morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7301] [Bug] Excluded source-map declarations become definite script changes or equality #4338

New issue

Closed

opened 2026-10-31 00:49:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:49:01 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 26, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7301

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The offline compare-web-captures CLI reports one script modification when the same declared source-map URL is retained in one capture and omitted by origin scope in the other. The producer receives an identical script event in both cases; only the allowed-origin set differs. The narrower capture correctly records the omitted declaration under source_maps with disallowed_origin, but comparison treats its null URL as an observed different value. Both comparison directions return scripts.status: "changed" and overall_status: "changed". Comparing the excluded capture with itself instead reports scripts.status: "unchanged", despite the unavailable declaration evidence.

These results were observed using production event ingestion and script-inventory generation, schema-valid retained snapshots, and the public CLI. No browser or network was used.

Reproduction

Use the prepared build and locked dependencies of the source revision below. Set REA_ROOT to the checkout. Save the following independently written probe as fixture.mjs outside the checkout. All URLs are inert identities; its connection stub throws if any external operation is attempted.

import assert from 'node:assert/strict';
import {mkdirSync, writeFileSync} from 'node:fs';
import {spawnSync} from 'node:child_process';
import {resolve} from 'node:path';
import {pathToFileURL} from 'node:url';
const root = resolve(process.argv[2]), out = resolve(process.argv[3]);
const load = p => import(pathToFileURL(resolve(root, 'dist', p)).href);
const {CdpCaptureEvents} = await load('browser/CdpCaptureEvents.js');
const {captureScripts} = await load('browser/CdpPageCaptureScripts.js');
const {inspectWebPageInputSchema} = await load('domain/browserObservation.js');
const {captureSnapshotSchema} = await load('domain/webCaptureDiffSchemas.js');
const origin = 'https://app.example.test', cdn = 'https://cdn.example.test';
assert(process.env.CAPTURE_AT, 'Set CAPTURE_AT using date');
const at = new Date(process.env.CAPTURE_AT).toISOString();
mkdirSync(out, {recursive:true});
let calls = 0;
const make = async (declared, origins, hash = 'a'.repeat(64), mapBytesUnavailable = false) => {
  const input = inspectWebPageInputSchema.parse({cdp_endpoint:'http://127.0.0.1:9222', target_id:'fixture', allowed_origins:origins, observation_ms:0, include_script_sources:false});
  const events = new CdpCaptureEvents(input, new Set(input.allowed_origins));
  events.beginAuthorizedFrame('frame');
  events.ingest({method:'Debugger.scriptParsed', params:{scriptId:'script', url:origin+'/app.js', hash, length:10, isModule:false, scriptLanguage:'JavaScript', sourceMapURL:declared}});
  const captured = await captureScripts({context:{input, operation:'inspect_web_page', connection:{send(){calls++; throw Error('Unexpected external operation');}}}, events, rawResources:[], resources:[], frameIds:new Set(['frame'])});
  events.recordScriptMetadataBudgetExclusions();
  if (mapBytesUnavailable) events.completeness.unavailable('source_maps');
  const snapshot = captureSnapshotSchema.parse({inspection:{
    browser:{product:'fixture', protocol_version:'1.3', revision:'fixture', user_agent:'fixture', js_version:'fixture'},
    target:{target_id:'fixture', type:'page', title:'Fixture', url:origin+'/', origin, attached:false},
    capture_window:{started_at:at, ended_at:at, observation_ms:0}, completeness:events.completeness.snapshot(),
    frames:[], dom:{total_nodes:0,nodes:[]}, accessibility:{total_nodes:0,nodes:[],text_capture:{status:'not_approved',retained_bytes:0,excluded_fields:0}},
    scripts:captured.inventory, resources:[], workers:[],
