[PR #4530] [MERGED] fix(plist): ignore inherited XML entity lookup properties #6290

New issue

Closed

opened 2026-10-31 01:13:19 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:13:19 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4530
Author: @ShuaixinHuang
Created: 10/16/2026
Status: ✅ Merged
Merged: 10/17/2026
Merged by: @morluto

Base: main ← Head: codex/fix-xml-entity-lookup

📝 Commits (9)

2c29081 fix(plist): ignore inherited XML entity lookup properties
06ee45c Merge remote-tracking branch 'origin/main' into codex/fix-xml-entity-lookup
aa62160 test(firmware): assert composed cleanup error evidence
548f228 Merge remote-tracking branch 'origin/main' into codex/fix-xml-entity-lookup
11736d1 Merge commit 'cc2e18a265' into codex/fix-xml-entity-lookup
7847009 test(ghidra): assert cancellation during profile shutdown
c664e74 Merge commit '5112fe07ae' into codex/fix-xml-entity-lookup
a65ff1d test(jeb): retain Linux ownership prerequisite in isolation
c900ab6 Merge commit '5b24399387' into codex/fix-xml-entity-lookup

📊 Changes

2 files changed (+17 additions, -2 deletions)

View changed files

📝 src/domain/propertyListKeys.test.ts (+14 -1)
📝 src/domain/propertyListKeys.ts (+3 -1)

📄 Description

Problem and outcome

The shared XML decoder substituted inherited object properties into unknown entities such as &constructor;. Restrict lookup to the predefined entity table's own entries. Unknown entities remain literal, while numeric and the five predefined entities retain their behavior.

This corrects the decoder contract; its current production consumer scans numeric literal metadata. No public CLI/MCP output difference is claimed. The net diff contains only propertyListKeys.ts and its tests. This branch normally synchronized with upstream 5b243993.

Validation

Current head: c900ab6188fab5d679c793f356adead52351a737.

Five focused files: 61/61 passed (40 decoder, 1 numeric-literal consumer, 9 native plist parser, 2 JEB CLI/MCP acceptance, 9 controlled Java-probe tests).
npm run check: 6/6 tasks plus architecture guards passed. git diff --check passed.
Original decoder regression on main 313a86a3: 1 failed / 39 passed.

Executed with pinned Node 24.18.0/npm 11.16.0 on Windows x64. Java stand-ins do not establish real JVM behavior; no live Apple application or performance claim.

Current-head CI run 39011594487: CI required passed; all 34 listed checks completed successfully or were legitimately skipped. Linux source tests passed and JEB CLI/stdio-MCP acceptance passed 2/2. Greptile reported 5/5, and no unresolved review threads remain.

Human review approved this exact head after independent 49/49 decoder/native-plist tests and four source probe groups. The reviewer explicitly superseded the earlier readiness-only hold: the manually disabled workflow has no status, but is not an additional gate. The three human declarations remain filled.

Sequencing: #4047 remains open and replaces this helper/raw-source scanner with DOM-owned numeric facts. This standalone decoder correction is not cumulative after that refactor; reconcile the helper-specific test/import at integration rather than retaining an obsolete decoder.

Author readiness

Human owner: @ShuaixinHuang

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4530 **Author:** [@ShuaixinHuang](https://github.com/ShuaixinHuang) **Created:** 10/16/2026 **Status:** ✅ Merged **Merged:** 10/17/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/fix-xml-entity-lookup` --- ### 📝 Commits (9) - [`2c29081`](https://github.com/morluto/rea/commit/2c29081935c2c49b38ea3e73030c40f38ec80b26) fix(plist): ignore inherited XML entity lookup properties - [`06ee45c`](https://github.com/morluto/rea/commit/06ee45c6cea31f72314fc472093299a1bd2b6304) Merge remote-tracking branch 'origin/main' into codex/fix-xml-entity-lookup - [`aa62160`](https://github.com/morluto/rea/commit/aa62160a607a10a6d5170a72102c4ae718d5000d) test(firmware): assert composed cleanup error evidence - [`548f228`](https://github.com/morluto/rea/commit/548f2284a4ab4241f3a1294ac5c7cffb7410e1dd) Merge remote-tracking branch 'origin/main' into codex/fix-xml-entity-lookup - [`11736d1`](https://github.com/morluto/rea/commit/11736d131402e5703a606b3a4d81d7a19f2f0321) Merge commit 'cc2e18a265198492dff1587a343bfb802d8c591b' into codex/fix-xml-entity-lookup - [`7847009`](https://github.com/morluto/rea/commit/78470093713630752ba6690e59c842cd2c29858f) test(ghidra): assert cancellation during profile shutdown - [`c664e74`](https://github.com/morluto/rea/commit/c664e7467abebb1acfadef31302246d486101224) Merge commit '5112fe07ae44cc99cb47641d50279efb5595ea71' into codex/fix-xml-entity-lookup - [`a65ff1d`](https://github.com/morluto/rea/commit/a65ff1defce5ab304d43c91a5f60cefcda892923) test(jeb): retain Linux ownership prerequisite in isolation - [`c900ab6`](https://github.com/morluto/rea/commit/c900ab6188fab5d679c793f356adead52351a737) Merge commit '5b243993872c2bcc70cb00060ffb79b347321370' into codex/fix-xml-entity-lookup ### 📊 Changes **2 files changed** (+17 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/propertyListKeys.test.ts` (+14 -1) 📝 `src/domain/propertyListKeys.ts` (+3 -1) </details> ### 📄 Description ## Problem and outcome The shared XML decoder substituted inherited object properties into unknown entities such as &constructor;. Restrict lookup to the predefined entity table's own entries. Unknown entities remain literal, while numeric and the five predefined entities retain their behavior. This corrects the decoder contract; its current production consumer scans numeric literal metadata. No public CLI/MCP output difference is claimed. The net diff contains only propertyListKeys.ts and its tests. This branch normally synchronized with upstream 5b243993. ## Validation Current head: `c900ab6188fab5d679c793f356adead52351a737`. - Five focused files: 61/61 passed (40 decoder, 1 numeric-literal consumer, 9 native plist parser, 2 JEB CLI/MCP acceptance, 9 controlled Java-probe tests). - npm run check: 6/6 tasks plus architecture guards passed. git diff --check passed. - Original decoder regression on main 313a86a3: 1 failed / 39 passed. Executed with pinned Node 24.18.0/npm 11.16.0 on Windows x64. Java stand-ins do not establish real JVM behavior; no live Apple application or performance claim. Current-head [CI run 39011594487](https://github.com/morluto/rea/actions/runs/39011594487): CI required passed; all 34 listed checks completed successfully or were legitimately skipped. Linux source tests passed and JEB CLI/stdio-MCP acceptance passed 2/2. Greptile reported 5/5, and no unresolved review threads remain. [Human review](https://github.com/morluto/rea/pull/4530#pullrequestreview-5556932330) approved this exact head after independent 49/49 decoder/native-plist tests and four source probe groups. The reviewer explicitly superseded the earlier readiness-only hold: the manually disabled workflow has no status, but is not an additional gate. The three human declarations remain filled. Sequencing: #4047 remains open and replaces this helper/raw-source scanner with DOM-owned numeric facts. This standalone decoder correction is not cumulative after that refactor; reconcile the helper-specific test/import at integration rather than retaining an obsolete decoder. ## Author readiness Human owner: @ShuaixinHuang - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:13:19 +00:00