morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #6349] [Bug] Any string `path`/`route` object property is reported as an exact route endpoint #3826

New issue

Closed

opened 2026-10-31 00:44:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:44:26 +00:00

Owner

Originally created by @Nikhi00718 on GitHub (Oct 22, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6349

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

analyze_javascript_application reports every object property named path or route with a string value as a route endpoint with confidence: "exact" and operation: "discover-static-endpoint", regardless of what the object is. Ordinary data records therefore become exact routes, while a real Express route registration in the same file is only a low-confidence network candidate.

On the published npm package @agentmemory/agentmemory@0.9.30 this produced 13 exact route endpoints in dist/src-Jsq9LCeH.mjs, all from key-value patch operations such as { type: "set", path: "updatedAt", value: ... } and a git worktree record { path: "", head: "" }. None of them is a route.

Reproduction

Reproduced 1/1 times on each revision below.

Create a directory with package.json ({ "name": "repro", "version": "1.0.0", "main": "main.js" }) and main.js:

// Plain data objects with a `path` key; no routing or network code.
const patch = [{ type: "set", path: "updatedAt", value: 1 }];
const worktree = { path: "", head: "" };
function applyPatch(target, ops) {
  for (const op of ops) target[op.path] = op.value;
  return target;
}
module.exports = { applyPatch, patch, worktree };

// Control: a real route registration.
const express = require("express");
const app = express();
app.get("/real-route", (req, res) => res.send("ok"));

MCP (rea-agents@6.7.0): analyze_javascript_application with { "input_path": "<dir>", "format": "directory", "detail": "summary" }, then inspect_analysis_view with { "kind": "javascript-facts", "where": { "kinds": ["endpoint"] }, "property_keys": ["value"] }.
Source (main at 54f51f0d7dc9c48355928a3d9ec84e6fc13e8e54): a scratch Vitest calling analyzeJavaScriptStaticSource on the same source and printing analysis.endpoints.

Expected behavior

A string path property on an object with no router shape should not be an exact, observed route. At most it should be a low-confidence candidate, the way app.get("/real-route", ...) is reported today (interpretation: "candidate", classify-static-endpoint-candidate). Router-shaped objects (component/element/children/index/_$, as JavaScriptRouteScan.#object already checks) should keep their current result, including the template-literal case from #2805.

This expectation conflicts with an existing test; see "Analysis or suspected cause".

Impact and scope

Evidence integrity: false endpoints are recorded as ast-static-analysis / observed / exact, the strongest level, so callers cannot filter them by confidence.
The route inventory, trace_application_feature route seeds, and any route counts include these entries.
Any bundle that uses JSON Patch-style ops, config records, or file/tree records with a path key is affected. I have only measured the agentmemory bundle and the fixture above; how common this is elsewhere is unknown.

REA version

rea-agents@6.7.0 (MCP, via npx -y rea-agents@6.7.0 mcp); also source main at 54f51f0d7dc9c48355928a3d9ec84e6fc13e8e54

Runtime and platform

Node v24.15.0; Windows 11 x64

Target and artifact context

Directory of plain CommonJS JavaScript; also the npm package @agentmemory/agentmemory@0.9.30 (dist/src-Jsq9LCeH.mjs, an ESM bundle)

Interface

MCP

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

MCP (rea-agents@6.7.0), endpoint rows for main.js:

value	namespace	evidence	location
`updatedAt`	`route`	`discover-static-endpoint`, `observed`, `exact`	`main.js:2:30-2:47`
`""`	`route`	`discover-static-endpoint`, `observed`, `exact`	`main.js:3:19-3:27`
`/real-route`	`network`	`classify-static-endpoint-candidate`, `inferred`, `low`	`main.js:13:0-13:52`

Source (main at 54f51f0), analyzeJavaScriptStaticSource(...).endpoints:

[
 { "kind": "route", "value": "updatedAt", "mechanism": "property:path" },
 { "kind": "route", "value": "", "mechanism": "property:path" },
 { "kind": "network", "value": "/real-route", "mechanism": "call:app.get", "interpretation": "candidate" }
]

Typed outcome or recovery expected

The two data objects should produce no route endpoint, or a route endpoint with interpretation: "candidate" and low-confidence classify-static-endpoint-candidate evidence. No change is expected for the Express control.

Analysis or suspected cause

Source-derived; not tested with a patch.

