morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1333] [CLOSED] fix(javascript): reject invalid package exports configurations #2806

New issue

Closed

opened 2026-10-17 21:10:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:10:29 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1333
Author: @ac1982
Created: 10/9/2026
Status: ❌ Closed

Base: main ← Head: fix/javascript-invalid-export-conditions

📝 Commits (1)

d1593df fix(javascript): reject invalid package exports configurations

📊 Changes

2 files changed (+61 additions, -2 deletions)

View changed files

📝 src/application/javascript/JavaScriptArtifactPathResolution.ts (+25 -2)
📝 tests/boundary/javascript/packageConditionalExports.test.ts (+36 -0)

📄 Description

Summary

Reject invalid package exports configurations instead of selecting an apparent dependency target. Mixed subpath/condition keys and numeric condition keys must fail as configuration errors; an exports array must not recover from that error by choosing a later file.

No linked issue: this is a focused correctness bug reproduced against Node. Related #591, #606 and #1046 cover condition order, target fallback and root arrays, respectively; this change handles configuration errors those paths still accepted.

Problem and expected behavior

For example, exports: {"node":[{"0":null},"./index.cjs"],"default":"./index.cjs"} makes Node throw ERR_INVALID_PACKAGE_CONFIG, but REA selects index.cjs. Likewise, mixing "." with "import" at the root selects a target despite Node rejecting the configuration.

Change and scope

Validate root key categories before root-subpath selection. Validate numeric condition keys only when that condition object is visited, using Node's numeric-key predicate. Carry a distinct private invalid-configuration outcome through array traversal; preserve ordinary invalid-target fallback, inactive branches, and early successful selections.

Contract and boundary impact

Semantic owner and earliest changed stage: application package-exports interpretation before artifact target selection.
CLI and MCP/tool-catalog contract: unchanged tools and schemas; invalid configurations no longer produce a resolved dependency.
Provider, bridge, target-format, or platform compatibility: static JavaScript analysis; real Node 24.18.0 import/require comparisons on Linux arm64.
Evidence, artifact, provenance, or reconstruction contract: existing source identities and unresolved relationship representation preserved.
Process execution, authorization, cleanup, or containment impact: none in production; tests execute owned inert packages.
Generated metadata, package, or installation impact: none.

Evidence and regression coverage

Five new cases fail on d83cbd2a, with 39 passing controls/existing tests.
Differential tests check Node's actual error code and REA's rejected outcome for mixed keys, numeric keys at root and under ".", and an invalid object before an array fallback. Both import and require are exercised after the fix.
Controls preserve "01", "4294967295", unvisited invalid branches, early array success and ordinary subpath maps.
Built CLI analyze-javascript-application <fixture> --json retains {"specifier":"fixture","resolved_path":null} rather than linking index.cjs. The resolver supplies a specific configuration diagnostic; this does not claim the application graph exposes every resolver diagnostic.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity and source provenance remain preserved.
Unsupported and uncertain outcomes remain visible.

Validation performed

Node 24.18.0 / npm 11.16.0:

npm run test:focused -- tests/boundary/javascript/packageConditionalExports.test.ts tests/boundary/filesystem/javascriptPackagePrecedence.test.ts src/application/javascript/JavaScriptArtifactPathResolution.test.ts src/application/javascript/JavaScriptModuleSpecifierPaths.test.ts — 158 passed across four files.
npm run check — all six tasks passed, warnings and no errors.
Built CLI reproduction and git diff --check — passed.

Compatibility, safety, and release

No migration, dependency, metadata, or execution-authority changes. Unsupported package subpaths remain outside this fix. Real Hopper/Ghidra/browser verification and the complete repository test suite were not run; those providers are unchanged. Hosted CI is separate from local validation.

Review checklist

Concrete problem and one focused outcome with a conventional title.
Related PRs and reason for no linked issue documented; duplicate search completed.
Tests cover refusals and successful controls against real Node.
Existing contracts/docs remain accurate; no generated changes needed.
Representative CLI output included.
Final diff reviewed for unrelated changes, credentials, and unsupported claims.

