[PR #1840] fix(javascript)!: preserve Vite dependency values and uncertainty #4850

New issue

Open

opened 2026-10-31 00:56:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:56:00 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1840
Author: @evenafterallisaid
Created: 10/11/2026
Status: 🔄 Open

Base: main ← Head: fix/vite-dependency-values

📝 Commits (10+)

d04d671 fix(javascript): preserve vite dependency values and indexes
215d21b fix(javascript): merge main and track shared Vite cache mutations
f029c24 style: format review corrections
1bb4b1f fix(javascript): retain Vite cache ownership across copies
a282791 fix(javascript): preserve Vite cache ownership facts
df2fa18 fix(javascript): retain cache ownership for getter overrides
0412c78 fix(javascript): complete Vite cache ownership cases
48fa42b fix(javascript): preserve Vite cache ownership facts
3400d75 merge(main): refresh Vite checks against current source
c4ebe5e Merge branch 'main' into fix/vite-dependency-values

📊 Changes

89 files changed (+11372 additions, -670 deletions)

View changed files

📝 docs/javascript-application-graph.md (+2 -2)
📝 docs/javascript-application-workflows.md (+6 -1)
📝 docs/javascript-artifact-reconstruction.md (+36 -9)
📝 src/android/JadxDoctor.ts (+4 -2)
📝 src/application/AnalysisContextQueries.test.ts (+1 -1)
📝 src/application/binary/BinarySessionOpen.ts (+1 -1)
📝 src/application/javascript/ElectronBoundaryGraphWindows.ts (+11 -3)
📝 src/application/javascript/JavaScriptArtifactGraphBuilder.ts (+1 -1)
📝 src/application/javascript/JavaScriptArtifactGraphBundlers.ts (+8 -5)
📝 src/application/javascript/JavaScriptArtifactGraphContext.ts (+8 -1)
📝 src/application/javascript/JavaScriptArtifactGraphDocuments.ts (+8 -1)
📝 src/application/javascript/JavaScriptArtifactGraphFindings.ts (+146 -59)
📝 src/application/javascript/JavaScriptArtifactGraphStructure.ts (+26 -13)
📝 src/application/javascript/JavaScriptModuleRelationships.ts (+5 -1)
📝 src/application/native/NativeFunctionMatchingService.ts (+4 -2)
📝 src/browser/history/NodeCaptureAdapter.ts (+1 -1)
📝 src/domain/analysisView/javascriptApplicationView.ts (+3 -1)
📝 src/domain/javascript/electronStaticReceiverAdmission.test.ts (+0 -1)
📝 src/domain/javascript/javascriptApplicationEvidenceSchemas.ts (+2 -0)
➕ src/domain/javascript/javascriptApplicationFileIdentity.ts (+23 -0)

...and 69 more files

📄 Description

summary

preserve decoded vite dependency values, original array indexes, and source provenance through the shared javascript analyzer. table selections remain explicit candidates when the actual load target is unproven; independent direct imports remain resolved. holes, dynamic slots, and possibly changed caches stay explicit unknowns through cli and mcp.

approach and contracts

one shared ast/binding and allocation/property owner tracks helpers, selected tables, aliases, shared descendants, prototypes, and ordered writes. consumers reuse normalized facts. primitive values, source containers, inherited values, copied values, and reachable cache owners remain distinct. no downstream logging exceptions or directly related deferred cleanup remain.

this changes graph/reference behavior: table-only selections no longer produce imports edges, and the reference contract adds vite-table-candidate / candidate. coverage remains partial when candidates are unresolved. new graph identities distinguish equal-content source occurrences and retain content digests for correspondence. existing retained evidence stays readable without re-projection or migration.

main through bf115be2 is integrated in 9c119b9, including coverage-qualified ipc relationships, exact json/addon loader selection, and structured input-error attribution. the single merge conflict uses main's stricter mcp assertion; the temporary diagnostic-layout compatibility check is removed. target source is never executed. no provider or target-execution authority is added.

