morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2834] [Bug] Inline HTML <script> bodies are silently omitted from JavaScript application analysis #1014

New issue

Closed

opened 2026-10-15 18:30:21 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:30:21 +00:00

Owner

Originally created by @ahmed0magdy on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2834

Before submitting

I searched existing issues and pull requests for duplicates.
I reproduced this on current main.

Area

JavaScript / Electron application analysis (analyze-javascript-application)

Observed behavior

analyze-javascript-application collects only <script src> references from local HTML files (htmlArtifactReferences). Inline classic and module script bodies are never parsed, and no limitation reports that they were skipped. The result still exits 0 and claims its normal coverage.

Capacitor and Cordova apps often keep the app code inline in www/index.html. For them, the evidence covers only cordova.js and cordova_plugins.js, and the actual app logic is invisible without any signal that it was skipped.

Reproduction

The fixture is a directory with package.json containing {"name":"game","version":"1.0.0"}, trivial stubs in www/cordova.js and www/cordova_plugins.js, and this www/index.html:

<!doctype html><html><head>
<script src="cordova.js"></script>
<script src="cordova_plugins.js"></script>
</head><body>
<script>
function startGame(){ fetch("https://api.example.test/score", {method:"POST", body: JSON.stringify({s:1})}); localStorage.setItem("hi","1"); }
document.addEventListener("deviceready", startGame);
</script>
<script type="module">import { x } from "./mod.js"; console.log(x);</script>
</body></html>

Run:

rea analyze-javascript-application /abs/path/to/fixture --json

Expected behavior

At minimum, a limitation that names each HTML file containing unanalyzed inline scripts, with their locations, so the omission is visible as AGENTS.md requires ("omission, uncertainty" must be preserved).

Preferably, inline script bodies are analyzed as embedded sources, with locations relative to the HTML file. That would need an embedded-module identity in the evidence graph, so it may warrant a short design discussion first.

Impact and scope

Any local HTML entry point with inline scripts: Capacitor/Cordova apps, simple Electron renderers, and static sites. Their app logic (endpoints, storage writes, imports) silently drops out of the evidence, and the result looks complete.

REA version

Reproduced on main at 60f771a.
First noticed on the npm release rea-agents@6.4.0.

Runtime and platform

Node 24.18.0 on Linux x64 (reproduction on main).
Node 24.21.0 on WSL2 Ubuntu 24.04 (first observation on 6.4.0).

Target and artifact context

A local unpacked app directory, analyzed statically. Nothing was executed.

Interface

CLI (rea analyze-javascript-application … --json).

Earliest failure stage

HTML artifact reference extraction: inline script content is never handed to JavaScript parsing.

Relevant output or evidence

On main at 60f771a:

Exit code 0, and 2 JavaScript files were parsed (the two stubs).
startGame, api.example.test, localStorage, deviceready and mod.js each appear 0 times in the JSON output.
None of the result's 5 limitations mentions inline scripts.
The semantic-graph families report partial, with no cause tied to the HTML.

On rea-agents@6.4.0, a real Capacitor app whose game code is inline in index.html produced 5 graph nodes, all Cordova glue.

Typed outcome or recovery expected

A typed limitation per HTML file with skipped inline scripts, with locations, at minimum. Analysis of the inline bodies as embedded sources would be better.

Analysis or suspected cause

src/domain/javascript/htmlArtifactReferences.ts collects only <script src> values.
src/application/javascript/JavaScriptArtifactAnalysis.ts (parseHtmlScripts) only parses the referenced files.

Additional context

Investigated with AI assistance (Claude Code); the reproduction above was run on current main. I'm happy to work on the disclosure-only fix (a typed limitation) if that direction is welcome.

