[PR #1216] [MERGED] fix(javascript): report located sources with differing digests as modified #2729

New issue

Closed

opened 2026-10-17 21:09:34 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:09:34 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1216
Author: @jayhemnani9910
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @morluto

Base: main ← Head: fix/source-to-bundle-modified

📝 Commits (1)

f851d9c fix(javascript): report located sources with differing digests as modified

📊 Changes

3 files changed (+73 additions, -1 deletions)

View changed files

📝 src/domain/javascript/sourceToBundleComparison.test.ts (+50 -0)
📝 src/domain/javascript/sourceToBundleComparison.ts (+17 -1)
📝 src/domain/javascript/sourceToBundleSignals.ts (+6 -0)

📄 Description

Summary

compare-source-to-bundle never reports a source file as modified. When a source file is located in the bundle by path and both sides have a digest that differs, the item is unknown with the limitation "comparable source digests are unavailable", which is not true in that case. The modified count in the summary is always 0.

Problem and expected behavior

Trigger: a webpack-style map with sources: ["webpack://fixture/./src/a.js"] and sourcesContent, compared with a reference tree where src/a.js was edited.

Before: the source-module candidate has source-map-original-path and a known source_sha256, the reference file has its own sha256, and they differ. classifyMapping returns unknown / "Location evidence links the source to the current node, but comparable source digests are unavailable." (src/domain/javascript/sourceToBundleComparison.ts:214-224).

Expected: modified, which the docs list as a status (docs/javascript-application-workflows.md) and the summary counts. A path-only match where the current node has no digest stays unknown, as 5a76aaf intended ("keep digestless bundle matches unknown"; its fixture node has no digest).

Change and scope

When exactly one path candidate wins, there is no exact digest match, the reference file has a digest and the candidate node carries at least one content digest, the item is now modified (confidence high for source-map or exact-path matches, otherwise medium). All other branches are unchanged. A small candidateHasDigest helper reads the digests the candidate index already collects.

Contract and boundary impact

Semantic owner and earliest changed stage: source-to-bundle classification (sourceToBundleComparison.ts).
CLI and MCP/tool-catalog contract: none; modified is already in the schema.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: items that were unknown with digests on both sides become modified.
Process execution, authorization, cleanup, or containment impact: none.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated: reports a located source with a different digest as modified in src/domain/javascript/sourceToBundleComparison.test.ts. It fails on current main and passes with this change. The existing digestless src/modified.ts case still expects unknown.
Base reproduction or other evidence: executed on main and on rea-agents 6.0.0 with a rolldown bundle whose map sources were rewritten to webpack://fixture/./src/*.js: src/a.js unknown unknown ['... comparable source digests are unavailable.'] with candidate signals source-map-original-path, current-path-suffix. With this change: src/a.js modified high ['Location evidence links the source to the current node, but their source digests differ.'], summary modified: 1, unknown: 0; src/main.js stays unchanged.
User-visible CLI/MCP output: the item above.
Remaining proof gaps: none known.

Validation performed

npx vitest run src/domain/javascript/sourceToBundleComparison.test.ts — 9 passed; the new test fails with the fix reverted.
npm run check:fast — passed.
npx vitest run (after npm run build:cached) — 5315 passed; 10 failures are firmware (local Binwalk is not 3.1.x) and two ASAR reconstruction tests that fail the same way on untouched main here, plus processCaptureTerminal.test.ts, which passed 10 of 10 runs on its own on both this branch and main.

Compatibility, safety, and release

Breaking changes or migration steps: none; callers reading status see modified where they saw unknown.
Real Hopper/Ghidra, browser, or OS coverage: not applicable; static JavaScript analysis only.
Package or release metadata impact: none.
Security, privacy, process, or containment review: none.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1216 **Author:** [@jayhemnani9910](https://github.com/jayhemnani9910) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/source-to-bundle-modified` --- ### 📝 Commits (1) - [`f851d9c`](https://github.com/morluto/rea/commit/f851d9c3b2336bd891d8e4167e21714151257f1a) fix(javascript): report located sources with differing digests as modified ### 📊 Changes **3 files changed** (+73 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/sourceToBundleComparison.test.ts` (+50 -0) 📝 `src/domain/javascript/sourceToBundleComparison.ts` (+17 -1) 📝 `src/domain/javascript/sourceToBundleSignals.ts` (+6 -0) </details> ### 📄 Description ## Summary `compare-source-to-bundle` never reports a source file as `modified`. When a source file is located in the bundle by path and both sides have a digest that differs, the item is `unknown` with the limitation "comparable source digests are unavailable", which is not true in that case. The `modified` count in the summary is always 0. ## Problem and expected behavior Trigger: a webpack-style map with `sources: ["webpack://fixture/./src/a.js"]` and `sourcesContent`, compared with a reference tree where `src/a.js` was edited. Before: the `source-module` candidate has `source-map-original-path` and a known `source_sha256`, the reference file has its own `sha256`, and they differ. `classifyMapping` returns `unknown` / "Location evidence links the source to the current node, but comparable source digests are unavailable." (`src/domain/javascript/sourceToBundleComparison.ts:214-224`). Expected: `modified`, which the docs list as a status (`docs/javascript-application-workflows.md`) and the summary counts. A path-only match where the current node has no digest stays `unknown`, as 5a76aaf intended ("keep digestless bundle matches unknown"; its fixture node has no digest). ## Change and scope When exactly one path candidate wins, there is no exact digest match, the reference file has a digest and the candidate node carries at least one content digest, the item is now `modified` (confidence `high` for source-map or exact-path matches, otherwise `medium`). All other branches are unchanged. A small `candidateHasDigest` helper reads the digests the candidate index already collects. ## Contract and boundary impact - Semantic owner and earliest changed stage: source-to-bundle classification (`sourceToBundleComparison.ts`). - CLI and MCP/tool-catalog contract: none; `modified` is already in the schema. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: items that were `unknown` with digests on both sides become `modified`. - Process execution, authorization, cleanup, or containment impact: none. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: `reports a located source with a different digest as modified` in `src/domain/javascript/sourceToBundleComparison.test.ts`. It fails on current main and passes with this change. The existing digestless `src/modified.ts` case still expects `unknown`. - Base reproduction or other evidence: executed on main and on rea-agents 6.0.0 with a rolldown bundle whose map sources were rewritten to `webpack://fixture/./src/*.js`: `src/a.js unknown unknown ['... comparable source digests are unavailable.']` with candidate signals `source-map-original-path`, `current-path-suffix`. With this change: `src/a.js modified high ['Location evidence links the source to the current node, but their source digests differ.']`, summary `modified: 1, unknown: 0`; `src/main.js` stays `unchanged`. - User-visible CLI/MCP output: the item above. - Remaining proof gaps: none known. ## Validation performed - `npx vitest run src/domain/javascript/sourceToBundleComparison.test.ts` — 9 passed; the new test fails with the fix reverted. - `npm run check:fast` — passed. - `npx vitest run` (after `npm run build:cached`) — 5315 passed; 10 failures are firmware (local Binwalk is not 3.1.x) and two ASAR reconstruction tests that fail the same way on untouched main here, plus `processCaptureTerminal.test.ts`, which passed 10 of 10 runs on its own on both this branch and main. ## Compatibility, safety, and release - Breaking changes or migration steps: none; callers reading `status` see `modified` where they saw `unknown`. - Real Hopper/Ghidra, browser, or OS coverage: not applicable; static JavaScript analysis only. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:09:34 +00:00