morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[GH-ISSUE #1236] fix(javascript): local HTML script URLs falsely report missing assets #434

New issue

Closed

opened 2026-10-15 18:25:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:25:01 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 9, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1236

Summary

Static JavaScript application analysis reports an inventoried script as missing when its HTML src uses encoded letters or surrounding whitespace. An encoded local document base produces the same wrong lookup. The plain equivalent declarations resolve correctly. This omits valid renderer-to-script relationships from the returned application graph.

Steps to reproduce

Create this two-file fixture in a disposable directory and run the published baseline listed under Runtime or environment:

fixture_dir=$(mktemp -d)
cat > "$fixture_dir/index.html" <<'HTML'
<script src="%61pp.js"></script>
HTML
cat > "$fixture_dir/app.js" <<'JS'
globalThis.fixtureValue = 42;
JS
npx -y rea-agents@6.1.0 analyze-javascript-application "$fixture_dir" --format json

Inspect the renderer observation with mechanism: "html-script-reference". It reports resolved_path: null and resolution_status: "not-found", although app.js is present. For the main build, use a checkout built with npm ci and npm run build:cached, and replace the npx runner with node scripts/rea.mjs while retaining the command arguments. Both CLI builds reproduced this two-file reduction.

For a plain control, replace the HTML with <script src="app.js"></script> and repeat analysis. This resolves app.js. For the whitespace variant, use <script src=" app.js "></script>; it incorrectly remains not-found. For the document-base variant, place the script at assets/app.js and use <base href="%61ssets/"><script src="app.js"></script>; the encoded base fails while the plain base assets/ resolves. Each variant and control was executed on both CLI builds.

The MCP equivalent is analyze_javascript_application with input_path set to the absolute fixture directory. The encoded-script case was also reproduced through a real stdio MCP session on the main build.

Expected behavior

Resolve an admitted local HTML script URL to the exact inventoried file after applying document URL semantics, while retaining the raw declaration as evidence. The encoded and whitespace forms above should resolve to the same asset as their plain controls. An encoded local base should resolve to assets/app.js.

The existing documentation says, "HTML script references resolve to exact inventoried files after applying the document base and query/fragment rules." The HTML base tests compare artifact resolution with native URL parsing and a decoded pathname. These inputs contain encoded letters or ordinary surrounding whitespace, without encoded dots or separators.

Actual behavior

Both tested CLI builds exit 0 for the failing fixture and return this renderer observation:

{"mechanism":"html-script-reference","script_path":"%61pp.js","base_href":null,"declared_path":"%61pp.js","resolution_context":"html-reference","resolved_path":null,"resolution_status":"not-found","limitations":["The exact HTML resource %61pp.js was not found among the selected application files."]}

The whitespace variant reports a missing resource named app.js. The encoded-base variant reports a missing resource named %61ssets/app.js. The plain controls return resolution_status: "resolved" with the expected inventoried asset path. The main MCP response succeeds with isError: false but preserves the same wrong missing-resource observation.

A nonexecuting native URL comparison was run independently. fileURLToPath(new URL('%61pp.js', documentUrl)) and the corresponding whitespace form both select app.js; resolving app.js against the encoded base selects assets/app.js. No real browser or application was launched for these static tests.

Evidence

Expected source: docs/javascript-artifact-reconstruction.md:296-300 describes exact HTML asset resolution after document-base and suffix handling; src/application/javascript/JavaScriptHtmlBaseResolution.test.ts:62-81 compares artifact resolution with native URL parsing and a decoded pathname.
Failure source: Executed public CLI analysis of the inline fixture on both tested builds, including the two-file reduction, returned the quoted renderer observation. A real main-build stdio MCP call returned the same missing-resource result.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

Source inspection shows htmlCandidate in src/application/javascript/JavaScriptArtifactPathResolution.ts:248-280 stripping suffixes before joining the remaining raw declaration and base as path text. This is source-derived reasoning consistent with the observed results, rather than a prescribed repair.

Open and closed issue searches covered HTML percent encoding, encoded paths, whitespace and script references. No exact duplicate was found. The existing HTML fallback issue concerns extension and directory-index lookup; the URL-policy discussion concerns outcome vocabularies.

Runtime or environment

Published package rea-agents@6.1.0; current default-branch build at f0da05f67fff1411cf2f7a48a752ee7b348c71ff. Runtime: Node.js v26.10.0, macOS 27.0.1, arm64. Targets were authored local HTML/JavaScript directory fixtures. The release and main CLI paths were tested; stdio MCP was tested on main. No deep binary-analysis provider was used.

Restoration check

The encoded script declaration, surrounding-whitespace declaration and encoded local base must resolve to the same exact inventoried assets as their plain controls, with the original declarations retained. Preserve exact-file lookup, the existing external-reference classifications and the explicit path-admission constraints. A file with a different appended extension or a directory index must not become a substitute HTML asset.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The bounded fixtures lose valid renderer-to-script relationships and receive false missing-resource limitations on the supported static HTML analysis path. Analysis remains available; production incidence and wider runtime consequences were not measured.
Workaround status: available
Workaround basis: A native, nonexecuting URL comparison was verified on these fixtures. Resolve the retained declaration against its document/base with new URL, decode the local pathname and compare it with the inventoried files. This checks the affected relationship without modifying or executing the target, although the returned REA graph remains incorrect.

