[PR #4646] [MERGED] fix(javascript): keep directory-form HTML URL references distinct from files #6339

Closed
opened 2026-10-31 01:13:41 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4646
Author: @viniciusdsandrade
Created: 10/17/2026
Status: ✅ Merged
Merged: 10/22/2026
Merged by: @morluto

Base: main ← Head: fix/javascript-html-directory-url-candidates


📝 Commits (3)

  • 3b5f01e fix(javascript): keep directory-form HTML URL references distinct from files
  • 3e3509d test(javascript): cover directory-form HTML URL references
  • 4102bc2 Merge remote-tracking branch 'upstream/main' into fix/javascript-html-directory-url-candidates

📊 Changes

3 files changed (+56 additions, -24 deletions)

View changed files

📝 src/application/javascript/JavaScriptArtifactPathResolution.test.ts (+14 -12)
📝 src/application/javascript/JavaScriptArtifactPathResolution.ts (+25 -12)
📝 src/application/javascript/JavaScriptHtmlBaseResolution.test.ts (+17 -0)

📄 Description

Summary

Fixes #3882

Keep directory-form HTML URL references (app.js/, app.js/., app.js/..) unresolved with resolution_status: "not-found" instead of resolving them to an existing application file at the stripped path.

Problem and expected behavior

In JavaScriptArtifactPathResolution, htmlCandidate only passed its candidate through exactUrlPathCandidate when declaredPath === "" with a non-empty htmlBaseHref. Root-relative HTML references (declaredPath.startsWith("/")), relative HTML references without a <base href>, and non-empty HTML references resolved against a <base href> bypassed exactUrlPathCandidate. Because posix.normalize("dist/worker.js/.") collapses to "dist/worker.js", <script src="./worker.js/."> or <script src="./worker.js/"> resolved to dist/worker.js, whereas url-reference and ESM module URL resolution kept directory-form URLs distinct from files.

Expected behavior: directory-form HTML URL references remain unresolved (resolution_status: "not-found", resolved_path: null) with the directory limitation message across root-relative, document-relative, and <base href>-relative paths.

Change and scope

  • src/application/javascript/JavaScriptArtifactPathResolution.ts: pass root-relative, document-relative, and <base href>-relative HTML path candidates through exactUrlPathCandidate, and allow exactUrlPathCandidate to forward non-string CandidateResolution values unchanged.
  • src/application/javascript/JavaScriptArtifactPathResolution.test.ts and src/application/javascript/JavaScriptHtmlBaseResolution.test.ts: verify that directory-form HTML references remain not-found with and without <base href>.
  • Not included: changes to url-reference, module-specifier, or source-map path resolution.

Contract and boundary impact

  • Semantic owner and earliest changed stage: htmlCandidate in src/application/javascript/JavaScriptArtifactPathResolution.ts.
  • Contribution scope fit and linked maintainer decision: not applicable (bug fix within existing JavaScript artifact path resolution).
  • CLI and MCP/tool-catalog contract: unchanged schemas; directory-form HTML script references now report resolution_status: "not-found" and resolved_path: null.
  • Provider, bridge, target-format, or platform compatibility: JavaScript and HTML artifact path resolution across all platforms.
  • Evidence, artifact, provenance, or reconstruction contract: HTML references with directory URL semantics no longer claim resolution to a file.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated:
    • src/application/javascript/JavaScriptArtifactPathResolution.test.ts: extends "keeps directory-form URLs distinct from files: %s" to cover html-reference alongside url-reference.
    • src/application/javascript/JavaScriptHtmlBaseResolution.test.ts: covers directory-form HTML references resolved against a <base href>.
  • Base reproduction or other evidence: source-derived. On the base revision, htmlCandidate returns urlRelativeCandidate(..., declaredPath) and urlPathCandidate(applyUrlReference(...)) directly without exactUrlPathCandidate, allowing resolveExactFile to match dist/worker.js or assets/app.js.
  • User-visible CLI/MCP output (if applicable): HTML references whose URL path has directory form report resolution_status: "not-found" and limitation "The HTML reference resolves to directory <dir>, not an exact selected application file."
  • Remaining proof gaps: none beyond the deterministic unit suite run by CI.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • No local test commands were run: verification is source-derived; CI executes the test suite.

Compatibility, safety, and release

  • Breaking changes or migration steps: none.
  • Real Hopper/Ghidra, browser, or OS coverage: none run.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no change to process ownership or target handling.

