[PR #6246] [CLOSED] fix: correct pcap parent guidance and preserve loader base uncertainty #7223

New issue

Closed

opened 2026-11-01 21:46:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:46:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6246
Author: @ShuaixinHuang
Created: 10/22/2026
Status: ❌ Closed

Base: main ← Head: codex/docs-pcap-analysis-view-parents

📝 Commits (10+)

64afd06 docs(views): include pcap in supported parent guidance
87a96c0 Merge remote-tracking branch 'origin/main' into codex/docs-pcap-analysis-view-parents
25dca0f test: align regression fixtures with current boundary contracts
1697cad Merge branch 'codex/fix-upstream-four-ci-regressions' into codex/docs-pcap-analysis-view-parents
72ee028 Merge remote-tracking branch 'origin/main' into codex/docs-pcap-analysis-view-parents
ab3daf2 fix(javascript): keep unprojected loader bases unknown
bd386b7 Merge remote-tracking branch 'origin/main' into codex/docs-pcap-analysis-view-parents
e971dd8 test: align ELF budgets and lookup ownership expectations
3731a56 test(ida): align literal matching with Unicode case folding
3674773 Merge remote-tracking branch 'origin/main' into codex/docs-pcap-analysis-view-parents

📊 Changes

12 files changed (+115 additions, -22 deletions)

View changed files

📝 src/application/environment/environmentReplayCapacity.test.ts (+2 -2)
📝 src/contracts/analysisViewToolContracts.ts (+1 -1)
📝 src/domain/analysisView/analysisView.ts (+1 -1)
📝 src/domain/javascript/javascriptStaticAnalysisCalls.ts (+4 -1)
📝 src/domain/javascript/javascriptStaticAnalysisLoaderInvocations.test.ts (+9 -0)
📝 src/domain/javascript/sourceToBundleComparison.test.ts (+12 -0)
📝 src/ida/IdaNativeProtocol.test.ts (+7 -1)
📝 src/native/elf/ElfNotesProvider.test.ts (+5 -2)
📝 tests/acceptance/applications/javascriptIndirectLoaderOwners.test.ts (+3 -2)
📝 tests/acceptance/applications/javascriptLiteralLoaderOwnership.ts (+15 -1)
📝 tests/acceptance/peCertificatesCli.test.ts (+36 -2)
📝 tests/boundary/browser/cdpResourceCompleteness.test.ts (+20 -9)

📄 Description

Superseded by main

Closed by the author after comparing the full diff with main 044c9705.

2ebaadfa replaces the two incomplete supported-parent lists with compatible-parent guidance; the contract still explicitly documents inspect_pcap_capture.
ccba355f preserves the alternate createRequire filename base through static facts, workers and graph resolution. f91b7f80 distinguishes resolver discovery from executable loading. These supersede this PR's conservative unknown-base guard and earlier resolver expectations.
Main also corrects managed graph token identity and Markdown formatting-capacity fault injection. The remaining unique assertions are duplicate or optional test strengthening, not unresolved product fixes; they will not be mixed into this PR.

This conclusion is based on source/diff comparison. No complete latest-main CI pass or real-provider run is claimed. Prior validation below describes earlier revisions only.

Historical PR description and validation

## Summary

Fixes #5733. Include pcap capture Evidence in both supported-parent guidance lists. Also preserve an unknown loader reference when the static projection cannot carry a proven createRequire URL base, so its literal is not resolved against the wrong source file.

Scope

The pcap change is wording only; schemas and projection admission are unchanged.
The loader fix adds one guard at the projection boundary, with a regression that fails on the original code. Historical source import handling is unchanged.
Align CI fixtures with current upstream contracts: repeated-query source identity, source-map URL identity, ELF fixed text versus decoded-name budgets, TeletexString compatibility decoding, require.resolve associations, Unicode simple case folding and unknown resource sizes.
Keep malformed certificate rejection, budget refusals and recovery, competing-owner uncertainty, separate CLI/MCP sessions, IDA case-sensitive/regex controls and CDP malformed/empty inventory coverage. Static associations do not establish runtime execution.

The latest synchronization uses upstream 96ea32b7. Preserve its expanded source-map matrix and capacity fixture, plus the existing host-versus-file control and scalar replay source assertion. The two newly exposed CI failures required test-only changes: IDA case-insensitive sigma matches both sigma forms; valid omitted CDP content size remains unknown during comparison. A known-size empty-MIME control still compares unchanged. No new production capability, timeout increase or removed scenario.

