[GH-ISSUE #3910] [Bug] passive inspection omits frames created during observation #1520

New issue

Closed

opened 2026-10-16 21:06:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:06:35 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3910

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

Passive inspect_electron_page fixes its frame inventory before observation. A valid local iframe created within that window is absent from returned frames, even when subsequent DOM/resource snapshots and script events include it. Its script receives frame_id: null despite a retained execution-context-to-frame association. No missing-frame limitation is recorded. This is one source-only stale-inventory failure with downstream attribution loss.

runElectronInspection reads frames before Runtime/Debugger enablement and observation, passes that array into content capture, and returns it unchanged. Navigation invalidates only the main frame. The final frame-tree check uses only mainFilePath, so the new child neither refreshes nor invalidates inventory. Content capture constructs frameIds from the old array. The child's context still maps to child, but script projection replaces that ID with null because the stale set lacks it. No branch records missing coverage. These are static deductions, not observed REA output.

Reproduction

These steps specify a proposed, unexecuted protocol fixture. No Electron or CDP fixture was launched. Use the baseline below.

Supply a conforming local CDP producer at http://127.0.0.1:9223, advertising page target page at file:///tmp/rea-frame-fixture/main.html. Create ordinary regular main.html, child.html, and child.js files there; child.html references child.js, whose exact text is void 0;. Return valid discovery, attachment, domain, resource, DOM snapshot, source, worker-list, and teardown replies using the resolved fixture paths.
Call MCP inspect_electron_page with {"cdp_endpoint":"http://127.0.0.1:9223","target_id":"page","observation_ms":100,"include_script_sources":true}. Equivalent CLI: rea inspect-electron-page http://127.0.0.1:9223 page --observation-ms 100 --include-script-sources --json.
Return only frame main in the first Page.getFrameTree. After domain enablement and before the observation delay ends, send child navigation for frame child, parent main, at the regular local child.html URL. Send Runtime.executionContextCreated with context.id: 7 and context.auxData.frameId: "child", then Debugger.scriptParsed for child.js with executionContextId: 7, a distinct script ID, scriptLanguage: "JavaScript", length: 7, and otherwise valid metadata. Keep context 7 alive without destruction, clearing, or reuse.
Subsequent Page.getResourceTree and DOMSnapshot.captureSnapshot include both documents. Return void 0; for Debugger.getScriptSource, the two-frame tree for the final Page.getFrameTree, and targetInfos: [] for worker discovery. Keep the main URL/path and identity unchanged throughout.
The source-derived successful result contains only main in frames and gives child.js a null frame ID, while completeness stays complete_within_window.

An application inserting a local iframe during observation can supply the same relevant ordering. No real Electron output, timing, or deployment frequency was observed.

Expected behavior

The passive inspector promises frame/DOM structure, explicit completeness, and retention of supplied execution-context frame IDs. Preserve the child and known script association, or explicitly report that the changed frame set cannot be represented. A complete result must not silently omit a present child while retaining its content and discarding its known association. The existing main-navigation guard remains applicable; this fixture changes only a child.

Impact and scope

Impact level: P2
Assessment status: supported
Impact basis: A valid newly added frame is omitted and its known script association discarded while coverage can remain complete. This misleads structural evidence analysis without demonstrated mutation or execution failure.

REA version

Reviewed release: rea-agents-6.5.0, revision 3b79af28e80785afce9f5998d8f03289402a1847. The source review compared fetched main at cf0a38ad9774ee9acff3164052688f7a58a1c72c; relevant provider, collector, projector, service, input, and contract files had no diff. Runtime, OS, and Chromium/Electron version are NOT_ENOUGH_INFO because no runtime was launched. The shared CLI/MCP source path has no platform-specific frame-set branch; real-browser behavior remains untested.

Runtime and platform

REA runtime reproduction was not run. Runtime and platform details for any smaller premise checks are recorded in the version/environment field above. Real-provider versions and end-to-end output are NOT_ENOUGH_INFO because no provider was launched.

Target and artifact context

Local-file Electron page with a child iframe added during passive CDP observation; DOM, resource, and script capture.

Interface

MCP

Earliest failure stage

Capture or observation

Relevant output or evidence

Expected source: docs/electron-observation.md:51-54 promises supplied frame-ID retention; src/contracts/javascript/electronToolContracts.ts:74 promises frames and DOM structure.
Failure source: src/browser/CdpElectronInspection.ts:69-128 retains the initial inventory and only invalidates main navigation; :182-222 captures later content and checks only the final main path. src/browser/CdpElectronScripts.ts:38-46 discards known mappings absent from the stale set.
Evidence provenance: static
Local verification: static-proof
Reproduction completeness: complete

