morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4242] [Bug] Noncanonical rest-array keys select the wrong inferred IPC channel #1666

New issue

Closed

opened 2026-10-16 21:08:47 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:08:47 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4242

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

analyze-javascript-application substitutes the channel SECOND into the contextual path for desktop.read when its returned closure sends items["01"] ?? "FALLBACK" and the rest arguments are the fixed literals "FIRST", "SECOND". The canonical items["1"] control produces the same inferred channel. The two keys have different ordinary JavaScript meanings: the fresh rest array has no property named "01", so the suspect expression selects FALLBACK.

The returned path remains a qualified static candidate, and the original dynamic expression remains available as observed syntax. The defect is the wrong literal value inside lexical substitution. This report does not claim that REA executes the fixture or reports an observed runtime channel.

Reproduction

Use the built source checkout at the revision below, with its locked dependencies and pinned Node.js runtime on PATH. From the repository root, run this complete reproduction. It creates inert CommonJS application directories and isolated home/config/cache/data/temporary directories, invokes the public CLI sequentially, and prints the relevant graph observations. It never executes main.cjs or loads Electron.

python3 - <<'PY_REPRO'
import json
import os
from pathlib import Path
import subprocess
from tempfile import TemporaryDirectory

cases = {
    "noncanonical": ("", 'items["01"] ?? "FALLBACK"'),
    "canonical": ("", 'items["1"] ?? "FALLBACK"'),
    "fallback": ("", '"FALLBACK"'),
    "dynamic": ("key", 'items[key] ?? "FALLBACK"'),
}
with TemporaryDirectory(prefix="rea-rest-key-") as temporary:
    root = Path(temporary)
    environment = dict(os.environ)
    for key in ("HOME", "XDG_CONFIG_HOME", "XDG_CACHE_HOME", "XDG_DATA_HOME", "TMPDIR"):
        folder = root / key.lower()
        folder.mkdir()
        environment[key] = str(folder)
    for name, (parameters, expression) in cases.items():
        app = root / name
        app.mkdir()
        source = (
            'const e = require("electron");\n'
            'function make(...items) {\n'
            '  return (' + parameters + ') => e.ipcRenderer.send(' + expression + ');\n'
            '}\n'
            'e.contextBridge.exposeInMainWorld("desktop", { read: make("FIRST", "SECOND") });\n'
        )
        (app / "main.cjs").write_text(source)
        result = subprocess.run(
            ["node", "scripts/rea.mjs", "analyze-javascript-application",
             str(app), "--format", "json", "--full-output"],
            env=environment, text=True, capture_output=True, timeout=60,
        )
        envelope = json.loads(result.stdout)
        assert result.returncode == 0 and envelope["ok"], envelope
        analysis = envelope["data"]["normalized_result"]
        assert analysis["statistics"]["parsed_javascript_files"] == 1
        assert analysis["statistics"]["parse_failures"] == 0
        paths = []
        channels = []
        for node in analysis["graph"]["nodes"]:
            for observation in node["observations"]:
                properties = observation["properties"]
                evidence = observation["evidence"]
                if (properties.get("entry") == "desktop.read"
                        and properties.get("step_kind") == "terminal"):
                    paths.append([properties["channel"], properties["resolution"], evidence["state"]])
                if node["kind"] == "ipc-channel":
                    channels.append([properties["channel"], properties["resolution"], evidence["state"]])
        channels.sort(key=lambda row: str(row))
        print(name, "exit", result.returncode, "paths", json.dumps(paths),
              "channels", json.dumps(channels))
PY_REPRO

noncanonical is the failing fixed-key source. canonical changes only the key from "01" to "1". fallback replaces the channel expression with the literal "FALLBACK". dynamic makes the key a parameter of the exposed callback and checks genuine caller-dependent uncertainty. These are discriminating controls, not source-preserving workarounds.

Expected behavior

Bounded lexical substitution must preserve literal property identity. A named array property "01" must not select positional element 1. For the noncanonical source, withhold the SECOND contextual channel and inferred literal:SECOND node attributed to this call. The analyzer may resolve the ordinary result to FALLBACK or retain explicit uncertainty if its abstraction cannot prove the missing property. Keep the canonical control's SECOND, the fallback control's FALLBACK, and the dynamic-key control's unresolved value. Preserve the written dynamic expression and all appropriate static-candidate limitations.