latest review and ci repairs

merged main c3647ade1, retaining its getter walker, CommonJS wrapper binding facts, and graph-wide external-resolution guard. the Vite helper uses the moved global-binding query, and the view fixture supplies main's predicate and uses its owning item-request schema.
prototype copy review: normalize data descriptor flags once and retain copied child values separately from the receiver. spread, rest, and Object.assign preserve candidates after harmless copies; an unproven flag or value and indexed iteration remain conservative.
source-map comparison review: compare path and content digest for both file occurrence fields while keeping the complete container provenance in retained Evidence. unchanged originals now compare unchanged through CLI and MCP when a sibling changes.
failed shard: the native handoff test expected the historical content-only identity. it now checks the occurrence identity and exact native byte digest, while preserving the missing-companion, evidence-link, and unchanged-input checks through both adapters.
8ae2c130 fixes primitive built-in property reads, unrelated cache metadata, and copy-index cancellation. a yielding stable merge replaces the whole-group native sort; positions are collected in that traversal. the cancellation regression observed 24,588 ordering reads in a baseline step; the fixed complete analysis stays within the test's 8,192-read per-step limit.
a9c9d685 restores computed literal own keys through the shared static property-key facts. unknown keys, accessors, and non-computed prototype declarations remain conservative.
the identity assertion repairs verify distinct occurrence ids, shared byte digests, exact paths, retained findings, and resource recovery. the newest boundary repairs also validate structured invalid-input diagnostics rather than their serialized text layout.
the version-comparison repair pairs unchanged bundle members using file content and parsed member coordinates across container changes. repeated factory bodies keep their correct correspondence without requiring equal occurrence ids. changed file content or paths, incomplete chunk coordinates, and residual ambiguous groups remain conservative.

ci on 7ce8a452 failed nine outdated identity/diagnostic assertions in three boundary files. its fail-fast policy canceled the other built shards. the follow-up also repairs the source-map occurrence expectation and the genuine bundle version-correspondence regression found in wider checks.

ci on 9c119b9 passed source tests, static checks, documentation, real javascript recovery, all three native package baselines, and built shard 4. shard 1 found that the source-map test resent full graphs above main's new mcp input allowance. canceled shard logs also exposed one source-map identity assertion, one native facts identity assertion, and two callback tests selecting the first hash-sorted chunk. all five observed failures across those four files now pass locally. the source-map comparison retains graphs in the same mcp session and verifies identical cli/mcp evidence ids; registered chunks are selected by namespace, and equal-content files keep distinct occurrence ids. input limits and production semantics remain unchanged. these repairs are in 9888267, 217801b, and 71d723f.

validation

on 5e8dbeb7a (Windows 11 Home, pinned Node 24.22.1/npm 11.16.0):

4,796 tests passed; 186 of 187 suites passed, including all 173 JavaScript domain suites, 416 Vite scenarios through both public adapters (52 batches), the exact source-map and native handoff regressions, and cooperative capacity checks.
the remaining source-to-bundle suite had 59 Windows failures and three skips: 55 cases stopped at the unchanged reader's unavailable safe no-follow gate, and four used filenames containing ?. the compiled reader's capability probe confirmed noFollowOpenSupported=false on this host; these cases did not reach comparison.
typecheck, ordinary lint, formatting, Knip, metadata, architecture guards, production reachability, deep static tasks, exact test discovery, npm run build:cached, and npm run docs:check passed. the matching Windows x64 6.8.0 native artifact passed manifest and checksum verification. normal commit/pre-push hooks passed. hosted checks for this head are pending.
the baseline reproduced five harmless-copy cases in both public adapters and reported the unchanged source-map original as changed. the corrected cases preserve exact source ranges and digests; controls retain unknowns for reachable values and iteration. an additional compiled analyzer probe verified Object.assign.
typed lint reported four Windows no-floating-promises diagnostics in two Electron example/fixture files unchanged from main, with the same lint inputs. main's hosted deep static check passed.
the POSIX Python producer suite and real debugger/browser provider execution were not verified on this Windows host. the current follow-up's whole-task token, CPU, elapsed-time, and peak family-memory effects are unmeasured.

previous validation:

current merged tree, macos arm64 with node 24.22.1 and npm 11.16.0:

51 source version-comparison tests and 52 focused vite source tests pass. all 408 source scenarios match their expected candidates, unknowns, and authored ranges.
110 affected compiled boundary tests pass across the original failure files, source-to-bundle paths, and source-map locations. both facts-paging tests passed before the final typed digest assertion; its subsequent local rerun hit the unchanged 30-second limit under host memory pressure.
all eight affected compiled acceptance tests pass: five version comparisons, both repeated-callback cli/mcp surfaces, and the url-backed source-map cli/mcp comparison. isolated reruns use unchanged repository time limits.
both unbound-require cli/mcp tests and the guarded factory test passed before the main merge. the generator cli/mcp test continues to reach the standard 30-second timeout on this host, including an isolated diagnostic; its repository timeout is unchanged.
docs:check passes, including nine readme consistency tests. normal commit/pre-push hooks, check:fast, and git diff --check pass.
the broader compiled run completed all 408 vite scenarios through cli and sdk stdio mcp in 52 batches, but was stopped under host memory pressure after unrelated failures and long timeouts. two platform failures, sqlite wal metadata and vscode registration environment, reproduce on unchanged main 429355ca4. this was not a successful full-suite run.

