morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4250] [Bug] Const-asserted inline BrowserWindow objects lose preferences and preload links #1673

New issue

Closed

opened 2026-10-16 21:08:52 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:08:52 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4250

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Successful analyze-javascript-application calls omit explicit window preferences and their preload association when as const wraps either the inline BrowserWindow options object or its inline webPreferences object. The same direct Electron import and literal preload work in a plain object. The affected results report partial application coverage and retain a separate property:preload role, but the window has no preferences, preload declaration or loads edge.

This report covers those two inline object positions. An assertion around only the preload string is a passing regression control. Both reproduced object failures report partial application coverage.

Reproduction

Use the source revision under REA version and the pinned toolchain under Runtime and platform, install the locked dependencies if needed, and run npm run build:cached. Run this script from the repository root. It creates separate extracted directories, writes an existing absolute preload file for each, isolates user configuration, and calls the public CLI. The dynamic expressions are inert analysis controls and are never executed.

python3 - <<'PYCODE'
import json
import os
from pathlib import Path
import subprocess
from tempfile import TemporaryDirectory

forms = {
    'plain': '{webPreferences:{preload:FILE}}',
    'options-assertion': '({webPreferences:{preload:FILE}} as const)',
    'preferences-assertion': '{webPreferences:({preload:FILE} as const)}',
    'literal-regression': '{webPreferences:{preload:FILE as const}}',
    'dynamic-object': '{webPreferences:getOptions()}',
    'dynamic-value': '{webPreferences:{preload:getPath()}}',
    'later-spread': '{webPreferences:{preload:FILE,...getOptions()}}',
    'later-key': '{webPreferences:{preload:FILE,[getKey()]:true}}',
}
with TemporaryDirectory(prefix='window-options-review-') as directory:
    root = Path(directory).resolve()
    env = dict(os.environ)
    for key in ['HOME', 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME',
                'XDG_DATA_HOME', 'TMPDIR']:
        folder = root / key.lower()
        folder.mkdir()
        env[key] = str(folder)
    for name, form in forms.items():
        app = root / name
        app.mkdir()
        preload = app / 'preload.cjs'
        preload.write_text('// Harmless fixture.\n')
        options = form.replace('FILE', json.dumps(str(preload)))
        (app / 'main.ts').write_text(
            'import {BrowserWindow} from "electron";\n'
            + 'new BrowserWindow(' + options + ');\n'
        )
        run = subprocess.run(
            ['node', 'scripts/rea.mjs', 'analyze-javascript-application',
             str(app), '--format', 'json', '--full-output'],
            env=env, text=True, capture_output=True, timeout=60,
        )
        assert run.returncode == 0, run.stderr
        reply = json.loads(run.stdout)
        assert reply['ok'], reply
        value = reply['data']['normalized_result']
        graph = value['graph']
        windows = [n for n in graph['nodes'] if n['kind'] == 'browser-window']
        assert len(windows) == 1
        window = windows[0]
        fields = window['observations'][0]['properties']
        print(json.dumps({
            'case': name,
            'counts': [value['summary'][k] for k in
                       ['browser_windows', 'explicit_web_preferences',
                        'preload_entrypoints']],
            'options': fields['options_status'],
            'preferences': fields['web_preferences_status'],
            'exact_preload': fields['preload_path'] == str(preload),
            'context': fields['preload_resolution_context'],
            'roles': sum(n['kind'] == 'electron-preload' for n in graph['nodes']),
            'window_loads': sum(e['relation'] == 'loads'
                                and e['source_node_id'] == window['node_id']
                                for e in graph['edges']),
            'application_coverage': graph['coverage']['status'],
            'semantic_coverage': value['semantic_graph']['coverage']['status'],
            'parse_failures': value['statistics']['parse_failures'],
        }))
PYCODE

The script was executed as written on a fresh current-source build. Each case has one window and one explicit preload property, apart from the dynamic object with no visible preference object and the two override controls with an additional syntax item. counts lists windows, explicit preference items and per-window preload declarations in that order. roles counts merged preload role nodes, which is a separate quantity.