    network:{requests:[],websocket_connections:[],coverage_started_at:at,prior_activity_available:false}, console:{events:[],coverage_started_at:at,prior_activity_available:false},
    metadata:{responses:[],dom_urls:[],agent_hints:[],excluded_dom_urls:0,headers_allowlisted:true},
    storage:{origin,usage_bytes:null,quota_bytes:null,local_storage_keys:[],session_storage_keys:[],indexed_db_names:[],cache_names:[],values_redacted:true}, limitations:['Synthetic empty sections; production script inventory and coverage. No live browser.']
  }});
  return snapshot;
};
const broad = [origin,cdn], narrow = [origin], declared = cdn+'/app.js.map';
const captures = {
  known:await make(declared,broad), excluded:await make(declared,narrow),
  absent:await make('',narrow), different:await make(cdn+'/other.js.map',broad),
  changed:await make(declared,narrow,'b'.repeat(64)),
  bytesUnavailable:await make(declared,broad,'a'.repeat(64),true)
};
for (const [name,capture] of Object.entries(captures)) {
  writeFileSync(resolve(out,name+'.json'),JSON.stringify(capture,null,2)+'\n');
  console.log('producer',name,JSON.stringify({script:capture.inspection.scripts.items[0],completeness:capture.inspection.completeness}));
}
assert.equal(captures.known.inspection.scripts.items[0].source_map_url,declared);
assert.equal(captures.excluded.inspection.scripts.items[0].source_map_url,null);
assert.deepEqual(captures.known.inspection.scripts.items[0].source,captures.excluded.inspection.scripts.items[0].source);
assert(captures.excluded.inspection.completeness.policy_filtered_sections.includes('source_maps'));
assert(!captures.excluded.inspection.completeness.policy_filtered_sections.includes('scripts'));
assert.equal(captures.absent.inspection.scripts.items[0].source_map_url,null);
assert(!captures.absent.inspection.completeness.policy_filtered_sections.includes('source_maps'));
const cases = [['known','excluded'],['excluded','known'],['excluded','excluded'],['known','known'],['absent','absent'],['known','different'],['absent','known'],['excluded','changed'],['known','bytesUnavailable'],['absent','excluded']];
const env = {PATH:process.env.PATH,HOME:resolve(out,'home'),XDG_CONFIG_HOME:resolve(out,'config'),XDG_CACHE_HOME:resolve(out,'cache'),NODE_COMPILE_CACHE:resolve(out,'compile-cache'),REA_LOG_LEVEL:'silent',NO_COLOR:'1'};
mkdirSync(env.HOME,{recursive:true});
for (const [left,right] of cases) {
  const result = spawnSync(process.execPath,[resolve(root,'scripts/rea.mjs'),'compare-web-captures',resolve(out,left+'.json'),resolve(out,right+'.json'),'--json'],{env,encoding:'utf8',timeout:30000});
  writeFileSync(resolve(out,left+'-'+right+'.stdout.json'),result.stdout);
  writeFileSync(resolve(out,left+'-'+right+'.stderr.txt'),result.stderr);
  assert.equal(result.status,0,result.stderr+result.stdout);
  assert.equal(result.stderr,'');
  const diff = JSON.parse(result.stdout).normalized_result;
  console.log('comparison',left,right,JSON.stringify({exit:result.status,overall:diff.overall_status,scripts:diff.dimensions.scripts}));
}
assert.equal(calls,0);
console.log('external-operations',calls);
console.log('runtime',process.version,process.platform,process.arch);

Run in that disposable directory:

WORK="$(mktemp -d)"
CAPTURE_AT="$(TZ=America/Los_Angeles date '+%Y-%m-%dT%H:%M:%S%z')" node fixture.mjs "$REA_ROOT" "$WORK"

The probe runs ten public CLI comparisons, each once, with isolated home/config/cache paths. Every comparison exited 0 with empty stderr, and the external-operation count was zero. It saves each capture and CLI output. The primary invocation is equivalent to:

node "$REA_ROOT/scripts/rea.mjs" compare-web-captures "$WORK/known.json" "$WORK/excluded.json" --json

Inspect normalized_result.dimensions.scripts. The producer-generated known and excluded records share the script URL, hash, length, module flag, language, source availability and declared raw map URL; the latter becomes null only in excluded. Both inventories contain one script with zero dropped scripts. Only their source-map declaration coverage differs, apart from the derived script key.

