morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4380] [Bug] Partial Inspector warning counts duplicate drafts as separate locations #1736

New issue

Closed

opened 2026-10-16 21:09:38 +00:00 by bsakaguchi · 4 comments

bsakaguchi commented

2026-10-16 21:09:38 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4380

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

In the reported-location projection used for partial captures, two identical script drafts produce one retained script item but the human-readable unknown says “2 observed script locations remain unverified; raw URLs and script metadata are retained.” The single-draft control produces one item and says one location. The raw observed_total correctly remains two for two events.

Reproduction

Source-boundary check, executed against each source baseline in the version field. Use the main checkout as the runner, with its locked dependencies installed, and save this complete script as repro.mts in that checkout root. The release source was checked using the same main-checkout tsx runner with REA_CHECKOUT pointing at the release checkout and its locked dependencies; the release itself does not include tsx.

import assert from 'node:assert/strict';
import {pathToFileURL} from 'node:url';
const {finalizeInspectorCapture}=await import(pathToFileURL(`${process.env.REA_CHECKOUT}/src/inspector/V8InspectorCaptureProjection.ts`).href);
const draft={rawUrl:'file:///fixture/dup.js',executionContextKey:'1',cdpHash:'same',length:7,isModule:false};
for(const count of [1,2]){
 const state={scripts:Array.from({length:count},()=>({...draft})),contexts:new Map(),eventsObserved:count,eventsRetained:count,eventsDropped:0,metadataBytes:0,scriptsObserved:count,invalidScripts:0,truncated:false,truncationReasons:new Set()};
 const result=await finalizeInspectorCapture({input:{inspector_endpoint:'http://127.0.0.1:9222',target_id:'fixture',observation_ms:100},runtime:{product:'Node.js/v24.18.0',protocol_version:'1.3',v8_version:null},target:{id:'fixture',type:'node',url:'file:///fixture/main.js',attached:false,webSocketUrl:'ws://127.0.0.1:9222/fixture',location:{kind:'file',file_path:'/fixture/main.js'}},state,locationMode:'reported',authorizeLocation:async()=>{throw new Error('reported mode must not authorize')}});
 const message=result.unknowns.find((s:string)=>s.includes('observed script location'));
 assert.equal(result.scripts.items.length,1);assert.equal(result.scripts.observed_total,count);
 assert.equal(result.scripts.items[0].location.kind,'unresolved');
 assert.equal(message,`${count} observed script location${count===1?' remains':'s remain'} unverified; raw URLs and script metadata are retained.`);
 console.log(JSON.stringify({drafts:count,retainedItems:result.scripts.items.length,observedTotal:result.scripts.observed_total,message}));
}

npm ci
REA_CHECKOUT="$PWD" node_modules/.bin/tsx repro.mts

For the release check, keep the runner and script in the main checkout and set REA_CHECKOUT to the separate release checkout. Both source checks produce:

{"drafts":1,"retainedItems":1,"observedTotal":1,"message":"1 observed script location remains unverified; raw URLs and script metadata are retained."}
{"drafts":2,"retainedItems":1,"observedTotal":2,"message":"2 observed script locations remain unverified; raw URLs and script metadata are retained."}

Expected behavior

The warning should describe the retained deduplicated script set accurately, or explicitly label its count as pre-deduplication observations. The observation guide documents stable-metadata deduplication, while observed_total already exposes the raw observation count.

Impact and scope

This is a misleading human-readable coverage count in partial Inspector observations with duplicate metadata. The retained item, raw event counters and unresolved status remain intact. No analysis result, authorization decision, or recovery behavior was shown to change.

REA version

Tested main source 8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd; latest published rea-agents 6.5.0 source 3b79af28e80785afce9f5998d8f03289402a1847. Newer main 2c7583599b9ac1c847bd77b1940930fd8d4594c7 has byte-identical Inspector provider, projection and capture guide files, checked directly from GitHub source.

Runtime and platform

Node v24.18.0; macOS arm64; lockfile-installed dependencies. Production projection function executed directly from source; no compiled CLI, MCP, live V8 session, or provider failure path was executed.

