[GH-ISSUE #7326] [Bug] Same-origin source-map refusal incorrectly reports an unapproved origin #4355

New issue

Closed

opened 2026-10-31 00:49:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:49:09 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 26, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7326

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

A source-map declaration on the selected origin, containing an inert userinfo label, produces a policy_filtered item with Declared source-map URL is outside the approved exact origins. The URL's parsed origin equals the sole allowed origin. Refusal is intentional; its explanation incorrectly identifies an origin mismatch. This was reproduced through production event ingestion, script inventory, source-map acquisition and bundle projection with local fake responses. The public CLI/MCP and a live browser were not run.

Reproduction

Use the prepared build and locked dependencies of the source revision below. Save the following as probe.mjs in a disposable directory outside the checkout. Set REA_ROOT to that checkout. The userinfo label is synthetic and contains no secret. The injected fetch returns a local response and never invokes a network API. Unrelated page sections are synthetic; no syntax-analysis worker runs, and its missing result remains explicit.

import assert from 'node:assert/strict';
import {resolve} from 'node:path';
import {pathToFileURL} from 'node:url';
import {release} from 'node:os';
const root=resolve(process.argv[2]);
const load=p=>import(pathToFileURL(resolve(root,'dist',p)).href);
const {CdpCaptureEvents}=await load('browser/CdpCaptureEvents.js');
const {captureScripts}=await load('browser/CdpPageCaptureScripts.js');
const {inspectWebPageInputSchema}=await load('domain/browserObservation.js');
const {analyzeWebBundleInputSchema}=await load('domain/webBundleAnalysis.js');
const {webPageInspectionSchema}=await load('domain/browserObservationSchemas.js');
const {fetchWebSourceMaps}=await load('browser/WebSourceMapFetcher.js');
const {sourceMapsWithCaptureExclusions}=await load('domain/webSourceMapCoverage.js');
const {buildCapturedWebBundleAnalysis}=await load('domain/webBundleAnalyzerResult.js');
const origin='https://app.example.test';
const source='export const fixture = 1;';
assert(process.env.CAPTURE_AT);
const at=new Date(process.env.CAPTURE_AT).toISOString();
for (const [name,declaration] of [['userinfo',origin.replace('://','://fixture-label@')+'/main.js.map'],['plain',origin+'/main.js.map']]) {
 const input=inspectWebPageInputSchema.parse({cdp_endpoint:'http://127.0.0.1:9222',target_id:'fixture',allowed_origins:[origin],observation_ms:0,include_script_sources:true});
 const events=new CdpCaptureEvents(input,new Set(input.allowed_origins));
 events.beginAuthorizedFrame('frame');
 events.ingest({method:'Debugger.scriptParsed',params:{scriptId:'script',url:origin+'/main.js',executionContextId:1,executionContextAuxData:{frameId:'frame'},hash:'a'.repeat(64),length:source.length,isModule:true,scriptLanguage:'JavaScript',sourceMapURL:declaration}});
 let sourceCalls=0;
 const captured=await captureScripts({context:{input,operation:'analyze_web_bundle',connection:{async send(method){assert.equal(method,'Debugger.getScriptSource');sourceCalls++;return {scriptSource:source};}}},events,rawResources:[],resources:[],frameIds:new Set(['frame'])});
 events.recordScriptMetadataBudgetExclusions();
 const inspection=webPageInspectionSchema.parse({browser:{product:'fixture',protocol_version:'1.3',revision:'fixture',user_agent:'fixture',js_version:'fixture'},target:{target_id:'fixture',type:'page',title:'Fixture',url:origin+'/',origin,attached:false},capture_window:{started_at:at,ended_at:at,observation_ms:0},completeness:events.completeness.snapshot(),frames:[],dom:{total_nodes:0,nodes:[]},accessibility:{total_nodes:0,nodes:[],text_capture:{status:'not_approved',retained_bytes:0,excluded_fields:0}},scripts:captured.inventory,resources:[],workers:[],network:{requests:[],websocket_connections:[],coverage_started_at:at,prior_activity_available:false},console:{events:[],coverage_started_at:at,prior_activity_available:false},metadata:{responses:[],dom_urls:[],agent_hints:[],excluded_dom_urls:0,headers_allowlisted:true},storage:{origin,usage_bytes:null,quota_bytes:null,local_storage_keys:[],session_storage_keys:[],indexed_db_names:[],cache_names:[],values_redacted:true},limitations:['Synthetic unrelated page sections; production script inventory.']});
 const bundleInput=analyzeWebBundleInputSchema.parse({cdp_endpoint:'http://127.0.0.1:9222',target_id:'fixture',allowed_origins:[origin],observation_ms:0,include_script_sources:true,fetch_source_maps:true});
 let fakeFetchCalls=0;
 const fetched=await fetchWebSourceMaps(captured.sourceMapRequests,bundleInput,undefined,{fetch:async url=>{fakeFetchCalls++;assert.equal(String(url),origin+'/main.js.map');assert.equal(name,'plain');return new Response(JSON.stringify({version:3,sources:['original.js'],sourcesContent:[source],names:[],mappings:'AAAA'}),{status:200,headers:{'content-type':'application/json'}});}});
 assert(fetched.ok);
 const maps=sourceMapsWithCaptureExclusions(fetched.value,inspection.completeness.excluded);
 // No syntax worker runs; its missing result is kept explicit. This checks only map projection.
 const bundle=buildCapturedWebBundleAnalysis(inspection,maps,[]);
 assert.equal(sourceCalls,1);
 assert.equal(captured.inventory.items[0].source_map_url,origin+'/main.js.map');
 assert.deepEqual(inspection.completeness.excluded.filter(x=>x.section==='source_maps'),[]);
 assert.equal(new URL(captured.sourceMapRequests[0].fetchUrl).origin,origin);
 assert.equal(maps.items[0].status,name==='userinfo'?'policy_filtered':'included');
 assert.equal(fakeFetchCalls,name==='userinfo'?0:1);
 if(name==='userinfo')assert.equal(maps.items[0].limitation,'Declared source-map URL is outside the approved exact origins.');
 console.log(JSON.stringify({name,approved_origin:origin,fetch_origin:new URL(captured.sourceMapRequests[0].fetchUrl).origin,retained_url:captured.inventory.items[0].source_map_url,capture_map_exclusions:inspection.completeness.excluded.filter(x=>x.section==='source_maps'),sourceCalls,fakeFetchCalls,collection:{status:maps.status,requested:maps.requested,processed:maps.processed},item:{status:maps.items[0].status,declared_url:maps.items[0].declared_url,effective_url:maps.items[0].effective_url,limitation:maps.items[0].limitation},bundle_source_map_unknowns:bundle.unknowns.filter(x=>x.dimension==='source_maps')}));
}
console.log(JSON.stringify({runtime:process.version,platform:process.platform,arch:process.arch,kernel:release(),realNetworkCalls:0}));

