[GH-ISSUE #6621] [Bug] tRPC procedures disappear when a router is named history #4006

New issue

Closed

opened 2026-10-31 00:46:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:46:00 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6621

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The public analyze-javascript-application CLI records client.orders.list.query() as the network endpoint orders.list but omits client.history.list.query() from the same file. Both calls use the same stable tRPC client binding. The analysis exits 0, reports zero parse failures and complete application-graph coverage, and records the transport URL. The browser permission queries and RTK Query control below correctly produce no procedure endpoints.

Reproduction

From a built REA source checkout, create this inert JavaScript artifact and analyze it. REA does not execute the artifact, so installing tRPC or starting a server is unnecessary.

mkdir -p trpc-router/app
cat > trpc-router/app/main.mjs <<'JS'
import { createTRPCClient, httpBatchLink } from "@trpc/client";
const client = createTRPCClient({
  links: [httpBatchLink({ url: "/api/trpc" })],
});
client.orders.list.query();
client.history.list.query();
navigator.permissions.query({ name: "geolocation" });
window.navigator.permissions.query({ name: "camera" });
client.endpoints.list.useQuery();
JS
node scripts/rea.mjs analyze-javascript-application "$PWD/trpc-router/app" --format json --full-output > trpc-router/analysis.json
node --input-type=module <<'JS'
import { readFileSync } from 'node:fs';
const output = readFileSync('trpc-router/analysis.json', 'utf8');
const result = JSON.parse(output.trim().split('\n').at(-1)).data.normalized_result;
for (const node of result.graph.nodes) {
  if (node.kind !== 'endpoint') continue;
  for (const observation of node.observations) {
    const p = observation.properties;
    if (p.endpoint_kind === 'network') console.log(p.value, p.mechanism);
  }
}
console.log('parse_failures', result.statistics.parse_failures);
console.log('graph_coverage', result.graph.coverage.status);
JS

The final fixture was analyzed once through each of the source-build and published-package launchers; both returned the output below and exited 0. A separate fixture using createTRPCReact() and the equivalent orders.list.useQuery() / history.list.useQuery() pair showed the same router-segment omission in both builds.

Expected behavior

Record both orders.list and history.list with mechanism trpc:procedure:query, alongside the transport URL. The documented rules recognize vanilla queries on stable factory-bound roots and exclude browser-owned roots. The root here is client; history is an ordinary property in its router path. The browser-global exclusion should continue excluding the permission queries without discarding that local client property.

Impact and scope

This produces an incomplete static endpoint inventory for the tested router name, with no endpoint observation identifying the missed procedure. The application graph reports complete coverage; the semantic graph separately reports unknown coverage and generic unresolved-property facts for both the recognized and omitted calls. Those semantic unknowns do not distinguish this omission. This is a bounded analysis defect, not an observed request-execution, data-loss, or security failure. NOT_ENOUGH_INFO: prevalence in real applications and consequences for downstream consumers were not measured.

REA version

Assigned source baseline bcd1f95e688a2ac020a9d13f9c85e0ce321cb6b6, reporting 6.7.0; independently reproduced with the published npm rea-agents@6.7.0 archive. The archive integrity matched registry metadata, and its runtime dependencies matched their exact published version pins in the prepared dependency tree.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1 arm64. CLI state and temporary files were isolated for verification. No browser, native analysis engine, or external application service was started.

Target and artifact context

One self-authored directory artifact containing the inline main.mjs. The file was read as inert source text, without resolving or executing its imports.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Expected source: docs/javascript-artifact-reconstruction.md:285-301 documents static procedure paths, factory-bound vanilla queries, and browser-global root exclusions.
Failure source: src/domain/javascript/javascriptRpcEndpoints.ts:192-202 rejects a first router segment found in BROWSER_GLOBAL_NAMES before evaluating the factory-bound query rule; the public CLI outputs below establish the resulting omission.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

Selected output from both tested builds:

orders.list trpc:procedure:query
/api/trpc trpc:link:httpBatchLink
parse_failures 0
graph_coverage complete

There is no history.list observation. No specific limitation names its exclusion. The equivalent hook fixture returns only orders.list with mechanism trpc:procedure:useQuery.

Typed outcome or recovery expected

Return a network endpoint observation for history.list with the recognized query mechanism. Retain the ordinary browser-global and RTK Query exclusions demonstrated by the same fixture.

Analysis or suspected cause

Source-derived reasoning: the first router segment is tested against a set described as browser-owned roots. This treats the property name history as sufficient to exclude the call even though the root expression is a local tRPC client. The hook and vanilla-query cases reach that same segment guard. No implementation approach is prescribed.

Additional context

The closed RPC recognition change introduced this capability and its false-positive exclusions; it does not report this local router-property omission. This report concerns the router segment under an ordinary client name. Locally declared client variables named after browser globals have a separate closure condition and are excluded from this report.