Target and artifact context

One passive-capture projection with repeated benign script metadata; no target process or binary.

Interface

Other

Internal production projection boundary; public provider reachability was inspected in source.

Earliest failure stage

Transport or result projection

Relevant output or evidence

The output above shows two observed drafts, one retained item and the two-location warning. Projection source; event producer; documented deduplication.

Typed outcome or recovery expected

Keep observed_total as the event count while deriving the retained-location warning from final items, or make the warning’s event basis explicit.

Analysis or suspected cause

The reported-mode loop increments unresolvedScripts for each draft before scripts.set deduplicates by script_key. Later warning construction uses that earlier counter. ingestScript appends each accepted event without deduplication, so matching drafts can reach this loop. Provider error/cancellation handling invokes this mode to preserve partial observations.

Additional context

Searched open and closed issues and PRs, including full bodies and related Inspector timeout, fatal-protocol-error, location-authorization and discovery-location reports; no matching warning-count report found. This verifies the production projection boundary and inspects its producer/caller. A live V8 duplicate event sequence and full provider failure path were not executed. The count in the warning can be interpreted as raw observations; explicitly naming that basis would also resolve the ambiguity. No analysis-result or raw-counter defect is claimed.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: This is a misleading human-readable coverage count in partial Inspector observations with duplicate metadata. The retained item, raw event counters and unresolved status remain intact. No analysis result, authorization decision, or recovery behavior was shown to change.
Workaround status: available
Workaround basis: Consumers can inspect scripts.items for retained unresolved entries and use observed_total for pre-deduplication observations; the executed control demonstrates both values remain accurate.