Expected behavior

An omitted declared URL must not prove either a map-URL change or equality. These omission-only comparisons should keep the necessary declaration fact unknown, with no unsupported script modification. Preserve independently observed script changes. A genuinely empty declaration remains known no-map absence, and two retained declared URLs remain comparable even if map-body bytes are unavailable.

Impact and scope

P2: the CLI emits unsupported definite evidence-comparison results for this bounded capture pair, including a false aggregate change in both directions. The stored inputs retain their correct facts and exclusion ledger. Excluded self-comparison falsely asserts equality only for the script dimension; unrelated incomplete dimensions keep its overall result unknown. Live-page frequency was not measured.

A manual workaround was checked on the saved records: compare the retained common script facts and inspect the exclusion ledger before interpreting null source_map_url. Here the common facts agree and source_maps/disallowed_origin explicitly identifies omitted declaration evidence, so the URL comparison remains unknown. This does not recover the omitted URL. No automatic CLI workaround or live recapture was tested.

REA version

Source revision 0d1a454e25db825567782e461da21530bad4b158, using its prepared compiled runtime.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1 arm64. No browser or native analysis provider was started.

Target and artifact context

Schema-valid synthetic passive capture JSON. Script records, derived keys and completeness ledgers come from production event ingestion and inventory projection; unrelated empty inventories are fixture data. The bytesUnavailable control adds a completeness-ledger marker without fetching a map, to distinguish declaration knownness from byte availability.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

Expected source: docs/browser-observation.md:30 prohibits equivalence from missing evidence; its comparison table at lines 78-90 preserves independently proven changes. src/domain/webCaptureDiff.ts:46-48 defines changed as an observed difference. src/browser/CdpCaptureEventHandlers.ts:187-233 distinguishes empty declarations from excluded declared URLs through the source_maps ledger; src/browser/CdpPageCaptureScripts.ts:148-168 projects the producer's map URL into the retained script.
Failure source: the executed public CLI returns one script modification for known/excluded and its reverse, and unchanged scripts for excluded/excluded and absent/excluded. src/domain/webCaptureDiff.ts:1027-1088 checks script inventory coverage but fingerprints source_map_url unconditionally at line 1062.
Evidence provenance: observed production-parser/inventory output and public CLI results; the explanation of comparison projection is source-derived.
Local verification: reproduced.
Reproduction completeness: complete for the offline retained-capture workflow.

Relevant output, omitting the repeated group identity:

Pair	Script status	Script changes	Overall status
known / excluded	changed	1 modified	changed
excluded / known	changed	1 modified	changed
excluded / excluded	unchanged	0	unknown
absent / excluded	unchanged	0	unknown
known / known	unchanged	0	unknown
absent / absent	unchanged	0	unknown
known / different	changed	1 modified	changed
absent / known	changed	1 modified	changed
excluded / changed	changed	1 modified	changed
known / bytesUnavailable	unchanged	0	unknown

For the failing known/excluded pair, the omitted declaration is explicitly recorded as {"section":"source_maps","reason":"disallowed_origin","count":1}. Every listed script result has reason: null. The changed capture differs independently in its known producer hash while both declared URLs are omitted.

Typed outcome or recovery expected

Restoration check: the same known/excluded pair in either direction must no longer establish a script modification solely from the omitted URL. Excluded self-comparison and absent/excluded comparison must retain the unknown declaration fact instead of asserting complete script equality. Keep known self-comparison and genuine no-map self-comparison unchanged; keep retained different map URLs, known absence versus a retained URL, and differing known hashes changed. A retained URL must not become unknown merely because the map-body evidence is unavailable. These are proposed post-fix checks; no implementation was changed.