Originally created by @ahmed0magdy on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2834 ### Before submitting - [x] I searched existing issues and pull requests for duplicates. - [x] I reproduced this on current `main`. ### Area JavaScript / Electron application analysis (`analyze-javascript-application`) ### Observed behavior `analyze-javascript-application` collects only `<script src>` references from local HTML files (`htmlArtifactReferences`). Inline classic and module script bodies are never parsed, and no limitation reports that they were skipped. The result still exits 0 and claims its normal coverage. Capacitor and Cordova apps often keep the app code inline in `www/index.html`. For them, the evidence covers only `cordova.js` and `cordova_plugins.js`, and the actual app logic is invisible without any signal that it was skipped. ### Reproduction The fixture is a directory with `package.json` containing `{"name":"game","version":"1.0.0"}`, trivial stubs in `www/cordova.js` and `www/cordova_plugins.js`, and this `www/index.html`: ```html <!doctype html><html><head> <script src="cordova.js"></script> <script src="cordova_plugins.js"></script> </head><body> <script> function startGame(){ fetch("https://api.example.test/score", {method:"POST", body: JSON.stringify({s:1})}); localStorage.setItem("hi","1"); } document.addEventListener("deviceready", startGame); </script> <script type="module">import { x } from "./mod.js"; console.log(x);</script> </body></html> ``` Run: ```sh rea analyze-javascript-application /abs/path/to/fixture --json ``` ### Expected behavior At minimum, a limitation that names each HTML file containing unanalyzed inline scripts, with their locations, so the omission is visible as AGENTS.md requires ("omission, uncertainty" must be preserved). Preferably, inline script bodies are analyzed as embedded sources, with locations relative to the HTML file. That would need an embedded-module identity in the evidence graph, so it may warrant a short design discussion first. ### Impact and scope Any local HTML entry point with inline scripts: Capacitor/Cordova apps, simple Electron renderers, and static sites. Their app logic (endpoints, storage writes, imports) silently drops out of the evidence, and the result looks complete. ### REA version - Reproduced on `main` at `60f771a`. - First noticed on the npm release `rea-agents@6.4.0`. ### Runtime and platform - Node 24.18.0 on Linux x64 (reproduction on main). - Node 24.21.0 on WSL2 Ubuntu 24.04 (first observation on 6.4.0). ### Target and artifact context A local unpacked app directory, analyzed statically. Nothing was executed. ### Interface CLI (`rea analyze-javascript-application … --json`). ### Earliest failure stage HTML artifact reference extraction: inline script content is never handed to JavaScript parsing. ### Relevant output or evidence On `main` at `60f771a`: - Exit code 0, and 2 JavaScript files were parsed (the two stubs). - `startGame`, `api.example.test`, `localStorage`, `deviceready` and `mod.js` each appear 0 times in the JSON output. - None of the result's 5 limitations mentions inline scripts. - The semantic-graph families report `partial`, with no cause tied to the HTML. On `rea-agents@6.4.0`, a real Capacitor app whose game code is inline in `index.html` produced 5 graph nodes, all Cordova glue. ### Typed outcome or recovery expected A typed limitation per HTML file with skipped inline scripts, with locations, at minimum. Analysis of the inline bodies as embedded sources would be better. ### Analysis or suspected cause - `src/domain/javascript/htmlArtifactReferences.ts` collects only `<script src>` values. - `src/application/javascript/JavaScriptArtifactAnalysis.ts` (`parseHtmlScripts`) only parses the referenced files. ### Additional context Investigated with AI assistance (Claude Code); the reproduction above was run on current `main`. I'm happy to work on the disclosure-only fix (a typed limitation) if that direction is welcome.

bsakaguchi

2026-10-15 18:30:21 +00:00

closed this issue
added the
area: domain

bug
labels

bsakaguchi commented

2026-10-15 18:30:22 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Verified the reported defect is addressed on main by c97aca7f3d.

Root cause and resolution: Inline HTML bodies remain unanalyzed, but the omission is now represented in graph coverage and per-file unavailable-static-parse-scope facts with script type and source locations. This meets the issue’s stated minimum disclosure criterion.

Validation: tests/boundary/filesystem/javascriptHtmlEntrypoints.test.ts — reports unanalyzed inline HTML scripts instead of claiming complete coverage: two classic/module scripts yield one unavailable parse-html-inline-scripts observation with exact types/ranges/hash, partial coverage, and an explicit limitation naming omitted facts; external cordova.js remains projected.

Evidence: CI run 500e: owner unchanged and assertion passed.

Verification scope: Inline bodies remain unanalyzed; the fix is explicit partial disclosure, meeting the accepted minimum, not inline-code analysis.