historical validation: the three capacity regressions, 209 loop/member source tests, old-head evidence byte preservation, equal-content sibling asar paths, and a real vite 8.3.5 build passed on earlier recorded heads. elapsed time, cpu, process-family peak memory, and whole-task token costs were not measured for the latest fixes; no general speedup is claimed.

real browser, electron, hopper, and ghidra provider execution remains unverified locally. arbitrary runtime reachability remains unproven, and getter-result expansion retains the existing 512-state query bound.

greptile's latest completed review scored cdba1cc at 5/5; no review threads were open when the follow-up began. hosted ci on 71d723f and fresh review are running. the branch is mergeable. maintainer merge is still required.

Required repository checklist

Author readiness

Human owner: @evenafterallisaid

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1840 **Author:** [@evenafterallisaid](https://github.com/evenafterallisaid) **Created:** 10/11/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/vite-dependency-values` --- ### 📝 Commits (10+) - [`d04d671`](https://github.com/morluto/rea/commit/d04d671c1dafae51a2b3063319c1b7621c4ced56) fix(javascript): preserve vite dependency values and indexes - [`215d21b`](https://github.com/morluto/rea/commit/215d21bac3dff7a43aec3b3b67a1433cfe982e6e) fix(javascript): merge main and track shared Vite cache mutations - [`f029c24`](https://github.com/morluto/rea/commit/f029c24edcf3522f312462a43925decb9f4daa8f) style: format review corrections - [`1bb4b1f`](https://github.com/morluto/rea/commit/1bb4b1feee2613d95e33d6c9e743a41d41ddb42b) fix(javascript): retain Vite cache ownership across copies - [`a282791`](https://github.com/morluto/rea/commit/a28279108adce820c32a55234f998e193e0346a4) fix(javascript): preserve Vite cache ownership facts - [`df2fa18`](https://github.com/morluto/rea/commit/df2fa1880133e6318e834542ad32bbe0aeb92b1d) fix(javascript): retain cache ownership for getter overrides - [`0412c78`](https://github.com/morluto/rea/commit/0412c786d023624b6385ec9733456953e61c47bc) fix(javascript): complete Vite cache ownership cases - [`48fa42b`](https://github.com/morluto/rea/commit/48fa42be31a2c204d4503883d3949b7d31b87802) fix(javascript): preserve Vite cache ownership facts - [`3400d75`](https://github.com/morluto/rea/commit/3400d7563ff67b367e81c9bb28935092a2dcaf6a) merge(main): refresh Vite checks against current source - [`c4ebe5e`](https://github.com/morluto/rea/commit/c4ebe5e25496e5ebc2f44560bbf821c9be69c95d) Merge branch 'main' into fix/vite-dependency-values ### 📊 Changes **89 files changed** (+11372 additions, -670 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-application-graph.md` (+2 -2) 📝 `docs/javascript-application-workflows.md` (+6 -1) 📝 `docs/javascript-artifact-reconstruction.md` (+36 -9) 📝 `src/android/JadxDoctor.ts` (+4 -2) 📝 `src/application/AnalysisContextQueries.test.ts` (+1 -1) 📝 `src/application/binary/BinarySessionOpen.ts` (+1 -1) 📝 `src/application/javascript/ElectronBoundaryGraphWindows.ts` (+11 -3) 📝 `src/application/javascript/JavaScriptArtifactGraphBuilder.ts` (+1 -1) 📝 `src/application/javascript/JavaScriptArtifactGraphBundlers.ts` (+8 -5) 📝 `src/application/javascript/JavaScriptArtifactGraphContext.ts` (+8 -1) 📝 `src/application/javascript/JavaScriptArtifactGraphDocuments.ts` (+8 -1) 📝 `src/application/javascript/JavaScriptArtifactGraphFindings.ts` (+146 -59) 📝 `src/application/javascript/JavaScriptArtifactGraphStructure.ts` (+26 -13) 📝 `src/application/javascript/JavaScriptModuleRelationships.ts` (+5 -1) 📝 `src/application/native/NativeFunctionMatchingService.ts` (+4 -2) 📝 `src/browser/history/NodeCaptureAdapter.ts` (+1 -1) 📝 `src/domain/analysisView/javascriptApplicationView.ts` (+3 -1) 📝 `src/domain/javascript/electronStaticReceiverAdmission.test.ts` (+0 -1) 📝 `src/domain/javascript/javascriptApplicationEvidenceSchemas.ts` (+2 -0) ➕ `src/domain/javascript/javascriptApplicationFileIdentity.ts` (+23 -0) _...and 69 more files_ </details> ### 📄 Description ## summary preserve decoded vite dependency values, original array indexes, and source provenance through the shared javascript analyzer. table selections remain explicit candidates when the actual load target is unproven; independent direct imports remain resolved. holes, dynamic slots, and possibly changed caches stay explicit unknowns through cli and mcp. ## approach and contracts one shared ast/binding and allocation/property owner tracks helpers, selected tables, aliases, shared descendants, prototypes, and ordered writes. consumers reuse normalized facts. primitive values, source containers, inherited values, copied