Run with isolated state directories:

WORK="$(mktemp -d)"
mkdir -p "$WORK/home" "$WORK/config" "$WORK/cache" "$WORK/tmp"
CAPTURE_AT="$(TZ=America/Los_Angeles date '+%Y-%m-%dT%H:%M:%S%z')" HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_CACHE_HOME="$WORK/cache" TMPDIR="$WORK/tmp" node probe.mjs "$REA_ROOT"

The successful probe ran once and exited 0 with empty stderr. It executes each declaration once. The userinfo case reports zero fake-fetch calls and the origin-focused limitation; the plain case reports one fake-fetch call, included, and a null item limitation. Both report identical approved and fetch origins. No real network, browser or target execution occurs.

Expected behavior

The item should explain the actual policy refusal without asserting that an allowed origin is outside scope. Keep the intentional refusal of a declaration carrying userinfo, its credential-free retained URL, null effective URL and zero fetch calls. The existing credential-free acquisition rule does not make the URL's origin different.

Impact and scope

P3 diagnostic wording defect. The observed map outcome remains correctly unavailable, and the plain-URL control is included. The bundle preserves the item but its source-map unknown uses a generic unavailable-map reason. No loss of fetched data or incorrect acquisition was observed. NOT_ENOUGH_INFO: live-page frequency and installed-package or CLI/MCP reproduction were not measured. A reader who knows the original declaration can interpret the refusal using the documented credential-free acquisition policy; no automatic recovery was tested.

REA version

Source revision ace4dbf36e8c8f36a0e192aff9a11484ed428358, using its prepared compiled runtime and locked dependencies.

Runtime and platform

Node.js v24.22.1; macOS arm64, Darwin kernel 27.0.0. No browser or native analysis provider was started.

