[PR #3080] [MERGED] fix: restore JavaScript analysis and current regression checks #5599

New issue

Closed

opened 2026-10-31 01:07:52 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:07:52 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3080
Author: @kaoru0822-kitauji
Created: 10/14/2026
Status: ✅ Merged
Merged: 10/14/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/main-red-ida-javascript-tests

📝 Commits (10+)

4450463 fix(javascript): restore read-site ambient aliases and string config reads
c023db3 Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests
828ccc3 test: cover config value escapes and source-map edge pairing
c0e4aa9 Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests
aff46f5 test(docs): retarget translated readme link drift at current links
0fdac09 fix(javascript): admit candidate endpoint interpretation in worker output
59c71be Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests
7346397 fix(ghidra): keep earlier LaunchSupport warnings when a later helper fails
1b75c0d fix(browser): read DOMSnapshot's -1 string index as an empty value
6681db8 Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests

📊 Changes

25 files changed (+394 additions, -144 deletions)

View changed files

📝 src/browser/CdpCaptureDocuments.test.ts (+60 -2)
📝 src/browser/CdpCaptureDocuments.ts (+13 -22)
📝 src/browser/CdpCaptureDomSvg.ts (+15 -25)
➕ src/browser/CdpSnapshotStrings.ts (+39 -0)
📝 src/domain/javascript/electronWrappedCallPaths.test.ts (+10 -2)
📝 src/domain/javascript/javascriptSemanticAmbientWrites.ts (+17 -10)
📝 src/domain/javascript/javascriptSemanticAnalysis.native_bindings.test.ts (+40 -0)
📝 src/domain/javascript/javascriptSemanticMemberMutations.ts (+10 -0)
📝 src/ghidra/GhidraSessionError.ts (+3 -1)
📝 src/ida/IdaNativeProtocol.test.ts (+11 -11)
📝 src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.ts (+1 -0)
📝 tests/acceptance/applications/applicationWorkflowCli.test.ts (+12 -2)
📝 tests/acceptance/applications/blockSourceMapCli.test.ts (+6 -1)
📝 tests/acceptance/applications/javascriptEndpointPayload.test.ts (+3 -1)
📝 tests/boundary/browser/sazWebCapture.test.ts (+15 -5)
📝 tests/boundary/cli/developmentTests.test.ts (+15 -5)
📝 tests/boundary/filesystem/directoryArtifactReaderOwnership.test.ts (+7 -2)
📝 tests/boundary/filesystem/javascript-applications/javascriptApplicationEmptyLiterals.test.ts (+9 -5)
📝 tests/boundary/filesystem/javascriptSourceMapLocations.test.ts (+25 -9)
📝 tests/boundary/filesystem/productCatalog.test.ts (+6 -5)

...and 5 more files

📄 Description

REA could lose valid configuration reads, incorrectly preserve an intrinsic worker URL after an ambient alias write, and reject valid analysis data at producer/consumer boundaries. This change restores those facts and brings the regression checks into agreement with the current contracts.

The production fixes keep alias initializer reads at their own source position, distinguish passing primitive env/argv values from replacing or exposing their containers, admit existing candidate endpoint metadata through the worker schema, decode Chrome DOMSnapshot empty-value indexes through one shared owner, and retain earlier Ghidra LaunchSupport diagnostics when a later helper fails. Regression assertions continue to check artifact identity, source-map provenance, malformed input, cancellation, and cleanup; they use declared facts rather than filesystem order, inherited terminal color, or outdated schema assumptions. The remaining MCP caveat regression checks the exact deduplicated envelope and graph-result lists separately, including actual complete graph edges; it preserves the output contract introduced on main.

Validation:

The original five source failures were independently reproduced on main f3534749e.
Sixteen affected source/CLI/MCP/provider files: 307 passed, one explicit platform skip. Four subsequent fixture/test files: 22 passed, including a CI-colored environment.
npm run check and npm run docs:check: passed. The final caveat follow-up passes another 22 workflow/MCP tests and npm run check:fast.
Real Chromium retains the previously missing form destinations. Production service-worker CLI/cancellation/restoration verification passes when isolated on both main and this branch, with owned-browser cleanup confirmed. The full local browser verifier reached a later service-worker error-page marker timeout whose cause remains unclassified; that original failure is retained. The current-head GitHub real-browser and JavaScript-recovery lanes pass.
Four public CLI analyses of npm http-server@14.1.1, with its archive integrity independently checked, retain the same artifact identity and workload statistics. Selected summary/provenance output is 581 o200k tokens each. Main cold/warm: 6.24/5.89 seconds, 7.41/7.00 CPU seconds, 448/445 MiB sampled process-family RSS. Fixed cold/warm: 6.03/5.66 seconds, 7.32/7.00 CPU seconds, 449/450 MiB. These individual runs use isolated Node compile caches; no speedup or whole-agent token improvement is claimed.

