[PR #2114] [MERGED] fix(wasm): preserve original glue source locations #5039

Closed
opened 2026-10-31 00:59:53 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2114
Author: @1052326311
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/wasm-glue-source-locations


📝 Commits (10+)

  • 9bf8140 fix(wasm): preserve original glue source locations
  • 81f0308 fix(wasm): retain BOM-prefixed hashbang glue references
  • 8374695 test(wasm): cover BOM coordinates and executable glue parsing
  • f2e035f test(wasm): parse the artifact contract before reading glue evidence
  • 9454bb4 test(wasm): give glue fixtures and assertions a single owner
  • e7f47e5 fix(wasm): sync source location fix with captured main checks
  • 58b6d5b fix(comparison): recheck historical calls-only changes (#2223)
  • ab88e2f fix(ci): isolate Linux Hopper process fixture inventory
  • e3a31a6 fix(android): make DEX descriptor pattern portable
  • 945c22c fix: repair the static-check failures on the default branch (#2895)

📊 Changes

4 files changed (+105 additions, -15 deletions)

View changed files

📝 scripts/verify-wasm-artifact.mjs (+39 -10)
📝 src/wasm/WabtArtifactProvider.test.ts (+56 -1)
📝 src/wasm/WabtArtifactProvider.ts (+5 -3)
📝 src/wasm/WasmGlueAdapter.ts (+5 -1)

📄 Description

Summary

Preserve original JavaScript source locations when inspecting BOM-prefixed WASM glue files. inspect-wasm-artifact / inspect_wasm_artifact previously reported first-line literal columns one character too early, even though their artifact hash and byte count described the original file.

Problem and expected behavior

For \uFEFFfetch("./module.wasm");, the string literal starts at zero-based column 7. The provider's default UTF-8 decoder removed U+FEFF before Babel parsed the source, so Evidence reported column 6. Locations must refer to the same original source whose digest is recorded. Newlines must reset columns normally; adding a downstream offset would incorrectly move later lines.

This was found by tracing source decoding into glue reference evidence; no existing issue is linked. This is distinct from #2102, which handles WABT binary custom-section names: this change fixes JavaScript file decoding and source coordinates, with no changes to WAT/binary name parsing.

Change and scope

Preserve U+FEFF in the existing fatal UTF-8 decoder at WabtArtifactProvider.inspect. Babel already accepts it as JavaScript whitespace and computes the original positions. For BOM-prefixed hashbangs, associateWasmGlue removes only the BOM before parsing so Babel can recognize the interpreter directive; reference line/column coordinates remain unchanged because executable source follows the hashbang line. No generic offset adjustment is introduced.

Extend the existing real-WABT verifier with plain, BOM-prefixed, BOM-plus-newline, plain hashbang, and BOM-prefixed hashbang source controls. Both local and URL literals are checked against positions derived from original source text; each glue file's path, hash, byte count, unchanged contents and candidate associations are verified.

Contract and boundary impact

  • Semantic owner and earliest changed stage: glue-file UTF-8 decoding in WabtArtifactProvider.inspect, before associateWasmGlue parses source.
  • CLI and MCP/tool-catalog contract: unchanged schemas; corrected source coordinates in both adapters.
  • Provider, bridge, target-format, or platform compatibility: same WABT 1.0.42 profile and fatal UTF-8 validation; no engine/bridge changes.
  • Evidence, artifact, provenance, or reconstruction contract: positions now agree with the hashed original artifact; CLI/MCP Evidence equality is verified.
  • Process execution, authorization, cleanup, or containment impact: none.
  • Generated metadata, package, or installation impact: none.

Evidence and regression coverage

  • Base c22111eca2c4bc84a084f12711f405b3e7422a40, running the extended verifier against its built runtime: failed with first-line columns 6/32 instead of 7/33.

  • Candidate with real WABT: all 42 verifier cases pass, including public CLI and stdio MCP, schema validation, equal Evidence, original artifact identity and cleanup.

  • Representative corrected output: glue[].references[0] has line: 1, column: 7 for the BOM-prefixed source; plain source has line: 1, column: 6, and BOM-plus-newline source has line: 2, column: 6.

  • Review regression: the expanded verifier fails on initial head 9bf8140788 with parse_status: failed for BOM-plus-hashbang source; the follow-up preserves references and exact later-line positions.

