morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5466] [Bug] JavaScript application analysis misreports external source-map sections as version mismatches #3326

New issue

Closed

opened 2026-10-31 00:39:11 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:39:11 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5466

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

analyze-javascript-application reports Source map is not a version 3 map. for an indexed source map with version: 3 and an external section URL. The CLI exits 0 and correctly retains partial coverage and an unavailable map scope, but its reason misidentifies the unsupported section as a version mismatch.

This report was prepared with AI assistance and independently reproduced through the public CLI. Runtime results below come from that independent verifier; the submission step checked upstream changes and duplicates without rerunning the CLI.

Reproduction

From the source revision below, with dependencies and the built CLI available, the verifier executed this exact block and reproduced the false reason, following an initial reproduction of the same external-section case:

fixture_root=$(mktemp -d)
mkdir -p "$fixture_root/app/maps" "$fixture_root/app/renderer" \
  "$fixture_root/home" "$fixture_root/config" "$fixture_root/data" \
  "$fixture_root/cache" "$fixture_root/state"
export HOME="$fixture_root/home"
export XDG_CONFIG_HOME="$fixture_root/config"
export XDG_DATA_HOME="$fixture_root/data"
export XDG_CACHE_HOME="$fixture_root/cache"
export XDG_STATE_HOME="$fixture_root/state"
printf '%s\n' '{"name":"source-map-fixture","version":"1.0.0","main":"main.js"}' > "$fixture_root/app/package.json"
printf '%s\n' 'export const main = 1;' > "$fixture_root/app/main.js"
printf '%s\n' 'export const value = 1;' '//# sourceMappingURL=../maps/app.js.map' > "$fixture_root/app/renderer/app.js"
printf '%s\n' '{"version":3,"sections":[{"offset":{"line":0,"column":0},"url":"https://app.test/maps/part.map"}]}' > "$fixture_root/app/maps/app.js.map"
node scripts/rea.mjs analyze-javascript-application "$fixture_root/app" --format json > "$fixture_root/external-result.json" 2> "$fixture_root/external-stderr.txt"
node --input-type=module - "$fixture_root/external-result.json" <<'JS'
import { readFileSync } from 'node:fs';
const { graph } = JSON.parse(readFileSync(process.argv[2], 'utf8')).normalized_result;
console.log(JSON.stringify(graph.coverage));
for (const node of graph.nodes) {
  for (const observation of node.observations) {
    if (observation.label === 'maps/app.js.map parse scope') {
      console.log(JSON.stringify({ kind: node.kind, properties: observation.properties, state: observation.evidence.state, limitations: observation.evidence.limitations }));
    }
  }
}
JS

Expected behavior

The unavailable scope should explain that an external source-map section cannot be recovered, rather than asserting a version mismatch. External fetching is not required.

The direct contract is AGENTS.md:31 (preserve meaningful failure reasons). docs/javascript-artifact-reconstruction.md:343-352 requires explicit unavailable map scopes, which this result already preserves. docs/web-source-location.md:62-70 corroborates the external-section distinction for tracing; it is not asserted as an identical decoder contract for application analysis.

Impact and scope

Misleading diagnostic wording for the tested external-section map, reproduced in the initial application-analysis run and the exact block above. Coverage stays partial and the map stays unavailable; no false recovered-source identity or security boundary crossing was observed. Inspecting the local map reveals its external URL, and the independently tested trace CLI provides an actionable diagnostic. Other indexed-map shapes and platforms were not established by this reproduction.

REA version

rea-agents 6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8.

Runtime and platform

Node.js v26.12.0. OS and architecture: NOT_ENOUGH_INFO — the independent verifier's execution notes do not record them. No browser or native analysis provider was used.

Target and artifact context

Locally authored inert JavaScript application and indexed JSON source map; the section URL is fixture data. No live service or external fetch is needed.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

The executed inspection printed coverage:

{"status":"partial","truncated":false,"omitted_count":null,"limits":[]}

The unknown node's maps/app.js.map parse scope observation had unavailable evidence, with properties.limitation and evidence.limitations containing Source map is not a version 3 map. It had no external-section explanation.

Observed control: replacing the external section with an embedded map containing version: 3, sources: ["original.ts"], sourcesContent: ["export const value = 1;"], names: [], and mappings: "AAAA" produced complete coverage, no unavailable map scope, and an original.ts source-module declaration.

The verifier also ran trace-web-source-location with matching script bytes and a fixture manifest: the external case returned capability_unavailable, reason unsupported_source_map_profile, and External source-map section URL is not fetched: https://app.test/maps/part.map; its embedded control succeeded.

Typed outcome or recovery expected

Retain the unavailable scope and partial coverage while the external content is unavailable, with a reason identifying the unsupported external section. Preserve successful recovery for embedded-section maps.

Analysis or suspected cause

Source-derived reasoning at the tested revision: src/domain/sourceMapEnvelope.ts:30-47 accepts the root version but returns undefined because the external section has no embedded object map. src/application/javascript/JavaScriptArtifactAnalysis.ts:575-589 maps that result to the version diagnostic, and src/application/javascript/JavaScriptArtifactGraphStructure.ts:284-291 projects it into the unavailable scope.

