked entities 8.1.0; generated documents checked through normal generators. ## Evidence and regression coverage - Seven focused files: 114 passing tests covering extraction, resource identity, filesystem reconstruction, base href, module punctuation, source ranges/digests, and a real Node CommonJS control. - Actual CLI and stdio MCP produce identical results in 22 cases; isolated Chrome 150 confirms their DOM declarations and owned-script execution outcomes. - For `src="./app"`, Chrome requests `app`; a neighboring `app.js`, directory index, or package entrypoint is not executed. REA retains `resolution_status: "not-found"` and its reason instead of inventing a loads edge. - Duplicate empty `src` can produce an extra Chrome request without execution. The oracle records requests separately from DOM and execution; the parser retains the first attribute. - Exact extensionless files supplied to the resolver remain supported. JavaScript file-set selection of extensionless directory entries is separate existing coverage, recorded for follow-up. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Node 24.18.0/npm 11.16.0, Linux x64, fresh normal locked installation. - `npm run build:cached` — passed. - Seven exact focused test files — 114 passed. - `npm run typecheck`, `npm run lint`, and `npm run docs:check` — passed. - Actual CLI/MCP + Chrome fixture verification — 22 cases passed, including preserved unresolved-reference diagnostics. - Normal pre-commit and pre-push hooks — passed. - `npm run verify:package` — passed, including an isolated normal tarball installation, CLI/setup lifecycle checks, and all 134 advertised MCP tools. - Exact-head hosted CI — 27 checks passed and the metadata workflow skipped; Linux x64/arm64, macOS x64/arm64, and Windows package lanes passed. ## Compatibility, safety, and release No breaking schema changes or migrations. Parser/file resolution changes can correct graph identities previously inferred incorrectly. Local work uses isolated owned fixtures/profiles, two CPUs at reduced priority, and a 2 GiB family memory budget. Real Hopper/Ghidra verification was not performed; their adapters are unchanged. Windows and macOS package lanes passed in exact-head CI. ## Review checklist - [x] One focused HTML reconstruction outcome and a Conventional Commit title. - [x] Related resource-resolution issue linked. - [x] Tests cover real producer/consumer behavior and meaningful controls. - [x] Owning guide and generated-document checks updated. - [x] Representative CLI/MCP outcome and evidence described above. - [x] Final diff checked for credentials, host paths, unrelated changes, and build-generated catalog tracking. Prepared with Codex assistance. The original contribution and maintainer follow-ups were independently validated before publication. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:05 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:06:42 +00:00

[PR #2863] [CLOSED] fix(saz): accept U+FFFD in well-formed metadata #5447

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2601

No description provided.

Rows
Columns