morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3898] [MERGED] fix(javascript): retain standalone GraphQL source operations #5956

New issue

Closed

opened 2026-10-31 01:10:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:10:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3898
Author: @N0zoM1z0
Created: 10/15/2026
Status: ✅ Merged
Merged: 10/15/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/graphql-source-body-3311

📝 Commits (5)

35aba47 fix(javascript): retain standalone GraphQL source operations
c6519a1 fix(javascript): prove GraphQL copies from exclusive source references
f7bfc8e fix(javascript): include document containers in GraphQL copy proofs
9526eea fix(javascript): require private lexical ownership for GraphQL copies
a47988c perf(javascript): skip copy ownership without Source metadata

📊 Changes

13 files changed (+986 additions, -234 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+7 -2)
📝 src/domain/javascript/javascriptAstValues.ts (+24 -0)
➕ src/domain/javascript/javascriptGraphqlOperations.ts (+479 -0)
📝 src/domain/javascript/javascriptRpcEndpoints.test.ts (+252 -1)
📝 src/domain/javascript/javascriptRpcEndpoints.ts (+12 -191)
📝 src/domain/javascript/javascriptSemanticAnalysis.ts (+22 -30)
📝 src/domain/javascript/javascriptSemanticAnalysisSteps.test.ts (+36 -5)
📝 src/domain/javascript/javascriptSemanticState.ts (+9 -0)
📝 src/domain/javascript/javascriptStaticAnalysis.ts (+6 -3)
📝 src/domain/javascript/javascriptStaticAnalysisCalls.ts (+10 -0)
📝 src/domain/webBundleAnalyzer.test.ts (+14 -0)
📝 src/domain/webBundleAnalyzerInspection.ts (+17 -2)
📝 tests/acceptance/applications/javascriptRpcPropertyOwnershipCli.test.ts (+98 -0)

📄 Description

Summary

Fixes #3311. A standalone GraphQL Source object lost its only operation when it included locationOffset. Retain its final known body; suppress a duplicate only when a recovered document actually references that source and represents the same operation.

Change and scope

A dedicated GraphQL owner separates field ownership from duplicate proof. Document roots, containing objects/arrays and source/location aliases share one ownership proof. Writes, opaque uses, exports and forward references cannot authorize suppression. Parsed script/module identity distinguishes private module bindings from classic-script globals; classic-script global bindings and direct eval remain unknown. Source metadata is checked before container ownership. Reference indexes are lazy and shared per source, so ordinary captured bundles avoid an extra AST pass. Deferred source and proof scans checkpoint examined entries, including suppressed copies. It reuses parsed lexical facts instead of reparsing or globally deduplicating operation names. JavaScript application analysis and captured web-bundle analysis consume the same facts. The now-unused receiver-only indexing entrypoints are removed; their pause/scope regression exercises the shared production index.

Ordinary static-analysis repair; maintainer scope decision not applicable. CLI/MCP schemas, caller choices, target bytes, package dependencies and execution authority are unchanged. Findings retain source locations and artifact identity. Per-source maps expire with the scan; there is no persistent cache.

Evidence and validation

Baseline cf0a38ad9: two new regressions fail; public CLI finds 0 operations for a genuine graphql@16.11.0 Source and 1 in the metadata-free control.
Fixed public CLI: standalone Source 1, control 1, precompiled graphql-tag@2.12.6 document 1. A corpus emitted by those published libraries recovers all 24 operations, versus 12 on baseline. Inputs retain their original digests; complete coverage and zero parse failures.
npm run test:focused -- the RPC, source-location, callee, capacity, cooperative-index, web-bundle and RPC CLI acceptance files: 155 passed across 7 files. Actual CLI and stdio MCP verify standalone, owned-copy and unrelated-same-name observations with provenance, a changed location alias a write through the containing document and classic-script versus module ownership with exact per-file locations. A 1,100-source regression checks cooperative draining for both inline and aliased copies. Existing overwrite/unknown-spread controls remain covered.
An isolated Node 24.18.0 VM experiment confirms a second classic script can disconnect a top-level constant document from its Source through indirect eval; the original Source body remains accessible. Global/module/local scope controls cover this ownership distinction.
npm run check and npm run docs:check: passed. The added complexity warning was eliminated before commit.

Exact-head a47988c92 vs. baseline cf0a38ad9, alternating completed CLI tasks on 24-operation corpora. Every normalized result is identical for these equivalent private-document tasks. Median of two repetitions per cache mode; baseline / fixed:

Corpus / Node compile cache	Wall (s)	Reaped child CPU (s)	Peak sampled family RSS (MiB)
plain documents, cold	8.001 / 7.638	11.153 / 10.553	472.3 / 472.6
plain documents, warm	7.512 / 7.187	10.657 / 10.263	478.0 / 480.8
private aliased metadata, cold	6.362 / 7.452	9.103 / 10.557	485.4 / 486.1
private aliased metadata, warm	4.061 / 4.021	6.103 / 6.007	503.8 / 506.8

Full retained JSON has 1,355,915 / 1,826,291 cl100k_base tokens for the plain / private-aliased corpus, unchanged between versions. An exported-document control correctly retains 24 additional Source observations (48 observations for 24 names): 1,829,915 → 1,846,631 tokens (+0.91%). Source, document and container ownership cannot be established across that export. These payloads stay local; no model consumes them. Billing, catalog negotiation and complete agent-transcript tokens are unmeasured.

