fix: strip inherited class definitions from extends and remote amends#48
fix: strip inherited class definitions from extends and remote amends#48
Conversation
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
Follow-up to #45: the class-definition leak also affected: - `extends` (both local file and HTTP) - `amends` with HTTP and package:// URIs The amends class injection pass now resolves base source for all URI schemes (HTTP via http_cache, package:// via extracted dirs), not just local files. The extends path now calls `base_obj.shift_remove()` for each class definition, matching the amends fix. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
69dbd4e to
a5622ed
Compare
Greptile SummaryThis PR extends the class-definition stripping fix from #45 to cover Key observations:
Confidence Score: 3/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[eval_module called] --> B{module.amends?}
B -- yes --> C{URI scheme}
C -- http/https --> D[fetch_source → eval_module → base_obj]
C -- package:// --> E{PackageSource}
E -- Direct --> F[fetch_source → eval_module → base_obj]
E -- Zip --> G[extract_package_zip → eval_file → base_obj]
C -- local/file:// --> H[read file → eval_file → base_obj]
C -- pkl: --> I[skip]
D & F & G & H --> J{Second pass: inject class defs}
J -- http/https --> K[http_cache.get uri]
J -- package:// Direct --> L[http_cache.get resolved_url]
J -- package:// Zip --> M["find_map over ALL package_dirs ⚠️"]
J -- local/file:// --> N[fs::read_to_string path]
K & L & M & N --> O{parse source OK?}
O -- yes --> P[for each ClassDef: eval + scope.set + base_obj.shift_remove ✅]
O -- no --> Q[skip class injection]
B -- no --> R{module.extends?}
R -- local/file:// --> S[read + parse + eval_module → base_obj\nfor each ClassDef: shift_remove ✅]
R -- http/https --> T[fetch_source + parse + eval_module → base_obj\nfor each ClassDef: shift_remove ✅]
R -- package:// --> U[not handled — silently skipped]
|
| PackageSource::Zip(_, entry) => { | ||
| // For zip packages, read from the extracted directory | ||
| self.package_dirs | ||
| .values() | ||
| .find_map(|dir| std::fs::read_to_string(dir.join(entry)).ok()) | ||
| } |
There was a problem hiding this comment.
Zip URL discarded — wrong package directory may be read
The zip URL in the PackageSource::Zip arm is bound to _ and discarded. The code then iterates over all extracted package directories with find_map, returning the first one that contains a file at entry. Because package_dirs is already keyed by the zip URL (set in extract_package_zip), the correct directory is already known. If two different package:// URIs share an identical internal entry path, find_map will silently return content from the wrong package.
The fix is to bind the zip URL and use it directly for the lookup:
PackageSource::Zip(zip_url, entry) => {
self.package_dirs.get(&zip_url).and_then(|dir| {
std::fs::read_to_string(dir.join(entry)).ok()
})
}
Addresses review feedback: the PackageSource::Zip arm was discarding the zip URL and iterating all package_dirs with find_map, which could return content from the wrong package when multiple packages share an internal entry path. Now uses the zip URL directly as the HashMap key. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## 🤖 New release * `pklr`: 0.2.1 -> 0.2.2 (✓ API compatible changes) <details><summary><i><b>Changelog</b></i></summary><p> <blockquote> ## [0.2.2](v0.2.1...v0.2.2) - 2026-03-24 ### Added - add HTTP URL rewrite support ([#46](#46)) ### Fixed - strip inherited class definitions from extends and remote amends ([#48](#48)) - strip inherited class definitions from amends output ([#45](#45)) </blockquote> </p></details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/).
Summary
Follow-up to #45 — the class-definition leak also affected:
extends(both local file and HTTP paths)amendswith HTTP andpackage://URIsChanges:
http_cache,package://via extracted dirs), not just local filesextendspath now callsbase_obj.shift_remove()for each class definition, matching the amends fixTest plan
amends_strips_inherited_class_definitionstestextends_strips_inherited_class_definitionstestThis PR was generated by Claude Code.