  • Remaining proof gaps: executed on macOS with WABT 1.0.42; no claim of Linux/Windows execution or runtime execution of the glue/module.

  • Observed, derived, and inferred claims remain distinguishable.

  • Artifact identity, source provenance, and failed attempts remain preserved.

  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run build:cached — passed.
  • REA_WABT_BIN_DIRECTORY=<local WABT 1.0.42 bin> node scripts/verify-wasm-artifact.mjs --require-tools — 42 cases passed; the extended verifier fails on the unchanged base runtime.
  • npm run test:focused -- src/wasm/WabtArtifactProvider.test.ts src/wasm/WabtOutput.test.ts src/application/wasm/WasmArtifactService.test.ts tests/boundary/mcp/wasmArtifactMcp.test.ts — 33 tests passed.
  • npm run check — all six tasks and architecture guards passed.
  • git diff --check — passed.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; coordinates are corrected to match the original source.
  • Real Hopper/Ghidra, browser, or OS coverage: real WABT CLI/MCP on macOS; no native-engine or browser changes.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no added execution or permissions; original input remains unchanged.

Review checklist

  • This PR addresses a concrete problem or an agreed enhancement.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed (no schema or metadata change).
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

Hosted CI baseline

Initial-head test shard 1 failed in promptCompletion.test.ts ([] versus ['App', 'AppTests']), matching exact base main. Both Darwin package jobs failed with packaged MCP prompt completion lifecycle failed, matching base arm64 and base x64. These remain CI failures, not passes. Follow-up-head CI results are tracked separately.


