fix(wasm): preserve original glue source locations (#2114)

* fix(wasm): preserve original glue source locations

* fix(wasm): retain BOM-prefixed hashbang glue references

* test(wasm): parse the artifact contract before reading glue evidence

* test(wasm): give glue fixtures and assertions a single owner

* fix(comparison): recheck historical calls-only changes (#2223)

* fix(comparison): preserve incomplete function call evidence

Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.

Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.

* fix(comparison): recheck historical calls-only changes

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit 688defca0f)

* fix(ci): isolate Linux Hopper process fixture inventory

(cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec)

* fix(android): make DEX descriptor pattern portable

(cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357)

* fix: repair the static-check failures on the default branch (#2895)

* fix: repair the static-check failures on the default branch

The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.

- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
  `src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
  `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
  union in `src/application/SupportedClients.ts`, and an unchecked index in
  `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
  inferred as `string[][]`.

Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.

Validation: `npm run check:fast` and `npm run format:check` pass.

* fix(setup): keep Devin on the JSON configuration dialect

---------

Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit df3d96da80)

---------

Co-authored-by: morluto <morluto@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>

scripts/verify-wasm-artifact.mjs

@@ -190,12 +190,21 @@ try {
     const candidate = join(candidateRoot, "module.wasm");
     await writeFile(join(candidateRoot, "source.wat"), "(module (memory 2))");
     await tool("wat2wasm", ["source.wat", "-o", "module.wasm"], candidateRoot);
-    const glue = join(fixtureRoot, "glue.js");
-    await writeFile(
-      glue,
-      'fetch("./module.wasm"); new URL("https://example.invalid/module.wasm?version=1", import.meta.url);',
+    const glueSource =
+      'fetch("./module.wasm"); new URL("https://example.invalid/module.wasm?version=1", import.meta.url);';
+    const glueSources = [
+      glueSource,
+      `\uFEFF${glueSource}`,
+      `\uFEFF\n${glueSource}`,
+      `#!/usr/bin/env node\n${glueSource}`,
+      `\uFEFF#!/usr/bin/env node\n${glueSource}`,
+    ];
+    const gluePaths = glueSources.map((_, index) =>
+      join(fixtureRoot, `glue-${index}.js`),
     );
-    const input = { path, glue_paths: [glue], candidate_paths: [candidate] };
+    for (const [index, gluePath] of gluePaths.entries())
+      await writeFile(gluePath, glueSources[index]);
+    const input = { path, glue_paths: gluePaths, candidate_paths: [candidate] };
     assert.ok(ajv.validate(advertised.inputSchema, input));
     const cliValue = await inspectCli(input);
     assert.equal(cliValue.category, undefined, JSON.stringify(cliValue));
@@ -219,11 +228,31 @@ try {
     assert.equal(report.wat.sha256, sha256(wat));
     assert.equal(report.headers, `${headers}\n`);
     assert.equal(report.details, details.slice(1));
-    assert.equal(report.glue[0].artifact.sha256, sha256(await readFile(glue)));
-    assert.deepEqual(
-      report.glue[0].references.map(({ candidate_paths }) => candidate_paths),
-      [[path], [path, candidate]],
-    );
+    assert.equal(report.glue.length, glueSources.length);
+    for (const [index, source] of glueSources.entries()) {
+      const observed = report.glue[index];
+      assert.equal(observed.artifact.path, gluePaths[index]);
+      assert.equal(observed.artifact.sha256, sha256(source));
+      assert.equal(observed.artifact.bytes, Buffer.byteLength(source));
+      assert.equal(await readFile(gluePaths[index], "utf8"), source);
+      assert.equal(observed.parse_status, "complete");
+      assert.deepEqual(
+        observed.references.map(({ candidate_paths }) => candidate_paths),
+        [[path], [path, candidate]],
+      );
+      assert.deepEqual(
+        observed.references.map(({ line, column }) => ({ line, column })),
+        ["./module.wasm", "https://example.invalid/module.wasm?version=1"].map(
+          (value) => {
+            const offset = source.indexOf(`"${value}"`);
+            return {
+              line: source.slice(0, offset).split("\n").length,
+              column: offset - source.lastIndexOf("\n", offset) - 1,
+            };
+          },
+        ),
+      );
+    }
     assert.notEqual(report.candidates[0].sha256, report.candidates[1].sha256);
     for (const command of report.tool_profile.commands)
       assert.equal(command.sha256, sha256(await readFile(command.path)));

