morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7672] [Bug] Electron guide labels an older renderer implementation as the downloadable example source #4596

New issue

Closed

opened 2026-10-31 00:51:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:51:07 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7672

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

The Electron CSV-export guide displays a renderer click listener under “renderer.js · example source,” but opening the renderer download linked on that same page gives a different implementation. The displayed listener directly awaits the export; the linked file delegates to a helper and catches export failures. The page does not label the displayed implementation as simplified or historical.

I independently compared the displayed and linked bytes at the baseline below. I also ran node scripts/rea.mjs analyze-javascript-application website/public/examples/notes-electron --json twice with isolated application state. Both analyzer runs exited 0 and reproduced all five IPC counters shown by the guide. The defect is the source presentation, with no demonstrated analyzer failure.

Reproduction

From the baseline checkout, run this comparison using Python's standard library. It decodes the first displayed source block and compares it with the renderer linked from the page:

python3 -I <<'PYTHON'
import hashlib, html, pathlib, re
page = pathlib.Path("website/public/guides/javascript/index.html").read_text()
fixture = pathlib.Path("website/public/examples/notes-electron/renderer.js").read_bytes()
block = html.unescape(re.search(r"<pre><code>(document[.]querySelector.*?)</code></pre>", page, re.S)[1]) + "\n"
evidence = pathlib.Path("website/evidence/guide-examples.md").read_text()
recorded = re.search(r"`examples/notes-electron/renderer[.]js`[^\n]*`([0-9a-f]{64})`", evidence)[1]
print("displayed source:", hashlib.sha256(block.encode()).hexdigest())
print("linked renderer:", hashlib.sha256(fixture).hexdigest())
print("same source:", block.encode() == fixture)
print("displayed source matches historical digest:", hashlib.sha256(block.encode()).hexdigest() == recorded)
print("HTML has a digest table:", "SHA-256" in page or recorded in page)
PYTHON

The displayed source hashes to b24aa22ed969c0849dd9da1102935a6b36b96bae46870234bdea10039dd9a5a0; the linked renderer hashes to 95db830a86cf8ea7ae95f273568e6cde3072c9992ce99394b7507ba13d2dcc42. The script prints same source: False, displayed source matches historical digest: True, and HTML has a digest table: False.

Inspect the guide HTML and the renderer file named by its download link. The label says “example source” and gives no simplification or historical-source qualification. For the introducing change, run:

git show 5938581b3733e955d8efc21d38b36be5ba08e15d -- website/public/examples/notes-electron/renderer.js

With Node.js v24.22.1 first on PATH, reproduce the successful analysis control below. The temporary package-runner fixtures answer version probes and reject package execution; HOME/XDG state is isolated and removed afterward. No Electron installation is needed.

python3 -I <<'PYTHON'
import json, os, pathlib, subprocess, tempfile
with tempfile.TemporaryDirectory() as temporary:
    root = pathlib.Path(temporary)
    bin_dir = root / "bin"
    bin_dir.mkdir()
    for name, version in (("npx", "11.11.0"), ("npm", "11.11.0"), ("bun", "1.3.0")):
        executable = bin_dir / name
        executable.write_text('#!/bin/sh\nif [ "$1" = "--version" ]; then echo "' + version + '"; exit 0; fi\necho "fixture denies package execution" >&2\nexit 1\n')
        executable.chmod(0o755)
    env = {"PATH": str(bin_dir) + os.pathsep + os.environ["PATH"], "NO_COLOR": "1"}
    for variable in ("HOME", "XDG_CONFIG_HOME", "XDG_CACHE_HOME", "XDG_DATA_HOME", "XDG_STATE_HOME", "TMPDIR"):
        directory = root / variable.lower()
        directory.mkdir()
        env[variable] = str(directory)
    result = subprocess.run(
        ["node", "scripts/rea.mjs", "analyze-javascript-application", "website/public/examples/notes-electron", "--json"],
        env=env, capture_output=True, text=True, timeout=90,
    )
    document = json.loads(result.stdout)
    ipc = document["normalized_result"]["summary"]["ipc"]
    fields = ("literal_channels", "renderer_transmissions", "main_handlers", "paired_renderer_transmissions", "ambiguous_renderer_transmissions")
    print("exit:", result.returncode)
    print(json.dumps({field: ipc[field] for field in fields}, sort_keys=True))
    if result.returncode:
        print(result.stderr)
PYTHON

It prints exit 0 and the five counters shown below. The source comparison reproduced in both independent comparisons; the analyzer control returned the same counters in both runs.

