morluto/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00
Code Issues 1.3k Projects Packages Wiki Activity

[GH-ISSUE #1442] [Bug] Assigning an object into a slot, then writing through it, reports a stale literal #490

New issue
Closed
opened 2026-10-15 18:25:31 +00:00 by bsakaguchi · 3 comments
bsakaguchi commented 2026-10-15 18:25:31 +00:00
Owner
Copy link

Originally created by @CassieFox23 on GitHub (Oct 10, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1442

TL;DR: Put an object into a slot, then write through that slot. REA misses the write. It reports the old value as a sure fact. No loop is needed. Real JS gives a different value.

Before submitting

  • I searched the open and closed issues for a related report.
  • I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The return shape says literal 1 here. Real JS returns 2.

export function result() {
  const shared = { x: 1 };
  const o = { a: { x: 0 } };
  o.a = shared;
  o.a.x = 2;
  return shared.x;
}

After o.a = shared, the slot o.a is shared. So o.a.x = 2 writes shared.x. REA does not link the two. It keeps the first value. The return-shape coverage still says complete.

When the object goes in at creation, REA is honest. const o = { a: shared } gives unknown. So the gap is the later assignment.

Reproduction

Save each form as app.js in its own folder. Run rea analyze-javascript-application <dir> --artifact-format directory --json. Then read static_return_shapes on result.

Form Real JS 6.3.0 main 0b9815b6 #1437 head 62bffde3
o.a = shared; o.a.x = 2 2 literal 1 literal 1 literal 1
arr[0] = shared; arr[0].x = 2 2 literal 1 literal 1 literal 1
o.a = shared; const t = o.a; t.x = 2 2 literal 1 literal 1 literal 1
const o = { a: shared }; o.a.x = 2 2 unknown
const arr = [shared]; arr[0].x = 2 2 unknown

Expected behavior

unknown, like the initializer forms. Or literal 2 if the write is followed. Never a literal that real JS can't produce.

Impact and scope

This is a wrong fact, not a lost one. A caller would trust literal 1. It is not new: 6.3.0 does it too. The same gap shows up in loops. arr[0] = shared; for (const t of arr) t.x = 2 gives literal 1 on main and on #1437. That PR fixes the loop form from #1428, so this is a separate root.

Interface

CLI. Also seen when calling the analysis function directly.

Earliest failure stage

Native analysis or reconstruction

Not run

Edit: Results for these are in the follow-up. The bug reaches further than this body says. macOS and Windows are still not run.

  • The MCP surface.
  • Deeper chains like o.a.b = shared.
  • Maps, sets and class fields.
  • macOS or Windows.

Found while testing #1437. Thanks to N0zoM1z0 for the quick loop fix that led here.

Test setup
  • Box: Nobara 44 (Fedora 44 base), Linux 7.2.9
  • CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
  • RAM: 32 GB DDR4-3600
  • Node: 22.23.1
  • REA: 6.3.0 (released package), main at 0b9815b6, #1437 at 62bffde3