On main, JavaScriptRouteScan.#property (src/domain/javascript/javascriptRouteScan.ts, about lines 536-542) calls onLegacyRoute for any path or route property with a string value. javascriptStaticAnalysis.ts maps that callback to addEndpoint(..., kind: "route") with no interpretation, so JavaScriptArtifactGraphFindings.ts records it as discover-static-endpoint with exact AST evidence.
In 6.7.0, the same behavior comes from inspectRouteProperty in src/domain/javascript/javascriptStaticAnalysisCalls.ts (about line 748).
On main, JavaScriptRouteScan.#object already checks for router shape before treating an object as a route root (typed || (hasView && (hasPath || hasChildren || hasIndex))). The legacy property callback skips that check.

Conflict with an existing test: src/domain/javascript/javascriptStaticAnalysis.routeProperties.test.ts expects bare { path: "settings" } and { path: "/login" } inside a routes array to be exact routes with interpretation: undefined. Any fix changes that contract, so I'd like a maintainer decision before opening a PR.

Two fix options, both untested proposals:

Demote by shape. Keep emitting property:path / property:route. When the enclosing object has no router shape (the #object criteria), emit it as interpretation: "candidate" with low-confidence evidence, as for unbound method-like routes. Router-shaped objects stay exact, so the #2805 Angular case is unchanged. The routeProperties test would expect interpretation: "candidate" for bare { path } entries, unless the routes array context is treated as router shape.
Drop non-router properties. Emit a route only for properties on router-shaped objects or inside structured route calls. This is simpler and removes the noise, but bare { path: "settings" } entries would disappear, and the routeProperties test would need rewriting.

A third option, skipping objects with data-op siblings such as type/op/value, would cover JSON Patch but is a denylist, and other record shapes would still slip through.

Which contract do you prefer? I can prepare the PR with a regression test once that is settled.

Additional context

Related but different: #2805 (template-literal route paths missed) and #3190 (route tracing matched generated labels). I found no existing report of path data properties being classified as routes.

