morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4617] [Bug] For-in template literals lose loop-head assignments and return stale constants #2398

New issue

Closed

opened 2026-10-17 21:04:10 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-17 21:04:10 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4617

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

On the tested main build, analyze-javascript-application <directory> --json completes successfully but treats a for-in head over a bare nonempty template as if it cannot assign. An exported function initializes selected to "before", assigns it in that loop head, and returns it. REA reports the literal "before"; executing the fixture returns "2". The equivalent quoted-string loop produces an unknown return value, conservatively preserving the possible assignment. The failure occurs with an ordinary identifier head as well as an array pattern.

The semantic graph retains the templateKey binding and variable definition but no loop-head assignment definition. Its quoted-string control retains an assignment definition. Overall semantic coverage is unknown; the incorrect literal appears in a return-shape projection marked complete. The published package does not reproduce this failure: its return values are unknown and it retains both assignment definitions.

Reproduction

Use the source revision under REA version with its pinned development toolchain (.nvmrc and package.json#packageManager). From a fresh checkout, run npm ci and npm run build:cached. Create the fixture and an isolated home:

case_root="$(mktemp -d)"
mkdir "$case_root/fixture" "$case_root/home"
cat > "$case_root/fixture/main.js" <<'JS'
export function template() { let selected = "before"; for ([selected] in `abc`) {} return selected; }
export function quoted() { let selected = "before"; for ([selected] in "abc") {} return selected; }
export function empty() { let selected = "before"; for ([selected] in ``) {} return selected; }
export function ordinaryTemplate() { let selected = "before"; for (selected in `abc`) {} return selected; }
export function ordinaryQuoted() { let selected = "before"; for (selected in "abc") {} return selected; }
for (const [templateKey] in `abc`) { void templateKey; }
for (const [quotedKey] in "abc") { void quotedKey; }
JS

From the checkout root, analyze with inherited client configuration removed. Ensure the selected Node binary is directly available on PATH rather than through a HOME-dependent shim:

env -i HOME="$case_root/home" PATH="$PATH" node scripts/rea.mjs \
  analyze-javascript-application "$case_root/fixture" --json \
  > "$case_root/result.json" 2> "$case_root/progress.ndjson"

Inspect exported return values and loop-head assignment definitions:

python3 - "$case_root/result.json" <<'PY'
import json, sys
r=json.load(open(sys.argv[1]))['normalized_result']
g=r['semantic_graph']; nodes={n['node_id']:n for n in g['nodes']}
shapes={p['exported_name']:p for n in r['graph']['nodes'] for o in n.get('observations',[]) if (p:=o.get('properties',{})).get('semantic_role')=='export-return-shapes'}
for name in ['template','quoted','empty','ordinaryTemplate','ordinaryQuoted']:
 p=shapes[name]; f=p['static_return_shapes'][0]['fields'][0]
 print(name, 'state='+f['state'], 'value='+json.dumps(f['value']), 'projection_complete='+str(p['return_shape_coverage']['projection_complete']))
for label in ['templateKey','quotedKey']:
 n=next(n for n in nodes.values() if n['kind']=='binding' and n['label']==label)
 assignments=sum(x['relation']=='defines' and x['target_node_id']==n['node_id'] and nodes[x['source_node_id']]['label']=='assignment' for x in g['relations'])
 print(label,'assignment_definitions='+str(assignments))
print('semantic_coverage='+g['coverage']['status'], 'truncated='+str(g['coverage']['truncated']), 'omitted_nodes='+str(g['coverage']['omitted_nodes']), 'omitted_relations='+str(g['coverage']['omitted_relations']))
PY