values, and reachable cache owners remain distinct. no downstream logging exceptions or directly related deferred cleanup remain. this changes graph/reference behavior: table-only selections no longer produce `imports` edges, and the reference contract adds `vite-table-candidate` / `candidate`. coverage remains partial when candidates are unresolved. new graph identities distinguish equal-content source occurrences and retain content digests for correspondence. existing retained evidence stays readable without re-projection or migration. main through `bf115be2` is integrated in `9c119b9`, including coverage-qualified ipc relationships, exact json/addon loader selection, and structured input-error attribution. the single merge conflict uses main's stricter mcp assertion; the temporary diagnostic-layout compatibility check is removed. target source is never executed. no provider or target-execution authority is added. ## latest review and ci repairs - merged main `c3647ade1`, retaining its getter walker, CommonJS wrapper binding facts, and graph-wide external-resolution guard. the Vite helper uses the moved global-binding query, and the view fixture supplies main's predicate and uses its owning item-request schema. - [prototype copy review](https://github.com/morluto/rea/pull/1840#discussion_r4415004403): normalize data descriptor flags once and retain copied child values separately from the receiver. spread, rest, and `Object.assign` preserve candidates after harmless copies; an unproven flag or value and indexed iteration remain conservative. - [source-map comparison review](https://github.com/morluto/rea/pull/1840#discussion_r4415004415): compare path and content digest for both file occurrence fields while keeping the complete container provenance in retained Evidence. unchanged originals now compare unchanged through CLI and MCP when a sibling changes. - [failed shard](https://github.com/morluto/rea/actions/runs/40908552927/job/123570665917): the native handoff test expected the historical content-only identity. it now checks the occurrence identity and exact native byte digest, while preserving the missing-companion, evidence-link, and unchanged-input checks through both adapters. - `8ae2c130` fixes [primitive built-in property reads](https://github.com/morluto/rea/pull/1840#discussion_r4409208820), [unrelated cache metadata](https://github.com/morluto/rea/pull/1840#discussion_r4409691026), and [copy-index cancellation](https://github.com/morluto/rea/pull/1840#discussion_r4409691036). a yielding stable merge replaces the whole-group native sort; positions are collected in that traversal. the cancellation regression observed 24,588 ordering reads in a baseline step; the fixed complete analysis stays within the test's 8,192-read per-step limit. - `a9c9d685` restores computed literal own keys through the shared static property-key facts. unknown keys, accessors, and non-computed prototype declarations remain conservative. - the identity assertion repairs verify distinct occurrence ids, shared byte digests, exact paths, retained findings, and resource recovery. the newest boundary repairs also validate structured invalid-input diagnostics rather than their serialized text layout. - the version-comparison repair pairs unchanged bundle members using file content and parsed member coordinates across container changes. repeated factory bodies keep their correct correspondence without requiring equal occurrence ids. changed file content or paths, incomplete chunk coordinates, and residual ambiguous groups remain conservative. [ci on `7ce8a452`](https://github.com/morluto/rea/actions/runs/40854917570) failed nine outdated identity/diagnostic assertions in three boundary files. its fail-fast policy canceled the other built shards. the follow-up also repairs the source-map occurrence expectation and the genuine bundle version-correspondence regression found in wider checks. [ci on `9c119b9`](https://github.com/morluto/rea/actions/runs/40904564058) passed source tests, static checks, documentation, real javascript recovery, all three native package baselines, and built shard 4. shard 1 found that the source-map test resent full graphs above main's new mcp input allowance. canceled shard logs also exposed one source-map identity assertion, one native facts identity assertion, and two callback tests selecting the first hash-sorted chunk. all five observed failures across those four files now pass locally. the source-map comparison retains graphs in the same mcp session and verifies identical cli/mcp evidence ids; registered chunks are selected by namespace, and equal-content files keep distinct occurrence ids. input limits and production semantics remain unchanged. these repairs are in `9888267`, `217801b`, and `71d723f`. ## validation on `5e8dbeb7a` (Windows 11 Home, pinned Node 24.22.1/npm 11.16.0): - **4,796 tests passed; 186 of 187 suites passed**, including all 173 JavaScript domain suites, 416 Vite scenarios through both public adapters (52 batches), the exact source-map and native handoff regressions, and cooperative capacity checks. - the remaining source-to-bundle suite had 59 Windows failures and three skips: 55 cases stopped at the unchanged reader's unavailable safe no-follow gate, and four used filenames containing `?