morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3861] [Bug] Overflowing configuration defaults abort JavaScript application analysis #1481

New issue

Closed

opened 2026-10-16 21:06:00 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-16 21:06:00 +00:00

Owner

Originally created by @Zhong-fan on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3861

Before submitting

I searched open and closed issues and pull requests for related reports.
I removed credentials, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

process.env.TTL ?? 1e400 causes analyze-javascript-application to fail with unreadable_output. The same failure occurs with ||. The source passes node --check.

Partial artifact Evidence survives, but the affected file loses unrelated semantics: the reproduction below retains only one semantic module node and zero relations, without unrelated. Changing only 1e400 to 100 succeeds with 11 semantic nodes and five relations, including that function.

Reproduction

Create an application directory containing these two files:

package.json:

{"type":"module"}

main.js:

export const ttl = process.env.TTL ?? 1e400;
export function unrelated() { return "retained"; }

Run the public launcher from either the installed package or a built source checkout:

node --check <app>/main.js
node <rea-root>/scripts/rea.mjs analyze-javascript-application <app> --format json

Syntax checking exits 0; analysis exits 1. The equivalent stdio MCP call also returns isError: true:

{"name":"analyze_javascript_application","arguments":{"input_path":"<absolute-app-directory>"}}

Expected behavior

Retain the configuration source/default candidate and unrelated file semantics, representing the nonfinite default as explicitly unknown and JSON-safe. Do not invent a finite value or relax JSON validation.

Impact and scope

Reproduced through CLI and stdio MCP on both versions below. Input file hashes were unchanged across the final CLI checks. This is a synthetic, source-owned reproduction; I have not established an affected production application or prevalence.

REA version

Published rea-agents@6.5.0.
Source build at a1ca8c76af64000e119fd2a14f34cbf28869f5d8, using the official 6.5.0 Windows native artifact.

Runtime and platform

Node.js 24.18.0; Windows x64, OS build 26200. No external analysis engine is needed.

Interface

CLI and stdio MCP

Earliest failure stage

Transport or result projection

Relevant output or evidence

code: unreadable_output
details.reason: main.js during projection:
  message: JSON numbers must be finite
  path: ["properties", "value"]

Controls on both the release and source build:

Input	CLI result
`process.env.TTL ?? 1e400`	exit 1
`process.env.TTL
`process.env.TTL ?? 100`	exit 0
`process.env.TTL ?? 1e308`	exit 0
`process.env.TTL ?? Infinity`	exit 0; default value stays unknown
standalone `export const ttl = 1e400`	exit 0

Analysis or suspected cause

Source-derived: dataEffectPrimitive returns NumericLiteral.value without a finiteness check. collectDefaults treats that result as complete, and configuration projection publishes it as properties.value.

The existing dataflow and graph-resource suites passed all 78 tests. They cover nonfinite binding values and ordinary configuration defaults separately, but do not exercise an overflowing configuration default through graph projection.

Additional context

Related to #3400, which reports overflowing timer delays. This reproduction contains no timer and uses a different producer. I inspected #3456: its production change is limited to timerDelay and does not change dataEffectPrimitive. Please link or consolidate this report if these paths should be tracked together.

Originally created by @Zhong-fan on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3861 ### Before submitting - [x] I searched open and closed issues and pull requests for related reports. - [x] I removed credentials, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `process.env.TTL ?? 1e400` causes `analyze-javascript-application` to fail with `unreadable_output`. The same failure occurs with `||`. The source passes `node --check`. Partial artifact Evidence survives, but the affected file loses unrelated semantics: the reproduction below retains only one semantic module node and zero relations, without `unrelated`. Changing only `1e400` to `100` succeeds with 11 semantic nodes and five relations, including that function. ### Reproduction Create an application directory containing these two files: `package.json`: ```json {"type":"module"} ``` `main.js`: ```js export const ttl = process.env.TTL ?? 1e400; export function unrelated() { return "retained"; } ``` Run the public launcher from either the installed package or a built source checkout: ```text node --check <app>/main.js node <rea-root>/scripts/rea.mjs analyze-javascript-application <app> --format json ``` Syntax checking exits 0; analysis exits 1. The equivalent stdio MCP call also returns `isError: true`: ```json {"name":"analyze_javascript_application","arguments":{"input_path":"<absolute-app-directory>"}} ``` ### Expected behavior Retain the configuration source/default candidate and unrelated file semantics, representing the nonfinite default as explicitly unknown and JSON-safe. Do not invent a finite value or relax JSON validation. ### Impact and scope Reproduced through CLI and stdio MCP on both versions below. Input file hashes were unchanged across the final CLI checks. This is a synthetic, source-owned reproduction; I have not established an affected production application or prevalence. ### REA version - Published `rea-agents@6.5.0`. - Source build at `a1ca8c76af64000e119fd2a14f34cbf28869f5d8`, using the official 6.5.0 Windows native artifact. ### Runtime and platform Node.js 24.18.0; Windows x64, OS build 26200. No external analysis engine is needed. ### Interface CLI and stdio MCP ### Earliest failure stage Transport or result projection ### Relevant output or evidence ```text code: unreadable_output details.reason: main.js during projection: message: JSON numbers must be finite path: ["properties", "value"] ``` Controls on both the release and source build: | Input | CLI result | | --- | --- | | `process.env.TTL ?? 1e400` | exit 1 | | `process.env.TTL || 1e400` | exit 1 | | `process.env.TTL ?? 100` | exit 0 | | `process.env.TTL ?? 1e308` | exit 0 | | `process.env.TTL ?? Infinity` | exit 0; default value stays unknown | | standalone `export const ttl = 1e400` | exit 0 | ### Analysis or suspected cause Source-derived: [`dataEffectPrimitive`](https://github.com/morluto/rea/blob/a1ca8c76af64000e119fd2a14f34cbf28869f5d8/src/domain/javascript/javascriptSemanticDataEffectHelpers.ts#L919) returns `NumericLiteral.value` without a finiteness check. [`collectDefaults`](https://github.com/morluto/rea/blob/a1ca8c76af64000e119fd2a14f34cbf28869f5d8/src/domain/javascript/javascriptSemanticDataEffects.ts#L160) treats that result as complete, and configuration projection publishes it as `properties.value`. The existing dataflow and graph-resource suites passed all 78 tests. They cover nonfinite binding values and ordinary configuration defaults separately, but do not exercise an overflowing configuration default through graph projection. ### Additional context Related to #3400, which reports overflowing **timer delays**. This reproduction contains no timer and uses a different producer. I inspected #3456: its production change is limited to `timerDelay` and does not change `dataEffectPrimitive`. Please link or consolidate this report if these paths should be tracked together.