Originally created by @coygeek on GitHub (Oct 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4380 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Process capture or runtime observation ### Observed behavior In the reported-location projection used for partial captures, two identical script drafts produce one retained script item but the human-readable unknown says “2 observed script locations remain unverified; raw URLs and script metadata are retained.” The single-draft control produces one item and says one location. The raw observed_total correctly remains two for two events. ### Reproduction Source-boundary check, executed against each source baseline in the version field. Use the main checkout as the runner, with its locked dependencies installed, and save this complete script as `repro.mts` in that checkout root. The release source was checked using the same main-checkout tsx runner with REA_CHECKOUT pointing at the release checkout and its locked dependencies; the release itself does not include tsx. ```ts import assert from 'node:assert/strict'; import {pathToFileURL} from 'node:url'; const {finalizeInspectorCapture}=await import(pathToFileURL(`${process.env.REA_CHECKOUT}/src/inspector/V8InspectorCaptureProjection.ts`).href); const draft={rawUrl:'file:///fixture/dup.js',executionContextKey:'1',cdpHash:'same',length:7,isModule:false}; for(const count of [1,2]){ const state={scripts:Array.from({length:count},()=>({...draft})),contexts:new Map(),eventsObserved:count,eventsRetained:count,eventsDropped:0,metadataBytes:0,scriptsObserved:count,invalidScripts:0,truncated:false,truncationReasons:new Set()}; const result=await finalizeInspectorCapture({input:{inspector_endpoint:'http://127.0.0.1:9222',target_id:'fixture',observation_ms:100},runtime:{product:'Node.js/v24.18.0',protocol_version:'1.3',v8_version:null},target:{id:'fixture',type:'node',url:'file:///fixture/main.js',attached:false,webSocketUrl:'ws://127.0.0.1:9222/fixture',location:{kind:'file',file_path:'/fixture/main.js'}},state,locationMode:'reported',authorizeLocation:async()=>{throw new Error('reported mode must not authorize')}}); const message=result.unknowns.find((s:string)=>s.includes('observed script location')); assert.equal(result.scripts.items.length,1);assert.equal(result.scripts.observed_total,count); assert.equal(result.scripts.items[0].location.kind,'unresolved'); assert.equal(message,`${count} observed script location${count===1?' remains':'s remain'} unverified; raw URLs and script metadata are retained.`); console.log(JSON.stringify({drafts:count,retainedItems:result.scripts.items.length,observedTotal:result.scripts.observed_total,message})); } ``` ```sh npm ci REA_CHECKOUT="$PWD" node_modules/.bin/tsx repro.mts ``` For the release check, keep the runner and script in the main checkout and set REA_CHECKOUT to the separate release checkout. Both source checks produce: ```text {"drafts":1,"retainedItems":1,"observedTotal":1,"message":"1 observed script location remains unverified; raw URLs and script metadata are retained."} {"drafts":2,"retainedItems":1,"observedTotal":2,"message":"2 observed script locations remain unverified; raw URLs and script metadata are retained."} ``` ### Expected behavior The warning should describe the retained deduplicated script set accurately, or explicitly label its count as pre-deduplication observations. The observation guide documents stable-metadata deduplication, while observed_total already exposes the raw observation count. ### Impact and scope This is a misleading human-readable coverage count in partial Inspector observations with duplicate metadata. The retained item, raw event counters and unresolved status remain intact. No analysis result, authorization decision, or recovery behavior was shown to change. ### REA version Tested main source `8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd`; latest published rea-agents 6.5.0 source `3b79af28e80785afce9f5998d8f03289402a1847`. Newer main `2c7583599b9ac1c847bd77b1940930fd8d4594c7` has byte-identical Inspector provider, projection and capture guide files, checked directly from GitHub source. ### Runtime and platform Node v24.18.0; macOS arm64; lockfile-installed dependencies. Production projection function executed directly from source; no compiled CLI, MCP, live V8 session, or provider failure path was executed. ### Target and artifact context One passive-capture projection with repeated benign script metadata; no target process or binary. ### Interface Other Internal production projection boundary; public provider reachability was inspected in source. ### Earliest failure stage Transport or result projection ### Relevant output or evidence The output above shows two observed drafts, one retained item and the two-location warning. [Projection source](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/src/inspector/V8InspectorCaptureProjection.ts#L140); [event producer](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/src/inspector/V8InspectorProvider.ts#L452); [documented deduplication](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/docs/javascript-runtime-observation.md#L140). ### Typed outcome or recovery expected Keep observed_total as the event count while deriving the retained-location warning from final items, or make the warning’s event basis explicit. ### Analysis or suspected cause The reported-mode loop increments unresolvedScripts for each draft before scripts.set deduplicates by script_key. Later warning construction uses that earlier counter. ingestScript appends each accepted event without deduplication, so matching drafts can reach this loop. Provider error/cancellation handling invokes this mode to preserve partial observations. ### Additional context Searched open and closed issues and PRs, including full bodies and related Inspector timeout, fatal-protocol-error, location-authorization and discovery-location reports; no matching warning-count report found. This verifies the production projection boundary and inspects its producer/caller. A live V8 duplicate event sequence and full provider failure path were not executed. The count in the warning can be interpreted as raw observations; explicitly naming that basis would also resolve the ambiguity. No analysis-result or raw-counter defect is claimed. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: This is a misleading human-readable coverage count in partial Inspector observations with duplicate metadata. The retained item, raw event counters and unresolved status remain intact. No analysis result, authorization decision, or recovery behavior was shown to change. - Workaround status: available - Workaround basis: Consumers can inspect scripts.items for retained unresolved entries and use observed_total for pre-deduplication observations; the executed control demonstrates both values remain accurate.

bsakaguchi commented

2026-10-16 21:09:39 +00:00

Author

Owner

@Siva-2517 commented on GitHub (Oct 16, 2026):

Hi! I'd like to work on this issue. I'll investigate the warning-counting logic in V8InspectorCaptureProjection.ts, add a regression test for duplicate script drafts, and keep observed_total consistent with its intended raw-observation semantics. I'll first confirm whether the warning should count retained locations or explicitly describe raw observations.

