morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3998] [MERGED] fix(javascript): retain static paths through TypeScript wrappers #5983

New issue

Closed

opened 2026-10-31 01:10:56 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:10:56 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3998
Author: @ShuaixinHuang
Created: 10/15/2026
Status: ✅ Merged
Merged: 10/15/2026
Merged by: @N0zoM1z0

Base: main ← Head: codex/fix-static-path-value-wrappers

📝 Commits (6)

1002238 fix(javascript): retain static paths through TypeScript wrappers
97dbac0 Merge remote-tracking branch 'origin/main' into codex/fix-static-path-value-wrappers
27c9197 Merge remote-tracking branch 'origin/main' into codex/fix-static-path-value-wrappers
c75f3ac fix(javascript): unwrap erased path call targets
98d294e fix(javascript): preserve wrapped collection read exclusions
94636ee fix(javascript): unwrap global receiver alias initializers

📊 Changes

6 files changed (+547 additions, -46 deletions)

View changed files

📝 src/domain/javascript/javascriptSemanticAnalysis.ts (+19 -18)
📝 src/domain/javascript/javascriptStaticAnalysisCalleeBoundary.test.ts (+167 -0)
📝 src/domain/javascript/javascriptStaticAnalysisHelpers.ts (+26 -15)
📝 src/domain/javascript/javascriptStaticPathResolution.test.ts (+110 -10)
📝 tests/acceptance/applications/javascriptEndpointCandidateCli.test.ts (+45 -3)
📝 tests/boundary/filesystem/javascript-applications/javascriptApplicationTypeScript.test.ts (+180 -0)

📄 Description

Summary

Preserve known Electron preload and utility-process paths through erased TypeScript wrappers on values, invoked functions and constructors. "./preload.js" as const and (path.join as typeof path.join)(__dirname, "preload.js") retain the same path facts as their plain equivalents.

Change and scope

Reuse the existing expression-unwrapping and exact-string owners for paths, filesystem context and callee names. Apply the same normalization to collection/configuration receiver classification and both existing global-alias initializer walks. Wrapped collection/configuration reads remain excluded from network candidates; wrapped window, indexedDB and caches aliases retain browser/storage identity.

Keep existing URL/path exceptions, module evidence, alias-depth policy, binding/mutation guards and unknown dynamic targets. The application fixture compares plain/wrapped values and call targets using its existing full graph oracle. The public CLI fixture verifies exact surviving endpoint values and recovered storage kinds/names through the real worker and graph projection.

Six files; no dependency, schema, catalog, provider, package or target-authority changes. This is inert static analysis: analyzed source and Electron applications are not executed. Distinct from merged #3480's property-key correction.

Evidence and validation

Windows x64, pinned Node 24.18.0 / npm 11.16.0 and matching locked dependencies. Current head 94636eebffbb990dd4128ddf7c9a629caa5bed21, including main ce897061 and merged #3480.

Historical path baselines: original value wrappers 10 failed / 68 passed, then 78 passed; call-target wrappers against 27c9197 10 failed / 94 passed, then focused 109 passed. These are prior runs, not repeated current-main claims.
Collection exclusions against unchanged c75f3ac: 4 failed / 7 passed, including unwanted endpoint keys in the real compiled CLI.
Global aliases against unchanged 98d294e: 4 failed / 12 passed. Wrapped browser aliases produced a spurious browser-context candidate; wrapped IndexedDB/Cache Storage aliases lost storage records. Plain/local/unknown controls passed.
Final focused selection: 570/570 passed across 15 files: 559 source tests, 10 real Windows application-boundary cases, and 1 public CLI acceptance case. Includes plain/asserted/non-null/satisfies aliases, both existing alias walks, local shadowing, replacement and conditional controls, exact keys, RPC/bundler consumers and 12,000-member chains.
npm run check: 6/6 tasks plus architecture guards passed, 0 lint errors (1449 existing warnings). git diff --check passed. The runtime rebuilt successfully after the production fix.

Final tests used checkout-local TEMP/TMP. An earlier collection-fix run using host sandbox TEMP failed in the CLI subprocess; the final runs with checkout-local TEMP/TMP passed. No production timeout or permission policy changed.

Native Windows artifacts were restored from CI run 38692939328 with matching archive digests, manifest/ABI/architecture/artifact verification and native source. No native mock, live Electron, public MCP target-analysis or real analysis-engine run is claimed. Public CLI coverage parses an inert fixture. Current-head GitHub CI run 38734265641 completed successfully on 94636eebffbb990dd4128ddf7c9a629caa5bed21 (18 successful checks, 15 configured skips); its required merge gate passes. Conditional skips remain unverified coverage.