Captured-web production-boundary measurements use synthetic captures containing published-library values, six operations, four alternating process pairs and ten analyses per process. Median baseline → fixed:

Capture	Wall / CPU for ten analyses (ms)	Maximum-process RSS (MiB)
private aliased Source	118.2 / 274.0 → 112.3 / 273.8	106.3 → 108.7
private inline Source	101.8 / 245.7 → 109.2 / 257.7	107.8 → 107.7
plain	101.2 / 227.3 → 104.6 / 246.3	107.4 → 107.8

All web result digests match and capture bytes remain unchanged. graphql-tag normally omits Source through Location.toJSON; Source-aware corpora explicitly retain the actual library object's Source fields. This is static artifact verification, not a live service/application benchmark.

Linux x86_64 shared host, Node 24.18.0/npm 11.16.0. Cold disables Node compile caching; warm primes a per-version cache. Family RSS uses 50 ms samples and may double-count shared pages or miss short children. OS caches are uncontrolled. The shared host showed substantial variance, including baseline timings changing during a corpus; these small samples do not establish an isolated speedup or a general performance guarantee.

Compatibility and limitations

No breaking call or configuration changes. The real-library evidence concerns emitted static Source/document representations, not a live GraphQL service or a full application benchmark. Other operating systems were not run. A no-longer-known source reference cannot authorize duplicate suppression. Unknown ownership retains both Source and document observations; ordinary graphql-tag JSON omits Source through Location.toJSON. Successful checks above ran serially against the final source.

Author readiness

Human owner: @N0zoM1z0

The human owner explicitly authorized delegated review, proxy completion of these declarations, ready-for-review publication and normal merge for this batch. The agent performed the diff and evidence review described above; this records that delegation rather than asserting a separate manual review occurred.

