morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3147] [CLOSED] fix(javascript): decode literal file URL paths #5643

New issue

Closed

opened 2026-10-31 01:08:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:08:13 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3147
Author: @jpdefo
Created: 10/14/2026
Status: ❌ Closed

Base: main ← Head: fix/literal-file-url-path

📝 Commits (1)

3ab6d34 fix(javascript): decode literal file URL paths

📊 Changes

2 files changed (+103 additions, -7 deletions)

View changed files

➕ src/domain/javascript/fileUrlConversion.test.ts (+88 -0)
📝 src/domain/javascript/javascriptStaticAnalysisHelpers.ts (+15 -7)

📄 Description

Summary

Fixes #2561. Static analysis now decodes a literal local file URL passed to fileURLToPath before projecting Electron preload, utility-process, and role paths. For example, fileURLToPath("file:///app/preload%20file.js") now yields /app/preload file.js with filesystem-expression context instead of the unchanged URL with module-specifier context.

Change and scope

The existing static path owner performs the URL conversion once using explicit POSIX semantics, independent of the analyzer host. Filesystem-expression classification follows the conversion syntax. Existing source-relative URL handling is retained. Invalid and remote URLs, decoded drive paths, and explicit platform options remain unresolved rather than inventing a target-specific path. The drive guard operates on the decoded path, including percent-encoded drive letters and colons.

This is a routine correction within the existing inert-source analysis boundary. A separate maintainer capability decision is not applicable. No target code is executed and no file is opened by the conversion.

Related parallel contribution: #3146 was published while this independent implementation was being validated. Both address #2561. This PR is limited to the file-URL path boundary and includes conservative handling of literal and encoded drive paths and explicit platform options, plus the input and consumer matrix described below. #3146 also addresses the separate conditional-initialization issue #2562.

Contract and boundary impact

Semantic owner: javascriptStaticAnalysisHelpers.ts, before static Electron findings are projected.
CLI/MCP contract: existing result fields now carry the correct recovered path and context. No request, schema, or tool-catalog change.
Consumers: Electron preload and utility-process records and their role-path findings.
Authority, provenance, and cleanup: existing source locations and unknown outcomes are retained. The change adds no target interaction or resource owner.
Package, generated metadata, and installation: no changes.

Evidence and regression coverage

The original main 58300885207133422af235e0f2b10658cf958b03 reproduced the incorrect literal URL and context. Its source-relative and dynamic controls passed. Tests call the production static analyzer on inert source strings, without launching Electron.

Regressions cover decoded whitespace and Unicode, query/fragment handling, preload and utility-process consumers, source-relative controls, malformed escapes, encoded separators, remote hosts, explicit options, and literal/encoded drive paths. Both encoded-drive regressions failed before the final correction and now remain unresolved as required.

Validation performed

Native Windows, Node 24.18.0 and npm 11.16.0:

Final fileUrlConversion.test.ts and javascriptStaticPathResolution.test.ts: 69 tests passed.
npm run check: passed types, lint, formatting, knip, metadata, module boundaries, and architecture guards.
npm run build:cached: passed.
npm run verify:test-discovery: all 1,243 test files discovered exactly once.
git diff --cached --check: passed.
Four Luna reviewers and one Sol reviewer in medium: final frozen diff clean after the encoded-drive correction.

A broader related selection during implementation returned 135 passed and one failure in the wrapped contextBridge dynamic-world assertion. That same failure was independently reproduced with the original helper restored. It is in untouched code and is related to existing PR #3080. The final focused selection above includes the two added encoded-drive controls.

Compatibility, safety, and release

This change corrects derived source facts and does not claim runtime Electron execution. Compiled public CLI/MCP execution was not verified because this source checkout lacks the Windows native-control artifact. No full-suite or real-provider qualification is claimed. Platform-dependent paths and caller platform options remain explicit unknowns. No release metadata change.