The upstream diff through 052956af3416fa01d93837e54fdec3ad2739f6d1 leaves this envelope walk, source-map parser, and unavailable-map projection unchanged; the later changes in these modules concern package entrypoints and application ownership.

Additional context

NOT_ENOUGH_INFO — no last-known-good version or first-bad revision was established. This report concerns the diagnostic only; external URL fetching and recovery of mixed embedded/external siblings are outside its verified scope.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5466 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `analyze-javascript-application` reports `Source map is not a version 3 map.` for an indexed source map with `version: 3` and an external section URL. The CLI exits 0 and correctly retains partial coverage and an unavailable map scope, but its reason misidentifies the unsupported section as a version mismatch. This report was prepared with AI assistance and independently reproduced through the public CLI. Runtime results below come from that independent verifier; the submission step checked upstream changes and duplicates without rerunning the CLI. ### Reproduction From the source revision below, with dependencies and the built CLI available, the verifier executed this exact block and reproduced the false reason, following an initial reproduction of the same external-section case: ```sh fixture_root=$(mktemp -d) mkdir -p "$fixture_root/app/maps" "$fixture_root/app/renderer" \ "$fixture_root/home" "$fixture_root/config" "$fixture_root/data" \ "$fixture_root/cache" "$fixture_root/state" export HOME="$fixture_root/home" export XDG_CONFIG_HOME="$fixture_root/config" export XDG_DATA_HOME="$fixture_root/data" export XDG_CACHE_HOME="$fixture_root/cache" export XDG_STATE_HOME="$fixture_root/state" printf '%s\n' '{"name":"source-map-fixture","version":"1.0.0","main":"main.js"}' > "$fixture_root/app/package.json" printf '%s\n' 'export const main = 1;' > "$fixture_root/app/main.js" printf '%s\n' 'export const value = 1;' '//# sourceMappingURL=../maps/app.js.map' > "$fixture_root/app/renderer/app.js" printf '%s\n' '{"version":3,"sections":[{"offset":{"line":0,"column":0},"url":"https://app.test/maps/part.map"}]}' > "$fixture_root/app/maps/app.js.map" node scripts/rea.mjs analyze-javascript-application "$fixture_root/app" --format json > "$fixture_root/external-result.json" 2> "$fixture_root/external-stderr.txt" node --input-type=module - "$fixture_root/external-result.json" <<'JS' import { readFileSync } from 'node:fs'; const { graph } = JSON.parse(readFileSync(process.argv[2], 'utf8')).normalized_result; console.log(JSON.stringify(graph.coverage)); for (const node of graph.nodes) { for (const observation of node.observations) { if (observation.label === 'maps/app.js.map parse scope') { console.log(JSON.stringify({ kind: node.kind, properties: observation.properties, state: observation.evidence.state, limitations: observation.evidence.limitations })); } } } JS ``` ### Expected behavior The unavailable scope should explain that an external source-map section cannot be recovered, rather than asserting a version mismatch. External fetching is not required. The direct contract is `AGENTS.md:31` (preserve meaningful failure reasons). `docs/javascript-artifact-reconstruction.md:343-352` requires explicit unavailable map scopes, which this result already preserves. `docs/web-source-location.md:62-70` corroborates the external-section distinction for tracing; it is not asserted as an identical decoder contract for application analysis. ### Impact and scope Misleading diagnostic wording for the tested external-section map, reproduced in the initial application-analysis run and the exact block above. Coverage stays partial and the map stays unavailable; no false recovered-source identity or security boundary crossing was observed. Inspecting the local map reveals its external URL, and the independently tested trace CLI provides an actionable diagnostic. Other indexed-map shapes and platforms were not established by this reproduction. ### REA version `rea-agents` 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. ### Runtime and platform Node.js v26.12.0. OS and architecture: NOT_ENOUGH_INFO — the independent verifier's execution notes do not record them. No browser or native analysis provider was used. ### Target and artifact context Locally authored inert JavaScript application and indexed JSON source map; the section URL is fixture data. No live service or external fetch is needed. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence The executed inspection printed coverage: ```json {"status":"partial","truncated":false,"omitted_count":null,"limits":[]} ``` The unknown node's `maps/app.js.map parse scope` observation had unavailable evidence, with `properties.limitation` and `evidence.limitations` containing `Source map is not a version 3 map.` It had no external-section explanation. Observed control: replacing the external section with an embedded map containing `version: 3`, `sources: ["original.ts"]`, `sourcesContent: ["export const value = 1;"]`, `names: []`, and `mappings: "AAAA"` produced complete coverage, no unavailable map scope, and an `original.ts` source-module declaration. The verifier also ran `trace-web-source-location` with matching script bytes and a fixture manifest: the external case returned `capability_unavailable`, reason `unsupported_source_map_profile`, and `External source-map section URL is not fetched: https://app.test/maps/part.map`; its embedded control succeeded. ### Typed outcome or recovery expected Retain the unavailable scope and partial coverage while the external content is unavailable, with a reason identifying the unsupported external section. Preserve successful recovery for embedded-section maps. ### Analysis or suspected cause Source-derived reasoning at the tested revision: `src/domain/sourceMapEnvelope.ts:30-47` accepts the root version but returns undefined because the external section has no embedded object `map`. `src/application/javascript/JavaScriptArtifactAnalysis.ts:575-589` maps that result to the version diagnostic, and `src/application/javascript/JavaScriptArtifactGraphStructure.ts:284-291` projects it into the unavailable scope. The upstream diff through `052956af3416fa01d93837e54fdec3ad2739f6d1` leaves this envelope walk, source-map parser, and unavailable-map projection unchanged; the later changes in these modules concern package entrypoints and application ownership. ### Additional context NOT_ENOUGH_INFO — no last-known-good version or first-bad revision was established. This report concerns the diagnostic only; external URL fetching and recovery of mixed embedded/external siblings are outside its verified scope.

