morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #829] Unify local-artifact vs live-DOM vs source-map URL policies #355

New issue

Open

opened 2026-10-15 18:24:14 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:24:14 +00:00

Owner

Originally created by @morluto on GitHub (Oct 7, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/829

Follow-up to the path-syntax extraction PR (domain/artifactPathSyntax.ts owns the character-level rules; the divergence table is in its header doc).

Remaining split, all observable:

Local artifact paths: rejected | external | not-found against an inventoried container root (lexical confinement).
Live DOM destinations: approved | outside_policy | unsupported against allowedOrigins (CdpCaptureDocuments.domDestination).
Source-map fetches: exact-origin http(s) without credentials (WebSourceMapFetcher.approvedUrl).

Unifying the outcome vocabularies changes MCP result schemas and needs per-policy regression tests pinning current classifications first, plus catalog regeneration. Do not merge fileUrlPath/bareModuleCandidate/htmlBaseDirectory until the table direction is agreed.

Originally created by @morluto on GitHub (Oct 7, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/829 Follow-up to the path-syntax extraction PR (domain/artifactPathSyntax.ts owns the character-level rules; the divergence table is in its header doc). Remaining split, all observable: - Local artifact paths: rejected | external | not-found against an inventoried container root (lexical confinement). - Live DOM destinations: approved | outside_policy | unsupported against allowedOrigins (CdpCaptureDocuments.domDestination). - Source-map fetches: exact-origin http(s) without credentials (WebSourceMapFetcher.approvedUrl). Unifying the outcome vocabularies changes MCP result schemas and needs per-policy regression tests pinning current classifications first, plus catalog regeneration. Do not merge fileUrlPath/bareModuleCandidate/htmlBaseDirectory until the table direction is agreed.

bsakaguchi added the

labels

2026-10-15 18:24:14 +00:00

bsakaguchi commented

2026-10-15 18:24:14 +00:00

Author

Owner

@morluto commented on GitHub (Oct 9, 2026):

Triage note (2026-10-09): keeping open. Verified the divergence is still deliberate in current main (src/domain/artifactPathSyntax.ts header: 'Policy divergence (deliberate, not yet unified)'). Still awaiting the table-direction decision before any vocabulary unification.

@morluto commented on GitHub (Oct 9, 2026): Triage note (2026-10-09): keeping open. Verified the divergence is still deliberate in current main (src/domain/artifactPathSyntax.ts header: 'Policy divergence (deliberate, not yet unified)'). Still awaiting the table-direction decision before any vocabulary unification.

bsakaguchi referenced this issue

2026-10-16 21:12:52 +00:00

[PR #410] [MERGED] fix(process): protect unrelated Hopper during cleanup #1959

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:05 +00:00

bsakaguchi commented

2026-11-03 21:43:16 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Nov 3, 2026):

TL;DR: Nothing on main unifies the policies, so the table direction is still open. The pinning tests for all three pass at c3647ade1, on Node 24.22.1 in a Fedora 44 VM (5 files, 476 tests). Two small things turned up.

htmlBaseDirectory, on this issue's do-not-merge list, no longer exists on main. 90c692290 (#3792) removed it.
Removing only the username check in approvedUrl failed no test. Removing the username and password checks together failed 2. The two cases in webSourceMapFetcher.test.ts that test this filter both use user:secret@.

I ran no whole suite and no other Node version.

Commands

Each ran in the VM, with Node 24 first on PATH. The scratch edits stayed in the VM and were restored afterwards.

npm run test:focused -- src/browser/CdpCaptureDocuments.baseUrl.test.ts tests/boundary/browser/webSourceMapFetcher.test.ts src/application/javascript/JavaScriptArtifactPathResolution.test.ts src/application/javascript/JavaScriptArtifactPathResolution.syntheticRootEscape.test.ts src/domain/artifactPathSyntax.test.ts

Result: 476 passed. The scratch runs used tests/boundary/browser/webSourceMapFetcher.test.ts alone: username check replaced with true, 100 passed; both checks replaced with true, 2 failed and 98 passed.

🤖 Written and tested with Claude Code (Sonnet 5.5, verified by Opus 5.5), posted with my OK 🦊

@CassieFox23 commented on GitHub (Nov 3, 2026): **TL;DR:** Nothing on main unifies the policies, so the table direction is still open. The pinning tests for all three pass at c3647ade1, on Node 24.22.1 in a Fedora 44 VM (5 files, 476 tests). Two small things turned up. - `htmlBaseDirectory`, on this issue's do-not-merge list, no longer exists on main. 90c692290 (#3792) removed it. - Removing only the username check in `approvedUrl` failed no test. Removing the username and password checks together failed 2. The two cases in `webSourceMapFetcher.test.ts` that test this filter both use `user:secret@`. I ran no whole suite and no other Node version. <details> <summary>Commands</summary> Each ran in the VM, with Node 24 first on PATH. The scratch edits stayed in the VM and were restored afterwards. ``` npm run test:focused -- src/browser/CdpCaptureDocuments.baseUrl.test.ts tests/boundary/browser/webSourceMapFetcher.test.ts src/application/javascript/JavaScriptArtifactPathResolution.test.ts src/application/javascript/JavaScriptArtifactPathResolution.syntheticRootEscape.test.ts src/domain/artifactPathSyntax.test.ts ``` Result: 476 passed. The scratch runs used `tests/boundary/browser/webSourceMapFetcher.test.ts` alone: username check replaced with `true`, 100 passed; both checks replaced with `true`, 2 failed and 98 passed. </details> 🤖 Written and tested with Claude Code (Sonnet 5.5, verified by Opus 5.5), posted with my OK 🦊

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#355

No description provided.

Rows
Columns