morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4279] [CLOSED] fix(browser): require exact WebMCP receiver segments #6154

New issue

Closed

opened 2026-10-31 01:12:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:12:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4279
Author: @geekwolf
Created: 10/15/2026
Status: ❌ Closed

Base: main ← Head: fix/webmcp-receiver-boundary

📝 Commits (1)

b5cbae4 fix(browser): require exact WebMCP receiver segments

📊 Changes

3 files changed (+104 additions, -1 deletions)

View changed files

📝 src/domain/webBundleAnalyzer.test.ts (+20 -0)
📝 src/domain/webBundleAnalyzerInspection.ts (+1 -1)
➕ tests/acceptance/browser/webMcpReceiverCli.test.ts (+83 -0)

📄 Description

Upstream integration update — 2026-10-16

Main already includes the fix in 38f92d108e3148cdf47e4ffbfe3de8a76e795d51, referencing #4205 and this PR, with Geekwolf credited as co-author. Its AST-segment implementation additionally rejects dotted-key collisions. Replaying this draft's older suffix-based implementation over it would lose that stronger boundary, so no replacement code push is proposed.

Verified upstream main 808339f0b1cf3837445f392b5d5f1f362d64a27d on Windows x64 with Node 24.18.0 / npm 11.16.0: all 39 analyzer tests and the compiled WebMCP CLI regression passed. The CLI uses a simulated CDP producer and checks retained source and receiver collisions; this does not establish real Chrome or runtime WebMCP behavior. This PR remains open/draft; code integration is not a GitHub merge of this PR. The original proposal and its historical verification follow.

Summary

Fixes #4205. Static WebMCP extraction no longer treats foobar_modelContext.registerTool as a declaration. Bare modelContext and exact nested member segments remain supported, including existing optional/literal-computed forms.

Change and scope

Require the receiver segment boundary in the owning captured-source classifier. No alias inference, source execution, API/schema change or new provider capability. Captured source and the page-declared-untrusted classification are retained. Maintainer capability-scope decision: not applicable to this bounded correction.

Evidence and validation

On main 93c620c3, the new regression failed with two false suffix declarations; the other 38 analyzer tests passed.
After the fix, 39 analyzer tests and one compiled CLI workflow passed. The CLI exercises real HTTP/WebSocket transport with a simulated CDP producer, checks four accepted and four rejected source forms, retained exact source and closed connections. This does not establish real Chrome or runtime WebMCP behavior.
check:fast, verify:test-discovery (1,388 files), staged formatting/lint and git diff --check passed. Invoked with Node 24.18.0 / npm 11.16.0 on Windows x64.
npm run check stopped on an existing formatting issue in unchanged src/adb/AdbProvider.ts; the complete check is not claimed. Full CI remains required.

Author readiness

Human owner: @geekwolf

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4279 **Author:** [@geekwolf](https://github.com/geekwolf) **Created:** 10/15/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/webmcp-receiver-boundary` --- ### 📝 Commits (1) - [`b5cbae4`](https://github.com/morluto/rea/commit/b5cbae4c66a0e5cfd35cb56497076b64b341367d) fix(browser): require exact WebMCP receiver segments ### 📊 Changes **3 files changed** (+104 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/webBundleAnalyzer.test.ts` (+20 -0) 📝 `src/domain/webBundleAnalyzerInspection.ts` (+1 -1) ➕ `tests/acceptance/browser/webMcpReceiverCli.test.ts` (+83 -0) </details> ### 📄 Description ## Upstream integration update — 2026-10-16 Main already includes the fix in [38f92d108e3148cdf47e4ffbfe3de8a76e795d51](https://github.com/morluto/rea/commit/38f92d108e3148cdf47e4ffbfe3de8a76e795d51), referencing #4205 and this PR, with Geekwolf credited as co-author. Its AST-segment implementation additionally rejects dotted-key collisions. Replaying this draft's older suffix-based implementation over it would lose that stronger boundary, so no replacement code push is proposed. Verified upstream main `808339f0b1cf3837445f392b5d5f1f362d64a27d` on Windows x64 with Node 24.18.0 / npm 11.16.0: all 39 analyzer tests and the compiled WebMCP CLI regression passed. The CLI uses a simulated CDP producer and checks retained source and receiver collisions; this does not establish real Chrome or runtime WebMCP behavior. This PR remains open/draft; code integration is not a GitHub merge of this PR. The original proposal and its historical verification follow. --- ## Summary Fixes #4205. Static WebMCP extraction no longer treats `foobar_modelContext.registerTool` as a declaration. Bare `modelContext` and exact nested member segments remain supported, including existing optional/literal-computed forms. ## Change and scope Require the receiver segment boundary in the owning captured-source classifier. No alias inference, source execution, API/schema change or new provider capability. Captured source and the `page-declared-untrusted` classification are retained. Maintainer capability-scope decision: not applicable to this bounded correction. ## Evidence and validation - On main `93c620c3`, the new regression failed with two false suffix declarations; the other 38 analyzer tests passed. - After the fix, 39 analyzer tests and one compiled CLI workflow passed. The CLI exercises real HTTP/WebSocket transport with a simulated CDP producer, checks four accepted and four rejected source forms, retained exact source and closed connections. This does not establish real Chrome or runtime WebMCP behavior. - `check:fast`, `verify:test-discovery` (1,388 files), staged formatting/lint and `git diff --check` passed. Invoked with Node 24.18.0 / npm 11.16.0 on Windows x64. - `npm run check` stopped on an existing formatting issue in unchanged `src/adb/AdbProvider.ts`; the complete check is not claimed. Full CI remains required. ## Author readiness Human owner: @geekwolf - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:12:16 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:45:53 +00:00

[PR #6155] [CLOSED] fix(domain): reject unwalkable Mach-O load-command tables at admission #7169

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6154

No description provided.

Rows
Columns