morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5469] [Bug] JavaScript application analysis reports complete coverage for source maps missing mappings #3327

New issue

Closed

opened 2026-10-31 00:39:11 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:39:11 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5469

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

analyze-javascript-application reports complete graph coverage and no unknown scope for a referenced local version-3 source map that omits mappings, even with names: [] present. It returns one original-source declaration and no limitation identifying the malformed map.

This report was prepared with AI assistance and independently reproduced through the supported CLI. Runtime results below come from that independent verifier. The submission step inspected upstream changes and existing reports; it did not rerun the CLI.

Reproduction

From the built source checkout identified below, the verifier executed this exact fixture check. It creates isolated CLI state and removes the disposable fixture after both cases:

python3 - <<'PY'
import json
import os
from pathlib import Path
import subprocess
import tempfile

cli = (Path.cwd() / 'scripts/rea.mjs').resolve()
with tempfile.TemporaryDirectory(prefix='rea-map-check-') as work:
    root = Path(work)
    app = root / 'app'
    (app / 'renderer').mkdir(parents=True)
    (app / 'maps').mkdir()
    (app / 'package.json').write_text(json.dumps({
        'name': 'map-fixture', 'version': '1.0.0', 'main': 'renderer/app.js'
    }))
    (app / 'renderer/app.js').write_text(
        'const marker = 1;\n//# sourceMappingURL=../maps/app.js.map\n'
    )
    env = {'PATH': os.environ['PATH'], 'REA_LOG_LEVEL': 'silent'}
    for key in ['HOME', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME',
                'XDG_CACHE_HOME', 'XDG_STATE_HOME', 'TMPDIR']:
        directory = root / key.lower()
        directory.mkdir()
        env[key] = str(directory)
    source_map = {
        'version': 3, 'sources': ['../renderer/app.js'],
        'sourcesContent': ['const marker = 1;\n'], 'names': []
    }
    for label, fields in [('missing mappings', {}),
                          ('valid control', {'mappings': 'AAAA'})]:
        (app / 'maps/app.js.map').write_text(json.dumps({**source_map, **fields}))
        response = subprocess.run(
            ['node', str(cli), 'analyze-javascript-application',
             str(app), '--format', 'json'],
            cwd=root, env=env, capture_output=True, text=True, timeout=60
        )
        response.check_returncode()
        graph = json.loads(response.stdout)['normalized_result']['graph']
        originals = [node for node in graph['nodes']
                     if node['identity']['strategy'] == 'source-map-original']
        unknowns = [node for node in graph['nodes'] if node['kind'] == 'unknown']
        print(label, json.dumps({
            'coverage': graph['coverage'], 'unknown_count': len(unknowns),
            'original_count': len(originals)
        }))
PY

Both cases exited 0 and printed complete coverage, zero unknown nodes, and one original-source declaration. The missing-mappings result is the defect; the valid control is expected.

Expected behavior

The map without mappings should produce an unknown graph scope with state: unavailable identifying the malformed source map, with partial graph coverage. Any retained source declarations should preserve the distinction between readable names/content and map validity. The valid control should retain its original-source declaration and complete coverage for this otherwise complete fixture.

docs/javascript-artifact-reconstruction.md:343-353 explicitly promises an unknown/unavailable scope for malformed source maps. As corroborating source evidence, src/javascript/sourceMaps/SourceMapFormat.ts:6-15 requires a string mappings member for the paired tracing consumer. This expectation does not require application reconstruction to decode generated positions.

Impact and scope

Bounded false completeness for malformed local source maps: callers receive no documented uncertainty about the absent required mapping table. The verifier reproduced the initial case, the names-present case, and the exact two-case script above. No data loss, target execution, security boundary crossing, or downstream comparison/tracing corruption was demonstrated. Other malformed field types and platforms were not established by this reproduction.

Verified workaround for this fixture: add --source-path package.json --source-path renderer/app.js to the application-analysis command. The map remains inventoried but outside the selected scope, with an unknown/unavailable observation and partial coverage. Callers must first identify the problematic map and accept excluding its declarations.

REA version

rea-agents 6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8.

Runtime and platform

Node.js v26.12.0; Darwin arm64. No native analysis provider was needed.

Target and artifact context

Locally authored inert JavaScript application with package.json, renderer/app.js, and a referenced JSON source map containing readable source names and embedded content. No network or provider installation is needed.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Both the missing-mappings and valid-control cases printed:

{"coverage":{"status":"complete","truncated":false,"omitted_count":0,"limits":[]},"unknown_count":0,"original_count":1}

The malformed case retained a source-module with identity strategy source-map-original and stability source-map-exact, without a malformed-map limitation. This identifies an exact declaration; it does not establish an independently validated generated-to-original mapping.

Independent controls actually run by the verifier:

Setting sources: 42 with names: [] and mappings: "AAAA" yielded partial coverage, an unavailable source-map parse scope, and zero original declarations. Existing malformed-map recovery is reachable.
trace-web-source-location, using a local synthetic export manifest and retained script bytes, rejected the same missing-mappings map with exit 1, code: invalid_request, an issue at source_map.path, and reason: invalid_format requiring a string mappings field. Its valid-map control exited 0 and returned the original position. No URL was fetched.