bsakaguchi closed this issue

2026-10-16 21:06:00 +00:00

bsakaguchi commented

2026-10-16 21:06:02 +00:00

Author

Owner

@xu91102 commented on GitHub (Oct 15, 2026):

Reproduced on current main 1b036ecbffefca61d074ffd4ec65cc41c1b1636e, Node 24.18.0 / npm 11.16.0, macOS arm64, after a clean locked install and runtime build.

For the report's two-file fixture, both ?? 1e400 and || 1e400 produce CLI exit 1 (unreadable_output, JSON numbers must be finite, properties.value) and an actual production stdio MCP tool error. The retained partial CLI graph has only its module node and no relations; the unrelated exported function is lost.

Controls ?? 100, ?? 1e308, ?? Infinity, and standalone 1e400 all succeed through both adapters. All six files pass node --check and retain their original SHA-256 after analysis. No target application code or external analysis engine was executed.

I am preparing a focused repair in the existing configuration/default producer, with public CLI/MCP regression coverage. The numeric default must remain explicitly unknown while its source, default relation, and the rest of the file's graph survive. Source review confirms that #3456 fixes the timer producer only; it does not cover this configuration-default path. The existing exact-literal reader already owns the finite-number rule, so the repair will reuse it rather than relax graph JSON validation.

@xu91102 commented on GitHub (Oct 15, 2026): Reproduced on current `main` `1b036ecbffefca61d074ffd4ec65cc41c1b1636e`, Node 24.18.0 / npm 11.16.0, macOS arm64, after a clean locked install and runtime build. For the report's two-file fixture, both `?? 1e400` and `|| 1e400` produce CLI exit 1 (`unreadable_output`, `JSON numbers must be finite`, `properties.value`) and an actual production stdio MCP tool error. The retained partial CLI graph has only its module node and no relations; the unrelated exported function is lost. Controls `?? 100`, `?? 1e308`, `?? Infinity`, and standalone `1e400` all succeed through both adapters. All six files pass `node --check` and retain their original SHA-256 after analysis. No target application code or external analysis engine was executed. I am preparing a focused repair in the existing configuration/default producer, with public CLI/MCP regression coverage. The numeric default must remain explicitly unknown while its source, default relation, and the rest of the file's graph survive. Source review confirms that #3456 fixes the timer producer only; it does not cover this configuration-default path. The existing exact-literal reader already owns the finite-number rule, so the repair will reuse it rather than relax graph JSON validation.

bsakaguchi commented

2026-10-16 21:06:02 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 16, 2026):

Duplicate of #3400.

Both issues isolate the exact same root failure in analyze_javascript_application: when source code defines a numeric literal overflowing IEEE 754 float limits (1e400 here, 1e999 in #3400), the evaluated value becomes Infinity, which cannot be serialized to valid JSON, triggering unreadable_output and aborting application analysis (dropping module semantics and relations).

@morluto: could you please review and consider closing this issue as a duplicate of earlier issue #3400, consolidating reproduction fixtures under the canonical report?

@matbrgz commented on GitHub (Oct 16, 2026): Duplicate of #3400. Both issues isolate the exact same root failure in `analyze_javascript_application`: when source code defines a numeric literal overflowing IEEE 754 float limits (`1e400` here, `1e999` in #3400), the evaluated value becomes `Infinity`, which cannot be serialized to valid JSON, triggering `unreadable_output` and aborting application analysis (dropping module semantics and relations). @morluto: could you please review and consider closing this issue as a duplicate of earlier issue #3400, consolidating reproduction fixtures under the canonical report?

bsakaguchi commented

2026-10-16 21:06:02 +00:00

Author

Owner

@Zhong-fan commented on GitHub (Oct 16, 2026):

Thanks for pointing this out. I’m closing this issue in favor of #3400 to consolidate tracking.
The configuration-default reproductions, including process.env.TTL ?? 1e400 and its || variant, are documented above. Please retain these cases as additional coverage alongside the timer-delay scenario.

@Zhong-fan commented on GitHub (Oct 16, 2026): Thanks for pointing this out. I’m closing this issue in favor of #3400 to consolidate tracking. The configuration-default reproductions, including process.env.TTL ?? 1e400 and its || variant, are documented above. Please retain these cases as additional coverage alongside the timer-delay scenario.

bsakaguchi referenced this issue

2026-10-17 21:11:48 +00:00

[PR #1481] [MERGED] fix(ida): canonicalize the headless workspace root before opening #2919

bsakaguchi referenced this issue

2026-10-31 00:39:48 +00:00

[GH-ISSUE #5559] [Bug] Doctor reports IDA ready with an unusable headless workspace root #3387