Analysis or suspected cause

Source-derived: null encodes both an empty declaration and a declared URL omitted by capture admission. The capture ledger distinguishes these cases, but the script comparison does not consult that evidence when comparing the URL. This report requests preservation of the existing known facts and unknown declaration, without prescribing an implementation or forcing the whole dimension unknown when another fact proves a change.

Additional context

The supplied offline index of 7,131 open/closed issues and PRs was searched for source-map URL, metadata, exclusion and capture-comparison terms. The related closed reports concern missing script module metadata, optional resource sizes, missing accessibility roles, and ignored retained script digests. The closed bundle exclusion report concerns source-map fetch-result projection; this comparison already receives a correctly preserved inspection exclusion. The parent also refreshed live issue and PR searches, confirmed the related current states, and read their full available discussion comments before submission. No exact open duplicate was found; the historical reports have distinct fields or projection paths and do not close this declared-URL comparison failure. Live capture, MCP transport and installed-package equivalence were not exercised.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The public offline CLI deterministically asserts a script modification or equality from unavailable declared-URL evidence on the tested bounded inputs; retained input data stays intact, and live-page frequency is unknown.
Workaround status: available
Workaround basis: Direct inspection of the saved producer-generated script records and source_maps exclusion ledger identifies the declaration as unavailable while preserving jointly known facts; this manual interpretation requires no recapture, code change, target operation or authority expansion.