🤖 Generated with Claude Code (Opus 5.5) 🦊

Originally created by @CassieFox23 on GitHub (Oct 10, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1442 **TL;DR:** Put an object into a slot, then write through that slot. REA misses the write. It reports the old value as a sure fact. No loop is needed. Real JS gives a different value. ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior The return shape says `literal 1` here. Real JS returns 2. ```js export function result() { const shared = { x: 1 }; const o = { a: { x: 0 } }; o.a = shared; o.a.x = 2; return shared.x; } ``` After `o.a = shared`, the slot `o.a` is `shared`. So `o.a.x = 2` writes `shared.x`. REA does not link the two. It keeps the first value. The return-shape coverage still says `complete`. When the object goes in at creation, REA is honest. `const o = { a: shared }` gives `unknown`. So the gap is the later assignment. ### Reproduction Save each form as `app.js` in its own folder. Run `rea analyze-javascript-application <dir> --artifact-format directory --json`. Then read `static_return_shapes` on `result`. | Form | Real JS | 6.3.0 | main `0b9815b6` | #1437 head `62bffde3` | |---|---|---|---|---| | `o.a = shared; o.a.x = 2` | 2 | `literal 1` | `literal 1` | `literal 1` | | `arr[0] = shared; arr[0].x = 2` | 2 | `literal 1` | `literal 1` | `literal 1` | | `o.a = shared; const t = o.a; t.x = 2` | 2 | `literal 1` | `literal 1` | `literal 1` | | `const o = { a: shared }; o.a.x = 2` | 2 | | `unknown` | | | `const arr = [shared]; arr[0].x = 2` | 2 | | `unknown` | | ### Expected behavior `unknown`, like the initializer forms. Or `literal 2` if the write is followed. Never a literal that real JS can't produce. ### Impact and scope This is a wrong fact, not a lost one. A caller would trust `literal 1`. It is not new: 6.3.0 does it too. The same gap shows up in loops. `arr[0] = shared; for (const t of arr) t.x = 2` gives `literal 1` on main and on #1437. That PR fixes the loop form from #1428, so this is a separate root. ### Interface CLI. Also seen when calling the analysis function directly. ### Earliest failure stage Native analysis or reconstruction ### Not run Edit: Results for these are in [the follow-up](https://github.com/morluto/rea/issues/1442#issuecomment-6094125652). The bug reaches further than this body says. macOS and Windows are still not run. - ~~The MCP surface.~~ - ~~Deeper chains like `o.a.b = shared`.~~ - ~~Maps, sets and class fields.~~ - macOS or Windows. Found while testing #1437. Thanks to N0zoM1z0 for the quick loop fix that led here. <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.9 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 22.23.1 - REA: 6.3.0 (released package), main at `0b9815b6`, #1437 at `62bffde3` </details> 🤖 Generated with Claude Code (Opus 5.5) 🦊
bsakaguchi commented 2026-10-15 18:25:32 +00:00
Author
Owner
Copy link

@CassieFox23 commented on GitHub (Oct 10, 2026):

TL;DR: I ran the tests from the Not run list. MCP gives the same wrong literal 1 as the CLI. So do Node 24 and 26. The bug reaches further than I said. Deeper chains, computed keys and spread copies all get it. Maps, sets and class fields stay honest.

WRONG: literal 1, but real JS returns 2

Each form puts shared in a slot, then writes x = 2 through it. Coverage still says complete on every row.

Form Real JS REA
o.a = shared; o.a.x = 2 (from the issue) 2 literal 1
o.a.b = shared; o.a.b.x = 2 2 literal 1
o.a = shared; o.a.inner.x = 2 (returns shared.inner.x) 2 literal 1
o.a = p; p.b = shared; o.a.b.x = 2 2 literal 1
const k = 'a'; o[k] = shared; o[k].x = 2 2 literal 1
o.a = other; o.a = shared; o.a.x = 2 2 literal 1
o.a = shared; const o2 = { ...o }; o2.a.x = 2 2 literal 1

Maps, sets and both class forms give an honest unknown. Five controls keep a correct literal 1. The fold below has every row.

Every cell above is the same in all of these:

  • 6.3.0, main 0b9815b6 and #1437 head 62bffde3.
  • Node 22.23.1, 24.18.0 and 26.11.1.
  • CLI and MCP. All 216 MCP calls matched the CLI.

#1437 has merged since. Main is now ce16f7bc9. Its src/domain/javascript is byte for byte the #1437 head. So the head column covers current main too.

One more thing stood out. A direct shared.x = 2 drops to unknown. The same write through a slot stays literal 1.

Still not run

Edit: The fresh build of main is done, in a new comment. Nothing changed.

