morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3190] [Bug] Route tracing matches generated endpoint labels for absent route seeds #1128

New issue

Closed

opened 2026-10-15 18:31:18 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:31:18 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3190

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

trace-application-feature selects a route endpoint for literal seeds absent from the analyzed application's preserved routes. An inert JavaScript fixture declares /accounts/preferences/notifications and /tiny. The analyzer returns successful Evidence and gives the long endpoint the generated display label route endpoint, while retaining its exact route in properties.value.

An exact, case-sensitive route endpoint seed and a contains-mode route seed each match the long endpoint through observations[0].label. Each false match returns five traced nodes, four traced edges, and complete-within-source coverage. Neither seed occurs in either preserved route value. All five trace CLI calls, including the controls below, exit 0. complete-within-source describes coverage within the source graph; it does not establish runtime execution.

Reproduction

Start from a clean checkout at 58300885207133422af235e0f2b10658cf958b03, using the repository's pinned toolchain. Install the locked dependencies and build the runtime. The verifier used already prepared baseline dependencies and build output, so these two preparation commands were not rerun during verification.

npm ci
npm run build:cached

Create a local application fixture and isolate the reproduction's home and configuration directories. Run all remaining commands from the repository root.

mkdir -p repro-work/app repro-work/home
run_local() {
  env HOME="$PWD/repro-work/home" \
    XDG_CONFIG_HOME="$PWD/repro-work/home/config" \
    XDG_CACHE_HOME="$PWD/repro-work/home/cache" \
    XDG_DATA_HOME="$PWD/repro-work/home/data" "$@"
}
cat > repro-work/app/routes.js <<'JS'
const definition = { path: "/accounts/preferences/notifications" };
const shortDefinition = { path: "/tiny" };
JS
run_local node scripts/rea.mjs analyze-javascript-application repro-work/app --json > repro-work/analysis.json

Construct trace inputs using the complete analyzer Evidence without modifying its graph. The first two seeds occur in neither preserved route value. The other inputs check the real long route, a short route, and an absent value.

run_local python3 - <<'PY'
import json
from pathlib import Path
root = Path('repro-work')
application = json.loads((root / 'analysis.json').read_text())
assert application['operation'] == 'analyze_javascript_application'
seeds = {
    'synthetic-exact': {'kind': 'route', 'value': 'route endpoint', 'match': 'exact', 'case_sensitive': True},
    'synthetic-contains': {'kind': 'route', 'value': 'route', 'match': 'contains'},
    'real-exact': {'kind': 'route', 'value': '/accounts/preferences/notifications', 'match': 'exact'},
    'short-exact': {'kind': 'route', 'value': '/tiny', 'match': 'exact'},
    'negative': {'kind': 'route', 'value': 'not-present', 'match': 'exact'},
}
for name, seed in seeds.items():
    (root / (name + '.input.json')).write_text(json.dumps({'application': application, 'seed': seed}))
PY
for case in synthetic-exact synthetic-contains real-exact short-exact negative; do
  run_local node scripts/rea.mjs trace-application-feature "repro-work/$case.input.json" --json > "repro-work/$case.output.json"
done

Inspect the retained route observations and trace results.

run_local python3 - <<'PY'
import json
from pathlib import Path
root = Path('repro-work')
application = json.loads((root / 'analysis.json').read_text())
for node in application['normalized_result']['graph']['nodes']:
    if node['kind'] == 'endpoint':
        for observation in node['observations']:
            print(json.dumps({'label': observation['label'], 'properties': observation['properties']}))
for name in ['synthetic-exact', 'synthetic-contains', 'real-exact', 'short-exact', 'negative']:
    result = json.loads((root / (name + '.output.json')).read_text())['normalized_result']
    print(json.dumps({'case': name, 'matched_seeds': result['summary']['matched_seeds'],
                      'coverage': result['coverage']['status'], 'seed_matches': result['seed_matches']}))
PY

Expected behavior

docs/javascript-application-workflows.md:43-47 documents route seeds with exact or literal substring matching. Lines 115-127 preserve exact endpoint values in properties.value, define endpoint labels as display metadata rather than endpoint lookup values, and require literal endpoint search and tracing to use the preserved values. The supported CLI workflow and analyzer Evidence are described at lines 1-18.