Before merge

Concrete reproduced issue and focused scope.
Existing capability and authority boundaries preserved.
Regression coverage at the producing boundary and direct consumers.
No schema or generated-document contract change.
Validation limitations and the unrelated baseline failure disclosed.
Final diff reviewed for secrets, unrelated changes, and unsupported claims.
Required hosted checks passed on the published revision.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3147 **Author:** [@jpdefo](https://github.com/jpdefo) **Created:** 10/14/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/literal-file-url-path` --- ### 📝 Commits (1) - [`3ab6d34`](https://github.com/morluto/rea/commit/3ab6d3416efd1fcc7c2dbed96ef0275b868e1241) fix(javascript): decode literal file URL paths ### 📊 Changes **2 files changed** (+103 additions, -7 deletions) <details> <summary>View changed files</summary> ➕ `src/domain/javascript/fileUrlConversion.test.ts` (+88 -0) 📝 `src/domain/javascript/javascriptStaticAnalysisHelpers.ts` (+15 -7) </details> ### 📄 Description ## Summary Fixes #2561. Static analysis now decodes a literal local file URL passed to `fileURLToPath` before projecting Electron preload, utility-process, and role paths. For example, `fileURLToPath("file:///app/preload%20file.js")` now yields `/app/preload file.js` with `filesystem-expression` context instead of the unchanged URL with `module-specifier` context. ## Change and scope The existing static path owner performs the URL conversion once using explicit POSIX semantics, independent of the analyzer host. Filesystem-expression classification follows the conversion syntax. Existing source-relative URL handling is retained. Invalid and remote URLs, decoded drive paths, and explicit platform options remain unresolved rather than inventing a target-specific path. The drive guard operates on the decoded path, including percent-encoded drive letters and colons. This is a routine correction within the existing inert-source analysis boundary. A separate maintainer capability decision is not applicable. No target code is executed and no file is opened by the conversion. Related parallel contribution: #3146 was published while this independent implementation was being validated. Both address #2561. This PR is limited to the file-URL path boundary and includes conservative handling of literal and encoded drive paths and explicit platform options, plus the input and consumer matrix described below. #3146 also addresses the separate conditional-initialization issue #2562. ## Contract and boundary impact - Semantic owner: `javascriptStaticAnalysisHelpers.ts`, before static Electron findings are projected. - CLI/MCP contract: existing result fields now carry the correct recovered path and context. No request, schema, or tool-catalog change. - Consumers: Electron preload and utility-process records and their role-path findings. - Authority, provenance, and cleanup: existing source locations and unknown outcomes are retained. The change adds no target interaction or resource owner. - Package, generated metadata, and installation: no changes. ## Evidence and regression coverage The original main `58300885207133422af235e0f2b10658cf958b03` reproduced the incorrect literal URL and context. Its source-relative and dynamic controls passed. Tests call the production static analyzer on inert source strings, without launching Electron. Regressions cover decoded whitespace and Unicode, query/fragment handling, preload and utility-process consumers, source-relative controls, malformed escapes, encoded separators, remote hosts, explicit options, and literal/encoded drive paths. Both encoded-drive regressions failed before the final correction and now remain unresolved as required. ## Validation performed Native Windows, Node 24.18.0 and npm 11.16.0: - Final `fileUrlConversion.test.ts` and `javascriptStaticPathResolution.test.ts`: 69 tests passed. - `npm run check`: passed types, lint, formatting, knip, metadata, module boundaries, and architecture guards. - `npm run build:cached`: passed. - `npm run verify:test-discovery`: all 1,243 test files discovered exactly once. - `git diff --cached --check`: passed. - Four Luna reviewers and one Sol reviewer in medium: final frozen diff clean after the encoded-drive correction. A broader related selection during implementation returned 135 passed and one failure in the wrapped `contextBridge` dynamic-world assertion. That same failure was independently reproduced with the original helper restored. It is in untouched code and is related to existing PR #3080. The final focused selection above includes the two added encoded-drive controls. ## Compatibility, safety, and release This change corrects derived source facts and does not claim runtime Electron execution. Compiled public CLI/MCP execution was not verified because this source checkout lacks the Windows native-control artifact. No full-suite or real-provider qualification is claimed. Platform-dependent paths and caller platform options remain explicit unknowns. No release metadata change. ## Before merge - [x] Concrete reproduced issue and focused scope. - [x] Existing capability and authority boundaries preserved. - [x] Regression coverage at the producing boundary and direct consumers. - [x] No schema or generated-document contract change. - [x] Validation limitations and the unrelated baseline failure disclosed. - [x] Final diff reviewed for secrets, unrelated changes, and unsupported claims. - [x] Required hosted checks passed on the published revision. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:08:13 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:44:39 +00:00

[PR #5643] [CLOSED] fix(analysis): preserve cancellation with partial observations #7008

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5643

No description provided.

Rows
Columns