Separately execute only this synthetic fixture to check the runtime result. REA's analysis itself remains static:

env -i HOME="$case_root/home" PATH="$PATH" node --input-type=module - "$case_root/fixture/main.js" <<'JS'
import { readFile } from 'node:fs/promises';
const source = await readFile(process.argv[2], 'utf8');
const module = await import('data:text/javascript;base64,' + Buffer.from(source).toString('base64'));
for (const name of ['template','quoted','empty','ordinaryTemplate','ordinaryQuoted']) console.log(name, JSON.stringify(module[name]()));
const templateKeys = [], quotedKeys = [];
for (const [k] in `abc`) templateKeys.push(k);
for (const [k] in "abc") quotedKeys.push(k);
console.log('template keys', JSON.stringify(templateKeys));
console.log('quoted keys', JSON.stringify(quotedKeys));
JS

The source fixture reproduced in two CLI analyses, both exit status 0. I also installed the published package locally with npm install --prefix <runner> rea-agents@6.5.0 --omit=optional --no-audit --no-fund in the isolated home and ran its scripts/rea.mjs against the identical fixture once, with exit status 0. That package run did not reproduce the defect. Direct Node execution independently confirmed the return values and enumerated keys.

Expected behavior

Retain the possible loop-head assignment for the nonempty template as for the quoted-string control. A read after that loop must not resolve to the pre-loop constant "before". Unknown is acceptable; exact loop execution or recovery of the final key is unnecessary. The empty-template control should preserve "before" on the source build that already recognizes empty loops.

The documented semantic workflow covers lexical definitions, destructuring, and loop assignment targets. It says rebound values are evaluated at their read position and unresolved ordering remains unknown. The literal-cardinality helper's stated exact source-only contract also applies to the no-substitution template. These expectations concern local static facts and require no target execution by REA.

Impact and scope

The source build loses assignment evidence and reports a wrong static literal for a valid local module in both runs. Both array-pattern and ordinary identifier loop heads are affected. This is a synthetic fixture; no production application incident or prevalence measurement was established. Analysis succeeds, overall coverage remains unknown, and the result is not truncated. I do not claim that all loop-body effects disappear. The published build retains conservative results.

Impact level: P2
Assessment status: supported
Impact basis: A bounded semantic-evidence error claims a constant contradicted by execution of the fixture and omits a documented assignment; ordinary identifier loops exhibit the same defect.
Workaround status: unverified
Workaround basis: The quoted-string control restores conservative assignment handling but changes the analyzed artifact. No alternative public operation was verified to restore the result for unchanged input on the affected source build.

REA version

Fresh main checkout at commit 0c7b6d834af2d044b23196e0e522cc2468327a1e, with CLI version output 6.5.0. Published npm package rea-agents@6.5.0, also reporting 6.5.0, was tested separately and did not reproduce the defect. npm and GitHub identify it as the latest published release.

Runtime and platform

Node.js v24.18.0; npm 11.16.0; Darwin arm64. The source build used the repository's pinned toolchain and locked dependencies. Static JavaScript analysis required no native provider.

Target and artifact context

A local directory containing only the synthetic main.js above. REA parsed it statically. Separate Node.js execution of this owned fixture supplied the runtime comparison. No external application or service was involved.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Expected source: docs/javascript-application-workflows.md:177-200 covers lexical/destructuring extraction and loop targets; :330-336 describes read-position evaluation and conservative ordering. src/domain/javascript/javascriptSemanticEvaluationOrder.ts:16 states exact source-only cardinality for literal loop heads. These locators refer to the tested source revision.
Failure source: The two source CLI analyses above, reduced from normalized_result.graph and normalized_result.semantic_graph; src/domain/javascript/javascriptSemanticEvaluationOrder.ts:61-64 classifies the template, and src/domain/javascript/javascriptSemanticAnalysis.ts:1377-1396 skips assignment registration for an empty classification.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

Both source runs produced:

template state=literal value="before" projection_complete=True
quoted state=unknown value=null projection_complete=True
empty state=literal value="before" projection_complete=True
ordinaryTemplate state=literal value="before" projection_complete=True
ordinaryQuoted state=unknown value=null projection_complete=True
templateKey assignment_definitions=0
quotedKey assignment_definitions=1
semantic_coverage=unknown truncated=False omitted_nodes=0 omitted_relations=0

The package run returned unknown/null for all five exported functions, with projection_complete=True, one assignment definition each for templateKey and quotedKey, and the same unknown/nontruncated semantic coverage with zero omitted nodes and relations. Its unknown empty-template result is conservative; this report does not request exact empty-loop inference in that release.