Expected behavior

Recover the explicit preference and preload association from both const-asserted inline object forms just as from the plain control. All four positive cases should preserve the exact literal preload declaration with filesystem-expression context, counts [1,1,1] and one window-to-preload loads edge. These are static source facts and inferences, not evidence that Electron executed or loaded the file.

The reconstruction guide promises recovery of explicit BrowserWindow options and preferences from supported TypeScript sources. These two inputs contain the entire object literal at the constructor call, with no option variable, runtime computation, dynamic key, spread, accessor or mutation. The assertion affects type checking and leaves that literal's expression identity intact. Recovering it requires no additional binding or value-flow inference. Existing inline-option tests and their type-erased-key controls at lines 122–174 retain explicit fields and final-property ownership, and the shared expression contract explicitly describes type-only wrappers as erased identity. The expectation therefore rests on the explicit inline recovery contract and these concrete values, rather than on parser acceptance alone.

The guide's unknowns rule still applies to unresolved values. The dynamic object/value and later override controls must keep their effective preload unknown. Omitted preferences must not become guessed Electron defaults.

Impact and scope

P2, supported: the two inline object forms lose useful machine-readable explicit preferences and their window/preload association in successful analysis. The demonstrated failure is bounded, retains source evidence and the standalone preload role, and warns of incomplete analysis through partial application coverage. Severe downstream harm, whole-workflow failure, and real-application frequency were not established.

Workaround status is unverified. No public workflow preserving the original artifact and restoring the missing window projections was demonstrated. Removing assertions or analyzing emitted JavaScript changes the selected bytes and Evidence identity; manual inspection does not correct the returned graph.

Only as const at the two executed inline object positions is claimed. Other assertion forms and platforms, installed-release behavior, real Electron execution, full-suite coverage, and post-fix restoration were not tested.

REA version

Freshly rebuilt source checkout from fetched upstream main 0e1f0bf2d06943e59253b8a66923a1ae6005e81e. The CLI reports 6.5.0; this is source-checkout behavior and does not establish behavior of the published 6.5.0 package.

Runtime and platform

Repository-pinned Node.js v24.18.0 and npm 11.16.0 on macOS arm64, with locked dependencies and TypeScript 7.0.2. Forced npm run build completed all three tasks with zero cache hits. No native analysis engine or Electron installation was used.

Target and artifact context

Separate local extracted application directories, each containing inert main.ts and an existing absolute preload.cjs file. REA reads these inputs as text. The absolute preload is a valid authored declaration; its artifact lookup remains not-found even in passing controls. The report concerns declaration and window-association recovery, not runtime loading or successful artifact mapping.

Interface

CLI and MCP (stdio)

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

All eight calls returned exit code 0, ok: true, one BrowserWindow and zero parse failures. The observed fields were:

Case	Counts	Options	Preferences	Exact window preload	Preload roles	Window loads edges	Application coverage
plain	1/1/1	object-literal	object-literal	yes	1	1	complete
options-assertion	1/0/0	dynamic	dynamic	no	1	0	partial
preferences-assertion	1/0/0	object-literal	dynamic	no	1	0	partial
literal-regression	1/1/1	object-literal	object-literal	yes	1	1	complete
dynamic-object	1/0/0	object-literal	dynamic	no	0	0	partial
dynamic-value	1/1/0	object-literal	object-literal	no	0	0	partial
later-spread	1/2/0	object-literal	object-literal	no	1	0	partial
later-key	1/2/0	object-literal	object-literal	no	1	0	partial

Both failing windows have an empty web_preferences list and null preload_path and preload_resolution_context. Their surviving role has only the standalone property:preload observation. The plain and literal-regression roles also have BrowserWindow:webPreferences.preload, and each window has its loads relationship. The earlier literal remains visible as preference syntax in the later-override controls, but it does not become an effective window preload.

Application coverage is partial and untruncated for both failures, with omitted_count: null. Separate semantic graph coverage is unknown in every case. The reported partial state warns of incomplete analysis; it does not recover the missing inline preferences or window association. No claim of total preload-discovery loss or global semantic completeness is made.

