morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #7117] [MERGED] fix(javascript): bind defaulted and destructured Webpack factory roles #7655

New issue

Closed

opened 2026-11-03 13:39:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 13:39:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7117
Author: @kaoru0822-kitauji
Created: 10/25/2026
Status: ✅ Merged
Merged: 10/25/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/webpack-factory-param-patterns

📝 Commits (3)

a90f4ec fix(javascript): bind defaulted and destructured Webpack factory roles
4eb9765 fix(javascript): keep factory receivers through unordered reads
ae6efce fix(javascript): treat never-run factory parameter defaults as dead code

📊 Changes

10 files changed (+569 additions, -119 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+11 -2)
📝 src/domain/javascript/javascriptAstFingerprint.ts (+100 -60)
📝 src/domain/javascript/javascriptBundledRequireOrigin.ts (+21 -15)
➕ src/domain/javascript/javascriptBundlerFactoryRoles.ts (+149 -0)
📝 src/domain/javascript/javascriptFactoryExportRoles.test.ts (+212 -0)
📝 src/domain/javascript/javascriptStaticAnalysis.ts (+2 -0)
📝 src/domain/javascript/javascriptStaticAnalysisBundler.ts (+22 -31)
📝 src/domain/javascript/javascriptStaticAnalysisHelpers.ts (+0 -9)
📝 src/domain/javascript/javascriptStaticAnalysisState.ts (+5 -2)
📝 tests/acceptance/applications/webpackRenamedExportsCli.test.ts (+47 -0)

📄 Description

What broke: A Webpack factory whose module parameter was defaulted (e = {}) or destructured ({exports: x}) reported exports: [] as observed / exact, with complete coverage. The runtime exposes ["defaulted"] and ["destructured"].
Fix: Factory roles (module, exports, loader) are now bound by position, once, in a new javascriptBundlerFactoryRoles. Defaults are unwrapped and {exports: alias} binds alias to module.exports. Any other role pattern gets no role and adds an unknown finding, so the file reports partial coverage instead of an exact empty list. An export-shaped write whose receiver read cannot be ordered is also counted as unknown, never silently dropped. Role-parameter defaults never run under the convention, so they yield no facts.
Risk: Low. Behavior changes only for factories with non-identifier, defaulted or repeated role parameters, or with an export write whose receiver read cannot be ordered against a replacement. Those files now report partial coverage where they used to claim complete. Whether real bundlers emit these shapes is unverified.

Summary

Fixes #7113. Found while checking related cases for #3551, which no longer reproduces on main.

Before this change, recoverBundlerModule assigned a role only when the parameter at that position was a plain Identifier. A defaulted or destructured module parameter therefore had no role. Its writes went unrecognized, and nothing recorded that the role was unresolved.

Problem and expected behavior

Smallest trigger, at main bc143125e:

globalThis.webpackChunkApp.push([[1], {
  111(e = {}, t) { e.exports = {defaulted: 1}; },
  112({exports: x}, t) { x.destructured = 1; }
}]);

The violated rule: an empty export list must not be reported as an exact, complete fact when the module receiver was never resolved.