Separate Node execution produced:

template "2"
quoted "2"
empty "before"
ordinaryTemplate "2"
ordinaryQuoted "2"
template keys ["0","1","2"]
quoted keys ["0","1","2"]

Typed outcome or recovery expected

For the unchanged fixture on the affected source build, template and ordinaryTemplate must stop reporting literal "before"; retain their possible loop assignments and an unknown or otherwise sound return value. Preserve the unknown results for quoted and ordinaryQuoted, the "before" result for empty, and the assignment definition for quotedKey. Restore a loop-head assignment definition for templateKey. A surviving lexical binding or generic partial-coverage flag alone does not correct the wrong literal.

Analysis or suspected cause

Source-derived reasoning: src/domain/javascript/javascriptAstValues.ts:59-67 recognizes a no-substitution template as an exact cooked string. Only quoted string syntax reaches the explicit nonempty-string branch of the cardinality helper. The template instead reaches the exact-literal fallback, which returns empty when no source prototype uncertainty was found; javascriptSemanticAnalysis.ts:913 initializes that uncertainty to false. The assignment collector then returns before registering loop-head writes. This explains the observed source result, but no fix was attempted or tested.

Additional context

Related #4604 and #4609 concern nested-default and assignment destructuring property dependencies. This report concerns loop cardinality and omitted head assignments, and its ordinary identifier case requires no destructuring. Template string extraction for endpoint object values is also separate: this fixture has no endpoint calls or object string fields. Closed #1428 concerns for-of array-reference member writes, rather than for-in string iteration or binding assignments. The last known good published baseline is the tested package; the first bad source commit was not isolated.

