morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1215] [MERGED] fix(javascript): match source-map originals that name parent directories #2726

New issue

Closed

opened 2026-10-17 21:09:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:09:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1215
Author: @jayhemnani9910
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/source-map-parent-paths

📝 Commits (9)

50642d0 fix(javascript): match source-map originals that name parent directories
b48702a fix(javascript): resolve parent segments against the source map's directory
75f0c9d fix(javascript): resolve source originals against their map location
819579c fix(javascript): preserve URI and empty source map path semantics
10b7706 fix(javascript): separate source URL paths from opaque URI payloads
3c31882 fix(javascript): preserve filesystem names during URI classification
0118c44 style(javascript): format source URI presence guard
c2a9dde fix(javascript): resolve source map references with URL semantics
89fd82d fix(javascript): preserve literal UNC source map paths

📊 Changes

4 files changed (+713 additions, -75 deletions)

View changed files

➕ src/domain/javascript/javascriptSourceMapPaths.ts (+69 -0)
📝 src/domain/javascript/sourceToBundleComparison.test.ts (+43 -39)
📝 src/domain/javascript/sourceToBundleSignals.ts (+76 -18)
📝 tests/boundary/filesystem/sourceToBundlePaths.test.ts (+525 -18)

📄 Description

Summary

compare-source-to-bundle never matches a historical source file to a source-map original when the map names it relative to the map's own directory, such as ../src/a.js. Rollup, Vite, esbuild and rolldown write sources this way by default, so for their bundles every source file loses its path evidence.

Problem and expected behavior

Trigger: dist/main.js with dist/main.js.map whose sources is ["../src/a.js"], compared with a reference tree containing src/a.js.

Before: normalizeCurrentPath returns null for any path that contains a .. segment (src/domain/javascript/sourceToBundleSignals.ts:287), so the source-module node gets no path, suffix or basename entries. An edited src/a.js is reported as unknown with "No candidate was observed, but incomplete input or graph coverage prevents a removal claim." An unedited file is still found, but only through its digest.

Expected: ../src/a.js is the same location as src/a.js for matching, so the node gets a source-map-original-path signal for src/a.js.

Change and scope

normalizeCurrentPath now collapses .. segments lexically instead of discarding the whole path; entries starting with ../ are resolved against the map file's directory first. The value is used only for path matching and for the signal's current_values, never to read a file. Scoring, weights and classification are unchanged.

Contract and boundary impact

Semantic owner and earliest changed stage: source-to-bundle candidate indexing (sourceToBundleSignals.ts).
CLI and MCP/tool-catalog contract: none.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: source-map originals with .. segments now produce path signals; current_values show the collapsed path.
Process execution, authorization, cleanup, or containment impact: none; no filesystem access uses this value.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated: matches source-map originals named relative to the map in tests/boundary/filesystem/sourceToBundlePaths.test.ts (real analyzer on a dist/main.js + map with sources: ["../src/a.js"]). It fails on current main and passes with this change. The existing test there now shares a small helper.
Base reproduction or other evidence: executed with a two-module rolldown bundle (default output, sources: ["../src/a.js","../src/main.js"]) and src/a.js edited in the reference tree, on main and on rea-agents 6.0.0: src/a.js unknown unknown ['No candidate was observed, ...']. With this change the source-module candidate carries source-map-original-path and current-path-exact for src/a.js (score 155, confidence high).
User-visible CLI/MCP output: the item and candidate above.
Remaining proof gaps: when the map and reference digests differ, the item is still unknown ("comparable source digests are unavailable"); that classification is a separate bug in classifyMapping, fixed in a separate PR. With both changes the edited file is reported modified.

