[GH-ISSUE #4385] [Bug] Bundle Evidence omits the effective default origin scope #1743

New issue

Closed

opened 2026-10-16 21:09:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:09:45 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4385

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

SOURCE-ONLY: successful analyze_web_bundle requests using the default empty allowed_origins project parameters.allowed_origins: [] into Evidence even though the provider derives a single target-origin scope. Bundle results carry the target URL under capture.target_url; Evidence only reconstructs the default scope from inspection.target or a top-level target, neither of which exists in WebBundleAnalysis.

Reproduction

Source inspection only; these commands do not start REA or connect to a browser. In a clone of this repository, inspect both revisions named in the version field:

for revision in 2c7583599b9ac1c847bd77b1940930fd8d4594c7 3b79af28e80785afce9f5998d8f03289402a1847; do
  git show "$revision:src/cli/browserCommands.ts" | rg -n -A 44 'cli.command\(CLI_COMMANDS.analyzeWebBundle'
  git show "$revision:src/domain/browserObservation.ts" | rg -n -A 5 'browserAllowedOriginsSchema ='
  git show "$revision:src/domain/webBundleAnalysis.ts" | rg -n -A 4 'analyzeWebBundleInputSchema|capture: z.object'
  git show "$revision:src/browser/CdpBrowserProvider.ts" | rg -n -A 22 'async analyzeBundle|const scopeToTargetOrigin|const scopedInput ='
  git show "$revision:src/domain/webBundleAnalyzerResult.ts" | rg -n -A 8 'capture: buildCaptureObservation|const buildCaptureObservation'
  git show "$revision:src/application/BrowserObservationService.ts" | rg -n -A 28 'export const analyzeWebBundle'
  git show "$revision:src/application/BrowserEvidence.ts" | rg -n -A 60 'const observedOrigin|const browserResultTargetOrigin'
done

I inspected those functions and ran a local Python source-anchor check on both checkouts. The check confirmed the producer emits capture.target_url and the complete origin selector contains neither a capture nor a target_url branch. Runtime reproduction was not performed. The valid trigger established by the source is a successful analyze-web-bundle / analyze_web_bundle request for a selected HTTP(S) page with omitted or empty allowed_origins; no live page was used.

Expected behavior

Evidence should retain the effective normalized origin scope used by this observation. The CLI describes bundle analysis as defaulting to the selected target origin, the public input schema accepts omitted origins, and the provider implements that default. The existing Evidence projection already reconstructs the default scope for page/session result shapes; bundle analysis should preserve equivalent scope provenance.

Impact and scope

This is a bounded metadata correctness defect for successful bundle analysis with omitted or empty origin lists. Consumers cannot determine the effective origin list from parameters.allowed_origins, although capture.target_url remains in the result. Explicit nonempty caller origin lists are preserved by source. No browser runtime or downstream incident was measured, and this report makes no claim about unauthorized capture or failure of provider origin enforcement.

REA version

Current main source 2c7583599b; latest published rea-agents 6.5.0 source 3b79af28e8. Both were inspected; no installed CLI or provider runtime was exercised.

Runtime and platform

Source inspection using Python 3 on Darwin arm64. No REA runtime, Node.js runtime, or browser/provider execution is claimed.

Target and artifact context

Supported CDP page bundle analysis transformed into Evidence; no real target or artifact was accessed.

Interface

Other

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

The following links pin the inspected current-main source:

Supported CLI entry parses the bundle request and invokes the shared service.
Default origins schema defaults omitted origins to []; bundle input and result schema extends the page input and defines the result with capture.target_url rather than top-level target (lines 159 onward).
Provider captures the selected target; its shared target-session path derives scopedInput (lines 350 onward), and scopeToTargetOrigin returns a copied request with one normalized origin (lines 513–522).
Bundle result producer records inspection.target.url as capture.target_url.
Service passes the original parsed input and successful bundle result to Evidence construction.
Evidence projection and complete origin selector preserve explicit origins, otherwise look only for inspection.target or top-level target. Consequently the bundle default falls through to [].