Expected behavior

A reader following the current download links should be able to identify the code being explained. Show the linked renderer's current implementation, or label the older/simplified presentation and identify its scope. The website's maintenance contract requires simplified source to be labeled and code excerpts to agree with their supporting evidence; exact locators appear below.

Keep the explicitly historical REA 4.1.0 recording and its source digests attributed to their original checkpoint. Their age alone does not require replacing them.

Impact and scope

P3: the source block's attribution is inaccurate, while the guide's demonstrated analysis workflow and expected IPC result still work. Readers can inspect the linked renderer to see its current helper and error handling. No wrong analyzer result or export-success failure was observed. Translated pages, built ZIP contents, the deployed website and a running Electron application were not tested.

Impact level: P3
Assessment status: supported
Impact basis: The guide labels a former implementation as example source without labeling the simplification; both current analysis controls preserve the advertised counters.
Workaround status: available
Workaround basis: The same page directly links the current renderer, whose bytes were independently read and compared.

REA version

Exact output of node scripts/rea.mjs --version:

6.8.0

Source baseline: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; arm64. Analysis used the already-built checkout CLI and a static six-file application fixture. No browser or native analysis provider was used.

Target and artifact context

The guide's displayed renderer source and the source-owned Notes Electron example it directly links for download and analysis.

Interface

Other

Earliest failure stage

Unknown

Relevant output or evidence

Source checked at the baseline:

website/public/guides/javascript/index.html:317-324: the source label and former renderer implementation. Lines 414-415 directly link the current renderer; lines 442-449 give the latest-package analysis command and expected result.
website/public/examples/notes-electron/renderer.js:1-11: current helper-based implementation and rejection handling.
website/style-guide.md:292-301: preserves target/source/version attribution and requires simplified source to be labeled. Lines 314-319 require checking downloadable files and agreement between code excerpts and supporting evidence.
website/evidence/guide-examples.md:33-37,105-118: explicitly historical source digests. The renderer row matches the displayed old source exactly. There is no digest table in the HTML guide.
website/AGENTS.md:51-53: preserve historical checkpoints and versions unless a new investigation supplies replacement evidence.
git show 5938581b3733e955d8efc21d38b36be5ba08e15d: replaces the renderer's inline listener; the guide is not changed in that commit. The renderer in its parent exactly matches the displayed block, including its final newline.

Selected output of both independent CLI controls:

{"ambiguous_renderer_transmissions":0,"literal_channels":1,"main_handlers":1,"paired_renderer_transmissions":1,"renderer_transmissions":1}

Both commands exited 0. The first analysis also reported four parsed JavaScript files and zero parse failures. Neither run produced a cleanup failure.

Analysis or suspected cause

The fixture changed independently of the guide's source presentation. The page remains a current walkthrough: it links the current files and asks readers to run the latest package, while separately identifying its result as a REA 4.1.0 recording. The historical evidence table correctly describes that recording; the source label is the part that needs clarification or synchronization.

Additional context

Read-only searches covered open/closed issues, PRs including merged work, and issue comments. Related #5955 concerns a different canonical example's analysis counters, #2156 excludes website content, #3423 concerns installation/observation wording, and #7598 concerns a rejected pause deadline. The demo tracker #778 and PR #1704 discuss a separate demo portfolio. None reports this source-block mismatch. Historical-checkpoint PR #1296 supports preserving the old digest table.