The exact route endpoint and contains-mode route seeds should each return zero matches and coverage.status: "no-match". The exact /accounts/preferences/notifications and /tiny seeds should each keep one valid route match. The absent not-present seed should remain a no-match result.

Impact and scope

Supported route queries can select an unrelated endpoint and return a misleading reachable trace graph. The verified scope is literal property-path route endpoints in local JavaScript source. Other endpoint variants and population frequency were not tested. No security boundary crossing was established.

A practical workaround was demonstrated in the same graph: read the exact route from the analyzer Evidence and seed the trace with that complete preserved value. The exact long-route control selected the correct endpoint through observations[0].properties.value.

REA version

6.4.0 (main at 5830088520)

Runtime and platform

Node.js v26.10.0; macOS arm64. Baseline dependencies and runtime output were already prepared. CLI and Python commands used isolated home and XDG directories.

Target and artifact context

A local directory containing inert JavaScript source with two literal path properties. The trace inputs use the complete, unmodified analyzer Evidence. No application execution, network service, native-analysis provider, or forged graph was needed.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

The following compact summary records the verified endpoint and trace results:

Long endpoint: label="route endpoint", endpoint_kind="route",
value="/accounts/preferences/notifications", mechanism="property:path"

seed                                  mode                    matches  basis     coverage
route endpoint                        exact, case-sensitive   1        label     complete-within-source
route                                 contains                1        label     complete-within-source
/accounts/preferences/notifications    exact                   1        property  complete-within-source
/tiny                                 exact                   1        label     complete-within-source
not-present                           exact                   0        none      no-match

Both synthetic seeds and the exact long-route seed selected the same endpoint.
Each synthetic-seed trace retained 5 nodes and 4 edges.
All five trace CLI calls exited 0.

Typed outcome or recovery expected

For the two synthetic route seeds, return an empty seed_matches list, summary.matched_seeds: 0, and coverage.status: "no-match". Preserve the absent-value control and both valid exact-route matches. The short-route match remains valid because its display label equals its preserved value; restoration should not require a particular reported matching basis for that control.

Analysis or suspected cause

Source-derived reasoning at the stated baseline corroborates the independently reproduced CLI behavior. src/domain/javascript/javascriptFeatureSeed.ts:96-102 admits route endpoint nodes. Lines 121-147 add observation labels before property fields, lines 151-167 retain .label for route lookup, and lines 75-87 return the first matching field. src/application/javascript/JavaScriptArtifactGraphFindings.ts:207-221 chooses the short generated endpoint label while preserving the exact route in properties.value.

The supported path reaches this selection through src/cli/applicationCommands.ts:32-39 and src/application/javascript/JavaScriptApplicationWorkflowService.ts:50-97, which authenticates the analyzer Evidence and invokes production tracing. The failure occurs during route seed selection before the reachable graph is returned.

Additional context

P2 is supported because valid route seeds return consequential false matches and misleading analysis Evidence, while the exact preserved-value control demonstrates a safe, practical workaround. The observed defect is bounded to the tested route fixture.

Related: #3189 reports a separate failure in the same area; the two have independent fixes.