These are source-derived facts, not captured runtime output. The same branches were inspected in the released source. Proposed restoration check: the same default-scope successful bundle request should record the selected page's normalized origin in Evidence; an explicit nonempty origin-list control must continue preserving the caller's list.

Typed outcome or recovery expected

A successful bundle Evidence record should carry the actual effective origin list. Supplying explicit exact origins avoids the omission according to source.

Analysis or suspected cause

The result-shape selector omits the bundle capture shape. The provider derives scope in a copied input, leaving the original input empty when the service constructs Evidence.

Additional context

I compared open and closed issue/PR bodies, including argument parsing reports #3408/#3525, navigation URL report #2593, and worker-evidence PR #2068. Those have different restoration signals. The worker PR adds selected worker IDs to Evidence parameters but does not change the origin fallback. No last-known-good baseline or observed regression is claimed.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The successful default-scope bundle path loses its effective origin list in Evidence parameters; the target URL remains, and no broader capture or runtime impact is established.
Workaround status: available
Workaround basis: The inspected input schema and projection accept and preserve a caller-supplied nonempty exact-origin list, so explicitly supplying the selected page origin avoids the missing fallback.

Originally created by @coygeek on GitHub (Oct 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4385 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior SOURCE-ONLY: successful `analyze_web_bundle` requests using the default empty `allowed_origins` project `parameters.allowed_origins: []` into Evidence even though the provider derives a single target-origin scope. Bundle results carry the target URL under `capture.target_url`; Evidence only reconstructs the default scope from `inspection.target` or a top-level `target`, neither of which exists in `WebBundleAnalysis`. ### Reproduction Source inspection only; these commands do not start REA or connect to a browser. In a clone of this repository, inspect both revisions named in the version field: ```sh for revision in 2c7583599b9ac1c847bd77b1940930fd8d4594c7 3b79af28e80785afce9f5998d8f03289402a1847; do git show "$revision:src/cli/browserCommands.ts" | rg -n -A 44 'cli.command\(CLI_COMMANDS.analyzeWebBundle' git show "$revision:src/domain/browserObservation.ts" | rg -n -A 5 'browserAllowedOriginsSchema =' git show "$revision:src/domain/webBundleAnalysis.ts" | rg -n -A 4 'analyzeWebBundleInputSchema|capture: z.object' git show "$revision:src/browser/CdpBrowserProvider.ts" | rg -n -A 22 'async analyzeBundle|const scopeToTargetOrigin|const scopedInput =' git show "$revision:src/domain/webBundleAnalyzerResult.ts" | rg -n -A 8 'capture: buildCaptureObservation|const buildCaptureObservation' git show "$revision:src/application/BrowserObservationService.ts" | rg -n -A 28 'export const analyzeWebBundle' git show "$revision:src/application/BrowserEvidence.ts" | rg -n -A 60 'const observedOrigin|const browserResultTargetOrigin' done ``` I inspected those functions and ran a local Python source-anchor check on both checkouts. The check confirmed the producer emits `capture.target_url` and the complete origin selector contains neither a `capture` nor a `target_url` branch. Runtime reproduction was not performed. The valid trigger established by the source is a successful `analyze-web-bundle` / `analyze_web_bundle` request for a selected HTTP(S) page with omitted or empty `allowed_origins`; no live page was used. ### Expected behavior Evidence should retain the effective normalized origin scope used by this observation. The CLI describes bundle analysis as defaulting to the selected target origin, the public input schema accepts omitted origins, and the provider implements that default. The existing Evidence projection already reconstructs the default scope for page/session result shapes; bundle analysis should preserve equivalent scope provenance. ### Impact and scope This is a bounded metadata correctness defect for successful bundle analysis with omitted or empty origin lists. Consumers cannot determine the effective origin list from `parameters.allowed_origins`, although `capture.target_url` remains in the result. Explicit nonempty