Typed outcome or recovery expected

An explicit unknown/unavailable malformed-map scope and partial coverage. Preserve successful declaration recovery for the valid control; readable declarations need not all be discarded if their authority and limitations remain explicit.

Analysis or suspected cause

Source-derived reasoning at the tested revision: src/application/javascript/JavaScriptArtifactAnalysis.ts:575-645 accepts version-3 leaves and validates source declarations without checking mappings. src/domain/sourceMapEnvelope.ts:24-47 intentionally leaves leaf-content validity to callers. src/application/javascript/JavaScriptArtifactGraphStructure.ts:284-291 creates the unavailable map scope only for invalid status, and src/application/javascript/JavaScriptArtifactGraphBuilder.ts:166-225 uses that status for incomplete coverage.

The upstream diff through 052956af3416fa01d93837e54fdec3ad2739f6d1 leaves this source-map parser, envelope handling, and malformed-map projection unchanged. The later changes in these modules concern package entrypoints and application ownership.

Additional context

NOT_ENOUGH_INFO — no last-known-good version or first-bad revision was established. Numeric mappings and indexed-section-offset variants were not independently replayed and are outside this report's verified scope.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5469 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `analyze-javascript-application` reports complete graph coverage and no unknown scope for a referenced local version-3 source map that omits `mappings`, even with `names: []` present. It returns one original-source declaration and no limitation identifying the malformed map. This report was prepared with AI assistance and independently reproduced through the supported CLI. Runtime results below come from that independent verifier. The submission step inspected upstream changes and existing reports; it did not rerun the CLI. ### Reproduction From the built source checkout identified below, the verifier executed this exact fixture check. It creates isolated CLI state and removes the disposable fixture after both cases: ```sh python3 - <<'PY' import json import os from pathlib import Path import subprocess import tempfile cli = (Path.cwd() / 'scripts/rea.mjs').resolve() with tempfile.TemporaryDirectory(prefix='rea-map-check-') as work: root = Path(work) app = root / 'app' (app / 'renderer').mkdir(parents=True) (app / 'maps').mkdir() (app / 'package.json').write_text(json.dumps({ 'name': 'map-fixture', 'version': '1.0.0', 'main': 'renderer/app.js' })) (app / 'renderer/app.js').write_text( 'const marker = 1;\n//# sourceMappingURL=../maps/app.js.map\n' ) env = {'PATH': os.environ['PATH'], 'REA_LOG_LEVEL': 'silent'} for key in ['HOME', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME', 'XDG_STATE_HOME', 'TMPDIR']: directory = root / key.lower() directory.mkdir() env[key] = str(directory) source_map = { 'version': 3, 'sources': ['../renderer/app.js'], 'sourcesContent': ['const marker = 1;\n'], 'names': [] } for label, fields in [('missing mappings', {}), ('valid control', {'mappings': 'AAAA'})]: (app / 'maps/app.js.map').write_text(json.dumps({**source_map, **fields})) response = subprocess.run( ['node', str(cli), 'analyze-javascript-application', str(app), '--format', 'json'], cwd=root, env=env, capture_output=True, text=True, timeout=60 ) response.check_returncode() graph = json.loads(response.stdout)['normalized_result']['graph'] originals = [node for node in graph['nodes'] if node['identity']['strategy'] == 'source-map-original'] unknowns = [node for node in graph['nodes'] if node['kind'] == 'unknown'] print(label, json.dumps({ 'coverage': graph['coverage'], 'unknown_count': len(unknowns), 'original_count': len(originals) })) PY ``` Both cases exited 0 and printed complete coverage, zero unknown nodes, and one original-source declaration. The missing-`mappings` result is the defect; the valid control is expected. ### Expected behavior The map without `mappings` should produce an `unknown` graph scope with `state: unavailable` identifying the malformed source map, with partial graph coverage. Any retained source declarations should preserve the distinction between readable names/content and map validity. The valid control should retain its original-source declaration and complete coverage for this otherwise complete fixture. `docs/javascript-artifact-reconstruction.md:343-353` explicitly promises an unknown/unavailable scope for malformed source maps. As corroborating source evidence, `src/javascript/sourceMaps/SourceMapFormat.ts:6-15` requires a string `mappings` member for the paired tracing consumer. This expectation does not require application reconstruction to decode generated positions. ### Impact and scope Bounded false completeness for malformed local source maps: callers receive no documented uncertainty about the absent required mapping table. The verifier reproduced the initial case, the names-present case, and the exact two-case script above. No data loss, target execution, security boundary crossing, or downstream comparison/tracing corruption was demonstrated. Other malformed field types and platforms were not established by this reproduction. Verified workaround for this fixture: add `--source-path package.json --source-path renderer/app.js` to the application-analysis command. The map remains inventoried but outside the selected scope, with an unknown/unavailable observation and partial coverage. Callers must first identify the problematic map and accept excluding its declarations. ### REA version `rea-agents` 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. ### Runtime and platform Node.js v26.12.0; Darwin arm64. No native analysis provider was needed. ### Target and artifact context Locally authored inert JavaScript application with `package.json`, `renderer/app.js`, and a referenced JSON source map containing readable source names and embedded content. No network or provider installation is needed. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence Both the missing-`mappings` and valid-control cases printed: ```json {"coverage":{"status":"complete","truncated":false,"omitted_count":0,"limits":[]},"unknown_count":0,"original_count":1} ``` The malformed case retained a `source-module` with identity strategy `source-map-original` and stability `source-map-exact`, without a malformed-map limitation. This identifies an exact declaration; it does not establish an independently validated generated-to-original mapping. Independent controls actually run by the verifier: - Setting `sources: 42` with `names: []` and `mappings: "AAAA"` yielded partial coverage, an unavailable source-map parse scope, and zero original declarations. Existing malformed-map recovery is reachable. - `trace-web-source-location`, using a local synthetic export manifest and retained script bytes, rejected the same missing-`mappings` map with exit 1, `code: invalid_request`, an issue at `source_map.path`, and `reason: invalid_format` requiring a string `mappings` field. Its valid-map control exited 0 and returned the original position. No URL was fetched. ### Typed outcome or recovery expected An explicit unknown/unavailable malformed-map scope and partial coverage. Preserve successful declaration recovery for the valid control; readable declarations need not all be discarded if their authority and limitations remain explicit. ### Analysis or suspected cause Source-derived reasoning at the tested revision: `src/application/javascript/JavaScriptArtifactAnalysis.ts:575-645` accepts version-3 leaves and validates source declarations without checking `mappings`. `src/domain/sourceMapEnvelope.ts:24-47` intentionally leaves leaf-content validity to callers. `src/application/javascript/JavaScriptArtifactGraphStructure.ts:284-291` creates the unavailable map scope only for invalid status, and `src/application/javascript/JavaScriptArtifactGraphBuilder.ts:166-225` uses that status for incomplete coverage. The upstream diff through `052956af3416fa01d93837e54fdec3ad2739f6d1` leaves this source-map parser, envelope handling, and malformed-map projection unchanged. The later changes in these modules concern package entrypoints and application ownership. ### Additional context NOT_ENOUGH_INFO — no last-known-good version or first-bad revision was established. Numeric `mappings` and indexed-section-offset variants were not independently replayed and are outside this report's verified scope.

