morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5464] [Bug] JavaScript summary coverage mixes examined modules with total graph nodes #3324

New issue

Closed

opened 2026-10-31 00:39:10 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:39:10 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5464

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

An unfiltered JavaScript application summary from inspect-analysis-view combines a module-only coverage.examined count with a graph-wide coverage.total. For an application containing only package.json, it returns examined: 0, total: 3. Adding one JavaScript source file changes those values to examined: 3, total: 6. Both summaries report status: "complete-within-view" and exhausted: true without declaring different populations for the two counters.

The parent analysis and projections succeed. The same parents' unfiltered module pages consistently return zero and three modules, respectively.

Reproduction

From a built source checkout with dependencies, Node.js and jq available, the independent verifier ran the following commands:

WORK="$(mktemp -d)"
export HOME="$WORK/home"
export XDG_CONFIG_HOME="$WORK/config"
export XDG_DATA_HOME="$WORK/data"
export XDG_CACHE_HOME="$WORK/cache"
export XDG_STATE_HOME="$WORK/state"
export TMPDIR="$WORK/cache"
mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME" "$XDG_STATE_HOME" "$WORK/app"
printf '%s\n' '{"name":"coverage-probe","version":"1.0.0"}' > "$WORK/app/package.json"

probe() {
  node scripts/rea.mjs analyze-javascript-application "$WORK/app" --json > "$WORK/$1-analysis.json"
  jq -c '{source:{kind:"inline",evidence:.},view:{kind:"summary"}}' "$WORK/$1-analysis.json" > "$WORK/$1-summary-request.json"
  node scripts/rea.mjs inspect-analysis-view "$WORK/$1-summary-request.json" --json > "$WORK/$1-summary.json"
  jq -c '{source:{kind:"inline",evidence:.},view:{kind:"page",collection:"modules",offset:0,limit:64}}' "$WORK/$1-analysis.json" > "$WORK/$1-page-request.json"
  node scripts/rea.mjs inspect-analysis-view "$WORK/$1-page-request.json" --json > "$WORK/$1-page.json"
  jq -c '.normalized_result.coverage' "$WORK/$1-summary.json" "$WORK/$1-page.json"
}

probe package-only
printf '%s\n' 'export const answer = 42;' > "$WORK/app/main.js"
probe one-source

Each input was exercised twice: once with equivalent inline request JSON generated by Python, then by replaying this shell reproduction. All twelve analysis/projection invocations exited successfully and returned the same coverage values on both runs.

Expected behavior

The summary's examined and total counters should describe one consistent population, allowing callers to interpret examined coverage and exhaustion. A module-scoped summary may count modules; a graph-scoped summary may count graph nodes. The report does not require all complete views to have equal counters or every summary to match its module page.

Contract basis: AGENTS.md, “Tool and Test Changes,” and docs/tool-design.md:171-175 require completeness to derive from examined coverage. docs/cli.md:15-35 documents the directory-analysis/summary workflow; docs/mcp-contracts.md:293-308 distinguishes view projections from parent application/semantic coverage. References are at the tested source revision below. The consistent-population expectation is source-derived reasoning, corroborated by the observed outputs.

Impact and scope

Both tested valid inputs consistently produce misleading machine-readable summary coverage. Callers assessing how much the summary examined cannot interpret these counters as coverage of one population. Impact is bounded to this metadata: no lost parent Evidence, failed analysis, security effect or downstream consumer failure was observed.

Verified workaround: use the unfiltered module page for module counts, or inspect the complete parent Evidence for graph counts. Other input sizes, MCP execution and platforms were not exercised.

REA version

rea-agents 6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8.

Runtime and platform

Node.js v26.12.0; macOS arm64. The macOS release was not recorded. No external provider was used.

Target and artifact context

Local JavaScript application directory containing package.json with {"name":"coverage-probe","version":"1.0.0"}, first alone and then with main.js containing export const answer = 42;. Each projection used freshly produced portable inline Evidence and isolated home/XDG/runtime directories.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

The reproduction prints .normalized_result.coverage for summary and module-page results in that order.

Package-only input:

{"status":"complete-within-view","examined":0,"total":3,"next_offset":null,"exhausted":true}
{"status":"empty","examined":0,"total":0,"next_offset":null,"exhausted":true}

After adding main.js:

{"status":"complete-within-view","examined":3,"total":6,"next_offset":null,"exhausted":true}
{"status":"page","examined":3,"total":3,"next_offset":null,"exhausted":true}

The retained package-only parent has two artifact nodes and one package node. The source-file parent adds one JavaScript asset and two JavaScript modules, bringing its graph to six nodes; the module selector includes the asset kind.