Validation performed

Head d8d316d3, Windows x64, pinned Node 24.22.1 and locked dependencies:

Reproduced IDA failure before its correction: 1 failed, 23 passed across IDA protocol/shared matching files. Reproduced CDP failure before its correction: 1 failed, 27 passed across CDP completeness/shared resource comparison files.
After final conflict resolution: all 216 tests passed across 12 files covering IDA protocol/session/shared matching, source-to-bundle comparison, source-map fetching/analysis, sourceMapPrefixCli, CDP completeness/shared resource comparison and environment bundle/replay/capacity. Public source-map cases exercise compiled CLI and real stdio MCP transport. CDP cases include public CLI and production MCP registration with a simulated CDP peer.
npm run check: six tasks, module boundaries and architecture guards passed.
npm run docs:check: six tasks and nine README consistency tests passed.
git diff --check, formatting and normal commit/push hooks passed.
Earlier head e971dd88 completed six CI shards successfully. Its source lane failed only the now-corrected IDA assertion; shard 2 failed only the now-corrected CDP assertion. Shard 3 reported 1,500 tests passed but its job was canceled, so it is not claimed as a successful CI job.
Fresh online CI for this head is pending. Earlier-head and local results do not establish complete current-head Linux CI success. IDA and CDP producers are simulated; no real IDA, browser, signed application, Electron launch or Wireshark acquisition was tested. No performance claim.