Target and artifact context

Synthetic CDP script metadata, harmless JavaScript text and a regular v3 map returned from an injected local fetch. The inert identities use app.example.test. The production script artifact is retained; unrelated page inventories are empty fixture data.

Interface

Other

Earliest failure stage

Capture or observation

Relevant output or evidence

Expected source: AGENTS.md, Architecture and Cleanup, requires preserving meaningful failure reasons. docs/browser-observation.md:610 documents credential-free exact-origin acquisition and retained failure context. tests/boundary/browser/webSourceMapFetcher.test.ts:465-494 intentionally requires refusal of userinfo-bearing declarations without a request, but does not require this limitation sentence.
Failure source: src/browser/WebSourceMapFetcher.ts:331-336,964-981 emits the origin-mismatch sentence after one predicate combining protocol, userinfo and origin checks. The executed userinfo case has approved_origin and fetch_origin both https://app.example.test, fakeFetchCalls: 0, collection unavailable, requested: 1, processed: 1, item policy_filtered, effective_url: null, and the quoted limitation.
Evidence provenance: observed production-module results; public-entry-point reachability is source-derived.
Local verification: reproduced at the capture/fetch/projection boundaries. No public CLI/MCP or live-browser runtime reproduction was run.
Reproduction completeness: complete for the shown module workflow; public transport was not exercised.

Public-path source trace: src/cli/browserCommands.ts:155-229 parses analyze-web-bundle with source capture and optional map fetching; src/application/BrowserObservationService.ts:95-125 calls the provider and wraps its result as Evidence. src/browser/CdpBrowserProvider.ts:193-245,360-450 reserves analysis, authorizes the selected HTTP(S) page, derives its origin scope, captures, fetches the retained map requests when selected, and preserves capture exclusions before analysis. src/browser/CdpPageCapture.ts:77-124,148-235,283-311 admits the stable allowed main frame, routes matching-session events, captures scripts and forwards their map requests. src/browser/CdpCaptureEventHandlers.ts:71-145,178-233 and src/browser/CdpPageCaptureScripts.ts:242-258 admit this small, valid same-origin declaration, retain its sanitized identity and preserve the raw request URL. src/browser/WebSourceMapFetcher.ts:102-140,183-219 has no cancellation, deadline or capacity reason to preempt this one small request. src/domain/webSourceMapCoverage.ts:8-20 leaves its empty capture-exclusion set unchanged. src/browser/IsolatedWebBundleAnalyzer.ts:234-236 and src/domain/webBundleAnalyzerResult.ts:172-179,364-378 retain the source-map item and use a generic source-map unknown reason. These guards do not reject the declaration before the demonstrated fetcher guard; discovery, attachment and actual CDP transport remain unexecuted.

The probe also observed an empty capture source-map exclusion list for both declarations. That list describes capture admission, whereas the item describes acquisition refusal; this difference is not independently claimed as a defect.

Additional context

The supplied index and full available bodies of 7,168 open/closed issues and PRs were searched for source maps, origin policy, userinfo, policy_filtered, embedded credentials and the diagnostic sentence. Related reports #7301 and #7299 concern capture comparison and source-location attribution respectively. #829 discusses broader URL-policy vocabulary; merged #1120 deliberately preserves credential-policy differences with tests. Neither establishes that the literal origin-mismatch sentence is intentional or correct. Closed #5952 concerns lost capture exclusions, restored by a capture-exclusion projection that is present here. No exact duplicate was found in the supplied snapshot or the current upstream issue/PR search before submission. The listed historical discussions were not freshly rechecked.

Restoration check: rerun the fixture and retain policy_filtered, zero fake-fetch calls, credential-free declared_url and null effective_url for the userinfo case, while its limitation no longer falsely reports an unapproved origin. Keep the plain-URL control included with one fake-fetch call and no map unknown. A genuinely unapproved origin must remain refused; that additional post-fix control is proposed, not executed here. No code was changed and no restoration was run.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: The observed defect is an inaccurate item limitation for a deliberately refused input; the refusal and plain-URL acquisition control remain correct, with no consequential behavior change observed.
Workaround status: available
Workaround basis: For the demonstrated declaration, compare its parsed origin with allowed_origins and interpret policy_filtered using the documented credential-free acquisition policy. This identifies the diagnostic mismatch without changing authority, fetching the refused URL or changing code.

