morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4413] [MERGED] fix(browser): retain bundle default origin scope #6224

New issue

Closed

opened 2026-10-31 01:12:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:12:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4413
Author: @XY-code1
Created: 10/16/2026
Status: ✅ Merged
Merged: 10/22/2026
Merged by: @morluto

Base: main ← Head: fix/browser-bundle-evidence-origin

📝 Commits (10+)

0ae96e8 fix(browser): retain bundle default origin scope
6c58aa4 test(browser): cover bundle URLs without origins
6b7a77b fix(browser): retain validated bundle target origin
afe4899 fix(browser): validate recorded origins canonically
2cb46fa Merge upstream/main into fix/browser-bundle-evidence-origin
fab1bec Merge upstream/main into fix/browser-bundle-evidence-origin
d548913 Merge branch 'main' into fix/browser-bundle-evidence-origin
6d10d94 Merge origin/main into fix/browser-bundle-evidence-origin
d7b87e2 Merge upstream/main into fix/browser-bundle-evidence-origin
81de491 Merge upstream/main into fix/browser-bundle-evidence-origin

📊 Changes

7 files changed (+173 additions, -10 deletions)

View changed files

➕ src/application/BrowserEvidence.test.ts (+112 -0)
📝 src/application/BrowserEvidence.ts (+2 -0)
📝 src/domain/browserObservation.test.ts (+15 -0)
📝 src/domain/browserObservation.ts (+12 -0)
📝 src/domain/webBundleAnalysis.ts (+7 -1)
📝 src/domain/webBundleAnalyzer.test.ts (+11 -0)
📝 src/domain/webBundleAnalyzerResult.ts (+14 -9)

📄 Description

Summary

Fixes #4385.

Preserve the effective default HTTP(S) origin scope in Evidence produced by
successful analyze_web_bundle operations without deriving browser authority
from a display URL.

Problem and expected behavior

The browser provider scopes an empty origin list to the selected target origin,
but the bundle result previously retained only capture.target_url. The Evidence
projection re-parsed that display field and accepted any URL origin. A
schema-valid non-HTTP URL such as ftp://host/app therefore produced
parameters.allowed_origins: ["ftp://host"], even though the allowed-origin
input contract admits only exact HTTP(S) origins.

Bundle Evidence should record the validated HTTP(S) target-origin fact used by
the provider. Explicit nonempty caller origin lists must remain unchanged.

Change and scope

At the bundle result's producing boundary, buildWebBundleAnalysis now validates
inspection.target.origin with the existing exact HTTP(S) origin parser and
retains it as capture.target_origin; unsupported origins are represented as
null. The output schema admits this field as optional for compatibility with
older saved observations, while current producers always emit string or null.

The Evidence projection consumes capture.target_origin instead of
reinterpreting capture.target_url. Browser capture, provider authorization,
origin enforcement, and input contracts are unchanged.

Evidence and regression coverage

Coverage now includes:

an empty caller origin list projecting a retained HTTP(S) target origin;
an explicit caller origin list retaining precedence;
file:// and schema-valid ftp://host/app bundle URLs producing no inferred
allowed origin;
the bundle producer retaining an HTTP(S) target origin and representing a
non-HTTP target origin as null.

Before the fix, the FTP regression failed with received
["ftp://host"] instead of []. After the fix, the focused suites pass.

Validation performed on Windows with Node/npm from the repository's pinned
setup:

npm run test:local -- src/application/BrowserEvidence.test.ts src/domain/webBundleAnalyzer.test.ts src/domain/browserObservation.test.ts — 50 passed.
npm run check:fast — passed (2 tasks).
npm run verify:test-discovery — all 1,415 test files discovered exactly once.
npm run check — passed (6 tasks plus architecture guards; lint reported 0 errors and 1,563 warnings).
git diff --check — passed.
npm run test:changed — 736 passed, 5 failed, 11 skipped. The five failures are outside the touched browser Evidence/bundle files: Windows path expectations in Doctor/Setup tests, a Ghidra profile environment failure, and a binary-session timing timeout. The focused suites and repository checks above passed.

No live browser, real CDP provider, or installed CLI/MCP transport was exercised.
Hosted CI must validate the browser/provider lanes available in the repository
environment.

Compatibility and safety

Adds an optional bundle-result capture.target_origin fact; older saved
observations that omit it remain schema-valid.
No public input, CLI, or MCP contract change.
No expansion of browser capture or allowed-origin authority.
Explicit caller scopes retain precedence.
Non-HTTP bundle URLs cannot become Evidence allowed_origins.