The existing absolute preload file makes the authored constructor input concrete, but the returned role's artifact lookup reports resolution_status: "not-found" and null resolved_path even in the passing controls. This comparison concerns preservation of the declaration and window association, not successful mapping of a host absolute path to an artifact-relative asset.

Six separate stdio MCP calls for the four positive forms and both dynamic controls returned graphs and summaries exactly equal to their CLI counterparts. All four positive fixtures passed strict TypeScript compilation against a minimal local Electron constructor declaration. Their emitted JavaScript each called a harmless constructor stub once with the exact original preload string. That check establishes assertion transparency for these authored inputs, not actual Electron behavior. The current options, computed-preference, constructor-identity and static-path source suites passed all 123 tests across four files.

Evidence provenance: observed.
Local verification: reproduced.
Reproduction completeness: complete.

Typed outcome or recovery expected

Analyze the unchanged two const-asserted inline object fixtures through the public workflow. Each must preserve its explicit preference, exact preload declaration and window loads association, matching the plain and fixed-literal controls with counts [1,1,1]. Check graph observations and relationships as well as summary values; adjusting a count or coverage label alone does not recover the evidence. Preserve exact source provenance and the distinction between declarations, artifact mapping and runtime execution. The implementation and regression-test design remain open.

Keep the dynamic object/value and later spread/computed-key controls unresolved with no effective window preload. Preserve final-property ownership, direct Electron constructor identity, merged-role behavior and the current passing literal assertion. The requested restoration does not require general evaluation of option variables or popup override configurations.

Analysis or suspected cause

Source-derived explanation: the BrowserWindow option collector uses raw object-node checks at both positions, and the effective-property reader classifies the whole asserted options object as dynamic before reading properties. The nested assertion fails the collector's raw preference-object check. The current static path reader already unwraps path values, so the literal assertion passes once those object guards are satisfied.

Window preload projection creates the associated role observation and loads relationship only when the window declaration survives. The summary owner counts explicit preference items and nonnull per-window preload declarations, not merged preload role nodes. These locators explain the observed loss and do not prescribe a repair design. The guide's explicit-observation and unknowns rules at lines 336–339 still prohibit guessing omitted defaults or unresolved option values.

Additional context

The exact CLI recipe above was replayed on the freshly fetched and rebuilt upstream revision. A separate retained-input replay confirmed unchanged fixture bytes, all eight CLI cases, all four strict compiler/stub controls, and six stdio MCP comparisons. Each MCP graph and summary exactly matched its corresponding CLI result. The cited contract, projection owners, relevant public adapters, and pinned dependencies were unchanged from the independently verified source baseline; subsequent drift changed a symlink diagnostic and its test, followed by lifecycle/cleanup handling. The public success workflow was rebuilt and replayed after that drift.

Merged PR #3998 restored static path values through TypeScript wrappers. Its literal-preload result passes here. Its body and six changed files cover path values, call targets, receiver classification, and aliases; the inline object guards remain unchanged. A read-only closing-issue query returned zero linked closing issues. This report excludes the already-handled path-value case.

The same-scope constant-options proposal #3536 requires following option bindings and recognizing popup override records. These failing inputs put both objects inline and require neither capability. #3962 concerns unrelated join/resolve semantics; #3883 and #4229 concern overwritten constructor identities; closed #2650 concerns dropped active-capture limitation text. Their restoration signals can pass while these inline object projections still fail. The later-override controls preserve the effective-property rule from closed #1237; computed literal key recovery in closed #2521 is also a distinct trigger.

NOT_ENOUGH_INFO: the first affected revision, last known good revision, published-package applicability, and real-application frequency were not established. No source fix or same-contract restoration run was performed. The strict compiler and harmless constructor stub establish type-assertion transparency only, not real Electron behavior.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Two supported inline TypeScript object forms lose explicit preference records and their window/preload association in a successful result. The failure is bounded, retains original source evidence and reports partial application coverage. Severe downstream harm, whole-workflow failure and shipped-application prevalence were not established; the repaired literal-wrapper case contributes no failure or complete-coverage claim.
Workaround status: unverified
Workaround basis: No public workflow preserving the original artifact and restoring these window projections was demonstrated. Removing assertions or analyzing emitted JavaScript changes the selected bytes and Evidence identity, so those comparisons do not establish a practical workaround for the original input. Manual source inspection does not correct the returned graph.

