[PR #1157] [MERGED] fix(javascript): omit self-referential static references with disclosure #2690

New issue

Closed

opened 2026-10-17 21:09:08 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:09:08 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1157
Author: @kaoru0822-kitauji
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/javascript-self-referential-static-references

📝 Commits (2)

e04a673 fix(javascript): omit self-referential static references with disclosure
75df022 refactor(javascript): share the self-reference omission disclosure

📊 Changes

5 files changed (+107 additions, -33 deletions)

View changed files

📝 src/application/javascript/JavaScriptArtifactGraphBuilder.ts (+11 -7)
📝 src/application/javascript/JavaScriptArtifactGraphBundlers.ts (+6 -5)
📝 src/application/javascript/JavaScriptArtifactGraphContext.ts (+15 -0)
📝 src/application/javascript/JavaScriptArtifactGraphFindings.ts (+17 -2)
📝 tests/boundary/cli/javascriptBundlerSelfReferences.test.ts (+58 -19)

📄 Description

Follow-up to #1152 (#1146), as described in the comment on #1152.

Problem

#1152 made analyze_javascript_application survive a chunk requesting its own chunk ID. The same invariant ("Application graph edges cannot be self-referential") can still be reached through the static-reference composer, addReference in JavaScriptArtifactGraphFindings.ts. A bundled module that requires its own key resolves back to its own module node:

"use strict";(self.webpackChunkdemo=self.webpackChunkdemo||[]).push([[5],{50(e,t,r){r(50)}}]);

On main (after #1152), rea analyze-javascript-application <dir> --json returns:

{"code":"unreadable_output","details":{"operation":"analyze_javascript_application","reason":"Result schema rejected 1 issue at /edges/1 (custom)"}}

Change

addReference skips a reference whose resolved target is its own source node, and counts it. This matches #1152's async-chunk handling and #1130's self-imports.
addJavaScriptStaticFindings returns the disclosure, as addJavaScriptBundlerNodes does since #1152: "N static reference(s) resolved back to the referencing module itself and was/were omitted; application graph edges cannot be self-referential."
Sibling requires, such as r(51) from module 50, are kept.
The three self-reference disclosures (self-imports from #1130, async chunks from #1152, and static references) now share one selfReferenceOmissions helper with identical wording. The test file shares one helper for the graph-wide invariants. Together these keep jscpd under its 2.5% gate (now 2.49%; adding a fourth copy of the template would have reached it).

Other self-reference shapes don't produce self-edges and are unchanged, because they resolve to distinct nodes:

a worker that spawns itself;
a module that dynamically imports itself;
an HTML <script src> pointing at its own document;
//# sourceMappingURL= naming its own file;
CommonJS self-require (covered by #1130).

Verification

tests/boundary/cli/javascriptBundlerSelfReferences.test.ts gains a compiled-CLI case. A module requiring itself and a sibling: no self-edges, one disclosed omission, and the sibling require edge kept. It fails on main.
All 39 test files that cover the JavaScript artifact graph, bundler registrations or analyze_javascript_application: 276 passed.
npm run check:fast, npm run jscpd

No real Hopper or Ghidra verification was run, because this change does not touch those providers.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1157 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/javascript-self-referential-static-references` --- ### 📝 Commits (2) - [`e04a673`](https://github.com/morluto/rea/commit/e04a67304782608b8467322ed0b787c3eb56be9b) fix(javascript): omit self-referential static references with disclosure - [`75df022`](https://github.com/morluto/rea/commit/75df022de94056e73488d825afc482b60ce8299b) refactor(javascript): share the self-reference omission disclosure ### 📊 Changes **5 files changed** (+107 additions, -33 deletions) <details> <summary>View changed files</summary> 📝 `src/application/javascript/JavaScriptArtifactGraphBuilder.ts` (+11 -7) 📝 `src/application/javascript/JavaScriptArtifactGraphBundlers.ts` (+6 -5) 📝 `src/application/javascript/JavaScriptArtifactGraphContext.ts` (+15 -0) 📝 `src/application/javascript/JavaScriptArtifactGraphFindings.ts` (+17 -2) 📝 `tests/boundary/cli/javascriptBundlerSelfReferences.test.ts` (+58 -19) </details> ### 📄 Description Follow-up to #1152 (#1146), as described in the comment on #1152. ## Problem #1152 made `analyze_javascript_application` survive a chunk requesting its own chunk ID. The same invariant ("Application graph edges cannot be self-referential") can still be reached through the static-reference composer, `addReference` in `JavaScriptArtifactGraphFindings.ts`. A bundled module that requires its own key resolves back to its own module node: ```js "use strict";(self.webpackChunkdemo=self.webpackChunkdemo||[]).push([[5],{50(e,t,r){r(50)}}]); ``` On `main` (after #1152), `rea analyze-javascript-application <dir> --json` returns: ```json {"code":"unreadable_output","details":{"operation":"analyze_javascript_application","reason":"Result schema rejected 1 issue at /edges/1 (custom)"}} ``` ## Change - `addReference` skips a reference whose resolved target is its own source node, and counts it. This matches #1152's async-chunk handling and #1130's self-imports. - `addJavaScriptStaticFindings` returns the disclosure, as `addJavaScriptBundlerNodes` does since #1152: "N static reference(s) resolved back to the referencing module itself and was/were omitted; application graph edges cannot be self-referential." - Sibling requires, such as `r(51)` from module 50, are kept. - The three self-reference disclosures (self-imports from #1130, async chunks from #1152, and static references) now share one `selfReferenceOmissions` helper with identical wording. The test file shares one helper for the graph-wide invariants. Together these keep `jscpd` under its 2.5% gate (now 2.49%; adding a fourth copy of the template would have reached it). Other self-reference shapes don't produce self-edges and are unchanged, because they resolve to distinct nodes: - a worker that spawns itself; - a module that dynamically imports itself; - an HTML `<script src>` pointing at its own document; - `//# sourceMappingURL=` naming its own file; - CommonJS self-require (covered by #1130). ## Verification - `tests/boundary/cli/javascriptBundlerSelfReferences.test.ts` gains a compiled-CLI case. A module requiring itself and a sibling: no self-edges, one disclosed omission, and the sibling `require` edge kept. It fails on `main`. - All 39 test files that cover the JavaScript artifact graph, bundler registrations or `analyze_javascript_application`: 276 passed. - `npm run check:fast`, `npm run jscpd` No real Hopper or Ghidra verification was run, because this change does not touch those providers. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:09:08 +00:00