[PR #4453] [CLOSED] fix(analysis): require an exact modelContext receiver segment for WebMCP declarations #6251

New issue

Closed

opened 2026-10-31 01:13:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:13:03 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4453
Author: @hemv-857
Created: 10/16/2026
Status: ❌ Closed

Base: main ← Head: fix-4205-webmcp-receiver-segment

📝 Commits (1)

cd4a445 fix(analysis): require an exact modelContext receiver segment for WebMCP declarations

📊 Changes

2 files changed (+24 additions, -2 deletions)

View changed files

📝 src/domain/webBundleAnalyzer.test.ts (+18 -0)
📝 src/domain/webBundleAnalyzerInspection.ts (+6 -2)

📄 Description

What

Fixes #4205. The static WebMCP declaration matcher produced false page-declared tool entries for any receiver identifier whose spelling ended in modelContext.

Why

webBundleAnalyzerInspection.ts used name.endsWith("modelContext.registerTool"), so appmodelContext.registerTool(...) and app.analyticsmodelContext.registerTool(...) both matched and contributed untrusted tool catalog entries. Issue #4205 documents the requirement: the receiver must own the exact member name modelContext; a suffix inside a longer identifier is an unrelated object.

How

Match the callee path by exact segment: split on ., require the segment before registerTool to be exactly modelContext (bare modelContext.registerTool and nested document.modelContext.registerTool / navigator.modelContext.registerTool keep matching).
New test covers the two false-positive receivers plus bare, nested, and navigator controls in one declaration pass.

Tests

npm run test:focused -- src/domain/webBundleAnalyzer.test.ts — 38 passed (new test RED without the fix, GREEN with it)
Existing controls preserved: optional member/call chaining, literal-computed ["registerTool"], dynamic computed member stays empty, renamed member stays empty
npm run check:fast — typecheck + lint pass

Author readiness (owner must complete)

I reviewed this change and I am ready for it to be reviewed.
I understand that AI-generated changes may still contain errors and that this change must receive human review before it can be merged.
I have run any relevant local verification commands.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4453 **Author:** [@hemv-857](https://github.com/hemv-857) **Created:** 10/16/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix-4205-webmcp-receiver-segment` --- ### 📝 Commits (1) - [`cd4a445`](https://github.com/morluto/rea/commit/cd4a44598576d4200dacc24f139619902b7380f5) fix(analysis): require an exact modelContext receiver segment for WebMCP declarations ### 📊 Changes **2 files changed** (+24 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/webBundleAnalyzer.test.ts` (+18 -0) 📝 `src/domain/webBundleAnalyzerInspection.ts` (+6 -2) </details> ### 📄 Description ## What Fixes #4205. The static WebMCP declaration matcher produced false page-declared tool entries for any receiver identifier whose spelling ended in `modelContext`. ## Why `webBundleAnalyzerInspection.ts` used `name.endsWith("modelContext.registerTool")`, so `appmodelContext.registerTool(...)` and `app.analyticsmodelContext.registerTool(...)` both matched and contributed untrusted tool catalog entries. Issue #4205 documents the requirement: the receiver must own the exact member name `modelContext`; a suffix inside a longer identifier is an unrelated object. ## How - Match the callee path by exact segment: split on `.`, require the segment before `registerTool` to be exactly `modelContext` (bare `modelContext.registerTool` and nested `document.modelContext.registerTool` / `navigator.modelContext.registerTool` keep matching). - New test covers the two false-positive receivers plus bare, nested, and navigator controls in one declaration pass. ## Tests - `npm run test:focused -- src/domain/webBundleAnalyzer.test.ts` — 38 passed (new test RED without the fix, GREEN with it) - Existing controls preserved: optional member/call chaining, literal-computed `["registerTool"]`, dynamic computed member stays empty, renamed member stays empty - `npm run check:fast` — typecheck + lint pass ## Author readiness (owner must complete) - [ ] I reviewed this change and I am ready for it to be reviewed. - [ ] I understand that AI-generated changes may still contain errors and that this change must receive human review before it can be merged. - [ ] I have run any relevant local verification commands. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:13:03 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6251

No description provided.

Rows
Columns