Change and scope

New owner, src/domain/javascript/javascriptBundlerFactoryRoles.ts. It binds roles by runtime position: Webpack/Rspack use module, exports, loader; esbuild CommonJS uses exports, module. Spelling is never used.
- A defaulted module or exports parameter keeps its role. The calling convention always passes that argument, so the default never runs. The defaults are recorded in unusedDefaults, and withoutUnusedFactoryDefaults removes them from the binding facts before write ordering. A defaulted parameter is therefore ordered exactly like a plain one inside loops, nested blocks, try and closures.
- {exports: alias}, {exports}, {"exports": alias} and {exports: alias = …} in the module position add alias to the exports role. That role is now a list. Other static keys cannot reach module.exports and are ignored.
- A sloppy-mode repeated parameter name binds its last argument. For example, in function (e, t, e) the name e is not the module.
- These patterns get no role and set exact: false:
  - a rest parameter
  - an object rest
  - an array pattern
  - a nested or computed key
  - an exports-position pattern
  - a defaulted or destructured loader
recoverBundlerModule adds one unknown finding when roles are not exact. This uses the existing mechanism, the same one that handles a computed module key. As a result parse_status is partial, the file's observations get partial coverage, and the existing "remain unknown" limitation is attached.
Never-run defaults are dead code. The role owner records the default of every role parameter (module, exports, loader, a destructured {exports: x} = … or a nested {exports: x = …}) in unusedDefaults. recoverBundlerModule adds them to accumulator.unusedFactoryDefaults, and three walks skip those subtrees: the static source traversal (references, loader require calls, n.e chunk references), the export collector and the async-chunk walk. Before, a write in a default could be reported as an export, and (e = n(5), t, n) reported a require reference to 5. Defaults of later, non-role parameters still run and are still reported. The separate semantic IR/graph still describes the default's syntax, as it does for any code that is never called.
Unordered reads are reported, not dropped. Receiver matching has three outcomes: role, unresolved or none. An export-shaped write whose receiver or loader read is unresolved counts in StaticExports.unknown, and finishBundlerExports adds that to the unknown findings. Before, such writes were dropped with complete coverage, for plain parameters too, e.g. for (…) { e.exports.a = 1; e = {exports: {}}; }. A non-export write such as e.id = 1 is not counted.
Every consumer now uses the parsed roles:
- collectJavaScriptExports
- factory_require_name and the loader binding ID. The superseded factoryRequireName helper is removed.
- The standalone-bootstrap loader and externalSpecifier in javascriptBundledRequireOrigin.ts. These read factory.params[n] directly and kept their own duplicate-name check; both are replaced.
Defaulted loader stays unknown. Loader calls are classified through the binding's own value facts in semanticFactoryLoaderMemberAt and the member-mutation index. Those cannot yet discount a default that never runs, so a defaulted loader is reported as unknown rather than resolved. Changing that would mean editing semantic indexing files, which is out of scope here.
Granularity: coverage is per file, not per module. There is no per-module export-coverage field, and adding one would change the contract.
Not addressed (already present on main, unchanged here, and the same for plain parameters):
- exports written through this (Webpack calls factories with this === module.exports) or through arguments[n]
- Object.assign(exports, …)
- exports declared in a catch block that never runs are still listed, because names describe recognized declarations
Contribution scope: an ordinary fix within existing boundaries; no maintainer scope decision needed.

Contract and boundary impact

Semantic owner and earliest changed stage: javascriptBundlerFactoryRoles (domain), during bundler module recovery. Consumers: the export collector, the factory require name and loader binding, and the standalone-bootstrap loader and externals. The superseded identifierAt, factoryRequireName and per-site params[n] reads are removed.
Contribution scope fit and linked maintainer decision: not applicable.
CLI and MCP/tool-catalog contract: no schema change. Values change only for the affected shapes: exports, factory_require_name, and the coverage/limitations of files with unresolved role patterns.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: unresolved role patterns now give partial coverage rather than complete.
Target selection, authority, upstream behavior, and cleanup details: not applicable.
Generated metadata, package, or installation impact: none.
Read existing files or captured data.