The reconstruction guide documents returned-closure/wrapper substitution as a static inference with literal channels and unknowns. Its authority limits concern runtime reachability, overrides, registration and dispatch. The repository separately defines canonical array indices and already tests that list["1"] resolves a slot while list["01"] remains unknown. This expectation does not require a precise Electron runtime model or exact undefined propagation for missing properties.

Impact and scope

A valid inert CommonJS input produces a wrong machine-readable inferred IPC channel and contextual candidate path. This is a bounded P2 analysis-correctness defect; original source evidence, partial coverage and runtime-unverified limitations survive. No severe incident or whole-workflow blockage was established. The four-case reproduction returned the same results in separate baseline verification and current-main publication replays. NOT_ENOUGH_INFO: real-application prevalence and downstream tracing consequences were not measured.

No supported public option or unchanged-input workflow was verified to correct the contextual channel. Changing "01" to "1" changes the program's meaning and is a control. Workaround status remains unverified.

REA version

Tested current upstream main 921fa03fca7181af5d69ccc10a4ceadc22c9c9e0, built with npm run build:cached and locked dependencies. Original independent verification used source baseline 62bf09809ef7bb224028916424f8f07652a20f4f. The standalone CLI recipe succeeded at both tested revisions with the output below. The source manifest reports 6.5.0. These are repository builds; NOT_ENOUGH_INFO: published-package behavior was not tested, and the manifest version does not establish it.

Runtime and platform

Repository-pinned Node.js v24.18.0 and npm 11.16.0 on macOS arm64. No external analysis provider was used.

Target and artifact context

Inert extracted CommonJS application directories, each with the complete authored main.cjs fixture above. The failing source has fixed rest arguments, a fixed named key, no call-site spread, assignment, accessor, branch or module-table bootstrap. REA does not execute these sources or require an Electron installation. A separate harmless recording oracle defines its own send operation.

Interface

CLI, through node scripts/rea.mjs analyze-javascript-application with JSON and full output.

Earliest failure stage

Native analysis or reconstruction. The symbolic evaluator supplies the wrong literal before graph projection; public request admission, parsing, Evidence creation and cleanup succeed.

Relevant output or evidence

The complete standalone reproduction succeeded. Each call exited 0, returned ok: true, parsed one JavaScript file and reported zero parse failures. Its output was:

noncanonical exit 0 paths [["SECOND", "candidate", "inferred"]] channels [["SECOND", "literal", "inferred"], [null, "dynamic", "observed"]]
canonical exit 0 paths [["SECOND", "candidate", "inferred"]] channels [["SECOND", "literal", "inferred"], [null, "dynamic", "observed"]]
fallback exit 0 paths [["FALLBACK", "candidate", "inferred"]] channels [["FALLBACK", "literal", "observed"]]
dynamic exit 0 paths [] channels [[null, "dynamic", "observed"]]

For the noncanonical source, the contextual desktop.read path has channel: "SECOND", resolution: "candidate", no conditions, and inferred evidence with high confidence. Its separate inferred IPC-channel node is keyed literal:SECOND and uses resolution: "literal". The channel evidence retains authority: "static-relationship-inference", state: "inferred", and limitations that runtime registration, dispatch and execution remain unverified. The raw IPC-channel observation retains channel: null, resolution: "dynamic", and channel_expression: "items[\"01\"] ?? \"FALLBACK\""; its observed/exact evidence describes the written syntax.

The result also retains partial graph coverage and separate semantic limitations such as Binding items has no constant initializer., Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity., and unknown cross-function mutation/dynamic property resolution. These describe the generic source analysis and unresolved facts; the contextual wrapper result still substitutes the fixed rest arguments and publishes SECOND. Those runtime qualifications remain honest. They do not explain changing the fixed named key to a positional index. The canonical source has the same reported candidate channel even though a harmless recording oracle gives different results. A separate first pass using --json reproduced the same four cases, also with successful cleanup.