Verification used Linux, Node 24.18.0/npm 11.16.0, two CPUs, and an 8-GiB process-family RSS stop threshold. Source selection and output filtering use existing caller controls; no new default result expansion or live-state cache is introduced. Native IDA/Ghidra engine execution and complete local suite completion are not claimed. Required current-head CI remains the merge gate.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3080 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/14/2026 **Status:** ✅ Merged **Merged:** 10/14/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/main-red-ida-javascript-tests` --- ### 📝 Commits (10+) - [`4450463`](https://github.com/morluto/rea/commit/44504630193253978d1de919bcbb0645652c7b32) fix(javascript): restore read-site ambient aliases and string config reads - [`c023db3`](https://github.com/morluto/rea/commit/c023db356f14fe8cc5ebee7aa2cc2d497677d8c8) Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests - [`828ccc3`](https://github.com/morluto/rea/commit/828ccc36b65c0ea373cddc227998b5b9bcef7b28) test: cover config value escapes and source-map edge pairing - [`c0e4aa9`](https://github.com/morluto/rea/commit/c0e4aa91bb72411adfc4d5c5cf8d4d7ad892998f) Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests - [`aff46f5`](https://github.com/morluto/rea/commit/aff46f51fdb38f3c1c481af59099c1c4de837161) test(docs): retarget translated readme link drift at current links - [`0fdac09`](https://github.com/morluto/rea/commit/0fdac09259eabafc7f852723c20d034e324590c2) fix(javascript): admit candidate endpoint interpretation in worker output - [`59c71be`](https://github.com/morluto/rea/commit/59c71be89e9e524e67931d3750ebd3367d715598) Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests - [`7346397`](https://github.com/morluto/rea/commit/7346397106544c5aa262b0daabfd8ef84079f95e) fix(ghidra): keep earlier LaunchSupport warnings when a later helper fails - [`1b75c0d`](https://github.com/morluto/rea/commit/1b75c0d2f9fcaa89171aa1afdfc95b9b7ecb8dbc) fix(browser): read DOMSnapshot's -1 string index as an empty value - [`6681db8`](https://github.com/morluto/rea/commit/6681db8e2e76ae2988904f4a7dfc5924a582e05b) Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests ### 📊 Changes **25 files changed** (+394 additions, -144 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/CdpCaptureDocuments.test.ts` (+60 -2) 📝 `src/browser/CdpCaptureDocuments.ts` (+13 -22) 📝 `src/browser/CdpCaptureDomSvg.ts` (+15 -25) ➕ `src/browser/CdpSnapshotStrings.ts` (+39 -0) 📝 `src/domain/javascript/electronWrappedCallPaths.test.ts` (+10 -2) 📝 `src/domain/javascript/javascriptSemanticAmbientWrites.ts` (+17 -10) 📝 `src/domain/javascript/javascriptSemanticAnalysis.native_bindings.test.ts` (+40 -0) 📝 `src/domain/javascript/javascriptSemanticMemberMutations.ts` (+10 -0) 📝 `src/ghidra/GhidraSessionError.ts` (+3 -1) 📝 `src/ida/IdaNativeProtocol.test.ts` (+11 -11) 📝 `src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.ts` (+1 -0) 📝 `tests/acceptance/applications/applicationWorkflowCli.test.ts` (+12 -2) 📝 `tests/acceptance/applications/blockSourceMapCli.test.ts` (+6 -1) 📝 `tests/acceptance/applications/javascriptEndpointPayload.test.ts` (+3 -1) 📝 `tests/boundary/browser/sazWebCapture.test.ts` (+15 -5) 📝 `tests/boundary/cli/developmentTests.test.ts` (+15 -5) 📝 `tests/boundary/filesystem/directoryArtifactReaderOwnership.test.ts` (+7 -2) 📝 `tests/boundary/filesystem/javascript-applications/javascriptApplicationEmptyLiterals.test.ts` (+9 -5) 📝 `tests/boundary/filesystem/javascriptSourceMapLocations.test.ts` (+25 -9) 📝 `tests/boundary/filesystem/productCatalog.test.ts` (+6 -5) _...and 5 more files_ </details> ### 📄 Description REA could lose valid configuration reads, incorrectly preserve an intrinsic worker URL after an ambient alias write, and reject valid analysis data at producer/consumer boundaries. This change restores those facts and brings the regression checks into agreement with the current contracts. The production fixes keep alias initializer reads at their own source position, distinguish passing primitive env/argv values from replacing or exposing their containers, admit existing candidate endpoint metadata through the worker schema, decode Chrome DOMSnapshot empty-value indexes through one shared owner, and retain earlier Ghidra LaunchSupport diagnostics when a later helper fails. Regression assertions continue to check artifact identity, source-map provenance, malformed input, cancellation, and cleanup; they use declared facts rather than filesystem order, inherited terminal color, or outdated schema assumptions. The remaining MCP caveat regression checks the exact deduplicated envelope and graph-result lists separately, including actual complete graph edges; it preserves the output contract introduced on main. Validation: - The original five source failures were independently reproduced on main `f3534749e`. - Sixteen affected source/CLI/MCP/provider files: 307 passed, one explicit platform skip. Four subsequent fixture/test files: 22 passed, including a CI-colored environment. - `npm run check` and `npm run docs:check`: passed. The final caveat follow-up passes another 22 workflow/MCP tests and `npm run check:fast`. - Real Chromium retains the previously missing form destinations. Production service-worker CLI/cancellation/restoration verification passes when isolated on both main and this branch, with owned-browser cleanup confirmed. The full local browser verifier reached a later service-worker error-page marker timeout whose cause remains unclassified; that original failure is retained. The current-head GitHub real-browser and JavaScript-recovery lanes pass. - Four public CLI analyses of npm `http-server@14.1.1`, with its archive integrity independently checked, retain the same artifact identity and workload statistics. Selected summary/provenance output is 581 o200k tokens each. Main cold/warm: 6.24/5.89 seconds, 7.41/7.00 CPU seconds, 448/445 MiB sampled process-family RSS. Fixed cold/warm: 6.03/5.66 seconds, 7.32/7.00 CPU seconds, 449/450 MiB. These individual runs use isolated Node compile caches; no speedup or whole-agent token improvement is claimed. Verification used Linux, Node 24.18.0/npm 11.16.0, two CPUs, and an 8-GiB process-family RSS stop threshold. Source selection and output filtering use existing caller controls; no new default result expansion or live-state cache is introduced. Native IDA/Ghidra engine execution and complete local suite completion are not claimed. Required current-head CI remains the merge gate. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:07:52 +00:00