Originally created by @coygeek on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4250 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior Successful `analyze-javascript-application` calls omit explicit window preferences and their preload association when `as const` wraps either the inline BrowserWindow options object or its inline `webPreferences` object. The same direct Electron import and literal preload work in a plain object. The affected results report partial application coverage and retain a separate `property:preload` role, but the window has no preferences, preload declaration or loads edge. This report covers those two inline object positions. An assertion around only the preload string is a passing regression control. Both reproduced object failures report partial application coverage. ## Reproduction Use the source revision under REA version and the pinned toolchain under Runtime and platform, install the locked dependencies if needed, and run `npm run build:cached`. Run this script from the repository root. It creates separate extracted directories, writes an existing absolute preload file for each, isolates user configuration, and calls the public CLI. The dynamic expressions are inert analysis controls and are never executed. ```sh python3 - <<'PYCODE' import json import os from pathlib import Path import subprocess from tempfile import TemporaryDirectory forms = { 'plain': '{webPreferences:{preload:FILE}}', 'options-assertion': '({webPreferences:{preload:FILE}} as const)', 'preferences-assertion': '{webPreferences:({preload:FILE} as const)}', 'literal-regression': '{webPreferences:{preload:FILE as const}}', 'dynamic-object': '{webPreferences:getOptions()}', 'dynamic-value': '{webPreferences:{preload:getPath()}}', 'later-spread': '{webPreferences:{preload:FILE,...getOptions()}}', 'later-key': '{webPreferences:{preload:FILE,[getKey()]:true}}', } with TemporaryDirectory(prefix='window-options-review-') as directory: root = Path(directory).resolve() env = dict(os.environ) for key in ['HOME', 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME', 'TMPDIR']: folder = root / key.lower() folder.mkdir() env[key] = str(folder) for name, form in forms.items(): app = root / name app.mkdir() preload = app / 'preload.cjs' preload.write_text('// Harmless fixture.\n') options = form.replace('FILE', json.dumps(str(preload))) (app / 'main.ts').write_text( 'import {BrowserWindow} from "electron";\n' + 'new BrowserWindow(' + options + ');\n' ) run = subprocess.run( ['node', 'scripts/rea.mjs', 'analyze-javascript-application', str(app), '--format', 'json', '--full-output'], env=env, text=True, capture_output=True, timeout=60, ) assert run.returncode == 0, run.stderr reply = json.loads(run.stdout) assert reply['ok'], reply value = reply['data']['normalized_result'] graph = value['graph'] windows = [n for n in graph['nodes'] if n['kind'] == 'browser-window'] assert len(windows) == 1 window = windows[0] fields = window['observations'][0]['properties'] print(json.dumps({ 'case': name, 'counts': [value['summary'][k] for k in ['browser_windows', 'explicit_web_preferences', 'preload_entrypoints']], 'options': fields['options_status'], 'preferences': fields['web_preferences_status'], 'exact_preload': fields['preload_path'] == str(preload), 'context': fields['preload_resolution_context'], 'roles': sum(n['kind'] == 'electron-preload' for n in graph['nodes']), 'window_loads': sum(e['relation'] == 'loads' and e['source_node_id'] == window['node_id'] for e in graph['edges']), 'application_coverage': graph['coverage']['status'], 'semantic_coverage': value['semantic_graph']['coverage']['status'], 'parse_failures': value['statistics']['parse_failures'], })) PYCODE ``` The script was executed as written on a fresh current-source build. Each case has one window and one explicit preload property, apart from the dynamic object with no visible preference object and the two override controls with an additional syntax item. `counts` lists windows, explicit preference items and per-window preload declarations in that order. `roles` counts merged preload role nodes, which is a separate quantity. ## Expected behavior Recover the explicit preference and preload association from both const-asserted inline object forms just as from the plain control. All four positive cases should preserve the exact literal preload declaration with filesystem-expression context, counts `[1,1,1]` and one window-to-preload loads edge. These are static source facts and inferences, not evidence that Electron executed or loaded the file. [The reconstruction guide](https://github.com/morluto/rea/blob/0e1f0bf2d06943e59253b8a66923a1ae6005e81e/docs/javascript-artifact-reconstruction.md#L212-L246) promises recovery of explicit BrowserWindow options and preferences from supported TypeScript sources. These two inputs contain the entire object literal at the constructor call, with no option variable, runtime computation, dynamic key, spread, accessor or mutation. The assertion affects type checking and leaves that literal's expression identity intact. Recovering it requires no additional binding or value-flow inference. [Existing inline-option tests](https://github.com/morluto/rea/blob/0e1f0bf2d06943e59253b8a66923a1ae6005e81e/src/domain/javascript/electronStaticAnalysisOptions.test.ts#L6-L26) and their type-erased-key controls at lines 122–174 retain explicit fields and final-property ownership, and [the shared expression contract](https://github.com/morluto/rea/blob/0e1f0bf2d06943e59253b8a66923a1ae6005e81e/src/domain/javascript/javascriptAstValues.ts#L12-L43) explicitly