[PR #1093] [MERGED] fix(javascript): preserve original BOM source coordinates #2641

New issue

Closed

opened 2026-10-17 21:08:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:32 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1093
Author: @rudycelekli
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: validation/artifact-bom-source-ranges-20261008

📝 Commits (4)

bff4e44 test(javascript): reproduce BOM source range drift
d874029 fix(javascript): preserve original BOM source coordinates
af9fbe3 style(javascript): format BOM decoder option
9490362 Merge branch 'main' into validation/artifact-bom-source-ranges-20261008

📊 Changes

5 files changed (+262 additions, -1 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+3 -0)
📝 src/artifacts/javascript/JavaScriptArtifactFiles.ts (+6 -1)
➕ tests/boundary/cli/javascriptArtifactBomRanges.test.ts (+45 -0)
➕ tests/boundary/filesystem/javascriptArtifactBomRanges.test.ts (+97 -0)
➕ tests/fixtures/javascriptArtifactBom.ts (+111 -0)

📄 Description

The artifact text decoder stripped an initial UTF-8 BOM before inert JavaScript and HTML parsing. Source ranges then described the decoded text while graph evidence retained the original raw-byte digest. Keep the BOM as one UTF-16 code unit for those two source kinds so reference locations match the original digest-bound bytes. Preserve existing BOM handling for package/JSON/source-map text and fatal rejection of invalid UTF-8. Document the coordinate contract.

Native qualification:

Tests-only head bff4e446b6f045bc106011c3162344aaafa4e3bc reproduced exactly ten BOM coordinate failures: six real directory/ASAR reference cases and four built public CLI cases. All ten controls passed individually: six no-BOM cases, two structured-text BOM cases and two invalid UTF-8 cases. Before CI.
All twenty frozen owners pass individually at GitHub verified head 9490362c5ecbbb35ff19c04585a08dfea6962835, including accepted upstream main 5f93b4b125e78f088a2349a178e60f8c0af3e1a2. The oracle retains original bytes through Buffer.toString and reads direct Babel/parse5 producer locations without production decoder/range helpers. CLI owners cover both commands and both actual artifact forms. No owning assertions changed in the fix.
Static/docs/build, all four test shards and aggregate coverage pass. Full deterministic aggregate: 5,005 passed, zero failed, 48 skipped (5,053 total). All 22 upstream integration checks now pass on this exact verified head, including both Darwin package jobs. Current upstream CI. Original exact-head native qualification.
The earlier baseline also had five unrelated generated-output failures, reproduced on unchanged main. Attribution control. Separately owned #1091 is now accepted in the qualification baseline and those failures are resolved. Its repair is not duplicated in this PR diff.

Publication main advanced to c701376777212ec9acfd10c97f45b1eaf0c885c6 after qualification. Both owning source/document blobs remain unchanged, and its updated repository policy was read; the resulting upstream integration run now passes all 22 checks on the unchanged head.

The Windows curated lane does not collect these new files, so no Windows BOM-owner qualification is claimed. Fixtures are synthetic and analysis remains inert. Workflows and dependencies are unchanged. No private input or credentials are included. Real Hopper/Ghidra verification was not performed; their providers are unaffected. Source commits are GitHub verified and carry Signed-off-by trailers; the verified main-refresh merge preserves them.

Independent #1087 changes the suffix filter in the same source file and adds prose at the same documentation insertion point. Preserve both accepted regression groups and prose if either merges first without duplicating the other production fix.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1093 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `validation/artifact-bom-source-ranges-20261008` --- ### 📝 Commits (4) - [`bff4e44`](https://github.com/morluto/rea/commit/bff4e446b6f045bc106011c3162344aaafa4e3bc) test(javascript): reproduce BOM source range drift - [`d874029`](https://github.com/morluto/rea/commit/d874029ab5bf63a3541df9d645500935e0834529) fix(javascript): preserve original BOM source coordinates - [`af9fbe3`](https://github.com/morluto/rea/commit/af9fbe39905f09dd09c30c2756a98bc082f2ff53) style(javascript): format BOM decoder option - [`9490362`](https://github.com/morluto/rea/commit/9490362c5ecbbb35ff19c04585a08dfea6962835) Merge branch 'main' into validation/artifact-bom-source-ranges-20261008 ### 📊 Changes **5 files changed** (+262 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+3 -0) 📝 `src/artifacts/javascript/JavaScriptArtifactFiles.ts` (+6 -1) ➕ `tests/boundary/cli/javascriptArtifactBomRanges.test.ts` (+45 -0) ➕ `tests/boundary/filesystem/javascriptArtifactBomRanges.test.ts` (+97 -0) ➕ `tests/fixtures/javascriptArtifactBom.ts` (+111 -0) </details> ### 📄 Description The artifact text decoder stripped an initial UTF-8 BOM before inert JavaScript and HTML parsing. Source ranges then described the decoded text while graph evidence retained the original raw-byte digest. Keep the BOM as one UTF-16 code unit for those two source kinds so reference locations match the original digest-bound bytes. Preserve existing BOM handling for package/JSON/source-map text and fatal rejection of invalid UTF-8. Document the coordinate contract. Native qualification: - Tests-only head `bff4e446b6f045bc106011c3162344aaafa4e3bc` reproduced exactly ten BOM coordinate failures: six real directory/ASAR reference cases and four built public CLI cases. All ten controls passed individually: six no-BOM cases, two structured-text BOM cases and two invalid UTF-8 cases. [Before CI](https://github.com/rudycelekli/rea/actions/runs/37795727666). - All twenty frozen owners pass individually at GitHub verified head `9490362c5ecbbb35ff19c04585a08dfea6962835`, including accepted upstream main `5f93b4b125e78f088a2349a178e60f8c0af3e1a2`. The oracle retains original bytes through Buffer.toString and reads direct Babel/parse5 producer locations without production decoder/range helpers. CLI owners cover both commands and both actual artifact forms. No owning assertions changed in the fix. - Static/docs/build, all four test shards and aggregate coverage pass. Full deterministic aggregate: 5,005 passed, zero failed, 48 skipped (5,053 total). All 22 upstream integration checks now pass on this exact verified head, including both Darwin package jobs. [Current upstream CI](https://github.com/morluto/rea/actions/runs/37802689160). [Original exact-head native qualification](https://github.com/rudycelekli/rea/actions/runs/37801180725). - The earlier baseline also had five unrelated generated-output failures, reproduced on unchanged main. [Attribution control](https://github.com/rudycelekli/rea/actions/runs/37795715138). Separately owned #1091 is now accepted in the qualification baseline and those failures are resolved. Its repair is not duplicated in this PR diff. Publication main advanced to `c701376777212ec9acfd10c97f45b1eaf0c885c6` after qualification. Both owning source/document blobs remain unchanged, and its updated repository policy was read; the resulting upstream integration run now passes all 22 checks on the unchanged head. The Windows curated lane does not collect these new files, so no Windows BOM-owner qualification is claimed. Fixtures are synthetic and analysis remains inert. Workflows and dependencies are unchanged. No private input or credentials are included. Real Hopper/Ghidra verification was not performed; their providers are unaffected. Source commits are GitHub verified and carry Signed-off-by trailers; the verified main-refresh merge preserves them. Independent #1087 changes the suffix filter in the same source file and adds prose at the same documentation insertion point. Preserve both accepted regression groups and prose if either merges first without duplicating the other production fix. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:32 +00:00