bsakaguchi closed this issue

2026-10-31 00:39:11 +00:00

bsakaguchi commented

2026-10-31 00:39:12 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 20, 2026):

Cross-referencing with sibling source-map parser report #5466 ([Bug] JavaScript application analysis misreports external source-map sections as version mismatches). Both reports isolate defects in source-map resolution within analyze_javascript_application (missing mappings fields reporting false complete coverage vs external section URLs classified as version mismatches).

Consolidated under Cluster AI (JavaScript Application Source Map Handling & Coverage Anomalies) in tracker #4330.

@matbrgz commented on GitHub (Oct 20, 2026): Cross-referencing with sibling source-map parser report #5466 (`[Bug] JavaScript application analysis misreports external source-map sections as version mismatches`). Both reports isolate defects in source-map resolution within `analyze_javascript_application` (missing `mappings` fields reporting false complete coverage vs external section URLs classified as version mismatches). Consolidated under **Cluster AI (JavaScript Application Source Map Handling & Coverage Anomalies)** in tracker #4330.

bsakaguchi commented

2026-10-31 00:39:13 +00:00

Author

Owner

@morluto commented on GitHub (Oct 21, 2026):

Closing as fixed on main by github.com/morluto/rea@a4dbb36d8e, retained at 67a6477f01.

Regular source maps now require a mappings string; missing mappings preserves source declarations while marking mapping scope unknown and coverage partial. The exact regression covers names: [] with mappings omitted and valid empty/populated mapping controls.

This closure follows current-main producer and regression source inspection and the existing issue evidence. Tests and runtime reproductions were not rerun in this audit; no additional platform/provider coverage is implied.

@morluto commented on GitHub (Oct 21, 2026): Closing as fixed on main by https://github.com/morluto/rea/commit/a4dbb36d8ea83e9f94dd289ac1a2d220d2c72c9b, retained at 67a6477f011ae358fc333e5a6e26c86d932654ed. Regular source maps now require a mappings string; missing mappings preserves source declarations while marking mapping scope unknown and coverage partial. The exact regression covers names: [] with mappings omitted and valid empty/populated mapping controls. This closure follows current-main producer and regression source inspection and the existing issue evidence. Tests and runtime reproductions were not rerun in this audit; no additional platform/provider coverage is implied.

bsakaguchi referenced this issue

2026-10-31 01:11:34 +00:00

[PR #4112] [MERGED] fix(ghidra): use resolved type addresses for NativeAOT metadata #6062

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3327

No description provided.

Rows
Columns