Evidence and regression coverage

Tests added or updated:
- src/domain/javascript/javascriptFactoryExportRoles.test.ts:
  - 25 shapes compared against a runtime oracle. The oracle runs the inert fixture factory under Webpack's calling convention and lists Object.getOwnPropertyNames(module.exports). The shapes cover renamed, defaulted and destructured parameters, nested-function and block shadows, rebinding, a second-position module, arrow and function factories, Object.defineProperty and n.d.
  - 40 control-flow oracle cases: (e, t), (e = {}, t), (e, t = {}) and ({exports: x}, t), each with for…of, for, for…in, while, do…while, try…finally, nested blocks, arrow and declared closures, and a conditional write.
  - A repeated-name case, and a non-export write with an unordered replacement, which must stay complete.
  - 13 never-run default cases checked against a runtime oracle that records every loader and n.e call. The cases cover writes, Object.defineProperty, n.d, n(…) and n.e(…) inside module, exports, loader and destructured defaults, plus two controls where non-role defaults run.
  - 15 unresolved cases, each of which must give partial with exactly one unknown finding: 9 role patterns plus 6 unordered receiver or loader reads.
- tests/acceptance/applications/webpackRenamedExportsCli.test.ts, run through CLI and stdio MCP:
  - defaulted factory → ["defaulted"], coverage complete
  - destructured factory → ["destructured"], coverage complete
  - a defaulted factory writing inside a for…of loop → ["loop"], coverage complete (the review case)
  - a rest-parameter factory in another file → [] with partial coverage
Base failure: at main, 20 of the then-41 tests in javascriptFactoryExportRoles.test.ts fail. At the first PR commit (a90f4ec36), 24 of the current 88 fail: 18 defaulted control-flow cases and 6 unresolved reads. At 4eb9765c3, the 11 non-control never-run default cases fail. With the current head, all 101 pass.

User-visible CLI output: below, for the #7113 fixture plus control 101(e, t) { e.exports = {parse: …}; }. Same command, node scripts/rea.mjs analyze-javascript-application <dir> --format json:

Module	Before (`bc143125e`)	After
101	`["parse"]` exact, complete	`["parse"]` exact, complete
111	`[]` exact, complete	`["defaulted"]` exact, complete
112	`[]` exact, complete	`["destructured"]` exact, complete

The #3551 15-factory fixture now matches the oracle for all 15 factories; before, 13 matched.

Credit: the oracle-comparison approach and several shadowing and defaulted cases come from #3552 (dakjdakd) and its review.
Remaining proof gaps:
- Whether Webpack, Rspack, esbuild or minifiers ever emit these parameter shapes is unverified; no survey of real bundles was done.
- No real-app benchmark was run. The change adds one scan of a factory's at most three role parameters.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Local runs on macOS, Node 26.5.0 (below the engines range; run with npm_config_engine_strict=false):

vitest run --maxWorkers=2 src/domain/javascript src/application/javascript src/javascript: 190 files, 4888 tests passed (head ae6efce20).
npm run test:focused -- on the following 7 files: 57 tests passed.
- tests/acceptance/applications/webpackRenamedExportsCli.test.ts
- tests/boundary/filesystem/javascript-applications/javascriptBundlerAdapters.test.ts
- tests/boundary/cli/javascriptBundlerRuntimeScopes.test.ts
- tests/boundary/cli/javascriptBundlerSelfReferences.test.ts
- tests/acceptance/applications/bundlerCallbackMetadataCli.test.ts
- tests/acceptance/applications/typescriptThisParametersCli.test.ts
- tests/acceptance/applications/applicationWorkflowCli.test.ts
vitest run src/domain/javascript/javascriptFactoryExportRoles.test.ts: 101 passed. With the dead-default fix stashed: 11 failed. With the earlier unordered-read fix stashed: 24 failed.
npm run check:fast: passed (typecheck and lint).
npm run format:check: passed.
npm run docs:check: passed.
CLI repro above: before and after outputs as shown.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: not applicable; static JavaScript analysis only.
Package or release metadata impact: none.
Security, privacy, process, or containment review: no target execution. The runtime oracle in the tests runs only the inert fixture strings, in node:vm.