The production-source trace is the primary violation evidence; no premise fixture was executed. Runtime reproduction was not run. Accepted input, public reachability, file eligibility, event ordering, retained context, and completeness guards are traced below. Reproduction completeness applies to the stated source-only protocol input. Real-browser reproduction and population frequency are unknown.

src/cli/electronCommands.ts:201-220 and src/server/registerElectronTools.ts:84-93 call the shared service. src/domain/javascript/electronObservation.ts:21 accepts the selected target, integer delay, and source flag. src/application/javascript/ElectronObservationService.ts:35 invokes the configured provider; src/composition/electronObservation.ts:6 constructs CdpElectronProvider.

src/browser/CdpElectronProvider.ts:107-153 discovers the endpoint, selects the exact page target, opens its session, invokes inspection, and parses output. ElectronFileScope.ts:12-41 accepts hostless absolute file URLs for existing regular files. CdpElectronScriptEvents.ts:37,53-71 retains the script context key and live "7" -> "child" association. No unsupported file, malformed collection, context loss, or ID reuse is involved.

CdpElectronInspection.ts:182 builds the old membership set and fetches current resources/DOM. Its :218-222 guard passes because main identity remains stable. src/browser/CdpCaptureCompleteness.ts:41 starts an empty limitation ledger; no omitted-child condition is added. src/domain/browserCompleteness.ts:100 yields complete_within_window for empty condition sets. Output schemas allow null frame IDs and do not reconcile them against current DOM/resources. Browser filenames above without prefixes are under src/browser/.

Typed outcome or recovery expected

For this ordering, eliminate the silent missing-child/null-attribution result with complete coverage. A completed capture should include child and preserve child.js -> child; an explicit typed instability/incomplete result may instead state the limitation. Control with the child already in the initial tree and the same live context must retain correct attribution. These proposed checks are unexecuted and require no particular repair.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A valid newly added frame is omitted and its known script association discarded while coverage can remain complete. This misleads structural evidence analysis without demonstrated mutation or execution failure.
Workaround status: available
Workaround basis: Source-derived control: begin inspection after the iframe loads and remains stable so the initial inventory includes it. The membership check then retains attribution. This recapture workaround was not executed and cannot repair an already retained result.

