Skip to content

fix(engine): include inputTokenPattern in ruleSignature's deny-hook identity - #8126

Merged
JSONbored merged 1 commit into
mainfrom
fix/rule-signature-input-token-pattern
Jul 23, 2026
Merged

fix(engine): include inputTokenPattern in ruleSignature's deny-hook identity#8126
JSONbored merged 1 commit into
mainfrom
fix/rule-signature-input-token-pattern

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Summary

  • Closes ruleSignature's deny-hook identity computation omits inputTokenPattern, so dedup can silently drop a rule that differs only by that field #8013
  • ruleSignature (the identity function resolveEffectiveDenyRules/synthesizeDenyRuleProposals use to decide "is this the same rule") omitted inputTokenPattern from its computed identity, so a maintainer-approved custom rule narrowing an existing rule only by inputTokenPattern would be silently deduped away as an exact duplicate.
  • Fix serializes .source + .flags rather than the RegExp object itself — JSON.stringify collapses every RegExp instance to "{}" regardless of its actual pattern, so the naive rule.inputTokenPattern ?? null fix would have "fixed" only the presence-vs-absence case, not two genuinely different patterns colliding. Caught this by testing before committing to the naive version.

Validation

  • npm run typecheck — clean.
  • npx vitest run test/unit/miner-deny-hook-synthesis.test.ts — 22/22 passing, including two new cases: three rules distinguished only by inputTokenPattern (none/--follow-tags/-f) all survive as distinct; two rules with byte-identical inputTokenPattern source+flags still correctly dedupe to one.
  • Rebuilt packages/loopover-engine (npm run build) before testing — the root test imports the compiled packages/loopover-miner/lib/deny-hook-synthesis.js, which wraps @loopover/engine's dist output, not the TS source directly.

…dentity

ruleSignature previously omitted inputTokenPattern from the identity it
computes for resolveEffectiveDenyRules/synthesizeDenyRuleProposals, so a
maintainer-approved custom rule that narrowed an existing rule only by
adding/changing inputTokenPattern would be silently deduped away as an
exact duplicate.

Serializes .source + .flags rather than the RegExp object itself, since
JSON.stringify collapses every RegExp instance to "{}" regardless of its
actual pattern.

Closes #8013
@JSONbored JSONbored self-assigned this Jul 22, 2026
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
loopover-ui ec0bf0d Commit Preview URL

Branch Preview URL
Jul 22 2026, 11:47 PM

@codecov

codecov Bot commented Jul 22, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.02%. Comparing base (073de61) to head (ec0bf0d).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8126      +/-   ##
==========================================
- Coverage   92.02%   92.02%   -0.01%     
==========================================
  Files         760      760              
  Lines       77372    77373       +1     
  Branches    23386    23386              
==========================================
- Hits        71203    71200       -3     
  Misses       5061     5061              
- Partials     1108     1112       +4     
Flag Coverage Δ
shard-1 57.06% <100.00%> (+<0.01%) ⬆️
shard-2 54.31% <0.00%> (-0.01%) ⬇️
shard-3 50.27% <0.00%> (-0.05%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
...s/loopover-engine/src/miner/deny-hook-synthesis.ts 100.00% <100.00%> (ø)

... and 1 file with indirect coverage changes

@JSONbored
JSONbored merged commit fbcba1e into main Jul 23, 2026
14 checks passed
@JSONbored
JSONbored deleted the fix/rule-signature-input-token-pattern branch July 23, 2026 00:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ruleSignature's deny-hook identity computation omits inputTokenPattern, so dedup can silently drop a rule that differs only by that field

1 participant