Typed outcome or recovery expected

Keep the existing summary result and parent application/semantic coverage, but give the summary coverage counters a coherent scope. Preserve the module pages' demonstrated contents and counts. This report does not prescribe empty status for a summary with no modules.

Analysis or suspected cause

Source-derived: at the tested revision, src/domain/analysisView/javascriptApplicationView.ts:352-387 computes moduleCount using isModuleNode and calls completeCoverage(moduleCount, analysis.graph.nodes.length). The selected kinds are defined at lines 66-69; the module page counts its own matching population at lines 415-425. analysisViewCoverage.ts:5-15 supplies the summary status and exhaustion. This explains the observed mixed counting units.

Fetched upstream main was checked before submission: these JavaScript projection and coverage-helper files have no changes since the baseline, and the mixed-count call remains present. Later shared-schema/native-matching changes do not alter this calculation; no new upstream runtime reproduction is claimed.

Additional context

Prepared with AI assistance and independently reproduced through the public CLI as described above. Open and closed issues and PRs were searched for the command, symptom and source module; related work on bounding projection messages and semantic-graph budgets describes different behavior.

NOT_ENOUGH_INFO: no last known good version or first introducing commit was established.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5464 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior An unfiltered JavaScript application summary from `inspect-analysis-view` combines a module-only `coverage.examined` count with a graph-wide `coverage.total`. For an application containing only `package.json`, it returns `examined: 0, total: 3`. Adding one JavaScript source file changes those values to `examined: 3, total: 6`. Both summaries report `status: "complete-within-view"` and `exhausted: true` without declaring different populations for the two counters. The parent analysis and projections succeed. The same parents' unfiltered module pages consistently return zero and three modules, respectively. ### Reproduction From a built source checkout with dependencies, Node.js and jq available, the independent verifier ran the following commands: ```sh WORK="$(mktemp -d)" export HOME="$WORK/home" export XDG_CONFIG_HOME="$WORK/config" export XDG_DATA_HOME="$WORK/data" export XDG_CACHE_HOME="$WORK/cache" export XDG_STATE_HOME="$WORK/state" export TMPDIR="$WORK/cache" mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME" "$XDG_STATE_HOME" "$WORK/app" printf '%s\n' '{"name":"coverage-probe","version":"1.0.0"}' > "$WORK/app/package.json" probe() { node scripts/rea.mjs analyze-javascript-application "$WORK/app" --json > "$WORK/$1-analysis.json" jq -c '{source:{kind:"inline",evidence:.},view:{kind:"summary"}}' "$WORK/$1-analysis.json" > "$WORK/$1-summary-request.json" node scripts/rea.mjs inspect-analysis-view "$WORK/$1-summary-request.json" --json > "$WORK/$1-summary.json" jq -c '{source:{kind:"inline",evidence:.},view:{kind:"page",collection:"modules",offset:0,limit:64}}' "$WORK/$1-analysis.json" > "$WORK/$1-page-request.json" node scripts/rea.mjs inspect-analysis-view "$WORK/$1-page-request.json" --json > "$WORK/$1-page.json" jq -c '.normalized_result.coverage' "$WORK/$1-summary.json" "$WORK/$1-page.json" } probe package-only printf '%s\n' 'export const answer = 42;' > "$WORK/app/main.js" probe one-source ``` Each input was exercised twice: once with equivalent inline request JSON generated by Python, then by replaying this shell reproduction. All twelve analysis/projection invocations exited successfully and returned the same coverage values on both runs. ### Expected behavior The summary's `examined` and `total` counters should describe one consistent population, allowing callers to interpret examined coverage and exhaustion. A module-scoped summary may count modules; a graph-scoped summary may count graph nodes. The report does not require all complete views to have equal counters or every summary to match its module page. Contract basis: `AGENTS.md`, “Tool and Test Changes,” and `docs/tool-design.md:171-175` require completeness to derive from examined coverage. `docs/cli.md:15-35` documents the directory-analysis/summary workflow; `docs/mcp-contracts.md:293-308` distinguishes view projections from parent application/semantic coverage. References are at the tested source revision below. The consistent-population expectation is source-derived reasoning, corroborated by the observed outputs. ### Impact and scope Both tested valid inputs consistently produce misleading machine-readable summary coverage. Callers assessing how much the summary examined cannot interpret these counters as coverage of one population. Impact is bounded to this metadata: no lost parent Evidence, failed analysis, security effect or downstream consumer failure was observed. Verified workaround: use the unfiltered module page for module counts, or inspect the complete parent Evidence for graph counts. Other input sizes, MCP execution and platforms were not exercised. ### REA version rea-agents 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. ### Runtime and platform Node.js v26.12.0; macOS arm64. The macOS release was not recorded. No external provider was used. ### Target and artifact context Local JavaScript application directory containing `package.json` with `{"name":"coverage-probe","version":"1.0.0"}`, first alone and then with `main.js` containing `export const answer = 42;`. Each projection used freshly produced portable inline Evidence and isolated home/XDG/runtime directories. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence The reproduction prints `.normalized_result.coverage` for summary and module-page results in that order. Package-only input: ```json {"status":"complete-within-view","examined":0,"total":3,"next_offset":null,"exhausted":true} {"status":"empty","examined":0,"total":0,"next_offset":null,"exhausted":true} ``` After adding `main.js`: ```json {"status":"complete-within-view","examined":3,"total":6,"next_offset":null,"exhausted":true} {"status":"page","examined":3,"total":3,"next_offset":null,"exhausted":true} ``` The retained package-only parent has two artifact nodes and one package node. The source-file parent adds one JavaScript asset and two JavaScript modules, bringing its graph to six nodes; the module selector includes the asset kind. ### Typed outcome or recovery expected Keep the existing summary result and parent application/semantic coverage, but give the summary coverage counters a coherent scope. Preserve the module pages' demonstrated contents and counts. This report does not prescribe `empty` status for a summary with no modules. ### Analysis or suspected cause Source-derived: at the tested revision, `src/domain/analysisView/javascriptApplicationView.ts:352-387` computes `moduleCount` using `isModuleNode` and calls `completeCoverage(moduleCount, analysis.graph.nodes.length)`. The selected kinds are defined at lines 66-69; the module page counts its own matching population at lines 415-425. `analysisViewCoverage.ts:5-15` supplies the summary status and exhaustion. This explains the observed mixed counting units. Fetched upstream `main` was checked before submission: these JavaScript projection and coverage-helper files have no changes since the baseline, and the mixed-count call remains present. Later shared-schema/native-matching changes do not alter this calculation; no new upstream runtime reproduction is claimed. ### Additional context Prepared with AI assistance and independently reproduced through the public CLI as described above. Open and closed issues and PRs were searched for the command, symptom and source module; related work on bounding projection messages and semantic-graph budgets describes different behavior. NOT_ENOUGH_INFO: no last known good version or first introducing commit was established.