Validation performed

npm run test:focused -- tests/boundary/filesystem/sourceToBundlePaths.test.ts — 3 passed; the new test fails with the fix reverted.
npx vitest run src/domain/javascript/ — 512 passed.
npm run check:fast — passed.
npx vitest run (after npm run build:cached) — 5316 passed; the 10 failures are firmware (local Binwalk is not 3.1.x) and two ASAR reconstruction tests, which fail the same way on untouched main here.
Re-ran the rolldown repro: src/a.js now has the source-map-original-path candidate; src/main.js stays unchanged.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: not applicable; static JavaScript analysis only, no provider involved.
Package or release metadata impact: none.
Security, privacy, process, or containment review: the collapsed path is a matching key only.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1215 **Author:** [@jayhemnani9910](https://github.com/jayhemnani9910) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/source-map-parent-paths` --- ### 📝 Commits (9) - [`50642d0`](https://github.com/morluto/rea/commit/50642d028205cf62bd7775729fe96d0c32cee481) fix(javascript): match source-map originals that name parent directories - [`b48702a`](https://github.com/morluto/rea/commit/b48702a4eeecd22799b0ebafe263f87a76795f92) fix(javascript): resolve parent segments against the source map's directory - [`75f0c9d`](https://github.com/morluto/rea/commit/75f0c9d314359495f602d83eb48be687a5ac87fe) fix(javascript): resolve source originals against their map location - [`819579c`](https://github.com/morluto/rea/commit/819579cc9f3d82919fb9f209e61369b74971ccef) fix(javascript): preserve URI and empty source map path semantics - [`10b7706`](https://github.com/morluto/rea/commit/10b7706d6493761fe7ad165c59e247a66bc0bc24) fix(javascript): separate source URL paths from opaque URI payloads - [`3c31882`](https://github.com/morluto/rea/commit/3c3188263d07102ac5432521c5ed20a6a66dbb91) fix(javascript): preserve filesystem names during URI classification - [`0118c44`](https://github.com/morluto/rea/commit/0118c444617a44ab33bbc8134286fa21741ff7ce) style(javascript): format source URI presence guard - [`c2a9dde`](https://github.com/morluto/rea/commit/c2a9dde0cc3d98a465beb238927f016ac4b9e396) fix(javascript): resolve source map references with URL semantics - [`89fd82d`](https://github.com/morluto/rea/commit/89fd82dd122556b5f8fd74a47eae778678630f8e) fix(javascript): preserve literal UNC source map paths ### 📊 Changes **4 files changed** (+713 additions, -75 deletions) <details> <summary>View changed files</summary> ➕ `src/domain/javascript/javascriptSourceMapPaths.ts` (+69 -0) 📝 `src/domain/javascript/sourceToBundleComparison.test.ts` (+43 -39) 📝 `src/domain/javascript/sourceToBundleSignals.ts` (+76 -18) 📝 `tests/boundary/filesystem/sourceToBundlePaths.test.ts` (+525 -18) </details> ### 📄 Description ## Summary `compare-source-to-bundle` never matches a historical source file to a source-map original when the map names it relative to the map's own directory, such as `../src/a.js`. Rollup, Vite, esbuild and rolldown write `sources` this way by default, so for their bundles every source file loses its path evidence. ## Problem and expected behavior Trigger: `dist/main.js` with `dist/main.js.map` whose `sources` is `["../src/a.js"]`, compared with a reference tree containing `src/a.js`. Before: `normalizeCurrentPath` returns `null` for any path that contains a `..` segment (`src/domain/javascript/sourceToBundleSignals.ts:287`), so the `source-module` node gets no path, suffix or basename entries. An edited `src/a.js` is reported as `unknown` with "No candidate was observed, but incomplete input or graph coverage prevents a removal claim." An unedited file is still found, but only through its digest. Expected: `../src/a.js` is the same location as `src/a.js` for matching, so the node gets a `source-map-original-path` signal for `src/a.js`. ## Change and scope `normalizeCurrentPath` now collapses `..` segments lexically instead of discarding the whole path; entries starting with `../` are resolved against the map file's directory first. The value is used only for path matching and for the signal's `current_values`, never to read a file. Scoring, weights and classification are unchanged. ## Contract and boundary impact - Semantic owner and earliest changed stage: source-to-bundle candidate indexing (`sourceToBundleSignals.ts`). - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: source-map originals with `..` segments now produce path signals; `current_values` show the collapsed path. - Process execution, authorization, cleanup, or containment impact: none; no filesystem access uses this value. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: `matches source-map originals named relative to the map` in `tests/boundary/filesystem/sourceToBundlePaths.test.ts` (real analyzer on a `dist/main.js` + map with `sources: ["../src/a.js"]`). It fails on current main and passes with this change. The existing test there now shares a small helper. - Base reproduction or other evidence: executed with a two-module rolldown bundle (default output, `sources: ["../src/a.js","../src/main.js"]`) and `src/a.js` edited in the reference tree, on main and on rea-agents 6.0.0: `src/a.js unknown unknown ['No candidate was observed, ...']`. With this change the `source-module` candidate carries `source-map-original-path` and `current-path-exact` for `src/a.js` (score 155, confidence high). - User-visible CLI/MCP output: the item and candidate above. - Remaining proof gaps: when the map and reference digests differ, the item is still `unknown` ("comparable source digests are unavailable"); that classification is a separate bug in `classifyMapping`, fixed in a separate PR. With both changes the edited file is reported `modified`. ## Validation performed - `npm run test:focused -- tests/boundary/filesystem/sourceToBundlePaths.test.ts` — 3 passed; the new test fails with the fix reverted. - `npx vitest run src/domain/javascript/` — 512 passed. - `npm run check:fast` — passed. - `npx vitest run` (after `npm run build:cached`) — 5316 passed; the 10 failures are firmware (local Binwalk is not 3.1.x) and two ASAR reconstruction tests, which fail the same way on untouched main here. - Re-ran the rolldown repro: `src/a.js` now has the `source-map-original-path` candidate; `src/main.js` stays `unchanged`. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable; static JavaScript analysis only, no provider involved. - Package or release metadata impact: none. - Security, privacy, process, or containment review: the collapsed path is a matching key only. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:09:33 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2726

No description provided.

Rows
Columns