[PR #2878] fix(browser): preserve explicit URL references and endpoint evidence #5461

New issue

Open

opened 2026-10-31 01:06:50 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:06:50 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2878
Author: @FengCi0
Created: 10/13/2026
Status: 🔄 Open

Base: main ← Head: fix/web-endpoint-candidates

📝 Commits (10+)

6cbc702 fix(browser): preserve ambiguous endpoint arguments as inferences
8fa58bf fix(browser): deduplicate repeated endpoint candidate sites
cf850da fix(browser): recognize query-only endpoint references
6b50a5e fix(browser): preserve fragment-only endpoint references
c011ff5 fix(browser): retain scheme-form references and inventory limits
6d5ac5c test(windows): verify retained probe identity after rename
e5ef88b chore: merge main and retain upstream ownership verification
df73b58 fix(browser): recognize reverse-solidus URL references
0e73b32 fix(browser): classify parsed URL protocols and merge main
fa4a112 chore: merge main into endpoint candidates fix

📊 Changes

21 files changed (+970 additions, -85 deletions)

View changed files

📝 docs/browser-observation.md (+8 -1)
📝 docs/javascript-artifact-reconstruction.md (+45 -0)
📝 src/browser/CdpCaptureDocuments.baseUrl.test.ts (+38 -2)
📝 src/browser/CdpCaptureDocuments.test.ts (+28 -0)
📝 src/browser/history/CaptureRedaction.test.ts (+31 -3)
📝 src/domain/browserObservation.test.ts (+102 -0)
📝 src/domain/browserObservation.ts (+12 -4)
📝 src/domain/javascript/javascriptSemanticAmbientWrites.test.ts (+59 -0)
📝 src/domain/javascript/javascriptSemanticAmbientWrites.ts (+13 -24)
📝 src/domain/javascript/javascriptSemanticAnalysis.native_bindings.test.ts (+36 -0)
📝 src/domain/javascript/javascriptSemanticMutationInitializers.test.ts (+81 -1)
📝 src/domain/javascript/javascriptSemanticMutationInitializers.ts (+45 -9)
📝 src/domain/javascript/javascriptStaticAnalysisHelpers.ts (+16 -7)
📝 src/domain/recordedTransportUrl.ts (+34 -5)
📝 src/domain/webBundleAnalyzer.test.ts (+132 -8)
📝 src/ida/IdaNativeProtocol.test.ts (+28 -15)
📝 tests/boundary/cli/developmentTests.test.ts (+21 -5)
📝 tests/boundary/filesystem/javascript-applications/javascriptArtifactReconstruction.test.ts (+98 -1)
📝 tests/boundary/mcp/browserMcp.test.ts (+134 -0)
📝 tests/boundary/mcp/enhancedTools.callPathsAndBatches.test.ts (+7 -0)

...and 1 more files

📄 Description

Summary

I preserve explicit URL references while keeping ambiguous method arguments as low-confidence candidates across captured bundles and artifact analysis. Refs #2806.

The shared producer recognizes parser-accepted HTTP/WS protocols and explicit relative markers: either slash kind, query/fragment references, and complete literal or encoded dot segments. It retains the original spelling.
Existing collection, configuration and extension-state exclusions keep their attribution rules.
Relative network userinfo redaction uses the shared transport parser's span/fallback facts without inventing a scheme or origin.
Ambient alias writes use each read's initializer snapshot. Deferred public/private/accessor field values retain all possible assignments; static fields and computed keys keep their eager snapshots. The same activation rule serves all consumers.
Regression coverage preserves candidate certainty through worker transfer and graph projection, original values and source evidence, explicit deduplication limits, and malformed-input uncertainty.

Upstream integration

I merged main@767fe0f. The resolution adopts upstream's shared DOMSnapshot string decoder, primitive-escape producer rule, exactOptional worker schema and consolidated regression fixtures. Superseded local decoder and scalar-escape repairs were removed after checking their consumers.

The retained tests cover Chrome's empty-value -1 encoding, strict document/name indexes, HTML/XML namespace behavior, source-map associations, provider ownership and error provenance. The class-field review regression remains covered at the shared initializer-selection boundary.