Restoration check

Analyze the unchanged inline fixture. Its network endpoints must include exactly orders.list and history.list with trpc:procedure:query, plus /api/trpc with trpc:link:httpBatchLink. Neither permission query nor the endpoints control may become a procedure. The equivalent hook pair should likewise retain both router paths. These are proposed passing criteria; no repair was made or tested.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Successful public-CLI runs in both tested builds omit a documented static procedure for a bounded input shape while retaining its sibling and transport URL; no wider analysis failure or security impact was observed.
Workaround status: unverified
Workaround basis: The unchanged source remains readable, but no alternative invocation was demonstrated to produce the missing endpoint observation for those original bytes. Renaming the router in a copied file would change the analyzed artifact and was not established as a substitute for the required result.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6621 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior The public `analyze-javascript-application` CLI records `client.orders.list.query()` as the network endpoint `orders.list` but omits `client.history.list.query()` from the same file. Both calls use the same stable tRPC client binding. The analysis exits 0, reports zero parse failures and complete application-graph coverage, and records the transport URL. The browser permission queries and RTK Query control below correctly produce no procedure endpoints. ## Reproduction From a built REA source checkout, create this inert JavaScript artifact and analyze it. REA does not execute the artifact, so installing tRPC or starting a server is unnecessary. ```sh mkdir -p trpc-router/app cat > trpc-router/app/main.mjs <<'JS' import { createTRPCClient, httpBatchLink } from "@trpc/client"; const client = createTRPCClient({ links: [httpBatchLink({ url: "/api/trpc" })], }); client.orders.list.query(); client.history.list.query(); navigator.permissions.query({ name: "geolocation" }); window.navigator.permissions.query({ name: "camera" }); client.endpoints.list.useQuery(); JS node scripts/rea.mjs analyze-javascript-application "$PWD/trpc-router/app" --format json --full-output > trpc-router/analysis.json node --input-type=module <<'JS' import { readFileSync } from 'node:fs'; const output = readFileSync('trpc-router/analysis.json', 'utf8'); const result = JSON.parse(output.trim().split('\n').at(-1)).data.normalized_result; for (const node of result.graph.nodes) { if (node.kind !== 'endpoint') continue; for (const observation of node.observations) { const p = observation.properties; if (p.endpoint_kind === 'network') console.log(p.value, p.mechanism); } } console.log('parse_failures', result.statistics.parse_failures); console.log('graph_coverage', result.graph.coverage.status); JS ``` The final fixture was analyzed once through each of the source-build and published-package launchers; both returned the output below and exited 0. A separate fixture using `createTRPCReact()` and the equivalent `orders.list.useQuery()` / `history.list.useQuery()` pair showed the same router-segment omission in both builds. ## Expected behavior Record both `orders.list` and `history.list` with mechanism `trpc:procedure:query`, alongside the transport URL. The documented rules recognize vanilla queries on stable factory-bound roots and exclude browser-owned roots. The root here is `client`; `history` is an ordinary property in its router path. The browser-global exclusion should continue excluding the permission queries without discarding that local client property. ## Impact and scope This produces an incomplete static endpoint inventory for the tested router name, with no endpoint observation identifying the missed procedure. The application graph reports complete coverage; the semantic graph separately reports unknown coverage and generic unresolved-property facts for both the recognized and omitted calls. Those semantic unknowns do not distinguish this omission. This is a bounded analysis defect, not an observed request-execution, data-loss, or security failure. NOT_ENOUGH_INFO: prevalence in real applications and consequences for downstream consumers were not measured. ## REA version Assigned source baseline `bcd1f95e688a2ac020a9d13f9c85e0ce321cb6b6`, reporting `6.7.0`; independently reproduced with the published npm `rea-agents@6.7.0` archive. The archive integrity matched registry metadata, and its runtime dependencies matched their exact published version pins in the prepared dependency tree. ## Runtime and platform Node.js v24.22.1; macOS 27.0.1 arm64. CLI state and temporary files were isolated for verification. No browser, native analysis engine, or external application service was started. ## Target and artifact context One self-authored directory artifact containing the inline `main.mjs`. The file was read as inert source text, without resolving or executing its imports. ## Interface CLI ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence - Expected source: `docs/javascript-artifact-reconstruction.md:285-301` documents static procedure paths, factory-bound vanilla queries, and browser-global root exclusions. - Failure source: `src/domain/javascript/javascriptRpcEndpoints.ts:192-202` rejects a first router segment found in `BROWSER_GLOBAL_NAMES` before evaluating the factory-bound query rule; the public CLI outputs below establish the resulting omission. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete Selected output from both tested builds: ```text orders.list trpc:procedure:query /api/trpc trpc:link:httpBatchLink parse_failures 0 graph_coverage complete ``` There is no `history.list` observation. No specific limitation names its exclusion. The equivalent hook fixture returns only `orders.list` with mechanism `trpc:procedure:useQuery`. ## Typed outcome or recovery expected Return a network endpoint observation for `history.list` with the recognized query mechanism. Retain the ordinary browser-global and RTK Query exclusions demonstrated by the same fixture. ## Analysis or suspected cause Source-derived reasoning: the first router segment is tested against a set described as browser-owned roots. This treats the property name `history` as sufficient to exclude the call even though the root expression is a local tRPC client. The hook and vanilla-query cases reach that same segment guard. No implementation approach is prescribed. ## Additional context The closed [RPC recognition change](https://github.com/morluto/rea/pull/1670) introduced this capability and its false-positive exclusions; it does not report this local router-property omission. This report concerns the router segment under an ordinary client name. Locally declared client variables named after browser globals have a separate closure condition and are excluded from this report. ## Restoration check Analyze the unchanged inline fixture. Its network endpoints must include exactly `orders.list` and `history.list` with `trpc:procedure:query`, plus `/api/trpc` with `trpc:link:httpBatchLink`. Neither permission query nor the `endpoints` control may become a procedure. The equivalent hook pair should likewise retain both router paths. These are proposed passing criteria; no repair was made or tested. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Successful public-CLI runs in both tested builds omit a documented static procedure for a bounded input shape while retaining its sibling and transport URL; no wider analysis failure or security impact was observed. - Workaround status: unverified - Workaround basis: The unchanged source remains readable, but no alternative invocation was demonstrated to produce the missing endpoint observation for those original bytes. Renaming the router in a copied file would change the analyzed artifact and was not established as a substitute for the required result.

bsakaguchi closed this issue

2026-10-31 00:46:00 +00:00

bsakaguchi referenced this issue

2026-10-31 01:10:59 +00:00

[PR #4006] [CLOSED] fix(artifacts): report ZIP reads beyond the archive as malformed #5986