[PR #1600] [CLOSED] fix(javascript): preserve exact static CommonJS export keys #2997

New issue

Closed

opened 2026-10-17 21:12:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:12:43 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1600
Author: @N0zoM1z0
Created: 10/10/2026
Status: ❌ Closed

Base: main ← Head: fix/javascript-export-keys-integration-1369

📝 Commits (6)

258ecd3 fix(javascript): preserve exact static CommonJS export keys
bcc3ad6 fix(javascript): qualify export helper calls before argument scanning
c1f1570 fix(ci): format concurrent maintenance changes
e28762a chore(ci): refresh export-key validation against repaired main
1e034a8 chore(ci): refresh export-key checks after snapshot cleanup
9d4dce1 chore(ci): refresh export-keys checks against current main

📊 Changes

5 files changed (+111 additions, -45 deletions)

View changed files

📝 src/apktool/ApktoolProvider.ts (+1 -1)
📝 src/application/UpdateMaintenance.ts (+3 -1)
➕ src/domain/javascript/javascriptAstExports.exact_keys.test.ts (+53 -0)
📝 src/domain/javascript/javascriptAstFingerprint.ts (+52 -37)
📝 src/domain/javascript/javascriptStaticAnalysis.member_path_depth.test.ts (+2 -6)

📄 Description

Preserve exact static CommonJS export keys. Quoted, dotted and empty keys retain their source identity; computed identifiers remain unknown instead of becoming invented export names. Helper handling recognizes member .d calls and exact Object.defineProperty, keeps this.d, and avoids scanning export arguments for unrelated callees.

This integrates the contribution from #1369 with the independently reviewed helper follow-up. The original contributor history and source branch are retained. Main now also contains the previously encountered formatting and maintenance/capture repairs.

Independent verification against main 11e3fae6: 126 affected tests across ten files and all eight static/documentation/architecture/discovery checks passed. Fresh compiled public CLI/pinned-SDK MCP runs cover an 833-byte eleven-module export fixture, a 296-byte helper control and a 113-byte this.d control. Exact export expectations, complete same-version CLI/MCP normalized-result and Evidence-ID parity, unchanged input bytes and subsequent ping all passed. An irrelevant-call probe confirms zero argument-path segment reads, compared with sixteen in the original candidate; this is a structural count, not a throughput or billed-token measurement. Native JavaScript controls confirm standalone d creates no exports and the owned this.d helper creates self.

No real Hopper/Ghidra or Electron runtime verification was performed for this static JavaScript change. Windows/provider behavior is covered only to the extent established by the linked CI; final-head CI is still running.

CI refresh at 1e034a80 changes no tracked source bytes. The independently compiled combination with main c1217e71 passes 17 focused export/helper tests, all eight checks, and all three public CLI/pinned-SDK MCP export controls plus the irrelevant-call structural probe. This includes the current snapshot cleanup and merged runtime ownership fix. The earlier 126-test validation remains tied to its stated revision. Original contributor and source history remain intact.

CI refresh at 9d4dce12 reruns the unchanged source tree against current main c12a532b, which now contains the shared cleanup-boundary corrections. Earlier local and real-target measurements remain tied to their stated revisions; this empty refresh makes no new runtime-verification claim.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1600 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/10/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/javascript-export-keys-integration-1369` --- ### 📝 Commits (6) - [`258ecd3`](https://github.com/morluto/rea/commit/258ecd361b90bffe8d82c105d5b61c3e50461ee9) fix(javascript): preserve exact static CommonJS export keys - [`bcc3ad6`](https://github.com/morluto/rea/commit/bcc3ad6014cecfcd44e82c322db75a52dba91f83) fix(javascript): qualify export helper calls before argument scanning - [`c1f1570`](https://github.com/morluto/rea/commit/c1f1570a0c0eb3a1eb5b878176ffc0e45e11436c) fix(ci): format concurrent maintenance changes - [`e28762a`](https://github.com/morluto/rea/commit/e28762a5c7bed9b3a6b55b99f0f97089d2391670) chore(ci): refresh export-key validation against repaired main - [`1e034a8`](https://github.com/morluto/rea/commit/1e034a80fecd3cd17a0236cd1ff99af5054954e7) chore(ci): refresh export-key checks after snapshot cleanup - [`9d4dce1`](https://github.com/morluto/rea/commit/9d4dce1263dacdeb1e6e1af43291065e704dc238) chore(ci): refresh export-keys checks against current main ### 📊 Changes **5 files changed** (+111 additions, -45 deletions) <details> <summary>View changed files</summary> 📝 `src/apktool/ApktoolProvider.ts` (+1 -1) 📝 `src/application/UpdateMaintenance.ts` (+3 -1) ➕ `src/domain/javascript/javascriptAstExports.exact_keys.test.ts` (+53 -0) 📝 `src/domain/javascript/javascriptAstFingerprint.ts` (+52 -37) 📝 `src/domain/javascript/javascriptStaticAnalysis.member_path_depth.test.ts` (+2 -6) </details> ### 📄 Description Preserve exact static CommonJS export keys. Quoted, dotted and empty keys retain their source identity; computed identifiers remain unknown instead of becoming invented export names. Helper handling recognizes member `.d` calls and exact `Object.defineProperty`, keeps `this.d`, and avoids scanning export arguments for unrelated callees. This integrates the contribution from #1369 with the independently reviewed helper follow-up. The original contributor history and source branch are retained. Main now also contains the previously encountered formatting and maintenance/capture repairs. Independent verification against main `11e3fae6`: 126 affected tests across ten files and all eight static/documentation/architecture/discovery checks passed. Fresh compiled public CLI/pinned-SDK MCP runs cover an 833-byte eleven-module export fixture, a 296-byte helper control and a 113-byte `this.d` control. Exact export expectations, complete same-version CLI/MCP normalized-result and Evidence-ID parity, unchanged input bytes and subsequent ping all passed. An irrelevant-call probe confirms zero argument-path segment reads, compared with sixteen in the original candidate; this is a structural count, not a throughput or billed-token measurement. Native JavaScript controls confirm standalone `d` creates no exports and the owned `this.d` helper creates `self`. No real Hopper/Ghidra or Electron runtime verification was performed for this static JavaScript change. Windows/provider behavior is covered only to the extent established by the linked CI; final-head CI is still running. CI refresh at `1e034a80` changes no tracked source bytes. The independently compiled combination with main `c1217e71` passes 17 focused export/helper tests, all eight checks, and all three public CLI/pinned-SDK MCP export controls plus the irrelevant-call structural probe. This includes the current snapshot cleanup and merged runtime ownership fix. The earlier 126-test validation remains tied to its stated revision. Original contributor and source history remain intact. CI refresh at `9d4dce12` reruns the unchanged source tree against current main `c12a532b`, which now contains the shared cleanup-boundary corrections. Earlier local and real-target measurements remain tied to their stated revisions; this empty refresh makes no new runtime-verification claim. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:12:43 +00:00