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3898 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/15/2026 **Status:** ✅ Merged **Merged:** 10/15/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/graphql-source-body-3311` --- ### 📝 Commits (5) - [`35aba47`](https://github.com/morluto/rea/commit/35aba472d69b54ee2227834d2abffe048c3d1111) fix(javascript): retain standalone GraphQL source operations - [`c6519a1`](https://github.com/morluto/rea/commit/c6519a16e95d8c10b2fb1bb857899f10e2684be6) fix(javascript): prove GraphQL copies from exclusive source references - [`f7bfc8e`](https://github.com/morluto/rea/commit/f7bfc8e75125f6390eff1d3f8f21622327024adc) fix(javascript): include document containers in GraphQL copy proofs - [`9526eea`](https://github.com/morluto/rea/commit/9526eea452811dafde35134aed6eaa65181580c0) fix(javascript): require private lexical ownership for GraphQL copies - [`a47988c`](https://github.com/morluto/rea/commit/a47988c92942a87b908a5d1f3fe5ee61d07ae006) perf(javascript): skip copy ownership without Source metadata ### 📊 Changes **13 files changed** (+986 additions, -234 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+7 -2) 📝 `src/domain/javascript/javascriptAstValues.ts` (+24 -0) ➕ `src/domain/javascript/javascriptGraphqlOperations.ts` (+479 -0) 📝 `src/domain/javascript/javascriptRpcEndpoints.test.ts` (+252 -1) 📝 `src/domain/javascript/javascriptRpcEndpoints.ts` (+12 -191) 📝 `src/domain/javascript/javascriptSemanticAnalysis.ts` (+22 -30) 📝 `src/domain/javascript/javascriptSemanticAnalysisSteps.test.ts` (+36 -5) 📝 `src/domain/javascript/javascriptSemanticState.ts` (+9 -0) 📝 `src/domain/javascript/javascriptStaticAnalysis.ts` (+6 -3) 📝 `src/domain/javascript/javascriptStaticAnalysisCalls.ts` (+10 -0) 📝 `src/domain/webBundleAnalyzer.test.ts` (+14 -0) 📝 `src/domain/webBundleAnalyzerInspection.ts` (+17 -2) 📝 `tests/acceptance/applications/javascriptRpcPropertyOwnershipCli.test.ts` (+98 -0) </details> ### 📄 Description ## Summary Fixes #3311. A standalone GraphQL Source object lost its only operation when it included `locationOffset`. Retain its final known body; suppress a duplicate only when a recovered document actually references that source and represents the same operation. ## Change and scope A dedicated GraphQL owner separates field ownership from duplicate proof. Document roots, containing objects/arrays and source/location aliases share one ownership proof. Writes, opaque uses, exports and forward references cannot authorize suppression. Parsed script/module identity distinguishes private module bindings from classic-script globals; classic-script global bindings and direct eval remain unknown. Source metadata is checked before container ownership. Reference indexes are lazy and shared per source, so ordinary captured bundles avoid an extra AST pass. Deferred source and proof scans checkpoint examined entries, including suppressed copies. It reuses parsed lexical facts instead of reparsing or globally deduplicating operation names. JavaScript application analysis and captured web-bundle analysis consume the same facts. The now-unused receiver-only indexing entrypoints are removed; their pause/scope regression exercises the shared production index. Ordinary static-analysis repair; maintainer scope decision not applicable. CLI/MCP schemas, caller choices, target bytes, package dependencies and execution authority are unchanged. Findings retain source locations and artifact identity. Per-source maps expire with the scan; there is no persistent cache. ## Evidence and validation - Baseline `cf0a38ad9`: two new regressions fail; public CLI finds 0 operations for a genuine `graphql@16.11.0` Source and 1 in the metadata-free control. - Fixed public CLI: standalone Source 1, control 1, precompiled `graphql-tag@2.12.6` document 1. A corpus emitted by those published libraries recovers all 24 operations, versus 12 on baseline. Inputs retain their original digests; complete coverage and zero parse failures. - `npm run test:focused --` the RPC, source-location, callee, capacity, cooperative-index, web-bundle and RPC CLI acceptance files: **155 passed across 7 files**. Actual CLI and stdio MCP verify standalone, owned-copy and unrelated-same-name observations with provenance, a changed location alias a write through the containing document and classic-script versus module ownership with exact per-file locations. A 1,100-source regression checks cooperative draining for both inline and aliased copies. Existing overwrite/unknown-spread controls remain covered. - An isolated Node 24.18.0 VM experiment confirms a second classic script can disconnect a top-level constant document from its Source through indirect eval; the original Source body remains accessible. Global/module/local scope controls cover this ownership distinction. - `npm run check` and `npm run docs:check`: passed. The added complexity warning was eliminated before commit. Exact-head `a47988c92` vs. baseline `cf0a38ad9`, alternating completed CLI tasks on 24-operation corpora. Every normalized result is identical for these equivalent private-document tasks. Median of two repetitions per cache mode; **baseline / fixed**: | Corpus / Node compile cache | Wall (s) | Reaped child CPU (s) | Peak sampled family RSS (MiB) | | --- | --- | --- | --- | | plain documents, cold | 8.001 / 7.638 | 11.153 / 10.553 | 472.3 / 472.6 | | plain documents, warm | 7.512 / 7.187 | 10.657 / 10.263 | 478.0 / 480.8 | | private aliased metadata, cold | 6.362 / 7.452 | 9.103 / 10.557 | 485.4 / 486.1 | | private aliased metadata, warm | 4.061 / 4.021 | 6.103 / 6.007 | 503.8 / 506.8 | Full retained JSON has **1,355,915 / 1,826,291 `cl100k_base` tokens** for the plain / private-aliased corpus, unchanged between versions. An exported-document control correctly retains 24 additional Source observations (48 observations for 24 names): **1,829,915 → 1,846,631 tokens (+0.91%)**. Source, document and container ownership cannot be established across that export. These payloads stay local; no model consumes them. Billing, catalog negotiation and complete agent-transcript tokens are unmeasured. Captured-web production-boundary measurements use synthetic captures containing published-library values, six operations, four alternating process pairs and ten analyses per process. Median **baseline → fixed**: | Capture | Wall / CPU for ten analyses (ms) | Maximum-process RSS (MiB) | | --- | --- | --- | | private aliased Source | 118.2 / 274.0 → 112.3 / 273.8 | 106.3 → 108.7 | | private inline Source | 101.8 / 245.7 → 109.2 / 257.7 | 107.8 → 107.7 | | plain | 101.2 / 227.3 → 104.6 / 246.3 | 107.4 → 107.8 | All web result digests match and capture bytes remain unchanged. `graphql-tag` normally omits Source through `Location.toJSON`; Source-aware corpora explicitly retain the actual library object's Source fields. This is static artifact verification, not a live service/application benchmark. Linux x86_64 shared host, Node 24.18.0/npm 11.16.0. Cold disables Node compile caching; warm primes a per-version cache. Family RSS uses 50 ms samples and may double-count shared pages or miss short children. OS caches are uncontrolled. The shared host showed substantial variance, including baseline timings changing during a corpus; these small samples do not establish an isolated speedup or a general performance guarantee. ## Compatibility and limitations No breaking call or configuration changes. The real-library evidence concerns emitted static Source/document representations, not a live GraphQL service or a full application benchmark. Other operating systems were not run. A no-longer-known source reference cannot authorize duplicate suppression. Unknown ownership retains both Source and document observations; ordinary `graphql-tag` JSON omits Source through `Location.toJSON`. Successful checks above ran serially against the final source. ## Author readiness Human owner: @N0zoM1z0 The human owner explicitly authorized delegated review, proxy completion of these declarations, ready-for-review publication and normal merge for this batch. The agent performed the diff and evidence review described above; this records that delegation rather than asserting a separate manual review occurred. - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:10:44 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:46:40 +00:00

[PR #6313] [MERGED] fix(web): refuse an existing script-export destination as invalid input #7274

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5956

No description provided.

Rows
Columns