Originally created by @coygeek on GitHub (Oct 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4617 ### Before submitting - [X] I searched the open and closed issues for a related report. - [X] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior On the tested `main` build, `analyze-javascript-application <directory> --json` completes successfully but treats a for-in head over a bare nonempty template as if it cannot assign. An exported function initializes `selected` to `"before"`, assigns it in that loop head, and returns it. REA reports the literal `"before"`; executing the fixture returns `"2"`. The equivalent quoted-string loop produces an unknown return value, conservatively preserving the possible assignment. The failure occurs with an ordinary identifier head as well as an array pattern. The semantic graph retains the `templateKey` binding and variable definition but no loop-head assignment definition. Its quoted-string control retains an assignment definition. Overall semantic coverage is unknown; the incorrect literal appears in a return-shape projection marked complete. The published package does not reproduce this failure: its return values are unknown and it retains both assignment definitions. ### Reproduction 1. Use the source revision under REA version with its pinned development toolchain (`.nvmrc` and `package.json#packageManager`). From a fresh checkout, run `npm ci` and `npm run build:cached`. Create the fixture and an isolated home: ```sh case_root="$(mktemp -d)" mkdir "$case_root/fixture" "$case_root/home" cat > "$case_root/fixture/main.js" <<'JS' export function template() { let selected = "before"; for ([selected] in `abc`) {} return selected; } export function quoted() { let selected = "before"; for ([selected] in "abc") {} return selected; } export function empty() { let selected = "before"; for ([selected] in ``) {} return selected; } export function ordinaryTemplate() { let selected = "before"; for (selected in `abc`) {} return selected; } export function ordinaryQuoted() { let selected = "before"; for (selected in "abc") {} return selected; } for (const [templateKey] in `abc`) { void templateKey; } for (const [quotedKey] in "abc") { void quotedKey; } JS ``` 2. From the checkout root, analyze with inherited client configuration removed. Ensure the selected Node binary is directly available on PATH rather than through a HOME-dependent shim: ```sh env -i HOME="$case_root/home" PATH="$PATH" node scripts/rea.mjs \ analyze-javascript-application "$case_root/fixture" --json \ > "$case_root/result.json" 2> "$case_root/progress.ndjson" ``` 3. Inspect exported return values and loop-head assignment definitions: ```sh python3 - "$case_root/result.json" <<'PY' import json, sys r=json.load(open(sys.argv[1]))['normalized_result'] g=r['semantic_graph']; nodes={n['node_id']:n for n in g['nodes']} shapes={p['exported_name']:p for n in r['graph']['nodes'] for o in n.get('observations',[]) if (p:=o.get('properties',{})).get('semantic_role')=='export-return-shapes'} for name in ['template','quoted','empty','ordinaryTemplate','ordinaryQuoted']: p=shapes[name]; f=p['static_return_shapes'][0]['fields'][0] print(name, 'state='+f['state'], 'value='+json.dumps(f['value']), 'projection_complete='+str(p['return_shape_coverage']['projection_complete'])) for label in ['templateKey','quotedKey']: n=next(n for n in nodes.values() if n['kind']=='binding' and n['label']==label) assignments=sum(x['relation']=='defines' and x['target_node_id']==n['node_id'] and nodes[x['source_node_id']]['label']=='assignment' for x in g['relations']) print(label,'assignment_definitions='+str(assignments)) print('semantic_coverage='+g['coverage']['status'], 'truncated='+str(g['coverage']['truncated']), 'omitted_nodes='+str(g['coverage']['omitted_nodes']), 'omitted_relations='+str(g['coverage']['omitted_relations'])) PY ``` 4. Separately execute only this synthetic fixture to check the runtime result. REA's analysis itself remains static: ```sh env -i HOME="$case_root/home" PATH="$PATH" node --input-type=module - "$case_root/fixture/main.js" <<'JS' import { readFile } from 'node:fs/promises'; const source = await readFile(process.argv[2], 'utf8'); const module = await import('data:text/javascript;base64,' + Buffer.from(source).toString('base64')); for (const name of ['template','quoted','empty','ordinaryTemplate','ordinaryQuoted']) console.log(name, JSON.stringify(module[name]())); const templateKeys = [], quotedKeys = []; for (const [k] in `abc`) templateKeys.push(k); for (const [k] in "abc") quotedKeys.push(k); console.log('template keys', JSON.stringify(templateKeys)); console.log('quoted keys', JSON.stringify(quotedKeys)); JS ``` The source fixture reproduced in two CLI analyses, both exit status 0. I also installed the published package locally with `npm install --prefix <runner> rea-agents@6.5.0 --omit=optional --no-audit --no-fund` in the isolated home and ran its `scripts/rea.mjs` against the identical fixture once, with exit status 0. That package run did not reproduce the defect. Direct Node execution independently confirmed the return values and enumerated keys. ### Expected behavior Retain the possible loop-head assignment for the nonempty template as for the quoted-string control. A read after that loop must not resolve to the pre-loop constant `"before"`. Unknown is acceptable; exact loop execution or recovery of the final key is unnecessary. The empty-template control should preserve `"before"` on the source build that already recognizes empty loops. The documented semantic workflow covers lexical definitions, destructuring, and loop assignment targets. It says rebound values are evaluated at their read position and unresolved ordering remains unknown. The literal-cardinality helper's stated