Author readiness

Human owner: @viniciusdsandrade

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4646 **Author:** [@viniciusdsandrade](https://github.com/viniciusdsandrade) **Created:** 10/17/2026 **Status:** ✅ Merged **Merged:** 10/22/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/javascript-html-directory-url-candidates` --- ### 📝 Commits (3) - [`3b5f01e`](https://github.com/morluto/rea/commit/3b5f01eea054468b34287c02029e1409343516cc) fix(javascript): keep directory-form HTML URL references distinct from files - [`3e3509d`](https://github.com/morluto/rea/commit/3e3509da3d61a89b80268a37799fa113a8aaafd2) test(javascript): cover directory-form HTML URL references - [`4102bc2`](https://github.com/morluto/rea/commit/4102bc2132c09650972ca4e99f93a80171ae7819) Merge remote-tracking branch 'upstream/main' into fix/javascript-html-directory-url-candidates ### 📊 Changes **3 files changed** (+56 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `src/application/javascript/JavaScriptArtifactPathResolution.test.ts` (+14 -12) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.ts` (+25 -12) 📝 `src/application/javascript/JavaScriptHtmlBaseResolution.test.ts` (+17 -0) </details> ### 📄 Description ## Summary Fixes #3882 Keep directory-form HTML URL references (`app.js/`, `app.js/.`, `app.js/..`) unresolved with `resolution_status: "not-found"` instead of resolving them to an existing application file at the stripped path. ## Problem and expected behavior In `JavaScriptArtifactPathResolution`, `htmlCandidate` only passed its candidate through `exactUrlPathCandidate` when `declaredPath === ""` with a non-empty `htmlBaseHref`. Root-relative HTML references (`declaredPath.startsWith("/")`), relative HTML references without a `<base href>`, and non-empty HTML references resolved against a `<base href>` bypassed `exactUrlPathCandidate`. Because `posix.normalize("dist/worker.js/.")` collapses to `"dist/worker.js"`, `<script src="./worker.js/.">` or `<script src="./worker.js/">` resolved to `dist/worker.js`, whereas `url-reference` and ESM module URL resolution kept directory-form URLs distinct from files. Expected behavior: directory-form HTML URL references remain unresolved (`resolution_status: "not-found"`, `resolved_path: null`) with the directory limitation message across root-relative, document-relative, and `<base href>`-relative paths. ## Change and scope - `src/application/javascript/JavaScriptArtifactPathResolution.ts`: pass root-relative, document-relative, and `<base href>`-relative HTML path candidates through `exactUrlPathCandidate`, and allow `exactUrlPathCandidate` to forward non-string `CandidateResolution` values unchanged. - `src/application/javascript/JavaScriptArtifactPathResolution.test.ts` and `src/application/javascript/JavaScriptHtmlBaseResolution.test.ts`: verify that directory-form HTML references remain `not-found` with and without `<base href>`. - Not included: changes to `url-reference`, `module-specifier`, or `source-map` path resolution. ## Contract and boundary impact - Semantic owner and earliest changed stage: `htmlCandidate` in `src/application/javascript/JavaScriptArtifactPathResolution.ts`. - Contribution scope fit and linked maintainer decision: not applicable (bug fix within existing JavaScript artifact path resolution). - CLI and MCP/tool-catalog contract: unchanged schemas; directory-form HTML script references now report `resolution_status: "not-found"` and `resolved_path: null`. - Provider, bridge, target-format, or platform compatibility: JavaScript and HTML artifact path resolution across all platforms. - Evidence, artifact, provenance, or reconstruction contract: HTML references with directory URL semantics no longer claim resolution to a file. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: - `src/application/javascript/JavaScriptArtifactPathResolution.test.ts`: extends `"keeps directory-form URLs distinct from files: %s"` to cover `html-reference` alongside `url-reference`. - `src/application/javascript/JavaScriptHtmlBaseResolution.test.ts`: covers directory-form HTML references resolved against a `<base href>`. - Base reproduction or other evidence: source-derived. On the base revision, `htmlCandidate` returns `urlRelativeCandidate(..., declaredPath)` and `urlPathCandidate(applyUrlReference(...))` directly without `exactUrlPathCandidate`, allowing `resolveExactFile` to match `dist/worker.js` or `assets/app.js`. - User-visible CLI/MCP output (if applicable): HTML references whose URL path has directory form report `resolution_status: "not-found"` and limitation `"The HTML reference resolves to directory <dir>, not an exact selected application file."` - Remaining proof gaps: none beyond the deterministic unit suite run by CI. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - No local test commands were run: verification is source-derived; CI executes the test suite. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: none run. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no change to process ownership or target handling. ## Author readiness Human owner: @viniciusdsandrade - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 01:13:41 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#6339
No description provided.