[PR #1671] [CLOSED] fix(javascript): respect static path helper ownership #4742

New issue

Closed

opened 2026-10-31 00:54:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:35 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1671
Author: @rudycelekli
Created: 10/11/2026
Status: ❌ Closed

Base: main ← Head: fix/javascript-path-helper-ownership-20261010

📝 Commits (1)

e14ebd5 fix(javascript): respect static path helper ownership

📊 Changes

7 files changed (+421 additions, -45 deletions)

View changed files

📝 src/domain/javascript/electronStaticAnalysisBrowser.ts (+16 -6)
📝 src/domain/javascript/javascriptSemanticAnalysis.ts (+132 -2)
📝 src/domain/javascript/javascriptStaticAnalysis.ts (+4 -3)
📝 src/domain/javascript/javascriptStaticAnalysisCalls.ts (+5 -2)
📝 src/domain/javascript/javascriptStaticAnalysisHelpers.ts (+71 -32)
📝 src/domain/javascript/javascriptStaticAnalysisState.ts (+2 -0)
➕ tests/boundary/filesystem/javascriptPathHelperOwnership.test.ts (+191 -0)

📄 Description

A locally declared fileURLToPath or path.join can return a different preload path, but static application analysis currently interprets its spelling as the native helper and reports the decoy file as resolved. This also affects shadowed URL constructors, directory anchors, and visibly overwritten native members.

Thread lexical path ownership alongside the existing Electron binding facts, using the shared member-write collector and canonical path/node:path and url/node:url identities. Known custom or reassigned helpers stay unresolved; supported native, aliased, and literal expressions keep resolving. Related variants are grouped here. Analysis remains static; arbitrary call side effects are not evaluated.

Validation on the exact source commit:

Original-source regression: 14 intended assertion failures, eight controls passing, 22 cases; six negative mutations of the baseline evaluator rejected.
Fixed official focused tests: 117 passing across nine files, including native object aliases, cross-specifier mutations, unrelated member writes, nested shadows, and existing path/Electron controls.
npm run check, npm run verify:test-discovery, and npm run build:cached pass.
Bounded hosted verification verifies the application head, tracked source, and file hashes before and after the gates. The validation workflow is excluded from this PR.

These checks cover static analysis and the relevant regression families; they do not claim the full optional native/provider test matrix.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1671 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/11/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/javascript-path-helper-ownership-20261010` --- ### 📝 Commits (1) - [`e14ebd5`](https://github.com/morluto/rea/commit/e14ebd531a0ed7fa777ea7b70f6947b390bbeb64) fix(javascript): respect static path helper ownership ### 📊 Changes **7 files changed** (+421 additions, -45 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/electronStaticAnalysisBrowser.ts` (+16 -6) 📝 `src/domain/javascript/javascriptSemanticAnalysis.ts` (+132 -2) 📝 `src/domain/javascript/javascriptStaticAnalysis.ts` (+4 -3) 📝 `src/domain/javascript/javascriptStaticAnalysisCalls.ts` (+5 -2) 📝 `src/domain/javascript/javascriptStaticAnalysisHelpers.ts` (+71 -32) 📝 `src/domain/javascript/javascriptStaticAnalysisState.ts` (+2 -0) ➕ `tests/boundary/filesystem/javascriptPathHelperOwnership.test.ts` (+191 -0) </details> ### 📄 Description A locally declared `fileURLToPath` or `path.join` can return a different preload path, but static application analysis currently interprets its spelling as the native helper and reports the decoy file as resolved. This also affects shadowed URL constructors, directory anchors, and visibly overwritten native members. Thread lexical path ownership alongside the existing Electron binding facts, using the shared member-write collector and canonical `path`/`node:path` and `url`/`node:url` identities. Known custom or reassigned helpers stay unresolved; supported native, aliased, and literal expressions keep resolving. Related variants are grouped here. Analysis remains static; arbitrary call side effects are not evaluated. Validation on the exact source commit: - Original-source regression: 14 intended assertion failures, eight controls passing, 22 cases; six negative mutations of the baseline evaluator rejected. - Fixed official focused tests: 117 passing across nine files, including native object aliases, cross-specifier mutations, unrelated member writes, nested shadows, and existing path/Electron controls. - `npm run check`, `npm run verify:test-discovery`, and `npm run build:cached` pass. - [Bounded hosted verification](https://github.com/rudycelekli/rea/actions/runs/38104211256) verifies the application head, tracked source, and file hashes before and after the gates. The validation workflow is excluded from this PR. These checks cover static analysis and the relevant regression families; they do not claim the full optional native/provider test matrix. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:35 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:14:05 +00:00

[PR #4751] [CLOSED] fix(lldb): retain journal descriptor cleanup ownership #6387

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4742

No description provided.

Rows
Columns