[GH-ISSUE #4854] [Bug] Static JavaScript analysis classifies a local Database class as exact SQLite storage #3016

New issue

Closed

opened 2026-10-31 00:34:54 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:34:54 +00:00

Owner

Originally created by @thomasisalwayslate on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4854

A locally defined class named Database, with no database implementation, is classified as SQLite storage with state: "observed", confidence: "exact", and no limitations.

Reproduced with the published npm package rea-agents@6.5.0 on macOS ARM64, Node 26.10.0. The npm provenance statement identifies commit 3b79af28e80785afce9f5998d8f03289402a1847. Also reproduced in a source checkout at 63c65a22430a4bbc0c1807a0298edb867775001f.

Create a directory containing only this main.js:

class Database { constructor(name) { this.name = name; } }
console.log(new Database('hello'));

Run:

npx -y rea-agents@6.5.0 analyze-javascript-application /absolute/path/to/repro --json

The returned graph contains a storage node with:

{
  "properties": {
    "storage_kind": "sqlite",
    "name": "hello",
    "mechanism": "call:Database"
  },
  "evidence": {
    "authority": "ast-static-analysis",
    "state": "observed",
    "confidence": "exact",
    "limitations": []
  }
}

The constructor only assigns a field on a JavaScript object. There is no SQLite import, file access or database operation.

Expected: resolve the local class binding and omit the SQLite classification. An unresolved constructor name can at most support a qualified candidate; it does not establish the storage engine.

Originally created by @thomasisalwayslate on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4854 A locally defined class named `Database`, with no database implementation, is classified as SQLite storage with `state: "observed"`, `confidence: "exact"`, and no limitations. Reproduced with the published npm package `rea-agents@6.5.0` on macOS ARM64, Node 26.10.0. The npm provenance statement identifies commit `3b79af28e80785afce9f5998d8f03289402a1847`. Also reproduced in a source checkout at `63c65a22430a4bbc0c1807a0298edb867775001f`. Create a directory containing only this `main.js`: ```js class Database { constructor(name) { this.name = name; } } console.log(new Database('hello')); ``` Run: ```sh npx -y rea-agents@6.5.0 analyze-javascript-application /absolute/path/to/repro --json ``` The returned graph contains a `storage` node with: ```json { "properties": { "storage_kind": "sqlite", "name": "hello", "mechanism": "call:Database" }, "evidence": { "authority": "ast-static-analysis", "state": "observed", "confidence": "exact", "limitations": [] } } ``` The constructor only assigns a field on a JavaScript object. There is no SQLite import, file access or database operation. Expected: resolve the local class binding and omit the SQLite classification. An unresolved constructor name can at most support a qualified candidate; it does not establish the storage engine.

bsakaguchi closed this issue

2026-10-31 00:34:54 +00:00

bsakaguchi commented

2026-10-31 00:34:55 +00:00

Author

Owner

@Abdooo2235 commented on GitHub (Oct 17, 2026):

@thomasisalwayslate I reproduced the local-class false positive and published a fix at Abdooo2235/rea@25afd9f6 (branch fix/javascript-database-binding). It requires established SQLite module identity and accounts for constructor mutation and supported function-local requires. The compiled public CLI reports fixture.db from sqlite3 and no storage for the local class's hello value; 40 focused tests, static checks and docs checks pass. PR creation is currently rejected for my account, so no PR is open yet. Comparison: https://github.com/morluto/rea/compare/main...Abdooo2235:fix/javascript-database-binding?expand=1 . @morluto the branch and regression evidence are available there.

@Abdooo2235 commented on GitHub (Oct 17, 2026): @thomasisalwayslate I reproduced the local-class false positive and published a fix at Abdooo2235/rea@25afd9f6 (branch fix/javascript-database-binding). It requires established SQLite module identity and accounts for constructor mutation and supported function-local requires. The compiled public CLI reports fixture.db from sqlite3 and no storage for the local class's hello value; 40 focused tests, static checks and docs checks pass. PR creation is currently rejected for my account, so no PR is open yet. Comparison: https://github.com/morluto/rea/compare/main...Abdooo2235:fix/javascript-database-binding?expand=1 . @morluto the branch and regression evidence are available there.

bsakaguchi commented

2026-10-31 00:34:56 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Fixed in fc847ffe3 on main (with eval uncertainty handled separately in 9ac76d3d9).

Database spelling now selects a candidate; shared module provenance and mutation facts establish certainty. Proven local constructors are omitted. Unknown or changed origins retain low-confidence candidate nodes and edges, distinct from exact SQLite identities even when filenames match. Type-only imports retain uncertain origins; runtime import-equals remains supported.

Validation: the final batch passed 306 focused checks across 16 files, including compiled CLI and stdio MCP consumers. The 24 SQLite controls without eval give 18 failures and 6 positive passes on the unchanged baseline. Static, docs and discovery checks passed. Two scoped source reviews found no remaining blocker.

Scope: authored static fixtures, no analyzed JavaScript or SQLite engine execution. Heavy tests/profiling remain stopped. Small workflow costs are measured separately; no speedup or large-input performance claim.

@morluto commented on GitHub (Oct 17, 2026): Fixed in `fc847ffe3` on `main` (with eval uncertainty handled separately in `9ac76d3d9`). `Database` spelling now selects a candidate; shared module provenance and mutation facts establish certainty. Proven local constructors are omitted. Unknown or changed origins retain low-confidence candidate nodes and edges, distinct from exact SQLite identities even when filenames match. Type-only imports retain uncertain origins; runtime import-equals remains supported. Validation: the final batch passed 306 focused checks across 16 files, including compiled CLI and stdio MCP consumers. The 24 SQLite controls without eval give 18 failures and 6 positive passes on the unchanged baseline. Static, docs and discovery checks passed. Two scoped source reviews found no remaining blocker. Scope: authored static fixtures, no analyzed JavaScript or SQLite engine execution. Heavy tests/profiling remain stopped. Small workflow costs are measured separately; no speedup or large-input performance claim.

bsakaguchi referenced this issue

2026-10-31 01:07:36 +00:00

[PR #3023] feat(config): persist provider settings in a user config file #5561

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471