Originally created by @coygeek on GitHub (Oct 26, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7301 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior The offline `compare-web-captures` CLI reports one script modification when the same declared source-map URL is retained in one capture and omitted by origin scope in the other. The producer receives an identical script event in both cases; only the allowed-origin set differs. The narrower capture correctly records the omitted declaration under `source_maps` with `disallowed_origin`, but comparison treats its null URL as an observed different value. Both comparison directions return `scripts.status: "changed"` and `overall_status: "changed"`. Comparing the excluded capture with itself instead reports `scripts.status: "unchanged"`, despite the unavailable declaration evidence. These results were observed using production event ingestion and script-inventory generation, schema-valid retained snapshots, and the public CLI. No browser or network was used. ## Reproduction Use the prepared build and locked dependencies of the source revision below. Set `REA_ROOT` to the checkout. Save the following independently written probe as `fixture.mjs` outside the checkout. All URLs are inert identities; its connection stub throws if any external operation is attempted. ```javascript import assert from 'node:assert/strict'; import {mkdirSync, writeFileSync} from 'node:fs'; import {spawnSync} from 'node:child_process'; import {resolve} from 'node:path'; import {pathToFileURL} from 'node:url'; const root = resolve(process.argv[2]), out = resolve(process.argv[3]); const load = p => import(pathToFileURL(resolve(root, 'dist', p)).href); const {CdpCaptureEvents} = await load('browser/CdpCaptureEvents.js'); const {captureScripts} = await load('browser/CdpPageCaptureScripts.js'); const {inspectWebPageInputSchema} = await load('domain/browserObservation.js'); const {captureSnapshotSchema} = await load('domain/webCaptureDiffSchemas.js'); const origin = 'https://app.example.test', cdn = 'https://cdn.example.test'; assert(process.env.CAPTURE_AT, 'Set CAPTURE_AT using date'); const at = new Date(process.env.CAPTURE_AT).toISOString(); mkdirSync(out, {recursive:true}); let calls = 0; const make = async (declared, origins, hash = 'a'.repeat(64), mapBytesUnavailable = false) => { const input = inspectWebPageInputSchema.parse({cdp_endpoint:'http://127.0.0.1:9222', target_id:'fixture', allowed_origins:origins, observation_ms:0, include_script_sources:false}); const events = new CdpCaptureEvents(input, new Set(input.allowed_origins)); events.beginAuthorizedFrame('frame'); events.ingest({method:'Debugger.scriptParsed', params:{scriptId:'script', url:origin+'/app.js', hash, length:10, isModule:false, scriptLanguage:'JavaScript', sourceMapURL:declared}}); const captured = await captureScripts({context:{input, operation:'inspect_web_page', connection:{send(){calls++; throw Error('Unexpected external operation');}}}, events, rawResources:[], resources:[], frameIds:new Set(['frame'])}); events.recordScriptMetadataBudgetExclusions(); if (mapBytesUnavailable) events.completeness.unavailable('source_maps'); const snapshot = captureSnapshotSchema.parse({inspection:{ browser:{product:'fixture', protocol_version:'1.3', revision:'fixture', user_agent:'fixture', js_version:'fixture'}, target:{target_id:'fixture', type:'page', title:'Fixture', url:origin+'/', origin, attached:false}, capture_window:{started_at:at, ended_at:at, observation_ms:0}, completeness:events.completeness.snapshot(), frames:[], dom:{total_nodes:0,nodes:[]}, accessibility:{total_nodes:0,nodes:[],text_capture:{status:'not_approved',retained_bytes:0,excluded_fields:0}}, scripts:captured.inventory, resources:[], workers:[], network:{requests:[],websocket_connections:[],coverage_started_at:at,prior_activity_available:false}, console:{events:[],coverage_started_at:at,prior_activity_available:false}, metadata:{responses:[],dom_urls:[],agent_hints:[],excluded_dom_urls:0,headers_allowlisted:true}, storage:{origin,usage_bytes:null,quota_bytes:null,local_storage_keys:[],session_storage_keys:[],indexed_db_names:[],cache_names:[],values_redacted:true}, limitations:['Synthetic empty sections; production script inventory and coverage. No live browser.'] }}); return snapshot; }; const broad = [origin,cdn], narrow = [origin], declared = cdn+'/app.js.map'; const captures = { known:await make(declared,broad), excluded:await make(declared,narrow), absent:await make('',narrow), different:await make(cdn+'/other.js.map',broad), changed:await make(declared,narrow,'b'.repeat(64)), bytesUnavailable:await make(declared,broad,'a'.repeat(64),true) }; for (const [name,capture] of