[PR #4536] fix(javascript): treat exact location-only moves as unchanged #6294

New issue

Open

opened 2026-10-31 01:13:21 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:13:21 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4536
Author: @VarunGore36
Created: 10/16/2026
Status: 🔄 Open

Base: main ← Head: fix/4520-version-location-only-unchanged

📝 Commits (4)

9f555f6 fix(javascript): treat exact location-only moves as unchanged
cabeb41 fix(javascript): cover relocation edge with distinct bundle IDs
f21ee7f fix(javascript): harden relocation rule per review
d133505 test(javascript): align relocation assertion with upstream limitations

📊 Changes

1 file changed (+148 additions, -0 deletions)

View changed files

📝 src/domain/javascript/javascriptApplicationVersionComparison.test.ts (+148 -0)

📄 Description

Summary

Fixes #4520. Version comparisons hid real content changes: 1,123 byte-identical Bitwarden modules all counted as changed, summary unchanged: 0, because every bundle byte-offset shift was a content change.

Problem and expected behavior

A pair matched by exact content / module-source digest whose only differing dimension is location was classified changed. Expected: unchanged with the location dimension retained, since relocation shifts offsets without changing content.

Change and scope

src/domain/javascript/javascriptApplicationVersionItems.ts: exact content, module-source, and node-identity pairs with dimensions exactly ["location"] are unchanged (complete graphs) instead of changed. Retains the location dimension, adds a relocation limitation, emits no changed_from edge.
docs/javascript-application-workflows.md: documents the relocation rule.
Intentionally not included: location-only semantic-key matches (e.g. IPC channels) still report changed; no new moved status/summary bucket (would be breaking).

Contribution scope fit: ordinary fix within existing comparison boundary; maintainer scope decision not applicable.

Contract and boundary impact

Semantic owner and earliest changed stage: domain classifyJavaScriptApplicationVersions / matchedItem.
CLI and MCP/tool-catalog contract: none (same schema, same statuses).
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: items keep dimensions: ["location"] + relocation limitation; change graph omits changed_from for these.
Generated metadata/package/installation impact: none.

Evidence and regression coverage

Tests added or updated: 2 new cases in src/domain/javascript/javascriptApplicationVersionComparison.test.ts (exact-content-digest and exact-module-source-digest location-only moves → unchanged, dimensions: ["location"], summary unchanged: 1, changed: 0, no changed_from edge).
Base reproduction: new tests fail on base (changed instead of unchanged); pass with fix.
Remaining proof gaps: no real Bitwarden 2026.9.1 → 2026.10.0 ASAR pair run here; IPC-channel location-only behavior unchanged by design.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:local -- src/domain/javascript/javascriptApplicationVersionComparison.test.ts src/domain/javascript/javascriptApplicationVersionMatching.test.ts src/domain/javascript/javascriptApplicationVersionRelationships.test.ts — 20 passed
npm run check:fast — clean (typecheck, lint)
npm run docs:check — clean

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: not applicable (domain-only change, synthetic graphs).
Package or release metadata impact: none.
Security, privacy, process, or containment review: none.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4536 **Author:** [@VarunGore36](https://github.com/VarunGore36) **Created:** 10/16/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/4520-version-location-only-unchanged` --- ### 📝 Commits (4) - [`9f555f6`](https://github.com/morluto/rea/commit/9f555f6329843b3c6407e36f33e2f35f8fa4cac9) fix(javascript): treat exact location-only moves as unchanged - [`cabeb41`](https://github.com/morluto/rea/commit/cabeb41e28253b8536a62b5899231d56e6edfbc9) fix(javascript): cover relocation edge with distinct bundle IDs - [`f21ee7f`](https://github.com/morluto/rea/commit/f21ee7f72669c275ecc3f8957f40be9fb3fb522d) fix(javascript): harden relocation rule per review - [`d133505`](https://github.com/morluto/rea/commit/d1335055843a8173d196e4561652893adf2e1cc6) test(javascript): align relocation assertion with upstream limitations ### 📊 Changes **1 file changed** (+148 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/javascriptApplicationVersionComparison.test.ts` (+148 -0) </details> ### 📄 Description ## Summary Fixes #4520. Version comparisons hid real content changes: 1,123 byte-identical Bitwarden modules all counted as `changed`, summary `unchanged: 0`, because every bundle byte-offset shift was a content change. ## Problem and expected behavior A pair matched by exact content / module-source digest whose only differing dimension is `location` was classified `changed`. Expected: `unchanged` with the `location` dimension retained, since relocation shifts offsets without changing content. ## Change and scope - `src/domain/javascript/javascriptApplicationVersionItems.ts`: exact content, module-source, and node-identity pairs with dimensions exactly `["location"]` are `unchanged` (complete graphs) instead of `changed`. Retains the `location` dimension, adds a relocation limitation, emits no `changed_from` edge. - `docs/javascript-application-workflows.md`: documents the relocation rule. - Intentionally not included: location-only `semantic-key` matches (e.g. IPC channels) still report `changed`; no new `moved` status/summary bucket (would be breaking). Contribution scope fit: ordinary fix within existing comparison boundary; maintainer scope decision not applicable. ## Contract and boundary impact - Semantic owner and earliest changed stage: domain `classifyJavaScriptApplicationVersions` / `matchedItem`. - CLI and MCP/tool-catalog contract: none (same schema, same statuses). - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: items keep `dimensions: ["location"]` + relocation limitation; change graph omits `changed_from` for these. - Generated metadata/package/installation impact: none. ## Evidence and regression coverage - Tests added or updated: 2 new cases in `src/domain/javascript/javascriptApplicationVersionComparison.test.ts` (exact-content-digest and exact-module-source-digest location-only moves → `unchanged`, `dimensions: ["location"]`, summary `unchanged: 1, changed: 0`, no `changed_from` edge). - Base reproduction: new tests fail on base (`changed` instead of `unchanged`); pass with fix. - Remaining proof gaps: no real Bitwarden 2026.9.1 → 2026.10.0 ASAR pair run here; IPC-channel location-only behavior unchanged by design. For evidence-bearing changes: - Observed, derived, and inferred claims remain distinguishable. - Artifact identity, source provenance, and failed attempts remain preserved. - Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:local -- src/domain/javascript/javascriptApplicationVersionComparison.test.ts src/domain/javascript/javascriptApplicationVersionMatching.test.ts src/domain/javascript/javascriptApplicationVersionRelationships.test.ts` — 20 passed - `npm run check:fast` — clean (typecheck, lint) - `npm run docs:check` — clean ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable (domain-only change, synthetic graphs). - Package or release metadata impact: none. - Security, privacy, process, or containment review: none. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 01:13:21 +00:00

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425

bsakaguchi referenced this issue

2026-11-01 21:46:34 +00:00

[PR #6294] test(javascript): order the caller abort by frame, not wall clock #7262