Originally created by @coygeek on GitHub (Oct 26, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7326 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior A source-map declaration on the selected origin, containing an inert userinfo label, produces a `policy_filtered` item with `Declared source-map URL is outside the approved exact origins.` The URL's parsed origin equals the sole allowed origin. Refusal is intentional; its explanation incorrectly identifies an origin mismatch. This was reproduced through production event ingestion, script inventory, source-map acquisition and bundle projection with local fake responses. The public CLI/MCP and a live browser were not run. ## Reproduction Use the prepared build and locked dependencies of the source revision below. Save the following as `probe.mjs` in a disposable directory outside the checkout. Set `REA_ROOT` to that checkout. The userinfo label is synthetic and contains no secret. The injected fetch returns a local response and never invokes a network API. Unrelated page sections are synthetic; no syntax-analysis worker runs, and its missing result remains explicit. ```javascript import assert from 'node:assert/strict'; import {resolve} from 'node:path'; import {pathToFileURL} from 'node:url'; import {release} from 'node:os'; const root=resolve(process.argv[2]); const load=p=>import(pathToFileURL(resolve(root,'dist',p)).href); const {CdpCaptureEvents}=await load('browser/CdpCaptureEvents.js'); const {captureScripts}=await load('browser/CdpPageCaptureScripts.js'); const {inspectWebPageInputSchema}=await load('domain/browserObservation.js'); const {analyzeWebBundleInputSchema}=await load('domain/webBundleAnalysis.js'); const {webPageInspectionSchema}=await load('domain/browserObservationSchemas.js'); const {fetchWebSourceMaps}=await load('browser/WebSourceMapFetcher.js'); const {sourceMapsWithCaptureExclusions}=await load('domain/webSourceMapCoverage.js'); const {buildCapturedWebBundleAnalysis}=await load('domain/webBundleAnalyzerResult.js'); const origin='https://app.example.test'; const source='export const fixture = 1;'; assert(process.env.CAPTURE_AT); const at=new Date(process.env.CAPTURE_AT).toISOString(); for (const [name,declaration] of [['userinfo',origin.replace('://','://fixture-label@')+'/main.js.map'],['plain',origin+'/main.js.map']]) { const input=inspectWebPageInputSchema.parse({cdp_endpoint:'http://127.0.0.1:9222',target_id:'fixture',allowed_origins:[origin],observation_ms:0,include_script_sources:true}); const events=new CdpCaptureEvents(input,new Set(input.allowed_origins)); events.beginAuthorizedFrame('frame'); events.ingest({method:'Debugger.scriptParsed',params:{scriptId:'script',url:origin+'/main.js',executionContextId:1,executionContextAuxData:{frameId:'frame'},hash:'a'.repeat(64),length:source.length,isModule:true,scriptLanguage:'JavaScript',sourceMapURL:declaration}}); let sourceCalls=0; const captured=await captureScripts({context:{input,operation:'analyze_web_bundle',connection:{async send(method){assert.equal(method,'Debugger.getScriptSource');sourceCalls++;return {scriptSource:source};}}},events,rawResources:[],resources:[],frameIds:new Set(['frame'])}); events.recordScriptMetadataBudgetExclusions(); const inspection=webPageInspectionSchema.parse({browser:{product:'fixture',protocol_version:'1.3',revision:'fixture',user_agent:'fixture',js_version:'fixture'},target:{target_id:'fixture',type:'page',title:'Fixture',url:origin+'/',origin,attached:false},capture_window:{started_at:at,ended_at:at,observation_ms:0},completeness:events.completeness.snapshot(),frames:[],dom:{total_nodes:0,nodes:[]},accessibility:{total_nodes:0,nodes:[],text_capture:{status:'not_approved',retained_bytes:0,excluded_fields:0}},scripts:captured.inventory,resources:[],workers:[],network:{requests:[],websocket_connections:[],coverage_started_at:at,prior_activity_available:false},console:{events:[],coverage_started_at:at,prior_activity_available:false},metadata:{responses:[],dom_urls:[],agent_hints:[],excluded_dom_urls:0,headers_allowlisted:true},storage:{origin,usage_bytes:null,quota_bytes:null,local_storage_keys:[],session_storage_keys:[],indexed_db_names:[],cache_names:[],values_redacted:true},limitations:['Synthetic unrelated page sections; production script inventory.']