Object.entries(captures)) { writeFileSync(resolve(out,name+'.json'),JSON.stringify(capture,null,2)+'\n'); console.log('producer',name,JSON.stringify({script:capture.inspection.scripts.items[0],completeness:capture.inspection.completeness})); } assert.equal(captures.known.inspection.scripts.items[0].source_map_url,declared); assert.equal(captures.excluded.inspection.scripts.items[0].source_map_url,null); assert.deepEqual(captures.known.inspection.scripts.items[0].source,captures.excluded.inspection.scripts.items[0].source); assert(captures.excluded.inspection.completeness.policy_filtered_sections.includes('source_maps')); assert(!captures.excluded.inspection.completeness.policy_filtered_sections.includes('scripts')); assert.equal(captures.absent.inspection.scripts.items[0].source_map_url,null); assert(!captures.absent.inspection.completeness.policy_filtered_sections.includes('source_maps')); const cases = [['known','excluded'],['excluded','known'],['excluded','excluded'],['known','known'],['absent','absent'],['known','different'],['absent','known'],['excluded','changed'],['known','bytesUnavailable'],['absent','excluded']]; const env = {PATH:process.env.PATH,HOME:resolve(out,'home'),XDG_CONFIG_HOME:resolve(out,'config'),XDG_CACHE_HOME:resolve(out,'cache'),NODE_COMPILE_CACHE:resolve(out,'compile-cache'),REA_LOG_LEVEL:'silent',NO_COLOR:'1'}; mkdirSync(env.HOME,{recursive:true}); for (const [left,right] of cases) { const result = spawnSync(process.execPath,[resolve(root,'scripts/rea.mjs'),'compare-web-captures',resolve(out,left+'.json'),resolve(out,right+'.json'),'--json'],{env,encoding:'utf8',timeout:30000}); writeFileSync(resolve(out,left+'-'+right+'.stdout.json'),result.stdout); writeFileSync(resolve(out,left+'-'+right+'.stderr.txt'),result.stderr); assert.equal(result.status,0,result.stderr+result.stdout); assert.equal(result.stderr,''); const diff = JSON.parse(result.stdout).normalized_result; console.log('comparison',left,right,JSON.stringify({exit:result.status,overall:diff.overall_status,scripts:diff.dimensions.scripts})); } assert.equal(calls,0); console.log('external-operations',calls); console.log('runtime',process.version,process.platform,process.arch); ``` Run in that disposable directory: ```sh WORK="$(mktemp -d)" CAPTURE_AT="$(TZ=America/Los_Angeles date '+%Y-%m-%dT%H:%M:%S%z')" node fixture.mjs "$REA_ROOT" "$WORK" ``` The probe runs ten public CLI comparisons, each once, with isolated home/config/cache paths. Every comparison exited 0 with empty stderr, and the external-operation count was zero. It saves each capture and CLI output. The primary invocation is equivalent to: ```sh node "$REA_ROOT/scripts/rea.mjs" compare-web-captures "$WORK/known.json" "$WORK/excluded.json" --json ``` Inspect `normalized_result.dimensions.scripts`. The producer-generated `known` and `excluded` records share the script URL, hash, length, module flag, language, source availability and declared raw map URL; the latter becomes null only in `excluded`. Both inventories contain one script with zero dropped scripts. Only their source-map declaration coverage differs, apart from the derived script key. ## Expected behavior An omitted declared URL must not prove either a map-URL change or equality. These omission-only comparisons should keep the necessary declaration fact unknown, with no unsupported script modification. Preserve independently observed script changes. A genuinely empty declaration remains known no-map absence, and two retained declared URLs remain comparable even if map-body bytes are unavailable. ## Impact and scope P2: the CLI emits unsupported definite evidence-comparison results for this bounded capture pair, including a false aggregate change in both directions. The stored inputs retain their correct facts and exclusion ledger. Excluded self-comparison falsely asserts equality only for the script dimension; unrelated incomplete dimensions keep its overall result unknown. Live-page frequency was not measured. A manual workaround was checked on the saved records: compare the retained common script facts and inspect the exclusion ledger before interpreting null `source_map_url`. Here the common facts agree and `source_maps/disallowed_origin` explicitly identifies omitted declaration evidence, so the URL comparison remains unknown. This does not recover the omitted URL. No automatic CLI workaround or live recapture was tested. ## REA version Source revision `0d1a454e25db825567782e461da21530bad4b158`, using its prepared compiled runtime. ## Runtime and platform Node.js v24.22.1; macOS 27.0.1 arm64. No browser or native analysis provider was started. ## Target and artifact context Schema-valid synthetic passive capture JSON. Script records, derived keys and completeness ledgers come from production event ingestion and inventory projection; unrelated empty inventories are fixture data. The `bytesUnavailable` control adds a completeness-ledger marker without fetching a map, to distinguish declaration knownness from byte availability. ## Interface CLI ## Earliest failure stage Transport or result projection ## Relevant output or evidence - Expected source: `docs/browser-observation.md:30` prohibits equivalence from missing evidence; its comparison table at lines 78-90 preserves independently proven changes. `src/domain/webCaptureDiff.ts:46-48` defines changed as an observed