Current main CI has separate failures under repair; this closure does not claim the complete main workflow is green.

@morluto commented on GitHub (Oct 14, 2026): Verified the reported defect is addressed on main by c97aca7f3da2b68744144221881243daa74abf44. Root cause and resolution: Inline HTML bodies remain unanalyzed, but the omission is now represented in graph coverage and per-file unavailable-static-parse-scope facts with script type and source locations. This meets the issue’s stated minimum disclosure criterion. Validation: `tests/boundary/filesystem/javascriptHtmlEntrypoints.test.ts` — `reports unanalyzed inline HTML scripts instead of claiming complete coverage`: two classic/module scripts yield one unavailable `parse-html-inline-scripts` observation with exact types/ranges/hash, partial coverage, and an explicit limitation naming omitted facts; external `cordova.js` remains projected. Evidence: CI run 500e: owner unchanged and assertion passed. Verification scope: Inline bodies remain unanalyzed; the fix is explicit partial disclosure, meeting the accepted minimum, not inline-code analysis. Current main CI has separate failures under repair; this closure does not claim the complete main workflow is green.

bsakaguchi commented

2026-10-15 18:30:22 +00:00

Author

Owner

@wangl-dev commented on GitHub (Oct 15, 2026):

Thanks for making skipped inline bodies explicit. I understand that the disclosure fix closes the original report; this is a question about a separate follow-up, not a request to reopen it.

Would actual static analysis of inline JavaScript be welcome, and is anyone already working on it? The question to answer is: which endpoints, storage operations and imports come from the inline code in a local HTML/Electron entry point?

In an AI-assisted check on October 14, the released 6.4.0 CLI recovered an endpoint and localStorage key from a small external script, but neither from the same code in classic or module inline scripts. The difference held for directories and generated Electron ASARs; no application code was executed. Today's source check at befbc024 still shows HTML bodies being recorded as skipped rather than passed to AST analysis. That is source inspection, not a fresh build/runtime test of today's main.

A possible follow-up would reuse the existing HTML classification and JavaScript analysis pipeline, bind embedded-source identity to the HTML digest/body range/script type, and map findings back to the original HTML. Classic shared scope, module boundaries and relative imports need an agreed contract rather than treating each body as an unrelated temporary .js file. This would remain static analysis, with no browser execution or new provider.

If this direction fits, would you prefer a short design here or a separate feature issue? I have not started an implementation or PR, and do not want to duplicate #2940 or anyone's planned work.

Codex assisted with the checks and this proposal.

@wangl-dev commented on GitHub (Oct 15, 2026): Thanks for making skipped inline bodies explicit. I understand that the disclosure fix closes the original report; this is a question about a separate follow-up, not a request to reopen it. Would actual static analysis of inline JavaScript be welcome, and is anyone already working on it? The question to answer is: which endpoints, storage operations and imports come from the inline code in a local HTML/Electron entry point? In an AI-assisted check on October 14, the released 6.4.0 CLI recovered an endpoint and localStorage key from a small external script, but neither from the same code in classic or module inline scripts. The difference held for directories and generated Electron ASARs; no application code was executed. Today's source check at befbc024 still shows HTML bodies being recorded as skipped rather than passed to AST analysis. That is source inspection, not a fresh build/runtime test of today's main. A possible follow-up would reuse the existing HTML classification and JavaScript analysis pipeline, bind embedded-source identity to the HTML digest/body range/script type, and map findings back to the original HTML. Classic shared scope, module boundaries and relative imports need an agreed contract rather than treating each body as an unrelated temporary .js file. This would remain static analysis, with no browser execution or new provider. If this direction fits, would you prefer a short design here or a separate feature issue? I have not started an implementation or PR, and do not want to duplicate #2940 or anyone's planned work. Codex assisted with the checks and this proposal.

bsakaguchi referenced this issue

2026-10-17 21:07:51 +00:00

[PR #1014] [MERGED] fix(ci): decouple stdio smoke tests from Linux display probes #2580

bsakaguchi referenced this issue

2026-10-17 21:07:51 +00:00

[PR #1016] [MERGED] fix(ci): avoid slow Azure archive for the native cross compiler #2583