morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #5196] [MERGED] fix(javascript): match unchanged module exports across application versions #6808

New issue

Closed

opened 2026-11-01 21:43:10 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:43:10 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5196
Author: @rodricksz4h5
Created: 10/19/2026
Status: ✅ Merged
Merged: 10/22/2026
Merged by: @morluto

Base: main ← Head: fix/version-compare-exports

📝 Commits (3)

95bbff5 fix(javascript): match unchanged module exports across application versions
f944680 style(javascript): format the version-matching export test
156ccee Merge branch 'main' into fix/version-compare-exports

📊 Changes

2 files changed (+109 additions, -0 deletions)

View changed files

📝 src/domain/javascript/javascriptApplicationVersionKeys.ts (+12 -0)
📝 tests/acceptance/applications/applicationVersionMatchingCli.test.ts (+97 -0)

📄 Description

Summary

Fixes #5195

compare-application-versions reported every export of an unchanged file as removed and added, and the modules exposing them as unknown, whenever any file differed between the versions. The exact module-source-digest tier now pairs an export binding by its own file's bytes and exported name, as it already pairs a source module (#3188).

Problem and expected behavior

An export node's identity is artifactLocalIdentity(file.sha256, "module-export", compositeKey([file.container_sha256, file.path, exportedName])); container_sha256 is the whole application root's digest, so the node id changes with any sibling. moduleSourceDigestKey matched only nodes carrying source_sha256 (source modules) and semanticKey skips javascript-module, so no tier paired export bindings. Expected: an export of a byte-identical file is unchanged, like that file's source module.

Change and scope

src/domain/javascript/javascriptApplicationVersionKeys.ts: for a javascript-module node with an artifact-local-key identity in the module-export namespace, moduleSourceDigestKey returns module-export\0<identity.artifact_sha256>\0<exported_name>. artifact_sha256 is the export's own file digest (file.sha256), already on the identity. The tier stays exact and unique-only, so duplicated files stay ambiguous, as for source modules.
Not included, by design of the existing tier: exports of an edited file stay unmatched (pairing those by path and name would be a new semantic tier). The root artifact node, which also never pairs across versions, is a separate gap.
The producer is unchanged. Adding source_sha256 to export nodes instead would also feed javascriptRuntimeStaticCandidates' module-source-sha256 candidates, so every export would compete with its module for a runtime script digest.

Follow the contribution scope.
Scope decision: not applicable (ordinary fix within existing boundaries).

Contract and boundary impact

Semantic owner and earliest changed stage: application-version matching keys (javascriptApplicationVersionKeys.ts).
Contribution scope fit and linked maintainer decision: not applicable.
CLI and MCP/tool-catalog contract: no schema change; more items unchanged with basis exact-module-source-digest.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: comparison items only; analysis graphs are unchanged.
Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Expected effects:

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added or updated: tests/acceptance/applications/applicationVersionMatchingCli.test.ts, matches unchanged module exports after a sibling file changes (public CLI, analyze then compare): with only package.json changed, every export is unchanged with basis exact-module-source-digest and no javascript-module item is anything but unchanged; with src/util.js edited, its export stays removed. With javascriptApplicationVersionKeys.ts reverted (and the CLI rebuilt) it fails: the exports are unmatched / removed.
Base reproduction (executed), REA built from source on Linux, the issue's two copies (only package.json differs):

`javascript-module` items	main `2e5171e3`	this PR
summary	`summary {"unchanged":1,"added":3,"removed":3,"changed":2,"unknown":4}`	`{"unchanged":5,"added":1,"removed":1,"changed":2,"unknown":2}`
exports	each `removed` + `added`, basis `none`	`unchanged`, `exact-module-source-digest`
modules	`unknown`	`unchanged`, `exact-module-source-digest`

The remaining added/removed/unknown items are the root artifact node and its assets, which never pair across versions (a separate gap).

User-visible CLI/MCP output (if applicable): above.
Remaining proof gaps: MCP not run separately (it calls the same domain function); ASAR roots not run separately.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Linux, node:24.18.0-bookworm, npm ci and npm run build:cached:

npx vitest run tests/acceptance/applications/applicationVersionMatchingCli.test.ts — 4 passed
npx vitest run src/domain/javascript tests/acceptance/applications tests/boundary/filesystem/javascript-applications tests/boundary/mcp — 3903 passed, 2 failed in 4 files: hopperPublisherRejectionCli (Hopper launcher in a Linux container), contractPresentation and toolSchemaValidity (fail to load, the same with this PR's source reverted to main), and processSnapshotCleanupMcp (passed 3/3 on rerun with this PR)
CI: the failing Source tests, Test shards and Portable tests are ProcessCaptureObservation and filesystemSnapshotRaces cancellation tests, which fail the same way in main's CI at 2e5171e3
npm run check:fast — pass; oxfmt --check on the changed files — pass; npm run verify:test-discovery — all 1632 test files once

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: not applicable.
Package or release metadata impact: none.
Security, privacy, process, or containment review: none.