Author readiness

Human owner: @XY-code1

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4413 **Author:** [@XY-code1](https://github.com/XY-code1) **Created:** 10/16/2026 **Status:** ✅ Merged **Merged:** 10/22/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/browser-bundle-evidence-origin` --- ### 📝 Commits (10+) - [`0ae96e8`](https://github.com/morluto/rea/commit/0ae96e854b03c6e88869f4b72bf2727ff6eedf82) fix(browser): retain bundle default origin scope - [`6c58aa4`](https://github.com/morluto/rea/commit/6c58aa4cd4ec84957beea55e88dd900d27c25346) test(browser): cover bundle URLs without origins - [`6b7a77b`](https://github.com/morluto/rea/commit/6b7a77b45a6618239cd6eba05fe0598a116a3beb) fix(browser): retain validated bundle target origin - [`afe4899`](https://github.com/morluto/rea/commit/afe489998529f8699681e075e3cc2c99916e00b6) fix(browser): validate recorded origins canonically - [`2cb46fa`](https://github.com/morluto/rea/commit/2cb46fa1ed4101aee99f5dc93582c52452884258) Merge upstream/main into fix/browser-bundle-evidence-origin - [`fab1bec`](https://github.com/morluto/rea/commit/fab1bec512ad191ed13cec67dcfedc04a8d137c8) Merge upstream/main into fix/browser-bundle-evidence-origin - [`d548913`](https://github.com/morluto/rea/commit/d548913efbc85269927d0b0dc6bda2ebdbdf7f16) Merge branch 'main' into fix/browser-bundle-evidence-origin - [`6d10d94`](https://github.com/morluto/rea/commit/6d10d940171fc2ebde3a149f7e8e7096f2ac3d64) Merge origin/main into fix/browser-bundle-evidence-origin - [`d7b87e2`](https://github.com/morluto/rea/commit/d7b87e2e712e9dc0780256548655a221b3b49bfc) Merge upstream/main into fix/browser-bundle-evidence-origin - [`81de491`](https://github.com/morluto/rea/commit/81de491644965841a58975e02496af3a83cfa333) Merge upstream/main into fix/browser-bundle-evidence-origin ### 📊 Changes **7 files changed** (+173 additions, -10 deletions) <details> <summary>View changed files</summary> ➕ `src/application/BrowserEvidence.test.ts` (+112 -0) 📝 `src/application/BrowserEvidence.ts` (+2 -0) 📝 `src/domain/browserObservation.test.ts` (+15 -0) 📝 `src/domain/browserObservation.ts` (+12 -0) 📝 `src/domain/webBundleAnalysis.ts` (+7 -1) 📝 `src/domain/webBundleAnalyzer.test.ts` (+11 -0) 📝 `src/domain/webBundleAnalyzerResult.ts` (+14 -9) </details> ### 📄 Description ## Summary Fixes #4385. Preserve the effective default HTTP(S) origin scope in Evidence produced by successful `analyze_web_bundle` operations without deriving browser authority from a display URL. ## Problem and expected behavior The browser provider scopes an empty origin list to the selected target origin, but the bundle result previously retained only `capture.target_url`. The Evidence projection re-parsed that display field and accepted any URL origin. A schema-valid non-HTTP URL such as `ftp://host/app` therefore produced `parameters.allowed_origins: ["ftp://host"]`, even though the allowed-origin input contract admits only exact HTTP(S) origins. Bundle Evidence should record the validated HTTP(S) target-origin fact used by the provider. Explicit nonempty caller origin lists must remain unchanged. ## Change and scope At the bundle result's producing boundary, `buildWebBundleAnalysis` now validates `inspection.target.origin` with the existing exact HTTP(S) origin parser and retains it as `capture.target_origin`; unsupported origins are represented as `null`. The output schema admits this field as optional for compatibility with older saved observations, while current producers always emit string or null. The Evidence projection consumes `capture.target_origin` instead of reinterpreting `capture.target_url`. Browser capture, provider authorization, origin enforcement, and input contracts are unchanged. ## Evidence and regression coverage Coverage now includes: - an empty caller origin list projecting a retained HTTP(S) target origin; - an explicit caller origin list retaining precedence; - `file://` and schema-valid `ftp://host/app` bundle URLs producing no inferred allowed origin; - the bundle producer retaining an HTTP(S) target origin and representing a non-HTTP target origin as null. Before the fix, the FTP regression failed with received `["ftp://host"]` instead of `[]`. After the fix, the focused suites pass. Validation performed on Windows with Node/npm from the repository's pinned setup: - `npm run test:local -- src/application/BrowserEvidence.test.ts src/domain/webBundleAnalyzer.test.ts src/domain/browserObservation.test.ts` — 50 passed. - `npm run check:fast` — passed (2 tasks). - `npm run verify:test-discovery` — all 1,415 test files discovered exactly once. - `npm run check` — passed (6 tasks plus architecture guards; lint reported 0 errors and 1,563 warnings). - `git diff --check` — passed. - `npm run test:changed` — 736 passed, 5 failed, 11 skipped. The five failures are outside the touched browser Evidence/bundle files: Windows path expectations in Doctor/Setup tests, a Ghidra profile environment failure, and a binary-session timing timeout. The focused suites and repository checks above passed. No live browser, real CDP provider, or installed CLI/MCP transport was exercised. Hosted CI must validate the browser/provider lanes available in the repository environment. ## Compatibility and safety - Adds an optional bundle-result `capture.target_origin` fact; older saved observations that omit it remain schema-valid. - No public input, CLI, or MCP contract change. - No expansion of browser capture or allowed-origin authority. - Explicit caller scopes retain precedence. - Non-HTTP bundle URLs cannot become Evidence `allowed_origins`. ## Author readiness Human owner: @XY-code1 - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:12:49 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:46:14 +00:00

[PR #6241] [CLOSED] fix(il2cpp): accept names filters on type references #7219

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6224

No description provided.

Rows
Columns