morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5648] [Bug] Backward JavaScript provenance loses a property passed directly as a call argument #3422

New issue

Closed

opened 2026-10-31 00:40:12 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:40:12 +00:00

Owner

Originally created by @cursor[bot] on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5648

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Backward provenance from a binding assigned the result of a local call loses the known string "products" when the call argument is the property read settings.index itself. The same literal is retained when the argument is a local binding that was assigned from that property. Parentheses around the argument do not recover it. Analysis of the synthetic module succeeds; the loss is in the semantic trace.

This was reproduced through buildJavaScriptSemanticGraph and queryJavaScriptSemanticGraph, the projection and query used by analyze-javascript-application and trace-javascript-semantics. The public CLI was not replayed for this sibling.

Reproduction

From the source checkout, the semantic graph for this module was built and queried with direction: "backward-provenance" from each result binding, with include_ambiguous_dynamic_edges false and true:

const settings = { index: "products" };
function take(value) { return value; }
const kept = settings.index;
const e = take(settings.index);
const g = take((settings.index));
const local = take(kept);

Expected behavior

Backward provenance from e and g should retain "products" through the resolved property read, as local and a direct assignment do. docs/javascript-application-workflows.md documents static property reads and argument/return flow for this query. An equivalent resolved connection is sufficient.

Impact and scope

Bounded loss of a known argument value in the supported semantic trace. The same gap as #5585, which covers a directly returned property; this report is the call-argument consumer of that projection. No target execution or security boundary is involved. Other argument shapes were not established beyond the parenthesized member.

REA version

6.7.0; source commit b3aadaf474e59b33e5ff465236008a67eccefb87.

Runtime and platform

Node.js v22.23.3; Linux x86_64. No native analysis provider was used.

Target and artifact context

Synthetic one-file JavaScript module. Static semantic graph only.

Interface

Other

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Graph query from the result bindings, candidates disabled and enabled:

binding  candidates  products
 e       false       false
 e       true        false
 g       false       false
 g       true        false

The direct assignment kept and take(kept) retain the literal. The argument graph aliases the receiver identifier settings and does not connect the property-read occurrence to the argument node. The property slot still has a resolved read and the literal "products".

Typed outcome or recovery expected

The e and g queries should reach "products" with candidates disabled and enabled. Preserve candidate uncertainty that is not this value edge.

Analysis or suspected cause

Source-derived, confirmed by the graph query above. projectCalls in src/application/javascript/JavaScriptSemanticGraphBuilder.ts aliases identifier references inside an argument range. A member expression's value is owned by the object-read occurrence in JavaScriptSemanticGraphObjectProjection.ts, so the argument never receives that occurrence. The same missing connection drops a directly returned member in #5585.

Additional context

Related #5585. NOT_ENOUGH_INFO: no last-known-good version was established. MCP and the public CLI were not executed for this sibling.