Originally created by @Nikhi00718 on GitHub (Oct 22, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6349 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `analyze_javascript_application` reports every object property named `path` or `route` with a string value as a `route` endpoint with `confidence: "exact"` and `operation: "discover-static-endpoint"`, regardless of what the object is. Ordinary data records therefore become exact routes, while a real Express route registration in the same file is only a `low`-confidence `network` candidate. On the published npm package `@agentmemory/agentmemory@0.9.30` this produced 13 exact `route` endpoints in `dist/src-Jsq9LCeH.mjs`, all from key-value patch operations such as `{ type: "set", path: "updatedAt", value: ... }` and a git worktree record `{ path: "", head: "" }`. None of them is a route. ### Reproduction Reproduced 1/1 times on each revision below. 1. Create a directory with `package.json` (`{ "name": "repro", "version": "1.0.0", "main": "main.js" }`) and `main.js`: ```js // Plain data objects with a `path` key; no routing or network code. const patch = [{ type: "set", path: "updatedAt", value: 1 }]; const worktree = { path: "", head: "" }; function applyPatch(target, ops) { for (const op of ops) target[op.path] = op.value; return target; } module.exports = { applyPatch, patch, worktree }; // Control: a real route registration. const express = require("express"); const app = express(); app.get("/real-route", (req, res) => res.send("ok")); ``` 2. MCP (`rea-agents@6.7.0`): `analyze_javascript_application` with `{ "input_path": "<dir>", "format": "directory", "detail": "summary" }`, then `inspect_analysis_view` with `{ "kind": "javascript-facts", "where": { "kinds": ["endpoint"] }, "property_keys": ["value"] }`. 3. Source (`main` at `54f51f0d7dc9c48355928a3d9ec84e6fc13e8e54`): a scratch Vitest calling `analyzeJavaScriptStaticSource` on the same source and printing `analysis.endpoints`. ### Expected behavior A string `path` property on an object with no router shape should not be an exact, observed route. At most it should be a low-confidence candidate, the way `app.get("/real-route", ...)` is reported today (`interpretation: "candidate"`, `classify-static-endpoint-candidate`). Router-shaped objects (`component`/`element`/`children`/`index`/`_$`, as `JavaScriptRouteScan.#object` already checks) should keep their current result, including the template-literal case from #2805. This expectation conflicts with an existing test; see "Analysis or suspected cause". ### Impact and scope - Evidence integrity: false endpoints are recorded as `ast-static-analysis` / `observed` / `exact`, the strongest level, so callers cannot filter them by confidence. - The route inventory, `trace_application_feature` route seeds, and any route counts include these entries. - Any bundle that uses JSON Patch-style ops, config records, or file/tree records with a `path` key is affected. I have only measured the agentmemory bundle and the fixture above; how common this is elsewhere is unknown. ### REA version `rea-agents@6.7.0` (MCP, via `npx -y rea-agents@6.7.0 mcp`); also source `main` at `54f51f0d7dc9c48355928a3d9ec84e6fc13e8e54` ### Runtime and platform Node v24.15.0; Windows 11 x64 ### Target and artifact context Directory of plain CommonJS JavaScript; also the npm package `@agentmemory/agentmemory@0.9.30` (`dist/src-Jsq9LCeH.mjs`, an ESM bundle) ### Interface MCP ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence MCP (`rea-agents@6.7.0`), endpoint rows for `main.js`: | value | namespace | evidence | location | | --- | --- | --- | --- | | `updatedAt` | `route` | `discover-static-endpoint`, `observed`, `exact` | `main.js:2:30-2:47` | | `""` | `route` | `discover-static-endpoint`, `observed`, `exact` | `main.js:3:19-3:27` | | `/real-route` | `network` | `classify-static-endpoint-candidate`, `inferred`, `low` | `main.js:13:0-13:52` | Source (`main` at `54f51f0`), `analyzeJavaScriptStaticSource(...).endpoints`: ```json [ { "kind": "route", "value": "updatedAt", "mechanism": "property:path" }, { "kind": "route", "value": "", "mechanism": "property:path" }, { "kind": "network", "value": "/real-route", "mechanism": "call:app.get", "interpretation": "candidate" } ] ``` ### Typed outcome or recovery expected The two data objects should produce no route endpoint, or a `route` endpoint with `interpretation: "candidate"` and low-confidence `classify-static-endpoint-candidate` evidence. No change is expected for the Express control. ### Analysis or suspected cause Source-derived; not tested with a patch. - On `main`, `JavaScriptRouteScan.#property` (`src/domain/javascript/javascriptRouteScan.ts`, about lines 536-542) calls `onLegacyRoute` for any `path` or `route` property with a string value. `javascriptStaticAnalysis.ts` maps that callback to `addEndpoint(..., kind: "route")` with no `interpretation`, so `JavaScriptArtifactGraphFindings.ts` records it as `discover-static-endpoint` with exact AST evidence. - In `6.7.0`, the same behavior comes from `inspectRouteProperty` in `src/domain/javascript/javascriptStaticAnalysisCalls.ts` (about line 748). - On `main`, `JavaScriptRouteScan.#object` already checks for router shape before treating an object as a route root (`typed || (hasView && (hasPath || hasChildren || hasIndex))`). The legacy property callback skips that check. Conflict with an existing test: `src/domain/javascript/javascriptStaticAnalysis.routeProperties.test.ts` expects bare `{ path: "settings" }` and `{ path: "/login" }` inside a `routes` array to be exact routes with `interpretation: undefined`. Any fix changes that contract, so I'd like a maintainer decision before opening a PR. Two fix options, both untested proposals: 1. **Demote by shape.** Keep emitting `property:path` / `property:route`. When the enclosing object has no router shape (the `#object` criteria), emit it as `interpretation: "candidate"` with low-confidence evidence, as for unbound method-like routes. Router-shaped objects stay exact, so the #2805 Angular case is unchanged. The `routeProperties` test would expect `interpretation: "candidate"` for bare `{ path }` entries, unless the `routes` array context is treated as router shape. 2. **Drop non-router properties.** Emit a route only for properties on router-shaped objects or inside structured route calls. This is simpler and removes the noise, but bare `{ path: "settings" }` entries would disappear, and the `routeProperties` test would need rewriting. A third option, skipping objects with data-op siblings such as `type`/`op`/`value`, would cover JSON Patch but is a denylist, and other record shapes would still slip through. Which contract do you prefer? I can prepare the PR with a regression test once that is settled. ### Additional context Related but different: #2805 (template-literal route paths missed) and #3190 (route tracing matched generated labels). I found no existing report of `path` data properties being classified as routes.

bsakaguchi closed this issue

2026-10-31 00:44:26 +00:00

bsakaguchi referenced this issue

2026-10-31 01:10:30 +00:00

[PR #3826] [MERGED] fix(reconstruction): retain semantic unknowns in obligation ledgers #5928

bsakaguchi referenced this issue

2026-11-01 21:46:55 +00:00

[PR #6363] [MERGED] fix(lifecycle): retain Android and Kuna descriptors when close fails #7309