caller origin lists are preserved by source. No browser runtime or downstream incident was measured, and this report makes no claim about unauthorized capture or failure of provider origin enforcement. ### REA version Current main source 2c7583599b9ac1c847bd77b1940930fd8d4594c7; latest published rea-agents 6.5.0 source 3b79af28e80785afce9f5998d8f03289402a1847. Both were inspected; no installed CLI or provider runtime was exercised. ### Runtime and platform Source inspection using Python 3 on Darwin arm64. No REA runtime, Node.js runtime, or browser/provider execution is claimed. ### Target and artifact context Supported CDP page bundle analysis transformed into Evidence; no real target or artifact was accessed. ### Interface Other ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence The following links pin the inspected current-main source: - [Supported CLI entry](https://github.com/morluto/rea/blob/2c7583599b9ac1c847bd77b1940930fd8d4594c7/src/cli/browserCommands.ts#L147-L186) parses the bundle request and invokes the shared service. - [Default origins schema](https://github.com/morluto/rea/blob/2c7583599b9ac1c847bd77b1940930fd8d4594c7/src/domain/browserObservation.ts#L159-L166) defaults omitted origins to `[]`; [bundle input and result schema](https://github.com/morluto/rea/blob/2c7583599b9ac1c847bd77b1940930fd8d4594c7/src/domain/webBundleAnalysis.ts#L7-L12) extends the page input and defines the result with `capture.target_url` rather than top-level `target` (lines 159 onward). - [Provider](https://github.com/morluto/rea/blob/2c7583599b9ac1c847bd77b1940930fd8d4594c7/src/browser/CdpBrowserProvider.ts#L162-L186) captures the selected target; its shared target-session path derives `scopedInput` (lines 350 onward), and `scopeToTargetOrigin` returns a copied request with one normalized origin (lines 513–522). - [Bundle result producer](https://github.com/morluto/rea/blob/2c7583599b9ac1c847bd77b1940930fd8d4594c7/src/domain/webBundleAnalyzerResult.ts#L64-L73) records `inspection.target.url` as `capture.target_url`. - [Service](https://github.com/morluto/rea/blob/2c7583599b9ac1c847bd77b1940930fd8d4594c7/src/application/BrowserObservationService.ts#L80-L104) passes the original parsed input and successful bundle result to Evidence construction. - [Evidence projection and complete origin selector](https://github.com/morluto/rea/blob/2c7583599b9ac1c847bd77b1940930fd8d4594c7/src/application/BrowserEvidence.ts#L132-L188) preserve explicit origins, otherwise look only for `inspection.target` or top-level `target`. Consequently the bundle default falls through to `[]`. These are source-derived facts, not captured runtime output. The same branches were inspected in the released source. Proposed restoration check: the same default-scope successful bundle request should record the selected page's normalized origin in Evidence; an explicit nonempty origin-list control must continue preserving the caller's list. ### Typed outcome or recovery expected A successful bundle Evidence record should carry the actual effective origin list. Supplying explicit exact origins avoids the omission according to source. ### Analysis or suspected cause The result-shape selector omits the bundle capture shape. The provider derives scope in a copied input, leaving the original input empty when the service constructs Evidence. ### Additional context I compared open and closed issue/PR bodies, including argument parsing reports #3408/#3525, navigation URL report #2593, and worker-evidence PR #2068. Those have different restoration signals. The worker PR adds selected worker IDs to Evidence parameters but does not change the origin fallback. No last-known-good baseline or observed regression is claimed. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The successful default-scope bundle path loses its effective origin list in Evidence parameters; the target URL remains, and no broader capture or runtime impact is established. - Workaround status: available - Workaround basis: The inspected input schema and projection accept and preserve a caller-supplied nonempty exact-origin list, so explicitly supplying the selected page origin avoids the missing fallback.

bsakaguchi referenced this issue

2026-10-17 21:01:31 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi closed this issue

2026-10-31 00:32:30 +00:00

bsakaguchi referenced this issue

2026-10-31 00:55:04 +00:00

[PR #1743] [MERGED] fix(managed): distinguish .NET Standard targets from runtimes #4790