bsakaguchi closed this issue

2026-10-31 00:39:11 +00:00

bsakaguchi commented

2026-10-31 00:39:12 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 20, 2026):

TL;DR: This looks fixed on main. An external source-map section now gets its own reason, not a version mismatch. Closing is the maintainers' call.

I checked main 1629266e3 (Linux, Node 24.18.0). The fixes are 498a66723 and 2b2e362a0.

I used the fixture from the issue. It has an indexed map with version: 3 and one external section URL. analyze-javascript-application exits 0. Coverage is still partial. The map scope is still unavailable. The reason now says the external section URL is not fetched. The section path and URL are listed. The text "not a version 3" does not appear anywhere in the result.

Not run

Malformed, nested, or mixed sections.
A source map from a real bundler.
MCP and the published package.

Thanks, coygeek, for the clear report.

Commands

rea analyze-javascript-application app --format json

Exit 0. Scope node: {"label":"maps/app.js.map parse scope","kind":"unknown","properties":{"external_sections":[{"section_path":[0],"url":"https://app.test/maps/part.map"}],"operation":"parse-local-source-map","limitation":"External source-map section URL is not fetched: https://app.test/maps/part.map"},"state":"unavailable"}

Test setup

Box: Nobara 44 (Fedora 44 base), Linux 7.2.11
CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
RAM: 32 GB DDR4-3600
Node: 24.18.0
Head: 1629266e3

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 20, 2026): **TL;DR:** This looks fixed on main. An external source-map section now gets its own reason, not a version mismatch. Closing is the maintainers' call. I checked main 1629266e3 (Linux, Node 24.18.0). The fixes are 498a66723 and 2b2e362a0. I used the fixture from the issue. It has an indexed map with `version: 3` and one external section URL. `analyze-javascript-application` exits 0. Coverage is still partial. The map scope is still unavailable. The reason now says the external section URL is not fetched. The section path and URL are listed. The text "not a version 3" does not appear anywhere in the result. ### Not run - Malformed, nested, or mixed sections. - A source map from a real bundler. - MCP and the published package. Thanks, coygeek, for the clear report. <details> <summary>Commands</summary> ```sh rea analyze-javascript-application app --format json ``` Exit 0. Scope node: `{"label":"maps/app.js.map parse scope","kind":"unknown","properties":{"external_sections":[{"section_path":[0],"url":"https://app.test/maps/part.map"}],"operation":"parse-local-source-map","limitation":"External source-map section URL is not fetched: https://app.test/maps/part.map"},"state":"unavailable"}` </details> <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.11 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 24.18.0 - Head: 1629266e3 </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-31 00:39:13 +00:00

Author

Owner

@morluto commented on GitHub (Oct 21, 2026):

Closing as fixed on main by github.com/morluto/rea@498a667234, retained at 67a6477f01.

Indexed source-map section interpretation now distinguishes external URL sections from version mismatches and retains their section paths with partial coverage. The landed producer and application mapping regressions preserve valid sibling declarations and the meaningful unavailable reason. Related structural fix 2b2e362a0 is also on main.

This closure follows current-main producer and regression source inspection and the existing issue evidence. Tests and runtime reproductions were not rerun in this audit; no additional platform/provider coverage is implied.

@morluto commented on GitHub (Oct 21, 2026): Closing as fixed on main by https://github.com/morluto/rea/commit/498a667234b0140c1cfa43c819b35454ab11d14e, retained at 67a6477f011ae358fc333e5a6e26c86d932654ed. Indexed source-map section interpretation now distinguishes external URL sections from version mismatches and retains their section paths with partial coverage. The landed producer and application mapping regressions preserve valid sibling declarations and the meaningful unavailable reason. Related structural fix 2b2e362a0 is also on main. This closure follows current-main producer and regression source inspection and the existing issue evidence. Tests and runtime reproductions were not rerun in this audit; no additional platform/provider coverage is implied.

bsakaguchi referenced this issue

2026-10-31 01:10:44 +00:00

[PR #3902] [MERGED] fix(mcp): declare Frida status session mutation #5960

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3326

No description provided.

Rows
Columns