exact source-only contract also applies to the no-substitution template. These expectations concern local static facts and require no target execution by REA. ### Impact and scope The source build loses assignment evidence and reports a wrong static literal for a valid local module in both runs. Both array-pattern and ordinary identifier loop heads are affected. This is a synthetic fixture; no production application incident or prevalence measurement was established. Analysis succeeds, overall coverage remains unknown, and the result is not truncated. I do not claim that all loop-body effects disappear. The published build retains conservative results. - Impact level: P2 - Assessment status: supported - Impact basis: A bounded semantic-evidence error claims a constant contradicted by execution of the fixture and omits a documented assignment; ordinary identifier loops exhibit the same defect. - Workaround status: unverified - Workaround basis: The quoted-string control restores conservative assignment handling but changes the analyzed artifact. No alternative public operation was verified to restore the result for unchanged input on the affected source build. ### REA version Fresh `main` checkout at commit `0c7b6d834af2d044b23196e0e522cc2468327a1e`, with CLI version output `6.5.0`. Published npm package `rea-agents@6.5.0`, also reporting `6.5.0`, was tested separately and did not reproduce the defect. npm and GitHub identify it as the latest published release. ### Runtime and platform Node.js `v24.18.0`; npm `11.16.0`; Darwin arm64. The source build used the repository's pinned toolchain and locked dependencies. Static JavaScript analysis required no native provider. ### Target and artifact context A local directory containing only the synthetic `main.js` above. REA parsed it statically. Separate Node.js execution of this owned fixture supplied the runtime comparison. No external application or service was involved. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence - Expected source: `docs/javascript-application-workflows.md:177-200` covers lexical/destructuring extraction and loop targets; `:330-336` describes read-position evaluation and conservative ordering. `src/domain/javascript/javascriptSemanticEvaluationOrder.ts:16` states exact source-only cardinality for literal loop heads. These locators refer to the tested source revision. - Failure source: The two source CLI analyses above, reduced from `normalized_result.graph` and `normalized_result.semantic_graph`; `src/domain/javascript/javascriptSemanticEvaluationOrder.ts:61-64` classifies the template, and `src/domain/javascript/javascriptSemanticAnalysis.ts:1377-1396` skips assignment registration for an empty classification. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete Both source runs produced: ```text template state=literal value="before" projection_complete=True quoted state=unknown value=null projection_complete=True empty state=literal value="before" projection_complete=True ordinaryTemplate state=literal value="before" projection_complete=True ordinaryQuoted state=unknown value=null projection_complete=True templateKey assignment_definitions=0 quotedKey assignment_definitions=1 semantic_coverage=unknown truncated=False omitted_nodes=0 omitted_relations=0 ``` The package run returned unknown/null for all five exported functions, with `projection_complete=True`, one assignment definition each for `templateKey` and `quotedKey`, and the same unknown/nontruncated semantic coverage with zero omitted nodes and relations. Its unknown empty-template result is conservative; this report does not request exact empty-loop inference in that release. Separate Node execution produced: ```text template "2" quoted "2" empty "before" ordinaryTemplate "2" ordinaryQuoted "2" template keys ["0","1","2"] quoted keys ["0","1","2"] ``` ### Typed outcome or recovery expected For the unchanged fixture on the affected source build, `template` and `ordinaryTemplate` must stop reporting literal `"before"`; retain their possible loop assignments and an unknown or otherwise sound return value. Preserve the unknown results for `quoted` and `ordinaryQuoted`, the `"before"` result for `empty`, and the assignment definition for `quotedKey`. Restore a loop-head assignment definition for `templateKey`. A surviving lexical binding or generic partial-coverage flag alone does not correct the wrong literal. ### Analysis or suspected cause Source-derived reasoning: `src/domain/javascript/javascriptAstValues.ts:59-67` recognizes a no-substitution template as an exact cooked string. Only quoted string syntax reaches the explicit nonempty-string branch of the cardinality helper. The template instead reaches the exact-literal fallback, which returns empty when no source prototype uncertainty was found; `javascriptSemanticAnalysis.ts:913` initializes that uncertainty to false. The assignment collector then returns before registering loop-head writes. This explains the observed source result, but no fix was attempted or tested. ### Additional context Related [#4604](https://github.com/morluto/rea/issues/4604) and [#4609](https://github.com/morluto/rea/issues/4609) concern nested-default and assignment destructuring property dependencies. This report concerns loop cardinality and omitted head assignments, and its ordinary identifier case requires no destructuring. Template string extraction for endpoint object values is also separate: this fixture has no endpoint calls or object string fields. Closed [#1428](https://github.com/morluto/rea/issues/1428) concerns for-of array-reference member writes, rather than for-in string iteration or binding assignments. The last known good published baseline is the tested package; the first bad source commit was not isolated.