Validation

Pinned Node 24.18.0 / npm 11.16.0 on macOS arm64:

Full source suite: 504 files, 7,390 tests passed, 13 expected skips.
Affected compiled/boundary suites: 203 tests passed, 3 expected skips across 18 files, including actual HTML/XHTML/SVG Chrome cases.
Complete real-browser verifier with Chrome 153.0.8010.12: passed. It recovered all four current-document form destinations and verified screenshots, popups, network evidence, script export, module tracing, cancellation and owned-resource cleanup.
npm run check, npm run docs:check, duplicate/TODO checks and test discovery passed; all 1,243 test files are discovered once.
Independent source review checked the conflict resolutions and producing boundaries.
Current-head GitHub CI: passed for f423780, including all five test shards, source/static checks, real Chrome, JavaScript recovery, Windows capability/package checks, native package baselines and the required CI gate.

The broad local gate and a clean c7105d9 checkout both reproduce three native DMG classification failures on this host: hdiutil returns localized diagnostics outside the current English classifier. Those tests, caller locale and unknown classification remain unchanged; I am not reporting a green complete local check:pr.

No new execution/mutation capability or performance improvement is claimed. Real Chrome verification used owned localhost fixtures; no real Ghidra or IDA installation was exercised.

Expected effects

Read existing files or captured data.