Originally created by @coygeek on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3190 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `trace-application-feature` selects a route endpoint for literal seeds absent from the analyzed application's preserved routes. An inert JavaScript fixture declares `/accounts/preferences/notifications` and `/tiny`. The analyzer returns successful Evidence and gives the long endpoint the generated display label `route endpoint`, while retaining its exact route in `properties.value`. An exact, case-sensitive `route endpoint` seed and a contains-mode `route` seed each match the long endpoint through `observations[0].label`. Each false match returns five traced nodes, four traced edges, and `complete-within-source` coverage. Neither seed occurs in either preserved route value. All five trace CLI calls, including the controls below, exit 0. `complete-within-source` describes coverage within the source graph; it does not establish runtime execution. ### Reproduction 1. Start from a clean checkout at `58300885207133422af235e0f2b10658cf958b03`, using the repository's pinned toolchain. Install the locked dependencies and build the runtime. The verifier used already prepared baseline dependencies and build output, so these two preparation commands were not rerun during verification. ```sh npm ci npm run build:cached ``` 2. Create a local application fixture and isolate the reproduction's home and configuration directories. Run all remaining commands from the repository root. ```sh mkdir -p repro-work/app repro-work/home run_local() { env HOME="$PWD/repro-work/home" \ XDG_CONFIG_HOME="$PWD/repro-work/home/config" \ XDG_CACHE_HOME="$PWD/repro-work/home/cache" \ XDG_DATA_HOME="$PWD/repro-work/home/data" "$@" } cat > repro-work/app/routes.js <<'JS' const definition = { path: "/accounts/preferences/notifications" }; const shortDefinition = { path: "/tiny" }; JS run_local node scripts/rea.mjs analyze-javascript-application repro-work/app --json > repro-work/analysis.json ``` 3. Construct trace inputs using the complete analyzer Evidence without modifying its graph. The first two seeds occur in neither preserved route value. The other inputs check the real long route, a short route, and an absent value. ```sh run_local python3 - <<'PY' import json from pathlib import Path root = Path('repro-work') application = json.loads((root / 'analysis.json').read_text()) assert application['operation'] == 'analyze_javascript_application' seeds = { 'synthetic-exact': {'kind': 'route', 'value': 'route endpoint', 'match': 'exact', 'case_sensitive': True}, 'synthetic-contains': {'kind': 'route', 'value': 'route', 'match': 'contains'}, 'real-exact': {'kind': 'route', 'value': '/accounts/preferences/notifications', 'match': 'exact'}, 'short-exact': {'kind': 'route', 'value': '/tiny', 'match': 'exact'}, 'negative': {'kind': 'route', 'value': 'not-present', 'match': 'exact'}, } for name, seed in seeds.items(): (root / (name + '.input.json')).write_text(json.dumps({'application': application, 'seed': seed})) PY for case in synthetic-exact synthetic-contains real-exact short-exact negative; do run_local node scripts/rea.mjs trace-application-feature "repro-work/$case.input.json" --json > "repro-work/$case.output.json" done ``` 4. Inspect the retained route observations and trace results. ```sh run_local python3 - <<'PY' import json from pathlib import Path root = Path('repro-work') application = json.loads((root / 'analysis.json').read_text()) for node in application['normalized_result']['graph']['nodes']: if node['kind'] == 'endpoint': for observation in node['observations']: print(json.dumps({'label': observation['label'], 'properties': observation['properties']})) for name in ['synthetic-exact', 'synthetic-contains', 'real-exact', 'short-exact', 'negative']: result = json.loads((root / (name + '.output.json')).read_text())['normalized_result'] print(json.dumps({'case': name, 'matched_seeds': result['summary']['matched_seeds'], 'coverage': result['coverage']['status'], 'seed_matches': result['seed_matches']})) PY ``` ### Expected behavior `docs/javascript-application-workflows.md:43-47` documents route seeds with exact or literal substring matching. Lines 115-127 preserve exact endpoint values in `properties.value`, define endpoint labels as display metadata rather than endpoint lookup values, and require literal endpoint search and tracing to use the preserved values. The supported CLI workflow and analyzer Evidence are described at lines 1-18. The exact `route endpoint` and contains-mode `route` seeds should each return zero matches and `coverage.status: "no-match"`. The exact `/accounts/preferences/notifications` and `/tiny` seeds should each keep one valid route match. The absent `not-present` seed should remain a no-match result. ### Impact and scope Supported route queries can select an unrelated endpoint and return a misleading reachable trace graph. The verified scope is literal property-path route endpoints in local JavaScript source. Other endpoint variants and population frequency were not tested. No security boundary crossing was established. A practical workaround was demonstrated in the same graph: read the exact route from the analyzer Evidence and seed the trace with that complete preserved value. The exact long-route control selected the correct endpoint through `observations[0].properties.value`. ### REA version 6.4.0 (main at 58300885207133422af235e0f2b10658cf958b03) ### Runtime and platform Node.js v26.10.0; macOS arm64. Baseline dependencies and runtime output were already prepared. CLI and Python commands used isolated home and XDG directories. ### Target and artifact context A local directory containing inert JavaScript source with two literal `path` properties. The trace inputs use the complete, unmodified analyzer Evidence. No application execution, network service, native-analysis provider, or forged graph was needed. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence The following compact summary records the verified endpoint and trace results: ```text Long endpoint: label="route endpoint", endpoint_kind="route", value="/accounts/preferences/notifications", mechanism="property:path" seed mode matches basis coverage route endpoint exact, case-sensitive 1 label complete-within-source route contains 1 label complete-within-source /accounts/preferences/notifications exact 1 property complete-within-source /tiny exact 1 label complete-within-source not-present exact 0 none no-match Both synthetic seeds and the exact long-route seed selected the same endpoint. Each synthetic-seed trace retained 5 nodes and 4 edges. All five trace CLI calls exited 0. ``` ### Typed outcome or recovery expected For the two synthetic route seeds, return an empty `seed_matches` list, `summary.matched_seeds: 0`, and `coverage.status: "no-match"`. Preserve the absent-value control and both valid exact-route matches. The short-route match remains valid because its display label equals its preserved value; restoration should not require a particular reported matching basis for that control. ### Analysis or suspected cause Source-derived reasoning at the stated baseline corroborates the independently reproduced CLI behavior. `src/domain/javascript/javascriptFeatureSeed.ts:96-102` admits route endpoint nodes. Lines 121-147 add observation labels before property fields, lines 151-167 retain `.label` for route lookup, and lines 75-87 return the first matching field. `src/application/javascript/JavaScriptArtifactGraphFindings.ts:207-221` chooses the short generated endpoint label while preserving the exact route in `properties.value`. The supported path reaches this selection through `src/cli/applicationCommands.ts:32-39` and `src/application/javascript/JavaScriptApplicationWorkflowService.ts:50-97`, which authenticates the analyzer Evidence and invokes production tracing. The failure occurs during route seed selection before the reachable graph is returned. ### Additional context P2 is supported because valid route seeds return consequential false matches and misleading analysis Evidence, while the exact preserved-value control demonstrates a safe, practical workaround. The observed defect is bounded to the tested route fixture. Related: #3189 reports a separate failure in the same area; the two have independent fixes.