The following self-authored recording oracle ran with the pinned Node runtime. It defines the recording send operation itself, uses ordinary fresh rest arrays, and does not import Electron:

const calls = [];
const e = { ipcRenderer: { send: channel => calls.push(channel) } };
function noncanonical(...items) {
  return () => e.ipcRenderer.send(items["01"] ?? "FALLBACK");
}
function canonical(...items) {
  return () => e.ipcRenderer.send(items["1"] ?? "FALLBACK");
}
noncanonical("FIRST", "SECOND")();
canonical("FIRST", "SECOND")();
console.log(JSON.stringify(calls));
// ["FALLBACK","SECOND"]

The retained verification oracle also asserts that the noncanonical array has no own "01" property and checks the fallback and dynamic controls. Its results were FALLBACK, SECOND, FALLBACK, FALLBACK, SECOND for noncanonical, canonical, literal fallback, dynamic key "01", and dynamic key "1", respectively. This establishes ordinary fixture language semantics with a recording object, not actual Electron engine or application execution coverage.

The current-main publication replay also retained and inspected the full noncanonical result. The unchanged source suites javascriptSymbolicBindings.test.ts and electronWrappedCallPaths.test.ts passed all 90 existing tests during the original baseline verification. Those tests were not rerun on current main; the current-main proof is a fresh build and repeated public CLI reproduction.

Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

Typed outcome or recovery expected

Run the same four-case public reproduction. The original noncanonical source must no longer acquire SECOND through its named property lookup, either in its contextual path or an inferred channel node attributed to that call. A correctly inferred FALLBACK or meaningful retained unknown satisfies this check. Preserve the canonical control's SECOND and the literal fallback control's FALLBACK; preserve genuinely unresolved dynamic-key behavior and the original syntax evidence. Keep every recovered relationship explicitly static. These checks allow either a more precise property model or conservative uncertainty and prescribe no implementation.

Analysis or suspected cause

Source-derived explanation: the symbolic array lookup treats every digit-only key as a positional index and reads value.values[Number(key)]. Rest binding constructs the positional array from the fixed literal arguments, and member evaluation supplies the written key. The wrapper collector requires a literal string to emit a contextual channel; graph projection retains it as a static candidate.

The expected contract is supported by the reconstruction guide, the canonical array-index owner, the existing index-identity test in the separate semantic evaluator, and the contextual collector's unresolved-channel controls. These support withholding a wrong literal without requiring exact missing-property propagation or runtime execution. The relevant symbolic evaluator, wrapper collector, projection and index-contract files are unchanged from the verified baseline; the current-main recipe directly reproduced the same failure.

Additional context

The related subtraction-assignment report #4206 concerns wrong branch pruning from evaluating an assignment expression's right operand as its result. This source has no assignment or conditional statement. That report's else-path restoration and this report's named-property/index distinction can fail independently, despite sharing a symbolic evaluator.

NOT_ENOUGH_INFO: the first affected revision and last known good revision are unknown. Published-package behavior, MCP transport, actual Electron operation, other platforms, full-suite coverage and post-fix restoration were not tested. The recording oracle establishes ordinary JavaScript fixture semantics, not Electron execution coverage.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A valid inert CommonJS input produces a wrong machine-readable inferred IPC channel and contextual candidate path. The demonstrated consequence is bounded analysis incorrectness; source evidence and runtime-unverified limitations survive. No severe incident, whole-workflow blockage, real-application frequency or downstream tracing consequence was established.
Workaround status: unverified
Workaround basis: No supported public option or unchanged-input workflow was verified to return a corrected contextual channel. Manual inspection and candidate qualification do not correct the returned value. Replacing "01" with "1" changes the recording oracle's result from FALLBACK to SECOND, so it changes the program's meaning and is only a control.