Prepared with OpenAI Codex assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1333 **Author:** [@ac1982](https://github.com/ac1982) **Created:** 10/9/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/javascript-invalid-export-conditions` --- ### 📝 Commits (1) - [`d1593df`](https://github.com/morluto/rea/commit/d1593df1b492a86bc7df6a4b84298983b2041f4f) fix(javascript): reject invalid package exports configurations ### 📊 Changes **2 files changed** (+61 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/application/javascript/JavaScriptArtifactPathResolution.ts` (+25 -2) 📝 `tests/boundary/javascript/packageConditionalExports.test.ts` (+36 -0) </details> ### 📄 Description ## Summary Reject invalid package `exports` configurations instead of selecting an apparent dependency target. Mixed subpath/condition keys and numeric condition keys must fail as configuration errors; an exports array must not recover from that error by choosing a later file. No linked issue: this is a focused correctness bug reproduced against Node. Related #591, #606 and #1046 cover condition order, target fallback and root arrays, respectively; this change handles configuration errors those paths still accepted. ## Problem and expected behavior For example, `exports: {"node":[{"0":null},"./index.cjs"],"default":"./index.cjs"}` makes Node throw `ERR_INVALID_PACKAGE_CONFIG`, but REA selects index.cjs. Likewise, mixing `"."` with `"import"` at the root selects a target despite Node rejecting the configuration. ## Change and scope Validate root key categories before root-subpath selection. Validate numeric condition keys only when that condition object is visited, using Node's numeric-key predicate. Carry a distinct private invalid-configuration outcome through array traversal; preserve ordinary invalid-target fallback, inactive branches, and early successful selections. ## Contract and boundary impact - Semantic owner and earliest changed stage: application package-exports interpretation before artifact target selection. - CLI and MCP/tool-catalog contract: unchanged tools and schemas; invalid configurations no longer produce a resolved dependency. - Provider, bridge, target-format, or platform compatibility: static JavaScript analysis; real Node 24.18.0 import/require comparisons on Linux arm64. - Evidence, artifact, provenance, or reconstruction contract: existing source identities and unresolved relationship representation preserved. - Process execution, authorization, cleanup, or containment impact: none in production; tests execute owned inert packages. - Generated metadata, package, or installation impact: none. ## Evidence and regression coverage - Five new cases fail on `d83cbd2a`, with 39 passing controls/existing tests. - Differential tests check Node's actual error code and REA's rejected outcome for mixed keys, numeric keys at root and under `"."`, and an invalid object before an array fallback. Both import and require are exercised after the fix. - Controls preserve `"01"`, `"4294967295"`, unvisited invalid branches, early array success and ordinary subpath maps. - Built CLI `analyze-javascript-application <fixture> --json` retains `{"specifier":"fixture","resolved_path":null}` rather than linking index.cjs. The resolver supplies a specific configuration diagnostic; this does not claim the application graph exposes every resolver diagnostic. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity and source provenance remain preserved. - [x] Unsupported and uncertain outcomes remain visible. ## Validation performed Node 24.18.0 / npm 11.16.0: - `npm run test:focused -- tests/boundary/javascript/packageConditionalExports.test.ts tests/boundary/filesystem/javascriptPackagePrecedence.test.ts src/application/javascript/JavaScriptArtifactPathResolution.test.ts src/application/javascript/JavaScriptModuleSpecifierPaths.test.ts` — 158 passed across four files. - `npm run check` — all six tasks passed, warnings and no errors. - Built CLI reproduction and `git diff --check` — passed. ## Compatibility, safety, and release No migration, dependency, metadata, or execution-authority changes. Unsupported package subpaths remain outside this fix. Real Hopper/Ghidra/browser verification and the complete repository test suite were not run; those providers are unchanged. Hosted CI is separate from local validation. ## Review checklist - [x] Concrete problem and one focused outcome with a conventional title. - [x] Related PRs and reason for no linked issue documented; duplicate search completed. - [x] Tests cover refusals and successful controls against real Node. - [x] Existing contracts/docs remain accurate; no generated changes needed. - [x] Representative CLI output included. - [x] Final diff reviewed for unrelated changes, credentials, and unsupported claims. Prepared with OpenAI Codex assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:10:29 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:06:50 +00:00

[PR #2878] fix(browser): preserve explicit URL references and endpoint evidence #5461

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2806

No description provided.

Rows
Columns