  • A fresh build of current main ce16f7bc9. Its JavaScript code matches #1437 head. Under src/, one MCP contracts file differs. Tests and docs differ too.
  • macOS and Windows.
Full matrix (24 cases, same on every version and Node)
Case Real JS 6.3.0 / main / #1437 head Verdict
o.a = shared; o.a.x = 2 2 literal 1 WRONG
arr[0] = shared; arr[0].x = 2 2 literal 1 WRONG
o.a = shared; const t = o.a; t.x = 2 2 literal 1 WRONG
o.a.b = shared; o.a.b.x = 2 2 literal 1 WRONG
o.a = shared; o.a.inner.x = 2 2 literal 1 WRONG
o.a = p; p.b = shared; o.a.b.x = 2 2 literal 1 WRONG
o[k] = shared; o[k].x = 2 2 literal 1 WRONG
o.a = { x: 0 }; o.a = shared; o.a.x = 2 2 literal 1 WRONG
o.a = other; o.a = shared; o.a.x = 2 2 literal 1 WRONG
o.a = shared; o2 = { ...o }; o2.a.x = 2 2 literal 1 WRONG
const o = { a: shared }; o.a.x = 2 2 unknown honest
const arr = [shared]; arr[0].x = 2 2 unknown honest
m.set('k', shared); m.get('k').x = 2 2 unknown honest
new Set([shared]) + for…of write 2 unknown honest
s.add(shared) + for…of write 2 unknown honest
Class method this.a = s; this.a.x = 2 2 unknown honest
Static method C.a = s; C.a.x = 2 2 unknown honest
shared.x = 2 (direct) 2 unknown honest
o.a = { x: 5 }; o.a.x = 2 1 literal 1 correct
o.a = shared; o.a = { x: 5 }; o.a.x = 2 1 literal 1 correct
o.a = shared; o.a = { x: 0 }; o.a.x = 2 1 literal 1 correct
o.a = { ...shared }; o.a.x = 2 1 literal 1 correct
o.a = shared; const y = o.a.x; return shared.x 1 literal 1 correct
o.a = shared; const y = o.a.x; return shared.x + 0 * y 1 unknown honest

Each case starts with const shared = { x: 1 }. Each returns shared.x, except the inner case.

Commands
  • Real JS: import each app.js and call result(). Run on all three Nodes.
  • CLI: rea analyze-javascript-application <dir> --artifact-format directory --json. Read static_return_shapes and return_shape_coverage on result.
  • MCP: one stdio server (rea --mcp) per version and Node. A client on the repo's own @modelcontextprotocol/client calls analyze_javascript_application with format: "directory". Then it reads static_return_shapes from structuredContent.
  • All 216 CLI runs and 216 MCP calls exited clean.
Test setup
  • Box: Nobara 44 (Fedora 44 base), Linux 7.2.9
  • CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
  • RAM: 32 GB DDR4-3600
  • Node: 22.23.1, 24.18.0, 26.11.1
  • REA: 6.3.0 (released package), main at 0b9815b6, #1437 at 62bffde3
  • Current main ce16f7bc9: same src/domain/javascript as 62bffde3, not built