Originally created by @cursor[bot] on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5648 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior Backward provenance from a binding assigned the result of a local call loses the known string `"products"` when the call argument is the property read `settings.index` itself. The same literal is retained when the argument is a local binding that was assigned from that property. Parentheses around the argument do not recover it. Analysis of the synthetic module succeeds; the loss is in the semantic trace. This was reproduced through `buildJavaScriptSemanticGraph` and `queryJavaScriptSemanticGraph`, the projection and query used by `analyze-javascript-application` and `trace-javascript-semantics`. The public CLI was not replayed for this sibling. ### Reproduction From the source checkout, the semantic graph for this module was built and queried with `direction: "backward-provenance"` from each result binding, with `include_ambiguous_dynamic_edges` false and true: ```js const settings = { index: "products" }; function take(value) { return value; } const kept = settings.index; const e = take(settings.index); const g = take((settings.index)); const local = take(kept); ``` ### Expected behavior Backward provenance from `e` and `g` should retain `"products"` through the resolved property read, as `local` and a direct assignment do. `docs/javascript-application-workflows.md` documents static property reads and argument/return flow for this query. An equivalent resolved connection is sufficient. ### Impact and scope Bounded loss of a known argument value in the supported semantic trace. The same gap as #5585, which covers a directly returned property; this report is the call-argument consumer of that projection. No target execution or security boundary is involved. Other argument shapes were not established beyond the parenthesized member. ### REA version 6.7.0; source commit `b3aadaf474e59b33e5ff465236008a67eccefb87`. ### Runtime and platform Node.js v22.23.3; Linux x86_64. No native analysis provider was used. ### Target and artifact context Synthetic one-file JavaScript module. Static semantic graph only. ### Interface Other ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence Graph query from the result bindings, candidates disabled and enabled: ```text binding candidates products e false false e true false g false false g true false ``` The direct assignment `kept` and `take(kept)` retain the literal. The argument graph aliases the receiver identifier `settings` and does not connect the property-read occurrence to the argument node. The property slot still has a resolved read and the literal `"products"`. ### Typed outcome or recovery expected The `e` and `g` queries should reach `"products"` with candidates disabled and enabled. Preserve candidate uncertainty that is not this value edge. ### Analysis or suspected cause Source-derived, confirmed by the graph query above. `projectCalls` in `src/application/javascript/JavaScriptSemanticGraphBuilder.ts` aliases identifier references inside an argument range. A member expression's value is owned by the object-read occurrence in `JavaScriptSemanticGraphObjectProjection.ts`, so the argument never receives that occurrence. The same missing connection drops a directly returned member in #5585. ### Additional context Related #5585. NOT_ENOUGH_INFO: no last-known-good version was established. MCP and the public CLI were not executed for this sibling.

bsakaguchi closed this issue

2026-10-31 00:40:12 +00:00

bsakaguchi commented

2026-10-31 00:40:13 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 20, 2026):

Cross-referencing with canonical issue #5585 ([Bug] Backward JavaScript provenance loses the value of a directly returned property). Both address property value loss in backward JavaScript provenance across call argument and return site boundaries. Addressed in maintainer PR #5651. Cataloged under Cluster BT in consolidation tracker #4330.

@matbrgz commented on GitHub (Oct 20, 2026): Cross-referencing with canonical issue #5585 (`[Bug] Backward JavaScript provenance loses the value of a directly returned property`). Both address property value loss in backward JavaScript provenance across call argument and return site boundaries. Addressed in maintainer PR #5651. Cataloged under Cluster BT in consolidation tracker #4330.

bsakaguchi commented

2026-10-31 00:40:13 +00:00

Author

Owner

@morluto commented on GitHub (Oct 21, 2026):

Closing as fixed on main by github.com/morluto/rea@53e0943223, retained at 67a6477f01.

Semantic flow projection now indexes object-read occurrences and connects member reads passed directly as call arguments. The graph-builder regression covers direct and parenthesized passed properties reaching products with candidate edges disabled/enabled, retaining the unresolved concatenation control.

This audit inspected the current producer, regression source, issue discussion and main ancestry. Tests/runtime reproductions were not rerun, and no additional real-provider or platform coverage is implied.

@morluto commented on GitHub (Oct 21, 2026): Closing as fixed on main by https://github.com/morluto/rea/commit/53e0943223b016c5e1782aa76f3ec2297dc4313b, retained at 67a6477f011ae358fc333e5a6e26c86d932654ed. Semantic flow projection now indexes object-read occurrences and connects member reads passed directly as call arguments. The graph-builder regression covers direct and parenthesized passed properties reaching products with candidate edges disabled/enabled, retaining the unresolved concatenation control. This audit inspected the current producer, regression source, issue discussion and main ancestry. Tests/runtime reproductions were not rerun, and no additional real-provider or platform coverage is implied.

bsakaguchi referenced this issue

2026-10-31 00:50:59 +00:00

[GH-ISSUE #7660] [Bug] Website Hopper setup guidance omits the Linux x86_64 host requirement #4583

bsakaguchi referenced this issue

2026-10-31 01:09:01 +00:00

[PR #3422] [MERGED] fix(hopper): keep automated Linux setup off non-x86_64 hosts #5734

bsakaguchi referenced this issue

2026-10-31 01:13:40 +00:00

[PR #4642] [MERGED] fix(setup): offer Hopper installation only where setup can install it #6336

bsakaguchi referenced this issue

2026-11-01 21:46:19 +00:00

[PR #6253] [MERGED] fix(doctor): check only the current platform's Hopper launcher candidates #7228