From cddf31d55e63b809e9a075bcbe34238c2728c06e Mon Sep 17 00:00:00 2001 From: xin zhuang <65798732+1052326311@users.noreply.github.com> Date: Wed, 14 Oct 2026 03:20:48 +0800 Subject: [PATCH] fix(wasm): preserve original glue source locations (#2114) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(wasm): preserve original glue source locations * fix(wasm): retain BOM-prefixed hashbang glue references * test(wasm): parse the artifact contract before reading glue evidence * test(wasm): give glue fixtures and assertions a single owner * fix(comparison): recheck historical calls-only changes (#2223) * fix(comparison): preserve incomplete function call evidence Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty. Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls. * fix(comparison): recheck historical calls-only changes --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> (cherry picked from commit 688defca0f4a3de04eb199f7754f323c68896c3c) * fix(ci): isolate Linux Hopper process fixture inventory (cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec) * fix(android): make DEX descriptor pattern portable (cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357) * fix: repair the static-check failures on the default branch (#2895) * fix: repair the static-check failures on the default branch The default branch fails its own required `Static checks` job three ways, so every pull request reports that job as failed regardless of its own change. - `npm run format:check` reports `src/domain/functionComparison.test.ts` and `src/ida/IdaOperationRunner.ts`. - `npm run lint` reports a duplicate `import { join } from "node:path"` in `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17). - `npm run typecheck` reports `format: "devin"` missing from the client format union in `src/application/SupportedClients.ts`, and an unchecked index in `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is inferred as `string[][]`. Apply the pinned formatter, drop the duplicate import, list the `"devin"` format that its own definition already uses, and mark the pair array `as const`. Validation: `npm run check:fast` and `npm run format:check` pass. * fix(setup): keep Devin on the JSON configuration dialect --------- Co-authored-by: 吴佳浩 Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> (cherry picked from commit df3d96da801976fdbe37a726c2f4f84af8ffbf90) --------- Co-authored-by: morluto Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com> Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com> Co-authored-by: 吴佳浩 --- scripts/verify-wasm-artifact.mjs | 49 ++++++++++++++++++----- src/wasm/WabtArtifactProvider.test.ts | 57 ++++++++++++++++++++++++++- src/wasm/WabtArtifactProvider.ts | 8 ++-- src/wasm/WasmGlueAdapter.ts | 6 ++- 4 files changed, 105 insertions(+), 15 deletions(-) diff --git a/scripts/verify-wasm-artifact.mjs b/scripts/verify-wasm-artifact.mjs index 305063ccc..5123d3400 100644 --- a/scripts/verify-wasm-artifact.mjs +++ b/scripts/verify-wasm-artifact.mjs @@ -190,12 +190,21 @@ try { const candidate = join(candidateRoot, "module.wasm"); await writeFile(join(candidateRoot, "source.wat"), "(module (memory 2))"); await tool("wat2wasm", ["source.wat", "-o", "module.wasm"], candidateRoot); - const glue = join(fixtureRoot, "glue.js"); - await writeFile( - glue, - 'fetch("./module.wasm"); new URL("https://example.invalid/module.wasm?version=1", import.meta.url);', + const glueSource = + 'fetch("./module.wasm"); new URL("https://example.invalid/module.wasm?version=1", import.meta.url);'; + const glueSources = [ + glueSource, + `\uFEFF${glueSource}`, + `\uFEFF\n${glueSource}`, + `#!/usr/bin/env node\n${glueSource}`, + `\uFEFF#!/usr/bin/env node\n${glueSource}`, + ]; + const gluePaths = glueSources.map((_, index) => + join(fixtureRoot, `glue-${index}.js`), ); - const input = { path, glue_paths: [glue], candidate_paths: [candidate] }; + for (const [index, gluePath] of gluePaths.entries()) + await writeFile(gluePath, glueSources[index]); + const input = { path, glue_paths: gluePaths, candidate_paths: [candidate] }; assert.ok(ajv.validate(advertised.inputSchema, input)); const cliValue = await inspectCli(input); assert.equal(cliValue.category, undefined, JSON.stringify(cliValue)); @@ -219,11 +228,31 @@ try { assert.equal(report.wat.sha256, sha256(wat)); assert.equal(report.headers, `${headers}\n`); assert.equal(report.details, details.slice(1)); - assert.equal(report.glue[0].artifact.sha256, sha256(await readFile(glue))); - assert.deepEqual( - report.glue[0].references.map(({ candidate_paths }) => candidate_paths), - [[path], [path, candidate]], - ); + assert.equal(report.glue.length, glueSources.length); + for (const [index, source] of glueSources.entries()) { + const observed = report.glue[index]; + assert.equal(observed.artifact.path, gluePaths[index]); + assert.equal(observed.artifact.sha256, sha256(source)); + assert.equal(observed.artifact.bytes, Buffer.byteLength(source)); + assert.equal(await readFile(gluePaths[index], "utf8"), source); + assert.equal(observed.parse_status, "complete"); + assert.deepEqual( + observed.references.map(({ candidate_paths }) => candidate_paths), + [[path], [path, candidate]], + ); + assert.deepEqual( + observed.references.map(({ line, column }) => ({ line, column })), + ["./module.wasm", "https://example.invalid/module.wasm?version=1"].map( + (value) => { + const offset = source.indexOf(`"${value}"`); + return { + line: source.slice(0, offset).split("\n").length, + column: offset - source.lastIndexOf("\n", offset) - 1, + }; + }, + ), + ); + } assert.notEqual(report.candidates[0].sha256, report.candidates[1].sha256); for (const command of report.tool_profile.commands) assert.equal(command.sha256, sha256(await readFile(command.path))); diff --git a/src/wasm/WabtArtifactProvider.test.ts b/src/wasm/WabtArtifactProvider.test.ts index 161e542d2..7d1eca0f7 100644 --- a/src/wasm/WabtArtifactProvider.test.ts +++ b/src/wasm/WabtArtifactProvider.test.ts @@ -1,8 +1,10 @@ +import { createHash } from "node:crypto"; import { access, chmod, readFile, writeFile } from "node:fs/promises"; import { join } from "node:path"; import { expect, it, vi } from "vitest"; import { createTestTempDirectory } from "../../tests/fixtures/temporaryDirectory.js"; import { WabtArtifactProvider } from "./WabtArtifactProvider.js"; +import { wasmArtifactSchema } from "../domain/wasm/wasmArtifact.js"; import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js"; import { PrivateRuntimeRootUnavailableError } from "../process/PrivateRuntimeRootUnavailableError.js"; import { spawnOwnedProviderProcess } from "../process/ProviderProcess.js"; @@ -271,6 +273,35 @@ it.each([false, true])( }); }, ); +const assertGlueObservations = ( + value: unknown, + inputs: readonly { readonly path: string; readonly source: string }[], + selectedPath: string, +): void => { + const glue = wasmArtifactSchema.parse(value).glue; + expect(glue).toHaveLength(inputs.length); + for (const [index, { path, source }] of inputs.entries()) { + expect(glue[index]).toMatchObject({ + artifact: { + path, + sha256: createHash("sha256").update(source).digest("hex"), + bytes: Buffer.byteLength(source), + }, + parse_status: "complete", + references: [ + { + value: "./selected.wasm", + line: source.includes("\n") ? 2 : 1, + column: source.startsWith("\uFEFFfetch") ? 7 : 6, + candidate_paths: [selectedPath], + association: "local-path-candidate", + evidence_kind: "static-literal", + }, + ], + }); + } +}; + it.each([ "success", "invalid", @@ -371,10 +402,34 @@ it.each([ }; }, ); + const literal = 'fetch("./selected.wasm");'; + const glueInputs = ( + mode === "success" + ? [ + literal, + `\uFEFF${literal}`, + `\uFEFF\n${literal}`, + `#!/usr/bin/env node\n${literal}`, + `\uFEFF#!/usr/bin/env node\n${literal}`, + ] + : [] + ).map((source, index) => ({ + path: join(selectedRoot, `glue-${index}.js`), + source, + })); + await Promise.all( + glueInputs.map(({ path, source }) => writeFile(path, source)), + ); const result = await provider.inspect( - { path, glue_paths: [], candidate_paths: [] }, + { + path, + glue_paths: glueInputs.map(({ path }) => path), + candidate_paths: [], + }, { signal: controller.signal }, ); + if (mode === "success" && result.ok) + assertGlueObservations(result.value.result, glueInputs, path); assertModeOutcome(mode, result, path); if (mode === "cleanup") { await assertCleanupRecovery({ diff --git a/src/wasm/WabtArtifactProvider.ts b/src/wasm/WabtArtifactProvider.ts index 3be21b2a1..d706c97e8 100644 --- a/src/wasm/WabtArtifactProvider.ts +++ b/src/wasm/WabtArtifactProvider.ts @@ -268,9 +268,11 @@ export class WabtArtifactProvider implements WasmArtifactPort { undefined, this.#resources, ); - const source = new TextDecoder("utf-8", { fatal: true }).decode( - bytes.bytes, - ); + // Keep source characters intact so locations match the hashed artifact. + const source = new TextDecoder("utf-8", { + fatal: true, + ignoreBOM: true, + }).decode(bytes.bytes); glue.push({ artifact: { path, sha256: bytes.sha256, bytes: bytes.bytes.length }, ...associateWasmGlue( diff --git a/src/wasm/WasmGlueAdapter.ts b/src/wasm/WasmGlueAdapter.ts index 1f8713042..91c524270 100644 --- a/src/wasm/WasmGlueAdapter.ts +++ b/src/wasm/WasmGlueAdapter.ts @@ -8,7 +8,11 @@ export const associateWasmGlue = ( path: string, candidates: readonly string[], ) => { - const file = parseJavaScriptSource(source); + // Babel requires a hashbang at offset zero. Removing only its preceding BOM + // leaves reference coordinates intact: all code starts on a later line. + const file = parseJavaScriptSource( + source.startsWith("\uFEFF#!") ? source.slice(1) : source, + ); const references: { value: string; line: number;