bsakaguchi closed this issue

2026-10-31 00:39:10 +00:00

bsakaguchi commented

2026-10-31 00:39:10 +00:00

Author

Owner

@morluto commented on GitHub (Oct 21, 2026):

Closing as fixed on main by github.com/morluto/rea@53e0943223, retained at 67a6477f01.

JavaScript summary coverage now counts module units against moduleCount; non-module graph nodes remain in their separate graph coverage. The targeted analysis-view regression includes an extra graph node and requires complete 1/1 module coverage.

This closure follows current-main producer and regression source inspection and the existing issue evidence. Tests and runtime reproductions were not rerun in this audit; no additional platform/provider coverage is implied.

@morluto commented on GitHub (Oct 21, 2026): Closing as fixed on main by https://github.com/morluto/rea/commit/53e0943223b016c5e1782aa76f3ec2297dc4313b, retained at 67a6477f011ae358fc333e5a6e26c86d932654ed. JavaScript summary coverage now counts module units against moduleCount; non-module graph nodes remain in their separate graph coverage. The targeted analysis-view regression includes an extra graph node and requires complete 1/1 module coverage. This closure follows current-main producer and regression source inspection and the existing issue evidence. Tests and runtime reproductions were not rerun in this audit; no additional platform/provider coverage is implied.

bsakaguchi referenced this issue

2026-10-31 01:10:01 +00:00

[PR #3655] [CLOSED] test(cli): cover SQLite selection through a symlink before .. #5864

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3324

No description provided.

Rows
Columns