src/wasm/WabtArtifactProvider.test.ts

@@ -1,8 +1,10 @@
+import { createHash } from "node:crypto";
 import { access, chmod, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { expect, it, vi } from "vitest";
 import { createTestTempDirectory } from "../../tests/fixtures/temporaryDirectory.js";
 import { WabtArtifactProvider } from "./WabtArtifactProvider.js";
+import { wasmArtifactSchema } from "../domain/wasm/wasmArtifact.js";
 import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
 import { PrivateRuntimeRootUnavailableError } from "../process/PrivateRuntimeRootUnavailableError.js";
 import { spawnOwnedProviderProcess } from "../process/ProviderProcess.js";
@@ -271,6 +273,35 @@ it.each([false, true])(
     });
   },
 );
+const assertGlueObservations = (
+  value: unknown,
+  inputs: readonly { readonly path: string; readonly source: string }[],
+  selectedPath: string,
+): void => {
+  const glue = wasmArtifactSchema.parse(value).glue;
+  expect(glue).toHaveLength(inputs.length);
+  for (const [index, { path, source }] of inputs.entries()) {
+    expect(glue[index]).toMatchObject({
+      artifact: {
+        path,
+        sha256: createHash("sha256").update(source).digest("hex"),
+        bytes: Buffer.byteLength(source),
+      },
+      parse_status: "complete",
+      references: [
+        {
+          value: "./selected.wasm",
+          line: source.includes("\n") ? 2 : 1,
+          column: source.startsWith("\uFEFFfetch") ? 7 : 6,
+          candidate_paths: [selectedPath],
+          association: "local-path-candidate",
+          evidence_kind: "static-literal",
+        },
+      ],
+    });
+  }
+};
+
 it.each([
   "success",
   "invalid",
@@ -371,10 +402,34 @@ it.each([
       };
     },
   );
+  const literal = 'fetch("./selected.wasm");';
+  const glueInputs = (
+    mode === "success"
+      ? [
+          literal,
+          `\uFEFF${literal}`,
+          `\uFEFF\n${literal}`,
+          `#!/usr/bin/env node\n${literal}`,
+          `\uFEFF#!/usr/bin/env node\n${literal}`,
+        ]
+      : []
+  ).map((source, index) => ({
+    path: join(selectedRoot, `glue-${index}.js`),
+    source,
+  }));
+  await Promise.all(
+    glueInputs.map(({ path, source }) => writeFile(path, source)),
+  );
   const result = await provider.inspect(
-    { path, glue_paths: [], candidate_paths: [] },
+    {
+      path,
+      glue_paths: glueInputs.map(({ path }) => path),
+      candidate_paths: [],
+    },
     { signal: controller.signal },
   );
+  if (mode === "success" && result.ok)
+    assertGlueObservations(result.value.result, glueInputs, path);
   assertModeOutcome(mode, result, path);
   if (mode === "cleanup") {
     await assertCleanupRecovery({

src/wasm/WabtArtifactProvider.ts

@@ -268,9 +268,11 @@ export class WabtArtifactProvider implements WasmArtifactPort {
           undefined,
           this.#resources,
         );
-        const source = new TextDecoder("utf-8", { fatal: true }).decode(
-          bytes.bytes,
-        );
+        // Keep source characters intact so locations match the hashed artifact.
+        const source = new TextDecoder("utf-8", {
+          fatal: true,
+          ignoreBOM: true,
+        }).decode(bytes.bytes);
         glue.push({
           artifact: { path, sha256: bytes.sha256, bytes: bytes.bytes.length },
           ...associateWasmGlue(

src/wasm/WasmGlueAdapter.ts

@@ -8,7 +8,11 @@ export const associateWasmGlue = (
   path: string,
   candidates: readonly string[],
 ) => {
-  const file = parseJavaScriptSource(source);
+  // Babel requires a hashbang at offset zero. Removing only its preceding BOM
+  // leaves reference coordinates intact: all code starts on a later line.
+  const file = parseJavaScriptSource(
+    source.startsWith("\uFEFF#!") ? source.slice(1) : source,
+  );
   const references: {
     value: string;
     line: number;