morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3244] [CLOSED] fix(javascript): honor final RPC object properties #5670

New issue

Closed

opened 2026-10-31 01:08:27 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:08:27 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3244
Author: @Vaishnavi220506
Created: 10/14/2026
Status: ❌ Closed

Base: main ← Head: Vaishnavi220506/fix-rpc-property-ownership

📝 Commits (1)

1c57b56 fix(javascript): honor final RPC object properties

📊 Changes

4 files changed (+122 additions, -18 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+6 -0)
📝 src/domain/javascript/javascriptRpcEndpoints.test.ts (+44 -0)
📝 src/domain/javascript/javascriptRpcEndpoints.ts (+15 -18)
➕ tests/acceptance/applications/javascriptRpcPropertyOwnershipCli.test.ts (+57 -0)

📄 Description

Summary

Recover RPC endpoint fields from the final known object property, rather than the first literal found. This prevents analyze_javascript_application and the shared web bundle analyzer from reporting an obsolete tRPC URL or an overwritten GraphQL operation name/type.

Problem and expected behavior

For httpBatchLink({ url: "/trpc/old", url: "/trpc/live" }), JavaScript supplies /trpc/live, but REA reports /trpc/old. A later url: runtimeUrl, spread, computed key, getter, or method also leaves the earlier literal incorrectly reported. Precompiled OperationDefinition objects have the same problem for kind, operation, and name.

Expected: use the final statically known definition; when a later property could replace it with an unknown value, omit the stale literal. An explicit final property after a spread or dynamic key remains recognizable. This is a source-discovered bug with an executable fixture reproduction; no issue was supplied.

Change and scope

Make the existing object-property lookup the single owner of property selection for RPC recognition. Scan from the final definition, stop at unknown writes/accessors/methods, and let the string lookup consume that selected node. Document this behavior and add source and public CLI/stdio MCP regressions.

This is an ordinary correctness fix within the existing contribution scope; an advance maintainer scope decision is not applicable. This does not add spread evaluation or execute analyzed application code.

Contract and boundary impact

Semantic owner and earliest changed stage: RPC recognition in the JavaScript domain; graph consumers reuse its selected facts.
Contribution scope fit and linked maintainer decision: existing static analysis correctness; decision not applicable.
CLI and MCP/tool-catalog contract: no argument, schema, or catalog changes. RPC endpoint observations now reflect final known fields; overwritten unknown fields produce no stale observation.
Provider, bridge, target-format, or platform compatibility: shared source parser; no provider or bridge changes.
Evidence, artifact, provenance, or reconstruction contract: source ranges and artifact commitments are preserved. No invented runtime URL or operation replaces an unknown field.
Target selection, authority, upstream behavior, and cleanup details: unchanged read-only directory/web source analysis with its existing owned parser helper; no added target execution, network access, or resource ownership.
Generated metadata, package, or installation impact: none; ignored build artifacts are not committed.

Expected effects:

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added: 16 property-order cases covering duplicate literals, runtime replacements, spreads, computed keys, accessors/methods, and final explicit properties. Two acceptance cases exercise the built CLI and stdio MCP server on the same authored directory fixture.
Base reproduction: the source regression file on 7375ab6e34e511095a74d5a67e57cec28d56fd10 produces 14 failures and 38 passes. With the fix, all 52 pass. A Node.js control in each acceptance case verifies actual object construction semantics; its local httpBatchLink stub establishes those semantics, not live tRPC library behavior.
User-visible CLI/MCP output: the acceptance fixture's endpoint observations include these properties and exclude the three stale URL literals and old GraphQL name:

[
  {"value":"/trpc/live","mechanism":"trpc:link:httpBatchLink"},
  {"value":"/trpc/final","mechanism":"trpc:link:httpBatchLink"},
  {"value":"Current","mechanism":"graphql:mutation"}
]

Remaining proof gaps: no live tRPC server/client, browser capture, or analyzed application execution. The full repository test suite was not run.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Node 24.18.0 / npm 11.16.0 on Windows, HEAD 1c57b56559f1cad061f54254007b73c7e395ce86:

npm run test:focused -- src/domain/javascript/javascriptRpcEndpoints.test.ts tests/acceptance/applications/javascriptRpcPropertyOwnershipCli.test.ts src/domain/webBundleAnalyzer.test.ts src/domain/webBundleAnalyzerAst.test.ts — 90 pass, including built CLI, stdio MCP, and neighboring web bundle analysis.
npm run check — passes.
npm run verify:test-discovery — all 1,247 test files discovered exactly once.
npm run docs:check — passes, including five README consistency tests.
git diff --check and pre-commit formatting/lint hooks — pass.

Windows worker supervision used the addon from upstream CI run 38519573909, built at the exact base 7375ab6e3, with node scripts/verify-windows-native-artifact.mjs passing. The checkout initially lacked the addon, and the published 6.4.0 addon lacked a current required capability; those unavailable-provider attempts were resolved before the passing acceptance run.