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2114 **Author:** [@1052326311](https://github.com/1052326311) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/wasm-glue-source-locations` --- ### 📝 Commits (10+) - [`9bf8140`](https://github.com/morluto/rea/commit/9bf81407881d6b94eb33588ae0c26ec375a3bda4) fix(wasm): preserve original glue source locations - [`81f0308`](https://github.com/morluto/rea/commit/81f030855daf0ad45ae505afd4a21ba8d56479c8) fix(wasm): retain BOM-prefixed hashbang glue references - [`8374695`](https://github.com/morluto/rea/commit/8374695502099a8002ea5e027b3fad5c2cc9f745) test(wasm): cover BOM coordinates and executable glue parsing - [`f2e035f`](https://github.com/morluto/rea/commit/f2e035f7e586af2ab100b3134832abbc66a963aa) test(wasm): parse the artifact contract before reading glue evidence - [`9454bb4`](https://github.com/morluto/rea/commit/9454bb424b2e4d869f3ae44c7b828642119efea0) test(wasm): give glue fixtures and assertions a single owner - [`e7f47e5`](https://github.com/morluto/rea/commit/e7f47e5ac08f52a67c3676d2cc74ada1fb4bc651) fix(wasm): sync source location fix with captured main checks - [`58b6d5b`](https://github.com/morluto/rea/commit/58b6d5bbcddcd03ca6c370baca01ae3c0f109af3) fix(comparison): recheck historical calls-only changes (#2223) - [`ab88e2f`](https://github.com/morluto/rea/commit/ab88e2f4d616d06badbe0fe02fa2edd65e529fc7) fix(ci): isolate Linux Hopper process fixture inventory - [`e3a31a6`](https://github.com/morluto/rea/commit/e3a31a6e449d23674cadb172ae15f7092b0da9e6) fix(android): make DEX descriptor pattern portable - [`945c22c`](https://github.com/morluto/rea/commit/945c22c42172d5c103bdd00e1038c50cc3a5d929) fix: repair the static-check failures on the default branch (#2895) ### 📊 Changes **4 files changed** (+105 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `scripts/verify-wasm-artifact.mjs` (+39 -10) 📝 `src/wasm/WabtArtifactProvider.test.ts` (+56 -1) 📝 `src/wasm/WabtArtifactProvider.ts` (+5 -3) 📝 `src/wasm/WasmGlueAdapter.ts` (+5 -1) </details> ### 📄 Description ## Summary Preserve original JavaScript source locations when inspecting BOM-prefixed WASM glue files. `inspect-wasm-artifact` / `inspect_wasm_artifact` previously reported first-line literal columns one character too early, even though their artifact hash and byte count described the original file. ## Problem and expected behavior For `\uFEFFfetch("./module.wasm");`, the string literal starts at zero-based column 7. The provider's default UTF-8 decoder removed U+FEFF before Babel parsed the source, so Evidence reported column 6. Locations must refer to the same original source whose digest is recorded. Newlines must reset columns normally; adding a downstream offset would incorrectly move later lines. This was found by tracing source decoding into glue reference evidence; no existing issue is linked. This is distinct from #2102, which handles WABT binary custom-section names: this change fixes JavaScript file decoding and source coordinates, with no changes to WAT/binary name parsing. ## Change and scope Preserve U+FEFF in the existing fatal UTF-8 decoder at `WabtArtifactProvider.inspect`. Babel already accepts it as JavaScript whitespace and computes the original positions. For BOM-prefixed hashbangs, `associateWasmGlue` removes only the BOM before parsing so Babel can recognize the interpreter directive; reference line/column coordinates remain unchanged because executable source follows the hashbang line. No generic offset adjustment is introduced. Extend the existing real-WABT verifier with plain, BOM-prefixed, BOM-plus-newline, plain hashbang, and BOM-prefixed hashbang source controls. Both local and URL literals are checked against positions derived from original source text; each glue file's path, hash, byte count, unchanged contents and candidate associations are verified. ## Contract and boundary impact - Semantic owner and earliest changed stage: glue-file UTF-8 decoding in `WabtArtifactProvider.inspect`, before `associateWasmGlue` parses source. - CLI and MCP/tool-catalog contract: unchanged schemas; corrected source coordinates in both adapters. - Provider, bridge, target-format, or platform compatibility: same WABT 1.0.42 profile and fatal UTF-8 validation; no engine/bridge changes. - Evidence, artifact, provenance, or reconstruction contract: positions now agree with the hashed original artifact; CLI/MCP Evidence equality is verified. - Process execution, authorization, cleanup, or containment impact: none. - Generated metadata, package, or installation impact: none. ## Evidence and regression coverage - Base `c22111eca2c4bc84a084f12711f405b3e7422a40`, running the extended verifier against its built runtime: failed with first-line columns 6/32 instead of 7/33. - Candidate with real WABT: all 42 verifier cases pass, including public CLI and stdio MCP, schema validation, equal Evidence, original artifact identity and cleanup. - Representative corrected output: `glue[].references[0]` has `line: 1, column: 7` for the BOM-prefixed source; plain source has `line: 1, column: 6`, and BOM-plus-newline source has `line: 2, column: 6`. - Review regression: the expanded verifier fails on initial head `9bf8140788` with `parse_status: failed` for BOM-plus-hashbang source; the follow-up preserves references and exact later-line positions. - Remaining proof gaps: executed on macOS with WABT 1.0.42; no claim of Linux/Windows execution or runtime execution of the glue/module. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run build:cached` — passed. - `REA_WABT_BIN_DIRECTORY=<local WABT 1.0.42 bin> node scripts/verify-wasm-artifact.mjs --require-tools` — 42 cases passed; the extended verifier fails on the unchanged base runtime. - `npm run test:focused -- src/wasm/WabtArtifactProvider.test.ts src/wasm/WabtOutput.test.ts src/application/wasm/WasmArtifactService.test.ts tests/boundary/mcp/wasmArtifactMcp.test.ts` — 33 tests passed. - `npm run check` — all six tasks and architecture guards passed. - `git diff --check` — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none; coordinates are corrected to match the original source. - Real Hopper/Ghidra, browser, or OS coverage: real WABT CLI/MCP on macOS; no native-engine or browser changes. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no added execution or permissions; original input remains unchanged. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed (no schema or metadata change). - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. ## Hosted CI baseline Initial-head test shard 1 failed in `promptCompletion.test.ts` (`[]` versus `['App', 'AppTests']`), matching [exact base main](https://github.com/morluto/rea/actions/runs/38224038323/job/114727940506). Both Darwin package jobs failed with `packaged MCP prompt completion lifecycle failed`, matching [base arm64](https://github.com/morluto/rea/actions/runs/38224038323/job/114728030045) and [base x64](https://github.com/morluto/rea/actions/runs/38224038323/job/114728029923). These remain CI failures, not passes. Follow-up-head CI results are tracked separately. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 00:59:53 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#5039
No description provided.