difference. `src/browser/CdpCaptureEventHandlers.ts:187-233` distinguishes empty declarations from excluded declared URLs through the `source_maps` ledger; `src/browser/CdpPageCaptureScripts.ts:148-168` projects the producer's map URL into the retained script. - Failure source: the executed public CLI returns one script modification for `known/excluded` and its reverse, and unchanged scripts for `excluded/excluded` and `absent/excluded`. `src/domain/webCaptureDiff.ts:1027-1088` checks script inventory coverage but fingerprints `source_map_url` unconditionally at line 1062. - Evidence provenance: observed production-parser/inventory output and public CLI results; the explanation of comparison projection is source-derived. - Local verification: reproduced. - Reproduction completeness: complete for the offline retained-capture workflow. Relevant output, omitting the repeated group identity: | Pair | Script status | Script changes | Overall status | | --- | --- | --- | --- | | known / excluded | changed | 1 modified | changed | | excluded / known | changed | 1 modified | changed | | excluded / excluded | unchanged | 0 | unknown | | absent / excluded | unchanged | 0 | unknown | | known / known | unchanged | 0 | unknown | | absent / absent | unchanged | 0 | unknown | | known / different | changed | 1 modified | changed | | absent / known | changed | 1 modified | changed | | excluded / changed | changed | 1 modified | changed | | known / bytesUnavailable | unchanged | 0 | unknown | For the failing known/excluded pair, the omitted declaration is explicitly recorded as `{"section":"source_maps","reason":"disallowed_origin","count":1}`. Every listed script result has `reason: null`. The `changed` capture differs independently in its known producer hash while both declared URLs are omitted. ## Typed outcome or recovery expected Restoration check: the same known/excluded pair in either direction must no longer establish a script modification solely from the omitted URL. Excluded self-comparison and absent/excluded comparison must retain the unknown declaration fact instead of asserting complete script equality. Keep known self-comparison and genuine no-map self-comparison unchanged; keep retained different map URLs, known absence versus a retained URL, and differing known hashes changed. A retained URL must not become unknown merely because the map-body evidence is unavailable. These are proposed post-fix checks; no implementation was changed. ## Analysis or suspected cause Source-derived: null encodes both an empty declaration and a declared URL omitted by capture admission. The capture ledger distinguishes these cases, but the script comparison does not consult that evidence when comparing the URL. This report requests preservation of the existing known facts and unknown declaration, without prescribing an implementation or forcing the whole dimension unknown when another fact proves a change. ## Additional context The supplied offline index of 7,131 open/closed issues and PRs was searched for source-map URL, metadata, exclusion and capture-comparison terms. The related closed reports concern missing [script module metadata](https://github.com/morluto/rea/issues/6554), optional [resource sizes](https://github.com/morluto/rea/issues/6773), missing [accessibility roles](https://github.com/morluto/rea/issues/6786), and ignored [retained script digests](https://github.com/morluto/rea/issues/3879). The closed [bundle exclusion report](https://github.com/morluto/rea/issues/5952) concerns source-map fetch-result projection; this comparison already receives a correctly preserved inspection exclusion. The parent also refreshed live issue and PR searches, confirmed the related current states, and read their full available discussion comments before submission. No exact open duplicate was found; the historical reports have distinct fields or projection paths and do not close this declared-URL comparison failure. Live capture, MCP transport and installed-package equivalence were not exercised. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The public offline CLI deterministically asserts a script modification or equality from unavailable declared-URL evidence on the tested bounded inputs; retained input data stays intact, and live-page frequency is unknown. - Workaround status: available - Workaround basis: Direct inspection of the saved producer-generated script records and source_maps exclusion ledger identifies the declaration as unavailable while preserving jointly known facts; this manual interpretation requires no recapture, code change, target operation or authority expansion.

bsakaguchi closed this issue

2026-10-31 00:49:01 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:30 +00:00

[PR #4338] [CLOSED] fix(javascript): verify loader origins, assignment operators, and bootstrap integrity in static analysis #6182

bsakaguchi referenced this issue

2026-10-31 01:12:32 +00:00

[PR #4342] [MERGED] fix(javascript): preserve uncertainty in compound assignment results #6187