describes type-only wrappers as erased identity. The expectation therefore rests on the explicit inline recovery contract and these concrete values, rather than on parser acceptance alone. The guide's unknowns rule still applies to unresolved values. The dynamic object/value and later override controls must keep their effective preload unknown. Omitted preferences must not become guessed Electron defaults. ## Impact and scope P2, supported: the two inline object forms lose useful machine-readable explicit preferences and their window/preload association in successful analysis. The demonstrated failure is bounded, retains source evidence and the standalone preload role, and warns of incomplete analysis through partial application coverage. Severe downstream harm, whole-workflow failure, and real-application frequency were not established. Workaround status is unverified. No public workflow preserving the original artifact and restoring the missing window projections was demonstrated. Removing assertions or analyzing emitted JavaScript changes the selected bytes and Evidence identity; manual inspection does not correct the returned graph. Only `as const` at the two executed inline object positions is claimed. Other assertion forms and platforms, installed-release behavior, real Electron execution, full-suite coverage, and post-fix restoration were not tested. ## REA version Freshly rebuilt source checkout from fetched upstream main `0e1f0bf2d06943e59253b8a66923a1ae6005e81e`. The CLI reports 6.5.0; this is source-checkout behavior and does not establish behavior of the published 6.5.0 package. ## Runtime and platform Repository-pinned Node.js v24.18.0 and npm 11.16.0 on macOS arm64, with locked dependencies and TypeScript 7.0.2. Forced `npm run build` completed all three tasks with zero cache hits. No native analysis engine or Electron installation was used. ## Target and artifact context Separate local extracted application directories, each containing inert `main.ts` and an existing absolute `preload.cjs` file. REA reads these inputs as text. The absolute preload is a valid authored declaration; its artifact lookup remains `not-found` even in passing controls. The report concerns declaration and window-association recovery, not runtime loading or successful artifact mapping. ## Interface CLI and MCP (stdio) ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence All eight calls returned exit code 0, `ok: true`, one BrowserWindow and zero parse failures. The observed fields were: | Case | Counts | Options | Preferences | Exact window preload | Preload roles | Window loads edges | Application coverage | | --- | --- | --- | --- | --- | --- | --- | --- | | plain | 1/1/1 | object-literal | object-literal | yes | 1 | 1 | complete | | options-assertion | 1/0/0 | dynamic | dynamic | no | 1 | 0 | partial | | preferences-assertion | 1/0/0 | object-literal | dynamic | no | 1 | 0 | partial | | literal-regression | 1/1/1 | object-literal | object-literal | yes | 1 | 1 | complete | | dynamic-object | 1/0/0 | object-literal | dynamic | no | 0 | 0 | partial | | dynamic-value | 1/1/0 | object-literal | object-literal | no | 0 | 0 | partial | | later-spread | 1/2/0 | object-literal | object-literal | no | 1 | 0 | partial | | later-key | 1/2/0 | object-literal | object-literal | no | 1 | 0 | partial | Both failing windows have an empty `web_preferences` list and null `preload_path` and `preload_resolution_context`. Their surviving role has only the standalone `property:preload` observation. The plain and literal-regression roles also have `BrowserWindow:webPreferences.preload`, and each window has its loads relationship. The earlier literal remains visible as preference syntax in the later-override controls, but it does not become an effective window preload. Application coverage is partial and untruncated for both failures, with `omitted_count: null`. Separate semantic graph coverage is unknown in every case. The reported partial state warns of incomplete analysis; it does not recover the missing inline preferences or window association. No claim of total preload-discovery loss or global semantic completeness is made. The existing absolute preload file makes the authored constructor input concrete, but the returned role's artifact lookup reports `resolution_status: "not-found"` and null `resolved_path` even in the passing controls. This comparison concerns preservation of the declaration and window association, not successful mapping of a host absolute path to an artifact-relative asset. Six separate stdio MCP calls for the four positive forms and both dynamic controls returned graphs and summaries exactly equal to their CLI counterparts. All four positive fixtures passed strict TypeScript compilation against a minimal local Electron constructor declaration. Their emitted JavaScript each called a harmless constructor stub once with the exact original preload string. That check establishes assertion transparency for these authored inputs, not actual Electron behavior. The current options, computed-preference, constructor-identity and static-path source suites passed all 123 tests across four files. - Evidence provenance: observed. - Local verification: reproduced. - Reproduction completeness: complete. ## Typed outcome or recovery expected Analyze the unchanged two const-asserted inline object fixtures through the public workflow. Each must preserve its explicit preference, exact preload declaration and window loads association, matching the plain and fixed-literal controls with counts `[1,1,1]`. Check