Originally created by @coygeek on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3910 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Process capture or runtime observation ## Observed behavior Passive `inspect_electron_page` fixes its frame inventory before observation. A valid local iframe created within that window is absent from returned `frames`, even when subsequent DOM/resource snapshots and script events include it. Its script receives `frame_id: null` despite a retained execution-context-to-frame association. No missing-frame limitation is recorded. This is one source-only stale-inventory failure with downstream attribution loss. `runElectronInspection` reads `frames` before Runtime/Debugger enablement and observation, passes that array into content capture, and returns it unchanged. Navigation invalidates only the main frame. The final frame-tree check uses only `mainFilePath`, so the new child neither refreshes nor invalidates inventory. Content capture constructs `frameIds` from the old array. The child's context still maps to `child`, but script projection replaces that ID with null because the stale set lacks it. No branch records missing coverage. These are static deductions, not observed REA output. ## Reproduction These steps specify a proposed, unexecuted protocol fixture. No Electron or CDP fixture was launched. Use the baseline below. 1. Supply a conforming local CDP producer at `http://127.0.0.1:9223`, advertising page target `page` at `file:///tmp/rea-frame-fixture/main.html`. Create ordinary regular `main.html`, `child.html`, and `child.js` files there; `child.html` references `child.js`, whose exact text is `void 0;`. Return valid discovery, attachment, domain, resource, DOM snapshot, source, worker-list, and teardown replies using the resolved fixture paths. 2. Call MCP `inspect_electron_page` with `{"cdp_endpoint":"http://127.0.0.1:9223","target_id":"page","observation_ms":100,"include_script_sources":true}`. Equivalent CLI: `rea inspect-electron-page http://127.0.0.1:9223 page --observation-ms 100 --include-script-sources --json`. 3. Return only frame `main` in the first `Page.getFrameTree`. After domain enablement and before the observation delay ends, send child navigation for frame `child`, parent `main`, at the regular local `child.html` URL. Send `Runtime.executionContextCreated` with `context.id: 7` and `context.auxData.frameId: "child"`, then `Debugger.scriptParsed` for `child.js` with `executionContextId: 7`, a distinct script ID, `scriptLanguage: "JavaScript"`, `length: 7`, and otherwise valid metadata. Keep context 7 alive without destruction, clearing, or reuse. 4. Subsequent `Page.getResourceTree` and `DOMSnapshot.captureSnapshot` include both documents. Return `void 0;` for `Debugger.getScriptSource`, the two-frame tree for the final `Page.getFrameTree`, and `targetInfos: []` for worker discovery. Keep the main URL/path and identity unchanged throughout. 5. The source-derived successful result contains only `main` in `frames` and gives `child.js` a null frame ID, while completeness stays `complete_within_window`. An application inserting a local iframe during observation can supply the same relevant ordering. No real Electron output, timing, or deployment frequency was observed. ## Expected behavior The passive inspector promises frame/DOM structure, explicit completeness, and retention of supplied execution-context frame IDs. Preserve the child and known script association, or explicitly report that the changed frame set cannot be represented. A complete result must not silently omit a present child while retaining its content and discarding its known association. The existing main-navigation guard remains applicable; this fixture changes only a child. ## Impact and scope - Impact level: P2 - Assessment status: supported - Impact basis: A valid newly added frame is omitted and its known script association discarded while coverage can remain complete. This misleads structural evidence analysis without demonstrated mutation or execution failure. ## REA version Reviewed release: `rea-agents-6.5.0`, revision `3b79af28e80785afce9f5998d8f03289402a1847`. The source review compared fetched main at `cf0a38ad9774ee9acff3164052688f7a58a1c72c`; relevant provider, collector, projector, service, input, and contract files had no diff. Runtime, OS, and Chromium/Electron version are `NOT_ENOUGH_INFO` because no runtime was launched. The shared CLI/MCP source path has no platform-specific frame-set branch; real-browser behavior remains untested. ## Runtime and platform REA runtime reproduction was not run. Runtime and platform details for any smaller premise checks are recorded in the version/environment field above. Real-provider versions and end-to-end output are NOT_ENOUGH_INFO because no provider was launched. ## Target and artifact context Local-file Electron page with a child iframe added during passive CDP observation; DOM, resource, and script capture. ## Interface MCP ## Earliest failure stage Capture or observation ## Relevant output or evidence - Expected source: [docs/electron-observation.md:51-54](https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/docs/electron-observation.md#L51-L54) promises supplied frame-ID retention; [src/contracts/javascript/electronToolContracts.ts:74](https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/contracts/javascript/electronToolContracts.ts#L74) promises frames and DOM structure. - Failure source: [src/browser/CdpElectronInspection.ts:69-128](https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/browser/CdpElectronInspection.ts#L69-L128) retains the initial inventory and only invalidates main navigation; `:182-222` captures later content and checks only the final main path. [src/browser/CdpElectronScripts.ts:38-46](https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/browser/CdpElectronScripts.ts#L38-L46) discards known mappings absent from the stale set. - Evidence provenance: static - Local verification: static-proof - Reproduction completeness: complete The production-source trace is the primary violation evidence; no premise fixture was executed. Runtime reproduction was not run. Accepted input, public reachability, file eligibility, event ordering, retained context, and completeness guards are traced below. Reproduction completeness applies to the stated source-only protocol input. Real-browser reproduction and population frequency are unknown. `src/cli/electronCommands.ts:201-220` and `src/server/registerElectronTools.ts:84-93` call the shared service. `src/domain/javascript/electronObservation.ts:21` accepts the selected target, integer delay, and source flag. `src/application/javascript/ElectronObservationService.ts:35` invokes the configured provider; `src/composition/electronObservation.ts:6` constructs `CdpElectronProvider`. `src/browser/CdpElectronProvider.ts:107-153` discovers the endpoint, selects the exact page target, opens its session, invokes inspection, and parses output. `ElectronFileScope.ts:12-41` accepts hostless absolute file URLs for existing regular files. `CdpElectronScriptEvents.ts:37,53-71` retains the script context key and live `"7" -> "child"` association. No unsupported file, malformed collection, context loss, or ID reuse is involved. `CdpElectronInspection.ts:182` builds the old membership set and fetches current resources/DOM. Its `:218-222` guard passes because main identity remains stable. `src/browser/CdpCaptureCompleteness.ts:41` starts an empty limitation ledger; no omitted-child condition is added. `src/domain/browserCompleteness.ts:100` yields `complete_within_window` for empty condition sets. Output schemas allow null frame IDs and do not reconcile them against current DOM/resources. Browser filenames above without prefixes are under `src/browser/`. ## Typed outcome or recovery expected For this ordering, eliminate the silent missing-child/null-attribution result with complete coverage. A completed capture should include `child` and preserve `child.js -> child`; an explicit typed instability/incomplete result may instead state the limitation. Control with the child already in the initial tree and the same live context must retain correct attribution. These proposed checks are unexecuted and require no particular repair. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A valid newly added frame is omitted and its known script association discarded while coverage can remain complete. This misleads structural evidence analysis without demonstrated mutation or execution failure. - Workaround status: available - Workaround basis: Source-derived control: begin inspection after the iframe loads and remains stable so the initial inventory includes it. The membership check then retains attribution. This recapture workaround was not executed and cannot repair an already retained result.

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:12:02 +00:00

[PR #1520] [CLOSED] perf(javascript): index returned method analysis #2939

bsakaguchi closed this issue

2026-10-31 00:31:14 +00:00