🤖 Generated with Claude Code (Opus 5.5) 🦊

<!-- gh-comment-id:6094125652 --> @CassieFox23 commented on GitHub (Oct 10, 2026): **TL;DR:** I ran the tests from the Not run list. MCP gives the same wrong `literal 1` as the CLI. So do Node 24 and 26. The bug reaches further than I said. Deeper chains, computed keys and spread copies all get it. Maps, sets and class fields stay honest. ### WRONG: `literal 1`, but real JS returns 2 Each form puts `shared` in a slot, then writes `x = 2` through it. Coverage still says `complete` on every row. | Form | Real JS | REA | |---|---|---| | `o.a = shared; o.a.x = 2` (from the issue) | 2 | `literal 1` | | `o.a.b = shared; o.a.b.x = 2` | 2 | `literal 1` | | `o.a = shared; o.a.inner.x = 2` (returns `shared.inner.x`) | 2 | `literal 1` | | `o.a = p; p.b = shared; o.a.b.x = 2` | 2 | `literal 1` | | `const k = 'a'; o[k] = shared; o[k].x = 2` | 2 | `literal 1` | | `o.a = other; o.a = shared; o.a.x = 2` | 2 | `literal 1` | | `o.a = shared; const o2 = { ...o }; o2.a.x = 2` | 2 | `literal 1` | Maps, sets and both class forms give an honest `unknown`. Five controls keep a correct `literal 1`. The fold below has every row. Every cell above is the same in all of these: - 6.3.0, main `0b9815b6` and #1437 head `62bffde3`. - Node 22.23.1, 24.18.0 and 26.11.1. - CLI and MCP. All 216 MCP calls matched the CLI. #1437 has merged since. Main is now `ce16f7bc9`. Its `src/domain/javascript` is byte for byte the #1437 head. So the head column covers current main too. One more thing stood out. A direct `shared.x = 2` drops to `unknown`. The same write through a slot stays `literal 1`. ### Still not run Edit: The fresh build of main is done, in [a new comment](https://github.com/morluto/rea/issues/1442#issuecomment-6094203030). Nothing changed. - ~~A fresh build of current main `ce16f7bc9`. Its JavaScript code matches #1437 head. Under `src/`, one MCP contracts file differs. Tests and docs differ too.~~ - macOS and Windows. <details> <summary>Full matrix (24 cases, same on every version and Node)</summary> | Case | Real JS | 6.3.0 / main / #1437 head | Verdict | |---|---|---|---| | `o.a = shared; o.a.x = 2` | 2 | `literal 1` | WRONG | | `arr[0] = shared; arr[0].x = 2` | 2 | `literal 1` | WRONG | | `o.a = shared; const t = o.a; t.x = 2` | 2 | `literal 1` | WRONG | | `o.a.b = shared; o.a.b.x = 2` | 2 | `literal 1` | WRONG | | `o.a = shared; o.a.inner.x = 2` | 2 | `literal 1` | WRONG | | `o.a = p; p.b = shared; o.a.b.x = 2` | 2 | `literal 1` | WRONG | | `o[k] = shared; o[k].x = 2` | 2 | `literal 1` | WRONG | | `o.a = { x: 0 }; o.a = shared; o.a.x = 2` | 2 | `literal 1` | WRONG | | `o.a = other; o.a = shared; o.a.x = 2` | 2 | `literal 1` | WRONG | | `o.a = shared; o2 = { ...o }; o2.a.x = 2` | 2 | `literal 1` | WRONG | | `const o = { a: shared }; o.a.x = 2` | 2 | `unknown` | honest | | `const arr = [shared]; arr[0].x = 2` | 2 | `unknown` | honest | | `m.set('k', shared); m.get('k').x = 2` | 2 | `unknown` | honest | | `new Set([shared])` + `for…of` write | 2 | `unknown` | honest | | `s.add(shared)` + `for…of` write | 2 | `unknown` | honest | | Class method `this.a = s; this.a.x = 2` | 2 | `unknown` | honest | | Static method `C.a = s; C.a.x = 2` | 2 | `unknown` | honest | | `shared.x = 2` (direct) | 2 | `unknown` | honest | | `o.a = { x: 5 }; o.a.x = 2` | 1 | `literal 1` | correct | | `o.a = shared; o.a = { x: 5 }; o.a.x = 2` | 1 | `literal 1` | correct | | `o.a = shared; o.a = { x: 0 }; o.a.x = 2` | 1 | `literal 1` | correct | | `o.a = { ...shared }; o.a.x = 2` | 1 | `literal 1` | correct | | `o.a = shared; const y = o.a.x; return shared.x` | 1 | `literal 1` | correct | | `o.a = shared; const y = o.a.x; return shared.x + 0 * y` | 1 | `unknown` | honest | Each case starts with `const shared = { x: 1 }`. Each returns `shared.x`, except the `inner` case. </details> <details> <summary>Commands</summary> - Real JS: import each `app.js` and call `result()`. Run on all three Nodes. - CLI: `rea analyze-javascript-application <dir> --artifact-format directory --json`. Read `static_return_shapes` and `return_shape_coverage` on `result`. - MCP: one stdio server (`rea --mcp`) per version and Node. A client on the repo's own `@modelcontextprotocol/client` calls `analyze_javascript_application` with `format: "directory"`. Then it reads `static_return_shapes` from `structuredContent`. - All 216 CLI runs and 216 MCP calls exited clean. </details> <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.9 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 22.23.1, 24.18.0, 26.11.1 - REA: 6.3.0 (released package), main at `0b9815b6`, #1437 at `62bffde3` - Current main `ce16f7bc9`: same `src/domain/javascript` as `62bffde3`, not built </details> 🤖 Generated with Claude Code (Opus 5.5) 🦊
bsakaguchi commented 2026-10-15 18:25:33 +00:00
Author
Owner
Copy link

@CassieFox23 commented on GitHub (Oct 10, 2026):

TL;DR: I built current main fresh and ran all 24 cases again. Nothing changed. The same 10 forms still give a wrong literal 1.

Main is now eeb83f658, two commits past ce16f7bc9. Its src/domain/javascript matches #1437 head 62bffde3 byte for byte. Three other src/ files differ. One is the MCP schema change from #1433. Two now load a package on first use.