Compatibility, safety, and release

Breaking changes or migration steps: no schema or format migration; corrected RPC observations can differ from previous erroneous results.
Real Hopper/Ghidra, browser, or OS coverage: Windows public static-analysis CLI and stdio MCP verified; other providers and live browser workflows not exercised.
Package or release metadata impact: none.
Security, privacy, process, or containment review: domain selection only; existing static worker supervision and cleanup remain unchanged.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3244 **Author:** [@Vaishnavi220506](https://github.com/Vaishnavi220506) **Created:** 10/14/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `Vaishnavi220506/fix-rpc-property-ownership` --- ### 📝 Commits (1) - [`1c57b56`](https://github.com/morluto/rea/commit/1c57b56559f1cad061f54254007b73c7e395ce86) fix(javascript): honor final RPC object properties ### 📊 Changes **4 files changed** (+122 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+6 -0) 📝 `src/domain/javascript/javascriptRpcEndpoints.test.ts` (+44 -0) 📝 `src/domain/javascript/javascriptRpcEndpoints.ts` (+15 -18) ➕ `tests/acceptance/applications/javascriptRpcPropertyOwnershipCli.test.ts` (+57 -0) </details> ### 📄 Description ## Summary Recover RPC endpoint fields from the final known object property, rather than the first literal found. This prevents `analyze_javascript_application` and the shared web bundle analyzer from reporting an obsolete tRPC URL or an overwritten GraphQL operation name/type. ## Problem and expected behavior For `httpBatchLink({ url: "/trpc/old", url: "/trpc/live" })`, JavaScript supplies `/trpc/live`, but REA reports `/trpc/old`. A later `url: runtimeUrl`, spread, computed key, getter, or method also leaves the earlier literal incorrectly reported. Precompiled `OperationDefinition` objects have the same problem for `kind`, `operation`, and `name`. Expected: use the final statically known definition; when a later property could replace it with an unknown value, omit the stale literal. An explicit final property after a spread or dynamic key remains recognizable. This is a source-discovered bug with an executable fixture reproduction; no issue was supplied. ## Change and scope Make the existing object-property lookup the single owner of property selection for RPC recognition. Scan from the final definition, stop at unknown writes/accessors/methods, and let the string lookup consume that selected node. Document this behavior and add source and public CLI/stdio MCP regressions. This is an ordinary correctness fix within the existing [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope); an advance maintainer scope decision is not applicable. This does not add spread evaluation or execute analyzed application code. ## Contract and boundary impact - Semantic owner and earliest changed stage: RPC recognition in the JavaScript domain; graph consumers reuse its selected facts. - Contribution scope fit and linked maintainer decision: existing static analysis correctness; decision not applicable. - CLI and MCP/tool-catalog contract: no argument, schema, or catalog changes. RPC endpoint observations now reflect final known fields; overwritten unknown fields produce no stale observation. - Provider, bridge, target-format, or platform compatibility: shared source parser; no provider or bridge changes. - Evidence, artifact, provenance, or reconstruction contract: source ranges and artifact commitments are preserved. No invented runtime URL or operation replaces an unknown field. - Target selection, authority, upstream behavior, and cleanup details: unchanged read-only directory/web source analysis with its existing owned parser helper; no added target execution, network access, or resource ownership. - Generated metadata, package, or installation impact: none; ignored build artifacts are not committed. Expected effects: - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added: 16 property-order cases covering duplicate literals, runtime replacements, spreads, computed keys, accessors/methods, and final explicit properties. Two acceptance cases exercise the built CLI and stdio MCP server on the same authored directory fixture. - Base reproduction: the source regression file on `7375ab6e34e511095a74d5a67e57cec28d56fd10` produces 14 failures and 38 passes. With the fix, all 52 pass. A Node.js control in each acceptance case verifies actual object construction semantics; its local `httpBatchLink` stub establishes those semantics, not live tRPC library behavior. - User-visible CLI/MCP output: the acceptance fixture's endpoint observations include these properties and exclude the three stale URL literals and old GraphQL name: ```json [ {"value":"/trpc/live","mechanism":"trpc:link:httpBatchLink"}, {"value":"/trpc/final","mechanism":"trpc:link:httpBatchLink"}, {"value":"Current","mechanism":"graphql:mutation"} ] ``` - Remaining proof gaps: no live tRPC server/client, browser capture, or analyzed application execution. The full repository test suite was not run. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Node 24.18.0 / npm 11.16.0 on Windows, HEAD `1c57b56559f1cad061f54254007b73c7e395ce86`: - `npm run test:focused -- src/domain/javascript/javascriptRpcEndpoints.test.ts tests/acceptance/applications/javascriptRpcPropertyOwnershipCli.test.ts src/domain/webBundleAnalyzer.test.ts src/domain/webBundleAnalyzerAst.test.ts` — 90 pass, including built CLI, stdio MCP, and neighboring web bundle analysis. - `npm run check` — passes. - `npm run verify:test-discovery` — all 1,247 test files discovered exactly once. - `npm run docs:check` — passes, including five README consistency tests. - `git diff --check` and pre-commit formatting/lint hooks — pass. Windows worker supervision used the addon from [upstream CI run 38519573909](https://github.com/morluto/rea/actions/runs/38519573909), built at the exact base `7375ab6e3`, with `node scripts/verify-windows-native-artifact.mjs` passing. The checkout initially lacked the addon, and the published 6.4.0 addon lacked a current required capability; those unavailable-provider attempts were resolved before the passing acceptance run. ## Compatibility, safety, and release - Breaking changes or migration steps: no schema or format migration; corrected RPC observations can differ from previous erroneous results. - Real Hopper/Ghidra, browser, or OS coverage: Windows public static-analysis CLI and stdio MCP verified; other providers and live browser workflows not exercised. - Package or release metadata impact: none. - Security, privacy, process, or containment review: domain selection only; existing static worker supervision and cleanup remain unchanged. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:08:27 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:44:49 +00:00

[PR #5671] [MERGED] fix(errors): preserve caller abort reasons at admission #7025

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5670

No description provided.

Rows
Columns