The existing browser workflow contacts the caller-selected CDP endpoint. This correction adds no provider or target execution authority.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2878 **Author:** [@FengCi0](https://github.com/FengCi0) **Created:** 10/13/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/web-endpoint-candidates` --- ### 📝 Commits (10+) - [`6cbc702`](https://github.com/morluto/rea/commit/6cbc7021220baf7661b9b4141de31ad9954898d7) fix(browser): preserve ambiguous endpoint arguments as inferences - [`8fa58bf`](https://github.com/morluto/rea/commit/8fa58bfff4d20b2e1c2cff17d708716d4f6bfd1a) fix(browser): deduplicate repeated endpoint candidate sites - [`cf850da`](https://github.com/morluto/rea/commit/cf850da3fb4a6a67c3484e8bbef17c299d771f26) fix(browser): recognize query-only endpoint references - [`6b50a5e`](https://github.com/morluto/rea/commit/6b50a5ef4e14a4bd7a0b9ff2a34b72e15df6c979) fix(browser): preserve fragment-only endpoint references - [`c011ff5`](https://github.com/morluto/rea/commit/c011ff543ec084993fb8ab810b9b8ed15127f4d1) fix(browser): retain scheme-form references and inventory limits - [`6d5ac5c`](https://github.com/morluto/rea/commit/6d5ac5c4e3d14a62b0b446a10b256f3071cb5541) test(windows): verify retained probe identity after rename - [`e5ef88b`](https://github.com/morluto/rea/commit/e5ef88b34ed6e8244eacd724daf97eb52a618301) chore: merge main and retain upstream ownership verification - [`df73b58`](https://github.com/morluto/rea/commit/df73b589f509d85b1de25b94a1c7ced86857c581) fix(browser): recognize reverse-solidus URL references - [`0e73b32`](https://github.com/morluto/rea/commit/0e73b320296ecd7bbda359d846ffec9c187a1123) fix(browser): classify parsed URL protocols and merge main - [`fa4a112`](https://github.com/morluto/rea/commit/fa4a1128a7822fb33c235bf9277608b5c21ff727) chore: merge main into endpoint candidates fix ### 📊 Changes **21 files changed** (+970 additions, -85 deletions) <details> <summary>View changed files</summary> 📝 `docs/browser-observation.md` (+8 -1) 📝 `docs/javascript-artifact-reconstruction.md` (+45 -0) 📝 `src/browser/CdpCaptureDocuments.baseUrl.test.ts` (+38 -2) 📝 `src/browser/CdpCaptureDocuments.test.ts` (+28 -0) 📝 `src/browser/history/CaptureRedaction.test.ts` (+31 -3) 📝 `src/domain/browserObservation.test.ts` (+102 -0) 📝 `src/domain/browserObservation.ts` (+12 -4) 📝 `src/domain/javascript/javascriptSemanticAmbientWrites.test.ts` (+59 -0) 📝 `src/domain/javascript/javascriptSemanticAmbientWrites.ts` (+13 -24) 📝 `src/domain/javascript/javascriptSemanticAnalysis.native_bindings.test.ts` (+36 -0) 📝 `src/domain/javascript/javascriptSemanticMutationInitializers.test.ts` (+81 -1) 📝 `src/domain/javascript/javascriptSemanticMutationInitializers.ts` (+45 -9) 📝 `src/domain/javascript/javascriptStaticAnalysisHelpers.ts` (+16 -7) 📝 `src/domain/recordedTransportUrl.ts` (+34 -5) 📝 `src/domain/webBundleAnalyzer.test.ts` (+132 -8) 📝 `src/ida/IdaNativeProtocol.test.ts` (+28 -15) 📝 `tests/boundary/cli/developmentTests.test.ts` (+21 -5) 📝 `tests/boundary/filesystem/javascript-applications/javascriptArtifactReconstruction.test.ts` (+98 -1) 📝 `tests/boundary/mcp/browserMcp.test.ts` (+134 -0) 📝 `tests/boundary/mcp/enhancedTools.callPathsAndBatches.test.ts` (+7 -0) _...and 1 more files_ </details> ### 📄 Description ## Summary I preserve explicit URL references while keeping ambiguous method arguments as low-confidence candidates across captured bundles and artifact analysis. Refs #2806. - The shared producer recognizes parser-accepted HTTP/WS protocols and explicit relative markers: either slash kind, query/fragment references, and complete literal or encoded dot segments. It retains the original spelling. - Existing collection, configuration and extension-state exclusions keep their attribution rules. - Relative network userinfo redaction uses the shared transport parser's span/fallback facts without inventing a scheme or origin. - Ambient alias writes use each read's initializer snapshot. Deferred public/private/accessor field values retain all possible assignments; static fields and computed keys keep their eager snapshots. The same activation rule serves all consumers. - Regression coverage preserves candidate certainty through worker transfer and graph projection, original values and source evidence, explicit deduplication limits, and malformed-input uncertainty. ## Upstream integration I merged `main@767fe0f`. The resolution adopts upstream's shared DOMSnapshot string decoder, primitive-escape producer rule, `exactOptional` worker schema and consolidated regression fixtures. Superseded local decoder and scalar-escape repairs were removed after checking their consumers. The retained tests cover Chrome's empty-value `-1` encoding, strict document/name indexes, HTML/XML namespace behavior, source-map associations, provider ownership and error provenance. The class-field review regression remains covered at the shared initializer-selection boundary. ## Validation Pinned Node 24.18.0 / npm 11.16.0 on macOS arm64: - Full source suite: **504 files, 7,390 tests passed, 13 expected skips**. - Affected compiled/boundary suites: **203 tests passed, 3 expected skips across 18 files**, including actual HTML/XHTML/SVG Chrome cases. - Complete real-browser verifier with Chrome **153.0.8010.12**: passed. It recovered all four current-document form destinations and verified screenshots, popups, network evidence, script export, module tracing, cancellation and owned-resource cleanup. - `npm run check`, `npm run docs:check`, duplicate/TODO checks and test discovery passed; all **1,243 test files** are discovered once. - Independent source review checked the conflict resolutions and producing boundaries. - Current-head [GitHub CI](https://github.com/morluto/rea/actions/runs/38513335998): **passed for `f423780`**, including all five test shards, source/static checks, real Chrome, JavaScript recovery, Windows capability/package checks, native package baselines and the required CI gate. The broad local gate and a clean `c7105d9` checkout both reproduce three native DMG classification failures on this host: hdiutil returns localized diagnostics outside the current English classifier. Those tests, caller locale and unknown classification remain unchanged; I am not reporting a green complete local `check:pr`. No new execution/mutation capability or performance improvement is claimed. Real Chrome verification used owned localhost fixtures; no real Ghidra or IDA installation was exercised. ## Expected effects - [x] Read existing files or captured data. The existing browser workflow contacts the caller-selected CDP endpoint. This correction adds no provider or target execution authority. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 01:06:50 +00:00

bsakaguchi referenced this issue

2026-11-01 21:44:09 +00:00

[PR #5461] feat(providers): add Leandec deep provider backed by its MCP cache #6931