}); const bundleInput=analyzeWebBundleInputSchema.parse({cdp_endpoint:'http://127.0.0.1:9222',target_id:'fixture',allowed_origins:[origin],observation_ms:0,include_script_sources:true,fetch_source_maps:true}); let fakeFetchCalls=0; const fetched=await fetchWebSourceMaps(captured.sourceMapRequests,bundleInput,undefined,{fetch:async url=>{fakeFetchCalls++;assert.equal(String(url),origin+'/main.js.map');assert.equal(name,'plain');return new Response(JSON.stringify({version:3,sources:['original.js'],sourcesContent:[source],names:[],mappings:'AAAA'}),{status:200,headers:{'content-type':'application/json'}});}}); assert(fetched.ok); const maps=sourceMapsWithCaptureExclusions(fetched.value,inspection.completeness.excluded); // No syntax worker runs; its missing result is kept explicit. This checks only map projection. const bundle=buildCapturedWebBundleAnalysis(inspection,maps,[]); assert.equal(sourceCalls,1); assert.equal(captured.inventory.items[0].source_map_url,origin+'/main.js.map'); assert.deepEqual(inspection.completeness.excluded.filter(x=>x.section==='source_maps'),[]); assert.equal(new URL(captured.sourceMapRequests[0].fetchUrl).origin,origin); assert.equal(maps.items[0].status,name==='userinfo'?'policy_filtered':'included'); assert.equal(fakeFetchCalls,name==='userinfo'?0:1); if(name==='userinfo')assert.equal(maps.items[0].limitation,'Declared source-map URL is outside the approved exact origins.'); console.log(JSON.stringify({name,approved_origin:origin,fetch_origin:new URL(captured.sourceMapRequests[0].fetchUrl).origin,retained_url:captured.inventory.items[0].source_map_url,capture_map_exclusions:inspection.completeness.excluded.filter(x=>x.section==='source_maps'),sourceCalls,fakeFetchCalls,collection:{status:maps.status,requested:maps.requested,processed:maps.processed},item:{status:maps.items[0].status,declared_url:maps.items[0].declared_url,effective_url:maps.items[0].effective_url,limitation:maps.items[0].limitation},bundle_source_map_unknowns:bundle.unknowns.filter(x=>x.dimension==='source_maps')})); } console.log(JSON.stringify({runtime:process.version,platform:process.platform,arch:process.arch,kernel:release(),realNetworkCalls:0})); ``` Run with isolated state directories: ```sh WORK="$(mktemp -d)" mkdir -p "$WORK/home" "$WORK/config" "$WORK/cache" "$WORK/tmp" CAPTURE_AT="$(TZ=America/Los_Angeles date '+%Y-%m-%dT%H:%M:%S%z')" HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_CACHE_HOME="$WORK/cache" TMPDIR="$WORK/tmp" node probe.mjs "$REA_ROOT" ``` The successful probe ran once and exited 0 with empty stderr. It executes each declaration once. The userinfo case reports zero fake-fetch calls and the origin-focused limitation; the plain case reports one fake-fetch call, `included`, and a null item limitation. Both report identical approved and fetch origins. No real network, browser or target execution occurs. ## Expected behavior The item should explain the actual policy refusal without asserting that an allowed origin is outside scope. Keep the intentional refusal of a declaration carrying userinfo, its credential-free retained URL, null effective URL and zero fetch calls. The existing credential-free acquisition rule does not make the URL's origin different. ## Impact and scope P3 diagnostic wording defect. The observed map outcome remains correctly unavailable, and the plain-URL control is included. The bundle preserves the item but its source-map unknown uses a generic unavailable-map reason. No loss of fetched data or incorrect acquisition was observed. NOT_ENOUGH_INFO: live-page frequency and installed-package or CLI/MCP reproduction were not measured. A reader who knows the original declaration can interpret the refusal using the documented credential-free acquisition policy; no automatic recovery was tested. ## REA version Source revision `ace4dbf36e8c8f36a0e192aff9a11484ed428358`, using its prepared compiled runtime and locked dependencies. ## Runtime and platform Node.js v24.22.1; macOS arm64, Darwin kernel 27.0.0. No browser or native analysis provider was started. ## Target and artifact context Synthetic CDP script metadata, harmless JavaScript text and a regular v3 map returned from an injected local fetch. The inert identities use app.example.test. The production script artifact is retained; unrelated page inventories are empty fixture data. ## Interface Other ## Earliest failure stage Capture or observation ## Relevant output or evidence - Expected source: `AGENTS.md`, Architecture and Cleanup, requires preserving meaningful failure reasons. `docs/browser-observation.md:610` documents credential-free exact-origin acquisition and retained failure context. `tests/boundary/browser/webSourceMapFetcher.test.ts:465-494` intentionally requires refusal of userinfo-bearing declarations without a request, but does not require this limitation sentence. - Failure source: `src/browser/WebSourceMapFetcher.ts:331-336,964-981` emits the origin-mismatch sentence after one predicate combining protocol, userinfo and origin