Author readiness

Human owner: @ShuaixinHuang

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

One focused reproduced defect; related path interpretation cleanup included.
Dynamic-input controls and existing upstream regressions retained.
Current-head application boundary and required CI pass (local application checks reported above; current-head CI linked above).
Human initial-readiness declaration is complete.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3998 **Author:** [@ShuaixinHuang](https://github.com/ShuaixinHuang) **Created:** 10/15/2026 **Status:** ✅ Merged **Merged:** 10/15/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `codex/fix-static-path-value-wrappers` --- ### 📝 Commits (6) - [`1002238`](https://github.com/morluto/rea/commit/10022380f18e6dbc07269f30b92a4598aeb6617a) fix(javascript): retain static paths through TypeScript wrappers - [`97dbac0`](https://github.com/morluto/rea/commit/97dbac0a92828c497adf4395e50102e4382aeaac) Merge remote-tracking branch 'origin/main' into codex/fix-static-path-value-wrappers - [`27c9197`](https://github.com/morluto/rea/commit/27c9197fadabd72844dd737498f120338d1a430f) Merge remote-tracking branch 'origin/main' into codex/fix-static-path-value-wrappers - [`c75f3ac`](https://github.com/morluto/rea/commit/c75f3ac92b78d10210149748e0e5206dac0a4118) fix(javascript): unwrap erased path call targets - [`98d294e`](https://github.com/morluto/rea/commit/98d294e2b4f4c80e0e3ebb3877d38c58ee71c5a6) fix(javascript): preserve wrapped collection read exclusions - [`94636ee`](https://github.com/morluto/rea/commit/94636eebffbb990dd4128ddf7c9a629caa5bed21) fix(javascript): unwrap global receiver alias initializers ### 📊 Changes **6 files changed** (+547 additions, -46 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/javascriptSemanticAnalysis.ts` (+19 -18) 📝 `src/domain/javascript/javascriptStaticAnalysisCalleeBoundary.test.ts` (+167 -0) 📝 `src/domain/javascript/javascriptStaticAnalysisHelpers.ts` (+26 -15) 📝 `src/domain/javascript/javascriptStaticPathResolution.test.ts` (+110 -10) 📝 `tests/acceptance/applications/javascriptEndpointCandidateCli.test.ts` (+45 -3) 📝 `tests/boundary/filesystem/javascript-applications/javascriptApplicationTypeScript.test.ts` (+180 -0) </details> ### 📄 Description ## Summary Preserve known Electron preload and utility-process paths through erased TypeScript wrappers on values, invoked functions and constructors. `"./preload.js" as const` and `(path.join as typeof path.join)(__dirname, "preload.js")` retain the same path facts as their plain equivalents. ## Change and scope Reuse the existing expression-unwrapping and exact-string owners for paths, filesystem context and callee names. Apply the same normalization to collection/configuration receiver classification and both existing global-alias initializer walks. Wrapped collection/configuration reads remain excluded from network candidates; wrapped `window`, `indexedDB` and `caches` aliases retain browser/storage identity. Keep existing URL/path exceptions, module evidence, alias-depth policy, binding/mutation guards and unknown dynamic targets. The application fixture compares plain/wrapped values and call targets using its existing full graph oracle. The public CLI fixture verifies exact surviving endpoint values and recovered storage kinds/names through the real worker and graph projection. Six files; no dependency, schema, catalog, provider, package or target-authority changes. This is inert static analysis: analyzed source and Electron applications are not executed. Distinct from merged #3480's property-key correction. ## Evidence and validation Windows x64, pinned Node 24.18.0 / npm 11.16.0 and matching locked dependencies. Current head `94636eebffbb990dd4128ddf7c9a629caa5bed21`, including main `ce897061` and merged #3480. - Historical path baselines: original value wrappers **10 failed / 68 passed**, then **78 passed**; call-target wrappers against `27c9197` **10 failed / 94 passed**, then focused **109 passed**. These are prior runs, not repeated current-main claims. - Collection exclusions against unchanged `c75f3ac`: **4 failed / 7 passed**, including unwanted endpoint keys in the real compiled CLI. - Global aliases against unchanged `98d294e`: **4 failed / 12 passed**. Wrapped browser aliases produced a spurious `browser-context` candidate; wrapped IndexedDB/Cache Storage aliases lost storage records. Plain/local/unknown controls passed. - Final focused selection: **570/570 passed across 15 files**: **559 source tests**, **10 real Windows application-boundary cases**, and **1 public CLI acceptance case**. Includes plain/asserted/non-null/satisfies aliases, both existing alias walks, local shadowing, replacement and conditional controls, exact keys, RPC/bundler consumers and 12,000-member chains. - `npm run check`: **6/6 tasks plus architecture guards passed**, **0 lint errors** (1449 existing warnings). `git diff --check` passed. The runtime rebuilt successfully after the production fix. Final tests used checkout-local TEMP/TMP. An earlier collection-fix run using host sandbox TEMP failed in the CLI subprocess; the final runs with checkout-local TEMP/TMP passed. No production timeout or permission policy changed. Native Windows artifacts were restored from CI run 38692939328 with matching archive digests, manifest/ABI/architecture/artifact verification and native source. No native mock, live Electron, public MCP target-analysis or real analysis-engine run is claimed. Public CLI coverage parses an inert fixture. Current-head [GitHub CI run 38734265641](https://github.com/morluto/rea/actions/runs/38734265641) completed successfully on `94636eebffbb990dd4128ddf7c9a629caa5bed21` (18 successful checks, 15 configured skips); its required merge gate passes. Conditional skips remain unverified coverage. ## Author readiness Human owner: @ShuaixinHuang - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] One focused reproduced defect; related path interpretation cleanup included. - [x] Dynamic-input controls and existing upstream regressions retained. - [x] Current-head application boundary and required CI pass (local application checks reported above; current-head CI linked above). - [x] Human initial-readiness declaration is complete. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:10:56 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5983

No description provided.

Rows
Columns