[GH-ISSUE #6359] [Bug] Static analysis reports fetch(new Request("/literal")) as a partial endpoint instead of the literal URL #3828

New issue

Closed

opened 2026-10-31 00:44:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:44:26 +00:00

Owner

Originally created by @xpeng5278-web on GitHub (Oct 22, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6359

Summary

When a page calls fetch with an inline built-in Request whose URL is a string literal, JavaScript static analysis does not record the URL. It records the whole constructor expression as a partial endpoint instead.

Reproduction (current `main`)

import { analyzeJavaScriptStaticSource } from "./src/domain/javascript/javascriptStaticAnalysis.js";
analyzeJavaScriptStaticSource(`fetch(new Request("/api/chat", { method: "POST" }));`).endpoints;

Actual:

[{ "kind": "network", "value": "new Request(\"/api/chat\", { method: \"POST\" })", "mechanism": "call:fetch", "resolution": "partial" }]

Expected:

[{ "kind": "network", "value": "/api/chat", "mechanism": "call:fetch" }]

fetch("/api/chat", { method: "POST" }) already gives the expected result. The Request form is common in bundled clients, such as AI chat SDKs that build a Request and then pass it to fetch.

Root cause

inspectEndpointCall in src/domain/javascript/javascriptStaticAnalysisCalls.ts only reads a literal from the first argument. Any other target goes to the partial-endpoint path, including new Request(<literal>) with the unmodified global Request, even though the literal is the request URL.

Originally created by @xpeng5278-web on GitHub (Oct 22, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6359 ## Summary When a page calls `fetch` with an inline built-in `Request` whose URL is a string literal, JavaScript static analysis does not record the URL. It records the whole constructor expression as a `partial` endpoint instead. ## Reproduction (current `main`) ```ts import { analyzeJavaScriptStaticSource } from "./src/domain/javascript/javascriptStaticAnalysis.js"; analyzeJavaScriptStaticSource(`fetch(new Request("/api/chat", { method: "POST" }));`).endpoints; ``` Actual: ```json [{ "kind": "network", "value": "new Request(\"/api/chat\", { method: \"POST\" })", "mechanism": "call:fetch", "resolution": "partial" }] ``` Expected: ```json [{ "kind": "network", "value": "/api/chat", "mechanism": "call:fetch" }] ``` `fetch("/api/chat", { method: "POST" })` already gives the expected result. The `Request` form is common in bundled clients, such as AI chat SDKs that build a `Request` and then pass it to `fetch`. ## Root cause `inspectEndpointCall` in `src/domain/javascript/javascriptStaticAnalysisCalls.ts` only reads a literal from the first argument. Any other target goes to the partial-endpoint path, including `new Request(<literal>)` with the unmodified global `Request`, even though the literal is the request URL.

bsakaguchi closed this issue

2026-10-31 00:44:26 +00:00

bsakaguchi referenced this issue

2026-10-31 01:10:31 +00:00

[PR #3828] [CLOSED] fix(native): trace UI actions for all receiver kinds #5930

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425