Author readiness

Human owner: @kaoru0822-kitauji

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7117 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/25/2026 **Status:** ✅ Merged **Merged:** 10/25/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/webpack-factory-param-patterns` --- ### 📝 Commits (3) - [`a90f4ec`](https://github.com/morluto/rea/commit/a90f4ec36fe509d29ef220a29b66b4e3f41e0e6c) fix(javascript): bind defaulted and destructured Webpack factory roles - [`4eb9765`](https://github.com/morluto/rea/commit/4eb9765c3fa1f62f66c2549749fc53e3c4fcaac1) fix(javascript): keep factory receivers through unordered reads - [`ae6efce`](https://github.com/morluto/rea/commit/ae6efce20663711a027f36018669079e17b091db) fix(javascript): treat never-run factory parameter defaults as dead code ### 📊 Changes **10 files changed** (+569 additions, -119 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+11 -2) 📝 `src/domain/javascript/javascriptAstFingerprint.ts` (+100 -60) 📝 `src/domain/javascript/javascriptBundledRequireOrigin.ts` (+21 -15) ➕ `src/domain/javascript/javascriptBundlerFactoryRoles.ts` (+149 -0) 📝 `src/domain/javascript/javascriptFactoryExportRoles.test.ts` (+212 -0) 📝 `src/domain/javascript/javascriptStaticAnalysis.ts` (+2 -0) 📝 `src/domain/javascript/javascriptStaticAnalysisBundler.ts` (+22 -31) 📝 `src/domain/javascript/javascriptStaticAnalysisHelpers.ts` (+0 -9) 📝 `src/domain/javascript/javascriptStaticAnalysisState.ts` (+5 -2) 📝 `tests/acceptance/applications/webpackRenamedExportsCli.test.ts` (+47 -0) </details> ### 📄 Description **What broke:** A Webpack factory whose module parameter was defaulted (`e = {}`) or destructured (`{exports: x}`) reported `exports: []` as `observed` / `exact`, with `complete` coverage. The runtime exposes `["defaulted"]` and `["destructured"]`. **Fix:** Factory roles (module, exports, loader) are now bound by position, once, in a new `javascriptBundlerFactoryRoles`. Defaults are unwrapped and `{exports: alias}` binds `alias` to `module.exports`. Any other role pattern gets no role and adds an unknown finding, so the file reports partial coverage instead of an exact empty list. An export-shaped write whose receiver read cannot be ordered is also counted as unknown, never silently dropped. Role-parameter defaults never run under the convention, so they yield no facts. **Risk:** Low. Behavior changes only for factories with non-identifier, defaulted or repeated role parameters, or with an export write whose receiver read cannot be ordered against a replacement. Those files now report partial coverage where they used to claim complete. Whether real bundlers emit these shapes is **unverified**. ## Summary Fixes #7113. Found while checking related cases for #3551, which no longer reproduces on main. Before this change, `recoverBundlerModule` assigned a role only when the parameter at that position was a plain `Identifier`. A defaulted or destructured module parameter therefore had no role. Its writes went unrecognized, and nothing recorded that the role was unresolved. ## Problem and expected behavior Smallest trigger, at main `bc143125e`: ```js globalThis.webpackChunkApp.push([[1], { 111(e = {}, t) { e.exports = {defaulted: 1}; }, 112({exports: x}, t) { x.destructured = 1; } }]); ``` The violated rule: an empty export list must not be reported as an exact, complete fact when the module receiver was never resolved. ## Change and scope - **New owner, `src/domain/javascript/javascriptBundlerFactoryRoles.ts`.** It binds roles by runtime position: Webpack/Rspack use module, exports, loader; esbuild CommonJS uses exports, module. Spelling is never used. - A defaulted module or exports parameter keeps its role. The calling convention always passes that argument, so the default never runs. The defaults are recorded in `unusedDefaults`, and `withoutUnusedFactoryDefaults` removes them from the binding facts before write ordering. A defaulted parameter is therefore ordered exactly like a plain one inside loops, nested blocks, `try` and closures. - `{exports: alias}`, `{exports}`, `{"exports": alias}` and `{exports: alias = …}` in the module position add `alias` to the `exports` role. That role is now a list. Other static keys cannot reach `module.exports` and are ignored. - A sloppy-mode repeated parameter name binds its last argument. For example, in `function (e, t, e)` the name `e` is not the module. - These patterns get no role and set `exact: false`: - a rest parameter - an object rest - an array pattern - a nested or computed key - an exports-position pattern - a defaulted or destructured loader - **`recoverBundlerModule`** adds one unknown finding when roles are not exact. This uses the existing mechanism, the same one that handles a computed module key. As a result `parse_status` is `partial`, the file's observations get `partial` coverage, and the existing "remain unknown" limitation is attached. - **Never-run defaults are dead code.