Every cell matched my last comment. That held on Node 22, 24 and 26. It held for the CLI and for MCP. All 72 CLI runs and 72 MCP calls exited clean. Coverage still says complete on every row.

The tests next to the changed files pass on Node 24:

  • toolOutputReferences.test.ts: 6 of 6
  • outputValidatorReuse.test.ts: 2 of 2
  • cliStartupImports.test.ts: 2 of 2

Still not run

  • macOS and Windows.
Full matrix (24 cases, main eeb83f658)
Case Real JS CLI 22 / 24 / 26 MCP 22 / 24 / 26 Verdict
o.a = shared; o.a.x = 2 2 literal 1 literal 1 WRONG
arr[0] = shared; arr[0].x = 2 2 literal 1 literal 1 WRONG
o.a = shared; const t = o.a; t.x = 2 2 literal 1 literal 1 WRONG
o.a.b = shared; o.a.b.x = 2 2 literal 1 literal 1 WRONG
o.a = shared; o.a.inner.x = 2 2 literal 1 literal 1 WRONG
o.a = p; p.b = shared; o.a.b.x = 2 2 literal 1 literal 1 WRONG
o[k] = shared; o[k].x = 2 2 literal 1 literal 1 WRONG
o.a = { x: 0 }; o.a = shared; o.a.x = 2 2 literal 1 literal 1 WRONG
o.a = other; o.a = shared; o.a.x = 2 2 literal 1 literal 1 WRONG
o.a = shared; o2 = { ...o }; o2.a.x = 2 2 literal 1 literal 1 WRONG
const o = { a: shared }; o.a.x = 2 2 unknown unknown honest
const arr = [shared]; arr[0].x = 2 2 unknown unknown honest
m.set('k', shared); m.get('k').x = 2 2 unknown unknown honest
new Set([shared]) + for…of write 2 unknown unknown honest
s.add(shared) + for…of write 2 unknown unknown honest
Class method this.a = s; this.a.x = 2 2 unknown unknown honest
Static method C.a = s; C.a.x = 2 2 unknown unknown honest
shared.x = 2 (direct) 2 unknown unknown honest
o.a = { x: 5 }; o.a.x = 2 1 literal 1 literal 1 correct
o.a = shared; o.a = { x: 5 }; o.a.x = 2 1 literal 1 literal 1 correct
o.a = shared; o.a = { x: 0 }; o.a.x = 2 1 literal 1 literal 1 correct
o.a = { ...shared }; o.a.x = 2 1 literal 1 literal 1 correct
o.a = shared; const y = o.a.x; return shared.x 1 literal 1 literal 1 correct
o.a = shared; const y = o.a.x; return shared.x + 0 * y 1 unknown unknown honest

Each case starts with const shared = { x: 1 }. Each returns shared.x, except the inner case. The full shape objects match the #1437 head run too. That covers source ranges and field paths.

Commands
  • Build: git archive eeb83f658, then npm ci and npm run build on Node 24.
  • CLI: rea analyze-javascript-application <dir> --artifact-format directory --json.
  • MCP: one stdio server (rea --mcp) per Node. It calls analyze_javascript_application with format: "directory".
  • Tests: npx vitest run --project <name> <file> on Node 24.
Test setup
  • Box: Nobara 44 (Fedora 44 base), Linux 7.2.9
  • CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
  • RAM: 32 GB DDR4-3600
  • Node: 22.23.1, 24.18.0, 26.11.1
  • REA: main at eeb83f658