Author readiness

Human owner: @rodricksz4h5

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

Maintainer blocker verification

The automated summary has no attached actionable finding; the adjacent Codex message reports review usage limits. Exact-head source review and the public CLI regression confirm unchanged file exports match while edited-file exports remain unmatched. On Node 24.18.0/npm 11.16.0, applicationVersionMatchingCli.test.ts passed 4/4 and check:fast passed. No source correction was needed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5196 **Author:** [@rodricksz4h5](https://github.com/rodricksz4h5) **Created:** 10/19/2026 **Status:** ✅ Merged **Merged:** 10/22/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/version-compare-exports` --- ### 📝 Commits (3) - [`95bbff5`](https://github.com/morluto/rea/commit/95bbff5c296685957fc89809a7eeb04a455dec2e) fix(javascript): match unchanged module exports across application versions - [`f944680`](https://github.com/morluto/rea/commit/f9446809ae1db9b5fbe5df6737f1faca9dc241a5) style(javascript): format the version-matching export test - [`156ccee`](https://github.com/morluto/rea/commit/156cceef47ae877834b70c7a44506b46a6f1e0e6) Merge branch 'main' into fix/version-compare-exports ### 📊 Changes **2 files changed** (+109 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/javascriptApplicationVersionKeys.ts` (+12 -0) 📝 `tests/acceptance/applications/applicationVersionMatchingCli.test.ts` (+97 -0) </details> ### 📄 Description ## Summary Fixes #5195 `compare-application-versions` reported every export of an unchanged file as `removed` and `added`, and the modules exposing them as `unknown`, whenever any file differed between the versions. The exact module-source-digest tier now pairs an export binding by its own file's bytes and exported name, as it already pairs a source module (#3188). ## Problem and expected behavior An export node's identity is `artifactLocalIdentity(file.sha256, "module-export", compositeKey([file.container_sha256, file.path, exportedName]))`; `container_sha256` is the whole application root's digest, so the node id changes with any sibling. `moduleSourceDigestKey` matched only nodes carrying `source_sha256` (source modules) and `semanticKey` skips `javascript-module`, so no tier paired export bindings. Expected: an export of a byte-identical file is `unchanged`, like that file's source module. ## Change and scope - `src/domain/javascript/javascriptApplicationVersionKeys.ts`: for a `javascript-module` node with an `artifact-local-key` identity in the `module-export` namespace, `moduleSourceDigestKey` returns `module-export\0<identity.artifact_sha256>\0<exported_name>`. `artifact_sha256` is the export's own file digest (`file.sha256`), already on the identity. The tier stays exact and unique-only, so duplicated files stay ambiguous, as for source modules. - Not included, by design of the existing tier: exports of an edited file stay unmatched (pairing those by path and name would be a new semantic tier). The root `artifact` node, which also never pairs across versions, is a separate gap. - The producer is unchanged. Adding `source_sha256` to export nodes instead would also feed `javascriptRuntimeStaticCandidates`' `module-source-sha256` candidates, so every export would compete with its module for a runtime script digest. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Scope decision: not applicable (ordinary fix within existing boundaries). ## Contract and boundary impact - Semantic owner and earliest changed stage: application-version matching keys (`javascriptApplicationVersionKeys.ts`). - Contribution scope fit and linked maintainer decision: not applicable. - CLI and MCP/tool-catalog contract: no schema change; more items `unchanged` with basis `exact-module-source-digest`. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: comparison items only; analysis graphs are unchanged. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `tests/acceptance/applications/applicationVersionMatchingCli.test.ts`, `matches unchanged module exports after a sibling file changes` (public CLI, analyze then compare): with only `package.json` changed, every export is `unchanged` with basis `exact-module-source-digest` and no `javascript-module` item is anything but `unchanged`; with `src/util.js` edited, its export stays `removed`. With `javascriptApplicationVersionKeys.ts` reverted (and the CLI rebuilt) it fails: the exports are `unmatched` / `removed`. - Base reproduction (executed), REA built from source on Linux, the issue's two copies (only `package.json` differs): | `javascript-module` items | main 2e5171e3 | this PR | | --- | --- | --- | | summary | `summary {"unchanged":1,"added":3,"removed":3,"changed":2,"unknown":4}` | `{"unchanged":5,"added":1,"removed":1,"changed":2,"unknown":2}` | | exports | each `removed` + `added`, basis `none` | `unchanged`, `exact-module-source-digest` | | modules | `unknown` | `unchanged`, `exact-module-source-digest` | The remaining `added`/`removed`/`unknown` items are the root `artifact` node and its assets, which never pair across versions (a separate gap). - User-visible CLI/MCP output (if applicable): above. - Remaining proof gaps: MCP not run separately (it calls the same domain function); ASAR roots not run separately. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Linux, `node:24.18.0-bookworm`, `npm ci` and `npm run build:cached`: - `npx vitest run tests/acceptance/applications/applicationVersionMatchingCli.test.ts` — 4 passed - `npx vitest run src/domain/javascript tests/acceptance/applications tests/boundary/filesystem/javascript-applications tests/boundary/mcp` — 3903 passed, 2 failed in 4 files: `hopperPublisherRejectionCli` (Hopper launcher in a Linux container), `contractPresentation` and `toolSchemaValidity` (fail to load, the same with this PR's source reverted to main), and `processSnapshotCleanupMcp` (passed 3/3 on rerun with this PR) - CI: the failing Source tests, Test shards and Portable tests are `ProcessCaptureObservation` and `filesystemSnapshotRaces` cancellation tests, which fail the same way in main's CI at 2e5171e3 - `npm run check:fast` — pass; `oxfmt --check` on the changed files — pass; `npm run verify:test-discovery` — all 1632 test files once ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none. ## Author readiness Human owner: @rodricksz4h5 - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims.  ### Maintainer blocker verification The automated summary has no attached actionable finding; the adjacent Codex message reports review usage limits. Exact-head source review and the public CLI regression confirm unchanged file exports match while edited-file exports remain unmatched. On Node 24.18.0/npm 11.16.0, applicationVersionMatchingCli.test.ts passed 4/4 and check:fast passed. No source correction was needed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:43:10 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6808

No description provided.

Rows
Columns