Originally created by @coygeek on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4242 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior `analyze-javascript-application` substitutes the channel `SECOND` into the contextual path for `desktop.read` when its returned closure sends `items["01"] ?? "FALLBACK"` and the rest arguments are the fixed literals `"FIRST", "SECOND"`. The canonical `items["1"]` control produces the same inferred channel. The two keys have different ordinary JavaScript meanings: the fresh rest array has no property named `"01"`, so the suspect expression selects `FALLBACK`. The returned path remains a qualified static candidate, and the original dynamic expression remains available as observed syntax. The defect is the wrong literal value inside lexical substitution. This report does not claim that REA executes the fixture or reports an observed runtime channel. ## Reproduction Use the built source checkout at the revision below, with its locked dependencies and pinned Node.js runtime on PATH. From the repository root, run this complete reproduction. It creates inert CommonJS application directories and isolated home/config/cache/data/temporary directories, invokes the public CLI sequentially, and prints the relevant graph observations. It never executes `main.cjs` or loads Electron. ```sh python3 - <<'PY_REPRO' import json import os from pathlib import Path import subprocess from tempfile import TemporaryDirectory cases = { "noncanonical": ("", 'items["01"] ?? "FALLBACK"'), "canonical": ("", 'items["1"] ?? "FALLBACK"'), "fallback": ("", '"FALLBACK"'), "dynamic": ("key", 'items[key] ?? "FALLBACK"'), } with TemporaryDirectory(prefix="rea-rest-key-") as temporary: root = Path(temporary) environment = dict(os.environ) for key in ("HOME", "XDG_CONFIG_HOME", "XDG_CACHE_HOME", "XDG_DATA_HOME", "TMPDIR"): folder = root / key.lower() folder.mkdir() environment[key] = str(folder) for name, (parameters, expression) in cases.items(): app = root / name app.mkdir() source = ( 'const e = require("electron");\n' 'function make(...items) {\n' ' return (' + parameters + ') => e.ipcRenderer.send(' + expression + ');\n' '}\n' 'e.contextBridge.exposeInMainWorld("desktop", { read: make("FIRST", "SECOND") });\n' ) (app / "main.cjs").write_text(source) result = subprocess.run( ["node", "scripts/rea.mjs", "analyze-javascript-application", str(app), "--format", "json", "--full-output"], env=environment, text=True, capture_output=True, timeout=60, ) envelope = json.loads(result.stdout) assert result.returncode == 0 and envelope["ok"], envelope analysis = envelope["data"]["normalized_result"] assert analysis["statistics"]["parsed_javascript_files"] == 1 assert analysis["statistics"]["parse_failures"] == 0 paths = [] channels = [] for node in analysis["graph"]["nodes"]: for observation in node["observations"]: properties = observation["properties"] evidence = observation["evidence"] if (properties.get("entry") == "desktop.read" and properties.get("step_kind") == "terminal"): paths.append([properties["channel"], properties["resolution"], evidence["state"]]) if node["kind"] == "ipc-channel": channels.append([properties["channel"], properties["resolution"], evidence["state"]]) channels.sort(key=lambda row: str(row)) print(name, "exit", result.returncode, "paths", json.dumps(paths), "channels", json.dumps(channels)) PY_REPRO ``` `noncanonical` is the failing fixed-key source. `canonical` changes only the key from `"01"` to `"1"`. `fallback` replaces the channel expression with the literal `"FALLBACK"`. `dynamic` makes the key a parameter of the exposed callback and checks genuine caller-dependent uncertainty. These are discriminating controls, not source-preserving workarounds. ## Expected behavior Bounded lexical substitution must preserve literal property identity. A named array property `"01"` must not select positional element 1. For the noncanonical source, withhold the `SECOND` contextual channel and inferred `literal:SECOND` node attributed to this call. The analyzer may resolve the ordinary result to `FALLBACK` or retain explicit uncertainty if its abstraction cannot prove the missing property. Keep the canonical control's `SECOND`, the fallback control's `FALLBACK`, and the dynamic-key control's unresolved value. Preserve the written dynamic expression and all appropriate static-candidate limitations. The reconstruction guide documents returned-closure/wrapper substitution as a static inference with literal channels and unknowns. Its authority limits concern runtime reachability, overrides, registration and dispatch. The repository separately defines canonical array indices and already tests that `list["1"]` resolves a slot while `list["01"]` remains unknown. This expectation does not require a precise Electron runtime model or exact undefined propagation for missing properties. ## Impact and scope A valid inert CommonJS input produces a wrong machine-readable inferred IPC channel and contextual candidate path. This is a bounded P2 analysis-correctness defect; original source evidence, partial coverage and runtime-unverified limitations survive. No severe incident or whole-workflow blockage was established. The four-case reproduction returned the same results in separate baseline verification and current-main publication replays. NOT_ENOUGH_INFO: real-application prevalence and downstream tracing consequences were not measured. No supported