`. the compiled reader's capability probe confirmed `noFollowOpenSupported=false` on this host; these cases did not reach comparison. - typecheck, ordinary lint, formatting, Knip, metadata, architecture guards, production reachability, deep static tasks, exact test discovery, `npm run build:cached`, and `npm run docs:check` passed. the matching Windows x64 6.8.0 native artifact passed manifest and checksum verification. normal commit/pre-push hooks passed. hosted checks for this head are pending. - the baseline reproduced five harmless-copy cases in both public adapters and reported the unchanged source-map original as changed. the corrected cases preserve exact source ranges and digests; controls retain unknowns for reachable values and iteration. an additional compiled analyzer probe verified `Object.assign`. - typed lint reported four Windows `no-floating-promises` diagnostics in two Electron example/fixture files unchanged from main, with the same lint inputs. [main's hosted deep static check](https://github.com/morluto/rea/actions/runs/41693996466/job/126119750472) passed. - the POSIX Python producer suite and real debugger/browser provider execution were not verified on this Windows host. the current follow-up's whole-task token, CPU, elapsed-time, and peak family-memory effects are unmeasured. previous validation: current merged tree, macos arm64 with node 24.22.1 and npm 11.16.0: - **51 source version-comparison tests** and **52 focused vite source tests pass**. all **408 source scenarios** match their expected candidates, unknowns, and authored ranges. - **110 affected compiled boundary tests pass** across the original failure files, source-to-bundle paths, and source-map locations. both facts-paging tests passed before the final typed digest assertion; its subsequent local rerun hit the unchanged 30-second limit under host memory pressure. - all **eight affected compiled acceptance tests pass**: five version comparisons, both repeated-callback cli/mcp surfaces, and the url-backed source-map cli/mcp comparison. isolated reruns use unchanged repository time limits. - both unbound-require cli/mcp tests and the guarded factory test passed before the main merge. the generator cli/mcp test continues to reach the standard 30-second timeout on this host, including an isolated diagnostic; its repository timeout is unchanged. - `docs:check` passes, including nine readme consistency tests. normal commit/pre-push hooks, `check:fast`, and `git diff --check` pass. the broader compiled run completed all **408 vite scenarios through cli and sdk stdio mcp in 52 batches**, but was stopped under host memory pressure after unrelated failures and long timeouts. two platform failures, sqlite wal metadata and vscode registration environment, reproduce on unchanged main `429355ca4`. this was not a successful full-suite run. historical validation: the three capacity regressions, 209 loop/member source tests, old-head evidence byte preservation, equal-content sibling asar paths, and a real vite 8.3.5 build passed on earlier recorded heads. elapsed time, cpu, process-family peak memory, and whole-task token costs were not measured for the latest fixes; no general speedup is claimed. real browser, electron, hopper, and ghidra provider execution remains unverified locally. arbitrary runtime reachability remains unproven, and getter-result expansion retains the existing 512-state query bound. [greptile's latest completed review](https://github.com/morluto/rea/pull/1840#issuecomment-6140058655) scored `cdba1cc` at 5/5; no review threads were open when the follow-up began. [hosted ci on `71d723f`](https://github.com/morluto/rea/actions/runs/40908552927) and fresh review are running. the branch is mergeable. maintainer merge is still required. <details> <summary>Required repository checklist</summary> ## Author readiness Human owner: @evenafterallisaid - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 00:56:00 +00:00

bsakaguchi referenced this issue

2026-10-31 01:14:28 +00:00

[PR #4850] [CLOSED] feat(apk): add offline APK signature inspection #6440