checks. The executed userinfo case has `approved_origin` and `fetch_origin` both `https://app.example.test`, `fakeFetchCalls: 0`, collection `unavailable`, `requested: 1`, `processed: 1`, item `policy_filtered`, `effective_url: null`, and the quoted limitation. - Evidence provenance: observed production-module results; public-entry-point reachability is source-derived. - Local verification: reproduced at the capture/fetch/projection boundaries. No public CLI/MCP or live-browser runtime reproduction was run. - Reproduction completeness: complete for the shown module workflow; public transport was not exercised. Public-path source trace: `src/cli/browserCommands.ts:155-229` parses `analyze-web-bundle` with source capture and optional map fetching; `src/application/BrowserObservationService.ts:95-125` calls the provider and wraps its result as Evidence. `src/browser/CdpBrowserProvider.ts:193-245,360-450` reserves analysis, authorizes the selected HTTP(S) page, derives its origin scope, captures, fetches the retained map requests when selected, and preserves capture exclusions before analysis. `src/browser/CdpPageCapture.ts:77-124,148-235,283-311` admits the stable allowed main frame, routes matching-session events, captures scripts and forwards their map requests. `src/browser/CdpCaptureEventHandlers.ts:71-145,178-233` and `src/browser/CdpPageCaptureScripts.ts:242-258` admit this small, valid same-origin declaration, retain its sanitized identity and preserve the raw request URL. `src/browser/WebSourceMapFetcher.ts:102-140,183-219` has no cancellation, deadline or capacity reason to preempt this one small request. `src/domain/webSourceMapCoverage.ts:8-20` leaves its empty capture-exclusion set unchanged. `src/browser/IsolatedWebBundleAnalyzer.ts:234-236` and `src/domain/webBundleAnalyzerResult.ts:172-179,364-378` retain the source-map item and use a generic source-map unknown reason. These guards do not reject the declaration before the demonstrated fetcher guard; discovery, attachment and actual CDP transport remain unexecuted. The probe also observed an empty capture source-map exclusion list for both declarations. That list describes capture admission, whereas the item describes acquisition refusal; this difference is not independently claimed as a defect. ## Additional context The supplied index and full available bodies of 7,168 open/closed issues and PRs were searched for source maps, origin policy, userinfo, policy_filtered, embedded credentials and the diagnostic sentence. Related reports [#7301](https://github.com/morluto/rea/issues/7301) and [#7299](https://github.com/morluto/rea/issues/7299) concern capture comparison and source-location attribution respectively. [#829](https://github.com/morluto/rea/issues/829) discusses broader URL-policy vocabulary; merged [#1120](https://github.com/morluto/rea/pull/1120) deliberately preserves credential-policy differences with tests. Neither establishes that the literal origin-mismatch sentence is intentional or correct. Closed [#5952](https://github.com/morluto/rea/issues/5952) concerns lost capture exclusions, restored by a capture-exclusion projection that is present here. No exact duplicate was found in the supplied snapshot or the current upstream issue/PR search before submission. The listed historical discussions were not freshly rechecked. Restoration check: rerun the fixture and retain `policy_filtered`, zero fake-fetch calls, credential-free `declared_url` and null `effective_url` for the userinfo case, while its limitation no longer falsely reports an unapproved origin. Keep the plain-URL control included with one fake-fetch call and no map unknown. A genuinely unapproved origin must remain refused; that additional post-fix control is proposed, not executed here. No code was changed and no restoration was run. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: The observed defect is an inaccurate item limitation for a deliberately refused input; the refusal and plain-URL acquisition control remain correct, with no consequential behavior change observed. - Workaround status: available - Workaround basis: For the demonstrated declaration, compare its parsed origin with allowed_origins and interpret policy_filtered using the documented credential-free acquisition policy. This identifies the diagnostic mismatch without changing authority, fetching the refused URL or changing code.

bsakaguchi closed this issue

2026-10-31 00:49:09 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:37 +00:00

[PR #4355] fix(javascript): preserve loader getters across inactive defaults #6197

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425