graph observations and relationships as well as summary values; adjusting a count or coverage label alone does not recover the evidence. Preserve exact source provenance and the distinction between declarations, artifact mapping and runtime execution. The implementation and regression-test design remain open. Keep the dynamic object/value and later spread/computed-key controls unresolved with no effective window preload. Preserve final-property ownership, direct Electron constructor identity, merged-role behavior and the current passing literal assertion. The requested restoration does not require general evaluation of option variables or popup override configurations. ## Analysis or suspected cause Source-derived explanation: [the BrowserWindow option collector](https://github.com/morluto/rea/blob/0e1f0bf2d06943e59253b8a66923a1ae6005e81e/src/domain/javascript/electronStaticAnalysisBrowser.ts#L42-L92) uses raw object-node checks at both positions, and [the effective-property reader](https://github.com/morluto/rea/blob/0e1f0bf2d06943e59253b8a66923a1ae6005e81e/src/domain/javascript/electronStaticAnalysisValues.ts#L58-L75) classifies the whole asserted options object as dynamic before reading properties. The nested assertion fails the collector's raw preference-object check. [The current static path reader](https://github.com/morluto/rea/blob/0e1f0bf2d06943e59253b8a66923a1ae6005e81e/src/domain/javascript/javascriptStaticAnalysisHelpers.ts#L182-L190) already unwraps path values, so the literal assertion passes once those object guards are satisfied. [Window preload projection](https://github.com/morluto/rea/blob/0e1f0bf2d06943e59253b8a66923a1ae6005e81e/src/application/javascript/ElectronBoundaryGraphWindows.ts#L129-L177) creates the associated role observation and loads relationship only when the window declaration survives. [The summary owner](https://github.com/morluto/rea/blob/0e1f0bf2d06943e59253b8a66923a1ae6005e81e/src/application/javascript/ElectronBoundaryAnalysis.ts#L120-L128) counts explicit preference items and nonnull per-window preload declarations, not merged preload role nodes. These locators explain the observed loss and do not prescribe a repair design. The guide's explicit-observation and unknowns rules at lines 336–339 still prohibit guessing omitted defaults or unresolved option values. ## Additional context The exact CLI recipe above was replayed on the freshly fetched and rebuilt upstream revision. A separate retained-input replay confirmed unchanged fixture bytes, all eight CLI cases, all four strict compiler/stub controls, and six stdio MCP comparisons. Each MCP graph and summary exactly matched its corresponding CLI result. The cited contract, projection owners, relevant public adapters, and pinned dependencies were unchanged from the independently verified source baseline; subsequent drift changed a symlink diagnostic and its test, followed by lifecycle/cleanup handling. The public success workflow was rebuilt and replayed after that drift. Merged [PR #3998](https://github.com/morluto/rea/pull/3998) restored static path values through TypeScript wrappers. Its literal-preload result passes here. Its body and six changed files cover path values, call targets, receiver classification, and aliases; the inline object guards remain unchanged. A read-only closing-issue query returned zero linked closing issues. This report excludes the already-handled path-value case. The same-scope constant-options proposal [#3536](https://github.com/morluto/rea/issues/3536) requires following option bindings and recognizing popup override records. These failing inputs put both objects inline and require neither capability. [#3962](https://github.com/morluto/rea/issues/3962) concerns unrelated join/resolve semantics; [#3883](https://github.com/morluto/rea/issues/3883) and [#4229](https://github.com/morluto/rea/issues/4229) concern overwritten constructor identities; closed [#2650](https://github.com/morluto/rea/issues/2650) concerns dropped active-capture limitation text. Their restoration signals can pass while these inline object projections still fail. The later-override controls preserve the effective-property rule from closed [#1237](https://github.com/morluto/rea/issues/1237); computed literal key recovery in closed [#2521](https://github.com/morluto/rea/issues/2521) is also a distinct trigger. NOT_ENOUGH_INFO: the first affected revision, last known good revision, published-package applicability, and real-application frequency were not established. No source fix or same-contract restoration run was performed. The strict compiler and harmless constructor stub establish type-assertion transparency only, not real Electron behavior. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Two supported inline TypeScript object forms lose explicit preference records and their window/preload association in a successful result. The failure is bounded, retains original source evidence and reports partial application coverage. Severe downstream harm, whole-workflow failure and shipped-application prevalence were not established; the repaired literal-wrapper case contributes no failure or complete-coverage claim. - Workaround status: unverified - Workaround basis: No public workflow preserving the original artifact and restoring these window projections was demonstrated. Removing assertions or analyzing emitted JavaScript changes the selected bytes and Evidence identity, so those comparisons do not establish a practical workaround for the original input. Manual source inspection does not correct the returned graph.