@Siva-2517 commented on GitHub (Oct 16, 2026): Hi! I'd like to work on this issue. I'll investigate the warning-counting logic in `V8InspectorCaptureProjection.ts`, add a regression test for duplicate script drafts, and keep `observed_total` consistent with its intended raw-observation semantics. I'll first confirm whether the warning should count retained locations or explicitly describe raw observations.

bsakaguchi commented

2026-10-16 21:09:40 +00:00

Author

Owner

@XY-code1 commented on GitHub (Oct 16, 2026):

Hi @Siva-2517, I’ve just seen your comment. I independently completed a small local fix and a regression test for this issue before seeing your claim. The test fails before the fix and passes afterward; the fix preserves the raw observed_total count and derives the warning count from deduplicated items.

I haven’t opened a PR yet. Focused tests pass, but the full npm run check is currently blocked by missing Windows native build artifacts.

Have you already started implementing this? If not, would you be happy for me to submit my patch for review? I’d like to coordinate and avoid duplicate work.

@XY-code1 commented on GitHub (Oct 16, 2026): Hi @Siva-2517, I’ve just seen your comment. I independently completed a small local fix and a regression test for this issue before seeing your claim. The test fails before the fix and passes afterward; the fix preserves the raw observed_total count and derives the warning count from deduplicated items. I haven’t opened a PR yet. Focused tests pass, but the full npm run check is currently blocked by missing Windows native build artifacts. Have you already started implementing this? If not, would you be happy for me to submit my patch for review? I’d like to coordinate and avoid duplicate work.

bsakaguchi commented

2026-10-16 21:09:41 +00:00

Author

Owner

@Siva-2517 commented on GitHub (Oct 16, 2026):

Hi, thanks for letting me know! I’ve created a feature branch, and i am is currently investigating the issue and running tests, but I haven’t made any changes or opened a PR yet.

Since you’ve already implemented the fix, please go ahead and submit your PR. I’ll review it and use my investigation to check for any additional edge cases or test coverage. Happy to help with review feedback if needed. Thanks for coordinating!

@Siva-2517 commented on GitHub (Oct 16, 2026): Hi, thanks for letting me know! I’ve created a feature branch, and i am is currently investigating the issue and running tests, but I haven’t made any changes or opened a PR yet. Since you’ve already implemented the fix, please go ahead and submit your PR. I’ll review it and use my investigation to check for any additional edge cases or test coverage. Happy to help with review feedback if needed. Thanks for coordinating!

bsakaguchi referenced this issue

2026-10-17 21:01:31 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-31 00:29:57 +00:00

[GH-ISSUE #3154] [Feature] Decode ECMA-335 custom attribute arguments from the constructor signature in inspect_managed_artifact #1101

bsakaguchi closed this issue

2026-10-31 00:32:27 +00:00

bsakaguchi commented

2026-10-31 00:32:28 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

Reported-mode drafts are deduplicated into the script-key map first, then unresolvedScripts is derived from final items, so identical script drafts yield one-location warning. scripts.observed_total remains state.scriptsObserved, preserving the raw event count. The exact regression supplies duplicate drafts in reported mode and asserts one retained item, observed_total 2 and the singular warning.

Implementation: V8InspectorCaptureProjection.ts, V8InspectorCaptureProjection.ts.

The relevant regression checks in V8InspectorCaptureProjection.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. Reported-mode drafts are deduplicated into the script-key map first, then unresolvedScripts is derived from final items, so identical script drafts yield one-location warning. scripts.observed_total remains state.scriptsObserved, preserving the raw event count. The exact regression supplies duplicate drafts in reported mode and asserts one retained item, observed_total 2 and the singular warning. Implementation: [V8InspectorCaptureProjection.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/inspector/V8InspectorCaptureProjection.ts#L142), [V8InspectorCaptureProjection.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/inspector/V8InspectorCaptureProjection.ts#L155). The relevant regression checks in [V8InspectorCaptureProjection.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/inspector/V8InspectorCaptureProjection.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 00:47:16 +00:00

[GH-ISSUE #6810] [Bug] Managed runtime classification hides ReadyToRun behind assembly hints #4158

bsakaguchi referenced this issue

2026-10-31 00:55:04 +00:00

[PR #1743] [MERGED] fix(managed): distinguish .NET Standard targets from runtimes #4790