bsakaguchi

2026-10-15 18:31:18 +00:00

closed this issue
added the
bug
label

bsakaguchi commented

2026-10-15 18:31:19 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 14, 2026):

Heads up: this looks fixed on main in 44c9d2924. The change is in src/domain/javascript/javascriptFeatureSeed.ts, and matches feature seeds against node IDs and preserved route values through CLI and MCP covers it. It is listed on tracker #3582. If it still happens on main, please say so here and I'll take it off the list.

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 14, 2026): Heads up: this looks fixed on main in 44c9d2924. The change is in `src/domain/javascript/javascriptFeatureSeed.ts`, and `matches feature seeds against node IDs and preserved route values through CLI and MCP` covers it. It is listed on tracker #3582. If it still happens on main, please say so here and I'll take it off the list. 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-15 18:31:19 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Resolved on main by 44c9d2924.

Route seeds match source-owned values and paths rather than generated display labels.

Rechecked on main b8510ee00 in the current focused run: 17 test files passed, 485 tests passed and one platform-dependent test skipped. Relevant regression coverage: tests/acceptance/applications/javascriptFeatureTraceSeedSelectionCli.test.ts.

@morluto commented on GitHub (Oct 14, 2026): Resolved on main by 44c9d2924. Route seeds match source-owned values and paths rather than generated display labels. Rechecked on main b8510ee00 in the current focused run: 17 test files passed, 485 tests passed and one platform-dependent test skipped. Relevant regression coverage: tests/acceptance/applications/javascriptFeatureTraceSeedSelectionCli.test.ts.

bsakaguchi referenced this issue

2026-10-17 21:09:00 +00:00

[PR #1147] [MERGED] fix(browser): report Windows HAR heap exhaustion #2680

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1128

No description provided.

Rows
Columns