bsakaguchi closed this issue

2026-10-16 21:08:52 +00:00

bsakaguchi commented

2026-10-16 21:08:53 +00:00

Author

Owner

@morluto commented on GitHub (Oct 16, 2026):

Fixed on main in b67baede2. BrowserWindow options and webPreferences use the shared transparent-expression owner, retaining asserted inline preferences and preload links without treating dynamic overrides as known.

Analyzer and CLI/MCP regressions cover asserted literals, spreads and overwrites; no Electron engine execution is claimed.

Hosted main CI is still pending; this closure is based on the implemented fix and the scoped regression evidence.

@morluto commented on GitHub (Oct 16, 2026): Fixed on `main` in [b67baede2](https://github.com/morluto/rea/commit/b67baede2ed679bdb22af5d9c62a549c30cff9b0). BrowserWindow options and webPreferences use the shared transparent-expression owner, retaining asserted inline preferences and preload links without treating dynamic overrides as known. Analyzer and CLI/MCP regressions cover asserted literals, spreads and overwrites; no Electron engine execution is claimed. Hosted main CI is still pending; this closure is based on the implemented fix and the scoped regression evidence.

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-31 00:43:58 +00:00

[GH-ISSUE #6208] [Bug] Second-argument utilityProcess.fork options lose the service name #3778

bsakaguchi referenced this issue

2026-10-31 00:54:35 +00:00

[PR #1673] [MERGED] fix(javascript): recover Electron APIs through default imports and optional calls #4741