bsakaguchi commented

2026-10-17 21:04:11 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Fixed in c3e42385e.

The cardinality owner now consumes readExactJavaScriptLiteral's value instead of checking quoted-string AST syntax separately. Cooked template strings therefore follow the same for-in/for-of rules as quoted strings. This restores possible loop-head assignments and also recognizes empty for-of templates. Prototype uncertainty remains conservative.

Local validation on Node 24.18.0:

Before the fix, new source controls: 8 failed, 82 passed (four missing for-in assignments; four empty for-of templates conservatively retained assignments).
After the fix: 473 focused tests passed across six files, including the public CLI regression checking assignment definitions and exported unknown/literal return shapes; member mutations, reference lifetimes, structure, and existing template extraction controls also passed.
Controls include ordinary/destructuring heads, cooked Unicode escapes, cooked empty line continuations, and uncertain prototypes.

The analyzer statically parsed owned fixtures; no target code or native provider was executed. No performance improvement or full CI outcome is claimed. Qodo's separate heavy test remained stopped.

@morluto commented on GitHub (Oct 17, 2026): Fixed in `c3e42385e`. The cardinality owner now consumes `readExactJavaScriptLiteral`'s value instead of checking quoted-string AST syntax separately. Cooked template strings therefore follow the same for-in/for-of rules as quoted strings. This restores possible loop-head assignments and also recognizes empty for-of templates. Prototype uncertainty remains conservative. Local validation on Node 24.18.0: - Before the fix, new source controls: 8 failed, 82 passed (four missing for-in assignments; four empty for-of templates conservatively retained assignments). - After the fix: 473 focused tests passed across six files, including the public CLI regression checking assignment definitions and exported unknown/literal return shapes; member mutations, reference lifetimes, structure, and existing template extraction controls also passed. - Controls include ordinary/destructuring heads, cooked Unicode escapes, cooked empty line continuations, and uncertain prototypes. The analyzer statically parsed owned fixtures; no target code or native provider was executed. No performance improvement or full CI outcome is claimed. Qodo's separate heavy test remained stopped.

bsakaguchi closed this issue

2026-10-31 00:33:28 +00:00

bsakaguchi commented

2026-10-31 00:33:29 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 18, 2026):

Closing as addressed on main by c3e42385e. Loop cardinality now uses canonical cooked literal values, so nonempty template for-in loops retain possible assignments and no longer publish the stale pre-loop constant; quoted and empty controls remain covered. I verified the committed source and regression coverage; I have not rerun the runtime reproduction.

@coygeek commented on GitHub (Oct 18, 2026): Closing as addressed on `main` by [c3e42385e](https://github.com/morluto/rea/commit/c3e42385e720ecc18be7190e7927e28f23b40a79). Loop cardinality now uses canonical cooked literal values, so nonempty template for-in loops retain possible assignments and no longer publish the stale pre-loop constant; quoted and empty controls remain covered. I verified the committed source and regression coverage; I have not rerun the runtime reproduction.

bsakaguchi referenced this issue

2026-10-31 00:49:09 +00:00

[GH-ISSUE #7327] [Bug] MCP provenance documentation lists two exceptions although both settings tools are also exempt #4354

bsakaguchi referenced this issue

2026-10-31 01:04:45 +00:00

[PR #2398] [MERGED] fix(server): mark retained partial-observation errors as target content #5199