Originally created by @coygeek on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7672 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Documentation ### Observed behavior The Electron CSV-export guide displays a renderer click listener under “renderer.js · example source,” but opening the renderer download linked on that same page gives a different implementation. The displayed listener directly awaits the export; the linked file delegates to a helper and catches export failures. The page does not label the displayed implementation as simplified or historical. I independently compared the displayed and linked bytes at the baseline below. I also ran `node scripts/rea.mjs analyze-javascript-application website/public/examples/notes-electron --json` twice with isolated application state. Both analyzer runs exited 0 and reproduced all five IPC counters shown by the guide. The defect is the source presentation, with no demonstrated analyzer failure. ### Reproduction 1. From the baseline checkout, run this comparison using Python's standard library. It decodes the first displayed source block and compares it with the renderer linked from the page: ```sh python3 -I <<'PYTHON' import hashlib, html, pathlib, re page = pathlib.Path("website/public/guides/javascript/index.html").read_text() fixture = pathlib.Path("website/public/examples/notes-electron/renderer.js").read_bytes() block = html.unescape(re.search(r"<pre><code>(document[.]querySelector.*?)</code></pre>", page, re.S)[1]) + "\n" evidence = pathlib.Path("website/evidence/guide-examples.md").read_text() recorded = re.search(r"`examples/notes-electron/renderer[.]js`[^\n]*`([0-9a-f]{64})`", evidence)[1] print("displayed source:", hashlib.sha256(block.encode()).hexdigest()) print("linked renderer:", hashlib.sha256(fixture).hexdigest()) print("same source:", block.encode() == fixture) print("displayed source matches historical digest:", hashlib.sha256(block.encode()).hexdigest() == recorded) print("HTML has a digest table:", "SHA-256" in page or recorded in page) PYTHON ``` The displayed source hashes to `b24aa22ed969c0849dd9da1102935a6b36b96bae46870234bdea10039dd9a5a0`; the linked renderer hashes to `95db830a86cf8ea7ae95f273568e6cde3072c9992ce99394b7507ba13d2dcc42`. The script prints `same source: False`, `displayed source matches historical digest: True`, and `HTML has a digest table: False`. 2. Inspect the guide HTML and the renderer file named by its download link. The label says “example source” and gives no simplification or historical-source qualification. For the introducing change, run: ```sh git show 5938581b3733e955d8efc21d38b36be5ba08e15d -- website/public/examples/notes-electron/renderer.js ``` 3. With Node.js v24.22.1 first on PATH, reproduce the successful analysis control below. The temporary package-runner fixtures answer version probes and reject package execution; HOME/XDG state is isolated and removed afterward. No Electron installation is needed. ```sh python3 -I <<'PYTHON' import json, os, pathlib, subprocess, tempfile with tempfile.TemporaryDirectory() as temporary: root = pathlib.Path(temporary) bin_dir = root / "bin" bin_dir.mkdir() for name, version in (("npx", "11.11.0"), ("npm", "11.11.0"), ("bun", "1.3.0")): executable = bin_dir / name executable.write_text('#!/bin/sh\nif [ "$1" = "--version" ]; then echo "' + version + '"; exit 0; fi\necho "fixture denies package execution" >&2\nexit 1\n') executable.chmod(0o755) env = {"PATH": str(bin_dir) + os.pathsep + os.environ["PATH"], "NO_COLOR": "1"} for variable in ("HOME", "XDG_CONFIG_HOME", "XDG_CACHE_HOME", "XDG_DATA_HOME", "XDG_STATE_HOME", "TMPDIR"): directory = root / variable.lower() directory.mkdir() env[variable] = str(directory) result = subprocess.run( ["node", "scripts/rea.mjs", "analyze-javascript-application", "website/public/examples/notes-electron", "--json"], env=env, capture_output=True, text=True, timeout=90, ) document = json.loads(result.stdout) ipc = document["normalized_result"]["summary"]["ipc"] fields = ("literal_channels", "renderer_transmissions", "main_handlers", "paired_renderer_transmissions", "ambiguous_renderer_transmissions") print("exit:", result.returncode) print(json.dumps({field: ipc[field] for field in fields}, sort_keys=True)) if result.returncode: print(result.stderr) PYTHON ``` It prints exit 0 and the five counters shown below. The source comparison reproduced in both independent comparisons; the analyzer control returned the same counters in both runs. ### Expected behavior A reader following the current