Author readiness

Human owner: @ShuaixinHuang

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6246 **Author:** [@ShuaixinHuang](https://github.com/ShuaixinHuang) **Created:** 10/22/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `codex/docs-pcap-analysis-view-parents` --- ### 📝 Commits (10+) - [`64afd06`](https://github.com/morluto/rea/commit/64afd0648677548b553b6e9c436524b455aa3475) docs(views): include pcap in supported parent guidance - [`87a96c0`](https://github.com/morluto/rea/commit/87a96c061f0dbaa94e01974c7e52f4df851b217d) Merge remote-tracking branch 'origin/main' into codex/docs-pcap-analysis-view-parents - [`25dca0f`](https://github.com/morluto/rea/commit/25dca0fc4b907b7f65daababfee432bb20a36061) test: align regression fixtures with current boundary contracts - [`1697cad`](https://github.com/morluto/rea/commit/1697cad4bfd4519aee1ad1e28090a16d29ef9e77) Merge branch 'codex/fix-upstream-four-ci-regressions' into codex/docs-pcap-analysis-view-parents - [`72ee028`](https://github.com/morluto/rea/commit/72ee028082494dd50578cf38244787ac4e6750da) Merge remote-tracking branch 'origin/main' into codex/docs-pcap-analysis-view-parents - [`ab3daf2`](https://github.com/morluto/rea/commit/ab3daf24248c50af3aabc55f43a9abe6e1b01611) fix(javascript): keep unprojected loader bases unknown - [`bd386b7`](https://github.com/morluto/rea/commit/bd386b7c8813296189d2e1645da7ca0e82809e54) Merge remote-tracking branch 'origin/main' into codex/docs-pcap-analysis-view-parents - [`e971dd8`](https://github.com/morluto/rea/commit/e971dd88f363b0d345441bf082e7c1a7d721a081) test: align ELF budgets and lookup ownership expectations - [`3731a56`](https://github.com/morluto/rea/commit/3731a565e836eabe0b71ee99fe6db2e76b9a26e3) test(ida): align literal matching with Unicode case folding - [`3674773`](https://github.com/morluto/rea/commit/3674773e442e998595bda356703cec25fc666ae3) Merge remote-tracking branch 'origin/main' into codex/docs-pcap-analysis-view-parents ### 📊 Changes **12 files changed** (+115 additions, -22 deletions) <details> <summary>View changed files</summary> 📝 `src/application/environment/environmentReplayCapacity.test.ts` (+2 -2) 📝 `src/contracts/analysisViewToolContracts.ts` (+1 -1) 📝 `src/domain/analysisView/analysisView.ts` (+1 -1) 📝 `src/domain/javascript/javascriptStaticAnalysisCalls.ts` (+4 -1) 📝 `src/domain/javascript/javascriptStaticAnalysisLoaderInvocations.test.ts` (+9 -0) 📝 `src/domain/javascript/sourceToBundleComparison.test.ts` (+12 -0) 📝 `src/ida/IdaNativeProtocol.test.ts` (+7 -1) 📝 `src/native/elf/ElfNotesProvider.test.ts` (+5 -2) 📝 `tests/acceptance/applications/javascriptIndirectLoaderOwners.test.ts` (+3 -2) 📝 `tests/acceptance/applications/javascriptLiteralLoaderOwnership.ts` (+15 -1) 📝 `tests/acceptance/peCertificatesCli.test.ts` (+36 -2) 📝 `tests/boundary/browser/cdpResourceCompleteness.test.ts` (+20 -9) </details> ### 📄 Description ## Superseded by main Closed by the author after comparing the full diff with main `044c9705`. - `2ebaadfa` replaces the two incomplete supported-parent lists with compatible-parent guidance; the contract still explicitly documents `inspect_pcap_capture`. - `ccba355f` preserves the alternate createRequire filename base through static facts, workers and graph resolution. `f91b7f80` distinguishes resolver discovery from executable loading. These supersede this PR's conservative unknown-base guard and earlier resolver expectations. - Main also corrects managed graph token identity and Markdown formatting-capacity fault injection. The remaining unique assertions are duplicate or optional test strengthening, not unresolved product fixes; they will not be mixed into this PR. This conclusion is based on source/diff comparison. No complete latest-main CI pass or real-provider run is claimed. Prior validation below describes earlier revisions only. <details><summary>Historical PR description and validation</summary> ## Summary Fixes #5733. Include pcap capture Evidence in both supported-parent guidance lists. Also preserve an unknown loader reference when the static projection cannot carry a proven createRequire URL base, so its literal is not resolved against the wrong source file. ## Scope - The pcap change is wording only; schemas and projection admission are unchanged. - The loader fix adds one guard at the projection boundary, with a regression that fails on the original code. Historical source import handling is unchanged. - Align CI fixtures with current upstream contracts: repeated-query source identity, source-map URL identity, ELF fixed text versus decoded-name budgets, TeletexString compatibility decoding, require.resolve associations, Unicode simple case folding and unknown resource sizes. - Keep malformed certificate rejection, budget refusals and recovery, competing-owner uncertainty, separate CLI/MCP sessions, IDA case-sensitive/regex controls and CDP malformed/empty inventory coverage. Static associations do not establish runtime execution. The latest synchronization uses upstream 96ea32b7. Preserve its expanded source-map matrix and capacity fixture, plus the existing host-versus-file control and scalar replay source assertion. The two newly exposed CI failures required test-only changes: IDA case-insensitive sigma matches both sigma forms; valid omitted CDP content size remains unknown during comparison. A known-size empty-MIME control still compares unchanged. No new production capability, timeout increase or removed scenario. ## Validation performed Head d8d316d3, Windows x64, pinned Node 24.22.1 and locked dependencies: - Reproduced IDA failure before its correction: 1 failed, 23 passed across IDA protocol/shared matching files. Reproduced CDP failure before its correction: 1 failed, 27 passed across CDP completeness/shared resource comparison files. - After final conflict resolution: all 216 tests passed across 12 files covering IDA protocol/session/shared matching, source-to-bundle comparison, source-map fetching/analysis, sourceMapPrefixCli, CDP completeness/shared resource comparison and environment bundle/replay/capacity. Public source-map cases exercise compiled CLI and real stdio MCP transport. CDP cases include public CLI and production MCP registration with a simulated CDP peer. - npm run check: six tasks, module boundaries and architecture guards passed. - npm run docs:check: six tasks and nine README consistency tests passed. - git diff --check, formatting and normal commit/push hooks passed. - Earlier head e971dd88 completed six CI shards successfully. Its source lane failed only the now-corrected IDA assertion; shard 2 failed only the now-corrected CDP assertion. Shard 3 reported 1,500 tests passed but its job was canceled, so it is not claimed as a successful CI job. - Fresh online CI for this head is pending. Earlier-head and local results do not establish complete current-head Linux CI success. IDA and CDP producers are simulated; no real IDA, browser, signed application, Electron launch or Wireshark acquisition was tested. No performance claim. ## Author readiness Human owner: @ShuaixinHuang - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:46:16 +00:00