** The role owner records the default of every role parameter (module, exports, loader, a destructured `{exports: x} = …` or a nested `{exports: x = …}`) in `unusedDefaults`. `recoverBundlerModule` adds them to `accumulator.unusedFactoryDefaults`, and three walks skip those subtrees: the static source traversal (references, loader require calls, `n.e` chunk references), the export collector and the async-chunk walk. Before, a write in a default could be reported as an export, and `(e = n(5), t, n)` reported a require reference to `5`. Defaults of later, non-role parameters still run and are still reported. The separate semantic IR/graph still describes the default's syntax, as it does for any code that is never called. - **Unordered reads are reported, not dropped.** Receiver matching has three outcomes: `role`, `unresolved` or none. An export-shaped write whose receiver or loader read is `unresolved` counts in `StaticExports.unknown`, and `finishBundlerExports` adds that to the unknown findings. Before, such writes were dropped with complete coverage, for plain parameters too, e.g. `for (…) { e.exports.a = 1; e = {exports: {}}; }`. A non-export write such as `e.id = 1` is not counted. - **Every consumer now uses the parsed roles:** - `collectJavaScriptExports` - `factory_require_name` and the loader binding ID. The superseded `factoryRequireName` helper is removed. - The standalone-bootstrap loader and `externalSpecifier` in `javascriptBundledRequireOrigin.ts`. These read `factory.params[n]` directly and kept their own duplicate-name check; both are replaced. - **Defaulted loader stays unknown.** Loader calls are classified through the binding's own value facts in `semanticFactoryLoaderMemberAt` and the member-mutation index. Those cannot yet discount a default that never runs, so a defaulted loader is reported as unknown rather than resolved. Changing that would mean editing semantic indexing files, which is out of scope here. - **Granularity:** coverage is per file, not per module. There is no per-module export-coverage field, and adding one would change the contract. - **Not addressed (already present on main, unchanged here, and the same for plain parameters):** - exports written through `this` (Webpack calls factories with `this === module.exports`) or through `arguments[n]` - `Object.assign(exports, …)` - exports declared in a `catch` block that never runs are still listed, because names describe recognized declarations - Contribution scope: an ordinary fix within existing boundaries; no maintainer scope decision needed. ## Contract and boundary impact - Semantic owner and earliest changed stage: `javascriptBundlerFactoryRoles` (domain), during bundler module recovery. Consumers: the export collector, the factory require name and loader binding, and the standalone-bootstrap loader and externals. The superseded `identifierAt`, `factoryRequireName` and per-site `params[n]` reads are removed. - Contribution scope fit and linked maintainer decision: not applicable. - CLI and MCP/tool-catalog contract: no schema change. Values change only for the affected shapes: `exports`, `factory_require_name`, and the coverage/limitations of files with unresolved role patterns. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: unresolved role patterns now give partial coverage rather than complete. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: none. - [x] Read existing files or captured data. ## Evidence and regression coverage - **Tests added or updated:** - `src/domain/javascript/javascriptFactoryExportRoles.test.ts`: - 25 shapes compared against a runtime oracle. The oracle runs the inert fixture factory under Webpack's calling convention and lists `Object.getOwnPropertyNames(module.exports)`. The shapes cover renamed, defaulted and destructured parameters, nested-function and block shadows, rebinding, a second-position `module`, arrow and function factories, `Object.defineProperty` and `n.d`. - 40 control-flow oracle cases: `(e, t)`, `(e = {}, t)`, `(e, t = {})` and `({exports: x}, t)`, each with `for…of`, `for`, `for…in`, `while`, `do…while`, `try…finally`, nested blocks, arrow and declared closures, and a conditional write. - A repeated-name case, and a non-export write with an unordered replacement, which must stay complete. - 13 never-run default cases checked against a runtime oracle that records every loader and `n.e` call. The cases cover writes, `Object.defineProperty`, `n.d`, `n(…)` and `n.e(…)` inside module, exports, loader and destructured defaults, plus two controls where non-role defaults run. - 15 unresolved cases, each of which must give `partial` with exactly one unknown finding: 9 role patterns plus 6 unordered receiver or loader reads. - `tests/acceptance/applications/webpackRenamedExportsCli.test.ts`, run through CLI and stdio MCP: - defaulted factory → `["defaulted"]`, coverage complete - destructured factory → `["destructured"]`, coverage complete - a defaulted factory writing inside a `for…of` loop → `["loop"]`, coverage complete (the review case) - a rest-parameter factory in another file → `[]` with `partial` coverage - **Base failure:** at main, 20 of the then-41 tests in `javascriptFactoryExportRoles.test.ts` fail. At the first PR commit (a90f4ec36), 24 of the current 88 fail: 18 defaulted control-flow cases and 6 unresolved reads. At 4eb9765c3, the 11 non-control never-run default cases fail. With the current head, all 101 pass. - **User-visible CLI output:** below, for the #7113 fixture plus control `101(e, t) { e.exports = {parse: …}; }`. Same command, `node scripts/rea.mjs analyze-javascript-application <dir> --format json`: | Module | Before (`bc143125e`) | After | | --- | --- | --- | | 101 | `["parse"]` exact, complete | `["parse"]` exact, complete | | 111 | `[]` exact, complete | `["defaulted"]` exact, complete | | 112 | `[]` exact, complete | `["destructured"]` exact, complete | The #3551 15-factory fixture now matches the oracle for all 15 factories; before, 13 matched. - **Credit:** the oracle-comparison approach and several shadowing and defaulted cases come from #3552 (dakjdakd) and its review. - **Remaining proof gaps:** - Whether Webpack, Rspack, esbuild or minifiers ever emit these parameter shapes is unverified; no survey of real bundles was done. - No real-app benchmark was run. The change adds one scan of a factory's at most three role parameters. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Local runs on macOS, Node 26.5.0 (below the engines range; run with `npm_config_engine_strict=false`): - `vitest run --maxWorkers=2 src/domain/javascript src/application/javascript src/javascript`: 190 files, 4888 tests passed (head ae6efce20). - `npm run test:focused --` on the following 7 files: 57 tests passed. - `tests/acceptance/applications/webpackRenamedExportsCli.test.ts` - `tests/boundary/filesystem/javascript-applications/javascriptBundlerAdapters.test.ts` - `tests/boundary/cli/javascriptBundlerRuntimeScopes.test.ts` - `tests/boundary/cli/javascriptBundlerSelfReferences.test.ts` - `tests/acceptance/applications/bundlerCallbackMetadataCli.test.ts` - `tests/acceptance/applications/typescriptThisParametersCli.test.ts` - `tests/acceptance/applications/applicationWorkflowCli.test.ts` - `vitest run src/domain/javascript/javascriptFactoryExportRoles.test.ts`: 101 passed. With the dead-default fix stashed: 11 failed. With the earlier unordered-read fix stashed: 24 failed. - `npm run check:fast`: passed (typecheck and lint). - `npm run format:check`: passed. - `npm run docs:check`: passed. - CLI repro above: before and after outputs as shown. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable; static JavaScript analysis only. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no target execution. The runtime oracle in the tests runs only the inert fixture strings, in `node:vm`. ## Author readiness Human owner: @kaoru0822-kitauji - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-03 13:39:25 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7655

No description provided.

Rows
Columns