download links should be able to identify the code being explained. Show the linked renderer's current implementation, or label the older/simplified presentation and identify its scope. The website's maintenance contract requires simplified source to be labeled and code excerpts to agree with their supporting evidence; exact locators appear below. Keep the explicitly historical REA 4.1.0 recording and its source digests attributed to their original checkpoint. Their age alone does not require replacing them. ### Impact and scope P3: the source block's attribution is inaccurate, while the guide's demonstrated analysis workflow and expected IPC result still work. Readers can inspect the linked renderer to see its current helper and error handling. No wrong analyzer result or export-success failure was observed. Translated pages, built ZIP contents, the deployed website and a running Electron application were not tested. - Impact level: P3 - Assessment status: supported - Impact basis: The guide labels a former implementation as example source without labeling the simplification; both current analysis controls preserve the advertised counters. - Workaround status: available - Workaround basis: The same page directly links the current renderer, whose bytes were independently read and compared. ### REA version Exact output of `node scripts/rea.mjs --version`: ```text 6.8.0 ``` Source baseline: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js `v24.22.1`; macOS 27.0.1; arm64. Analysis used the already-built checkout CLI and a static six-file application fixture. No browser or native analysis provider was used. ### Target and artifact context The guide's displayed renderer source and the source-owned Notes Electron example it directly links for download and analysis. ### Interface Other ### Earliest failure stage Unknown ### Relevant output or evidence Source checked at the baseline: - `website/public/guides/javascript/index.html:317-324`: the source label and former renderer implementation. Lines 414-415 directly link the current renderer; lines 442-449 give the latest-package analysis command and expected result. - `website/public/examples/notes-electron/renderer.js:1-11`: current helper-based implementation and rejection handling. - `website/style-guide.md:292-301`: preserves target/source/version attribution and requires simplified source to be labeled. Lines 314-319 require checking downloadable files and agreement between code excerpts and supporting evidence. - `website/evidence/guide-examples.md:33-37,105-118`: explicitly historical source digests. The renderer row matches the displayed old source exactly. There is no digest table in the HTML guide. - `website/AGENTS.md:51-53`: preserve historical checkpoints and versions unless a new investigation supplies replacement evidence. - `git show 5938581b3733e955d8efc21d38b36be5ba08e15d`: replaces the renderer's inline listener; the guide is not changed in that commit. The renderer in its parent exactly matches the displayed block, including its final newline. Selected output of both independent CLI controls: ```json {"ambiguous_renderer_transmissions":0,"literal_channels":1,"main_handlers":1,"paired_renderer_transmissions":1,"renderer_transmissions":1} ``` Both commands exited 0. The first analysis also reported four parsed JavaScript files and zero parse failures. Neither run produced a cleanup failure. ### Analysis or suspected cause The fixture changed independently of the guide's source presentation. The page remains a current walkthrough: it links the current files and asks readers to run the latest package, while separately identifying its result as a REA 4.1.0 recording. The historical evidence table correctly describes that recording; the source label is the part that needs clarification or synchronization. ### Additional context Read-only searches covered open/closed issues, PRs including merged work, and issue comments. Related #5955 concerns a different canonical example's analysis counters, #2156 excludes website content, #3423 concerns installation/observation wording, and #7598 concerns a rejected pause deadline. The demo tracker #778 and PR #1704 discuss a separate demo portfolio. None reports this source-block mismatch. Historical-checkpoint PR #1296 supports preserving the old digest table.

bsakaguchi closed this issue

2026-10-31 00:51:07 +00:00

bsakaguchi referenced this issue

2026-10-31 01:13:37 +00:00

[PR #4596] [CLOSED] fix(ghidra): reject seed files that grow during commitment read #6329