public option or unchanged-input workflow was verified to correct the contextual channel. Changing "01" to "1" changes the program's meaning and is a control. Workaround status remains unverified. ## REA version Tested current upstream main [921fa03fca7181af5d69ccc10a4ceadc22c9c9e0](https://github.com/morluto/rea/tree/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0), built with `npm run build:cached` and locked dependencies. Original independent verification used source baseline [62bf09809ef7bb224028916424f8f07652a20f4f](https://github.com/morluto/rea/tree/62bf09809ef7bb224028916424f8f07652a20f4f). The standalone CLI recipe succeeded at both tested revisions with the output below. The source manifest reports 6.5.0. These are repository builds; NOT_ENOUGH_INFO: published-package behavior was not tested, and the manifest version does not establish it. ## Runtime and platform Repository-pinned Node.js v24.18.0 and npm 11.16.0 on macOS arm64. No external analysis provider was used. ## Target and artifact context Inert extracted CommonJS application directories, each with the complete authored main.cjs fixture above. The failing source has fixed rest arguments, a fixed named key, no call-site spread, assignment, accessor, branch or module-table bootstrap. REA does not execute these sources or require an Electron installation. A separate harmless recording oracle defines its own send operation. ## Interface CLI, through node scripts/rea.mjs analyze-javascript-application with JSON and full output. ## Earliest failure stage Native analysis or reconstruction. The symbolic evaluator supplies the wrong literal before graph projection; public request admission, parsing, Evidence creation and cleanup succeed. ## Relevant output or evidence The complete standalone reproduction succeeded. Each call exited 0, returned `ok: true`, parsed one JavaScript file and reported zero parse failures. Its output was: ```text noncanonical exit 0 paths [["SECOND", "candidate", "inferred"]] channels [["SECOND", "literal", "inferred"], [null, "dynamic", "observed"]] canonical exit 0 paths [["SECOND", "candidate", "inferred"]] channels [["SECOND", "literal", "inferred"], [null, "dynamic", "observed"]] fallback exit 0 paths [["FALLBACK", "candidate", "inferred"]] channels [["FALLBACK", "literal", "observed"]] dynamic exit 0 paths [] channels [[null, "dynamic", "observed"]] ``` For the noncanonical source, the contextual `desktop.read` path has `channel: "SECOND"`, `resolution: "candidate"`, no conditions, and inferred evidence with high confidence. Its separate inferred IPC-channel node is keyed `literal:SECOND` and uses `resolution: "literal"`. The channel evidence retains `authority: "static-relationship-inference"`, `state: "inferred"`, and limitations that runtime registration, dispatch and execution remain unverified. The raw IPC-channel observation retains `channel: null`, `resolution: "dynamic"`, and `channel_expression: "items[\"01\"] ?? \"FALLBACK\""`; its observed/exact evidence describes the written syntax. The result also retains partial graph coverage and separate semantic limitations such as `Binding items has no constant initializer.`, `Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.`, and unknown cross-function mutation/dynamic property resolution. These describe the generic source analysis and unresolved facts; the contextual wrapper result still substitutes the fixed rest arguments and publishes `SECOND`. Those runtime qualifications remain honest. They do not explain changing the fixed named key to a positional index. The canonical source has the same reported candidate channel even though a harmless recording oracle gives different results. A separate first pass using `--json` reproduced the same four cases, also with successful cleanup. The following self-authored recording oracle ran with the pinned Node runtime. It defines the recording send operation itself, uses ordinary fresh rest arrays, and does not import Electron: ```js const calls = []; const e = { ipcRenderer: { send: channel => calls.push(channel) } }; function noncanonical(...items) { return () => e.ipcRenderer.send(items["01"] ?? "FALLBACK"); } function canonical(...items) { return () => e.ipcRenderer.send(items["1"] ?? "FALLBACK"); } noncanonical("FIRST", "SECOND")(); canonical("FIRST", "SECOND")(); console.log(JSON.stringify(calls)); // ["FALLBACK","SECOND"] ``` The retained verification oracle also asserts that the noncanonical array has no own `"01"` property and checks the fallback and dynamic controls. Its results were `FALLBACK`, `SECOND`, `FALLBACK`, `FALLBACK`, `SECOND` for noncanonical, canonical, literal fallback, dynamic key `"01"`, and dynamic key `"1"`, respectively. This establishes ordinary fixture language semantics with a recording object, not actual Electron engine or application execution coverage. The current-main publication replay also retained and inspected the full noncanonical result. The unchanged source suites javascriptSymbolicBindings.test.ts and electronWrappedCallPaths.test.ts passed all 90 existing tests during the original baseline verification. Those tests were not rerun on current main; the current-main proof is a fresh build and repeated public CLI reproduction. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete ## Typed outcome or recovery expected Run the same four-case public reproduction. The original noncanonical source must no longer acquire `SECOND` through its named property lookup, either in its contextual path or an inferred channel node attributed to that call. A correctly inferred `FALLBACK` or meaningful retained unknown satisfies this check. Preserve the canonical control's `SECOND` and the literal fallback control's `FALLBACK`; preserve genuinely unresolved dynamic-key behavior and the original syntax evidence. Keep every recovered relationship explicitly static. These checks allow either a more precise property model or conservative uncertainty and prescribe no implementation. ## Analysis or suspected cause Source-derived explanation: [the symbolic array lookup](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/src/domain/javascript/javascriptSymbolicBindings.ts#L304-L305) treats every digit-only key as a positional index and reads `value.values[Number(key)]`. [Rest binding](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/src/domain/javascript/javascriptSymbolicBindings.ts#L393-L414) constructs the positional array from the fixed literal arguments, and [member evaluation](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/src/domain/javascript/javascriptSymbolicBindings.ts#L452-L457) supplies the written key. [The wrapper collector](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/src/domain/javascript/electronWrappedCallPaths.ts#L325-L334) requires a literal string to emit a contextual channel; [graph projection](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/src/application/javascript/ElectronBoundaryGraphCallPaths.ts#L31-L78) retains it as a static candidate. The expected contract is supported by [the reconstruction guide](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/docs/javascript-artifact-reconstruction.md#L325-L352), [the canonical array-index owner](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/src/domain/javascript/javascriptSemanticPropertyPaths.ts#L15-L24), [the existing index-identity test in the separate semantic evaluator](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/src/domain/javascript/javascriptSemanticAnalysis.dataflow.test.ts#L448-L465), and [the contextual collector's unresolved-channel controls](https://github.com/morluto/rea/blob/921fa03fca7181af5d69ccc10a4ceadc22c9c9e0/src/domain/javascript/electronWrappedCallPaths.test.ts#L662-L674). These support withholding a wrong literal without requiring exact missing-property propagation or runtime execution. The relevant symbolic evaluator, wrapper collector, projection and index-contract files are unchanged from the verified baseline; the current-main recipe directly reproduced the same failure. ## Additional context The related subtraction-assignment report #4206 concerns wrong branch pruning from evaluating an assignment expression's right operand as its result. This source has no assignment or conditional statement. That report's else-path restoration and this report's named-property/index distinction can fail independently, despite sharing a symbolic evaluator. NOT_ENOUGH_INFO: the first affected revision and last known good revision are unknown. Published-package behavior, MCP transport, actual Electron operation, other platforms, full-suite coverage and post-fix restoration were not tested. The recording oracle establishes ordinary JavaScript fixture semantics, not Electron execution coverage. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A valid inert CommonJS input produces a wrong machine-readable inferred IPC channel and contextual candidate path. The demonstrated consequence is bounded analysis incorrectness; source evidence and runtime-unverified limitations survive. No severe incident, whole-workflow blockage, real-application frequency or downstream tracing consequence was established. - Workaround status: unverified - Workaround basis: No supported public option or unchanged-input workflow was verified to return a corrected contextual channel. Manual inspection and candidate qualification do not correct the returned value. Replacing `"01"` with `"1"` changes the recording oracle's result from `FALLBACK` to `SECOND`, so it changes the program's meaning and is only a control.

bsakaguchi closed this issue

2026-10-16 21:08:47 +00:00

bsakaguchi commented

2026-10-16 21:08:48 +00:00

Author

Owner

@morluto commented on GitHub (Oct 16, 2026):

Fixed on main in 43bc6e1d2. Rest-array lookups now use canonical array-index parsing, so a noncanonical key such as 01 cannot select slot 1.

Regression controls retain canonical indices, fallback and dynamic-key uncertainty, including the public CLI cases.

Hosted main CI is still pending; this closure is based on the implemented fix and the scoped regression evidence.

@morluto commented on GitHub (Oct 16, 2026): Fixed on `main` in [43bc6e1d2](https://github.com/morluto/rea/commit/43bc6e1d23355e9e1c494fbcb11b777c348731b8). Rest-array lookups now use canonical array-index parsing, so a noncanonical key such as 01 cannot select slot 1. Regression controls retain canonical indices, fallback and dynamic-key uncertainty, including the public CLI cases. Hosted main CI is still pending; this closure is based on the implemented fix and the scoped regression evidence.

bsakaguchi referenced this issue

2026-10-31 00:54:33 +00:00

[PR #1666] [CLOSED] fix(ghidra): recover returning import callers #4738

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1666

No description provided.

Rows
Columns