Originally created by @coygeek on GitHub (Oct 9, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1236 ## Summary Static JavaScript application analysis reports an inventoried script as missing when its HTML `src` uses encoded letters or surrounding whitespace. An encoded local document base produces the same wrong lookup. The plain equivalent declarations resolve correctly. This omits valid renderer-to-script relationships from the returned application graph. ## Steps to reproduce Create this two-file fixture in a disposable directory and run the published baseline listed under Runtime or environment: ```sh fixture_dir=$(mktemp -d) cat > "$fixture_dir/index.html" <<'HTML' <script src="%61pp.js"></script> HTML cat > "$fixture_dir/app.js" <<'JS' globalThis.fixtureValue = 42; JS npx -y rea-agents@6.1.0 analyze-javascript-application "$fixture_dir" --format json ``` Inspect the renderer observation with `mechanism: "html-script-reference"`. It reports `resolved_path: null` and `resolution_status: "not-found"`, although `app.js` is present. For the main build, use a checkout built with `npm ci` and `npm run build:cached`, and replace the npx runner with `node scripts/rea.mjs` while retaining the command arguments. Both CLI builds reproduced this two-file reduction. For a plain control, replace the HTML with `<script src="app.js"></script>` and repeat analysis. This resolves `app.js`. For the whitespace variant, use `<script src=" app.js "></script>`; it incorrectly remains not-found. For the document-base variant, place the script at `assets/app.js` and use `<base href="%61ssets/"><script src="app.js"></script>`; the encoded base fails while the plain base `assets/` resolves. Each variant and control was executed on both CLI builds. The MCP equivalent is `analyze_javascript_application` with `input_path` set to the absolute fixture directory. The encoded-script case was also reproduced through a real stdio MCP session on the main build. ## Expected behavior Resolve an admitted local HTML script URL to the exact inventoried file after applying document URL semantics, while retaining the raw declaration as evidence. The encoded and whitespace forms above should resolve to the same asset as their plain controls. An encoded local base should resolve to `assets/app.js`. The existing documentation says, "HTML script references resolve to exact inventoried files after applying the document base and query/fragment rules." The HTML base tests compare artifact resolution with native URL parsing and a decoded pathname. These inputs contain encoded letters or ordinary surrounding whitespace, without encoded dots or separators. ## Actual behavior Both tested CLI builds exit 0 for the failing fixture and return this renderer observation: ```json {"mechanism":"html-script-reference","script_path":"%61pp.js","base_href":null,"declared_path":"%61pp.js","resolution_context":"html-reference","resolved_path":null,"resolution_status":"not-found","limitations":["The exact HTML resource %61pp.js was not found among the selected application files."]} ``` The whitespace variant reports a missing resource named ` app.js `. The encoded-base variant reports a missing resource named `%61ssets/app.js`. The plain controls return `resolution_status: "resolved"` with the expected inventoried asset path. The main MCP response succeeds with `isError: false` but preserves the same wrong missing-resource observation. A nonexecuting native URL comparison was run independently. `fileURLToPath(new URL('%61pp.js', documentUrl))` and the corresponding whitespace form both select `app.js`; resolving `app.js` against the encoded base selects `assets/app.js`. No real browser or application was launched for these static tests. ## Evidence - Expected source: `docs/javascript-artifact-reconstruction.md:296-300` describes exact HTML asset resolution after document-base and suffix handling; `src/application/javascript/JavaScriptHtmlBaseResolution.test.ts:62-81` compares artifact resolution with native URL parsing and a decoded pathname. - Failure source: Executed public CLI analysis of the inline fixture on both tested builds, including the two-file reduction, returned the quoted renderer observation. A real main-build stdio MCP call returned the same missing-resource result. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete Source inspection shows `htmlCandidate` in `src/application/javascript/JavaScriptArtifactPathResolution.ts:248-280` stripping suffixes before joining the remaining raw declaration and base as path text. This is source-derived reasoning consistent with the observed results, rather than a prescribed repair. Open and closed issue searches covered HTML percent encoding, encoded paths, whitespace and script references. No exact duplicate was found. The existing HTML fallback issue concerns extension and directory-index lookup; the URL-policy discussion concerns outcome vocabularies. ## Runtime or environment Published package `rea-agents@6.1.0`; current default-branch build at `f0da05f67fff1411cf2f7a48a752ee7b348c71ff`. Runtime: Node.js `v26.10.0`, macOS `27.0.1`, arm64. Targets were authored local HTML/JavaScript directory fixtures. The release and main CLI paths were tested; stdio MCP was tested on main. No deep binary-analysis provider was used. ## Restoration check The encoded script declaration, surrounding-whitespace declaration and encoded local base must resolve to the same exact inventoried assets as their plain controls, with the original declarations retained. Preserve exact-file lookup, the existing external-reference classifications and the explicit path-admission constraints. A file with a different appended extension or a directory index must not become a substitute HTML asset. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The bounded fixtures lose valid renderer-to-script relationships and receive false missing-resource limitations on the supported static HTML analysis path. Analysis remains available; production incidence and wider runtime consequences were not measured. - Workaround status: available - Workaround basis: A native, nonexecuting URL comparison was verified on these fixtures. Resolve the retained declaration against its document/base with `new URL`, decode the local pathname and compare it with the inventoried files. This checks the affected relationship without modifying or executing the target, although the returned REA graph remains incorrect.

bsakaguchi

2026-10-15 18:25:01 +00:00

closed this issue
added the
area: domain

bug
labels

bsakaguchi referenced this issue

2026-10-16 21:13:04 +00:00

[PR #434] [MERGED] fix(ci): normalize generated release metadata #1983

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#434

No description provided.

Rows
Columns