🤖 Generated with Claude Code (Opus 5.5) 🦊

<!-- gh-comment-id:6094203030 --> @CassieFox23 commented on GitHub (Oct 10, 2026): **TL;DR:** I built current main fresh and ran all 24 cases again. Nothing changed. The same 10 forms still give a wrong `literal 1`. Main is now `eeb83f658`, two commits past `ce16f7bc9`. Its `src/domain/javascript` matches #1437 head `62bffde3` byte for byte. Three other `src/` files differ. One is the MCP schema change from #1433. Two now load a package on first use. Every cell matched my last comment. That held on Node 22, 24 and 26. It held for the CLI and for MCP. All 72 CLI runs and 72 MCP calls exited clean. Coverage still says `complete` on every row. The tests next to the changed files pass on Node 24: - `toolOutputReferences.test.ts`: 6 of 6 - `outputValidatorReuse.test.ts`: 2 of 2 - `cliStartupImports.test.ts`: 2 of 2 ### Still not run - macOS and Windows. <details> <summary>Full matrix (24 cases, main eeb83f658)</summary> | Case | Real JS | CLI 22 / 24 / 26 | MCP 22 / 24 / 26 | Verdict | |---|---|---|---|---| | `o.a = shared; o.a.x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `arr[0] = shared; arr[0].x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `o.a = shared; const t = o.a; t.x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `o.a.b = shared; o.a.b.x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `o.a = shared; o.a.inner.x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `o.a = p; p.b = shared; o.a.b.x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `o[k] = shared; o[k].x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `o.a = { x: 0 }; o.a = shared; o.a.x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `o.a = other; o.a = shared; o.a.x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `o.a = shared; o2 = { ...o }; o2.a.x = 2` | 2 | `literal 1` | `literal 1` | WRONG | | `const o = { a: shared }; o.a.x = 2` | 2 | `unknown` | `unknown` | honest | | `const arr = [shared]; arr[0].x = 2` | 2 | `unknown` | `unknown` | honest | | `m.set('k', shared); m.get('k').x = 2` | 2 | `unknown` | `unknown` | honest | | `new Set([shared])` + `for…of` write | 2 | `unknown` | `unknown` | honest | | `s.add(shared)` + `for…of` write | 2 | `unknown` | `unknown` | honest | | Class method `this.a = s; this.a.x = 2` | 2 | `unknown` | `unknown` | honest | | Static method `C.a = s; C.a.x = 2` | 2 | `unknown` | `unknown` | honest | | `shared.x = 2` (direct) | 2 | `unknown` | `unknown` | honest | | `o.a = { x: 5 }; o.a.x = 2` | 1 | `literal 1` | `literal 1` | correct | | `o.a = shared; o.a = { x: 5 }; o.a.x = 2` | 1 | `literal 1` | `literal 1` | correct | | `o.a = shared; o.a = { x: 0 }; o.a.x = 2` | 1 | `literal 1` | `literal 1` | correct | | `o.a = { ...shared }; o.a.x = 2` | 1 | `literal 1` | `literal 1` | correct | | `o.a = shared; const y = o.a.x; return shared.x` | 1 | `literal 1` | `literal 1` | correct | | `o.a = shared; const y = o.a.x; return shared.x + 0 * y` | 1 | `unknown` | `unknown` | honest | Each case starts with `const shared = { x: 1 }`. Each returns `shared.x`, except the `inner` case. The full shape objects match the #1437 head run too. That covers source ranges and field paths. </details> <details> <summary>Commands</summary> - Build: `git archive eeb83f658`, then `npm ci` and `npm run build` on Node 24. - CLI: `rea analyze-javascript-application <dir> --artifact-format directory --json`. - MCP: one stdio server (`rea --mcp`) per Node. It calls `analyze_javascript_application` with `format: "directory"`. - Tests: `npx vitest run --project <name> <file>` on Node 24. </details> <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.9 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 22.23.1, 24.18.0, 26.11.1 - REA: main at `eeb83f658` </details> 🤖 Generated with Claude Code (Opus 5.5) 🦊
bsakaguchi commented 2026-10-15 18:25:33 +00:00
Author
Owner
Copy link

@CassieFox23 commented on GitHub (Oct 10, 2026):

TL;DR: Fixed on my box too. All 10 wrong forms now give unknown, not literal 1. That holds on Node 22, 24 and 26, through the CLI and MCP.

The full check is on https://github.com/morluto/rea/pull/1445. Three right answers turn into unknown, which is safe. One related form still slips through: a reference that a function call returns. It needs no slot, so I filed it as #1449.

Thanks, N0zoM1z0, for the fix in about an hour and a half.

🤖 Generated with Claude Code (Opus 5.5) 🦊

<!-- gh-comment-id:6094384311 --> @CassieFox23 commented on GitHub (Oct 10, 2026): **TL;DR:** Fixed on my box too. All 10 wrong forms now give `unknown`, not `literal 1`. That holds on Node 22, 24 and 26, through the CLI and MCP. The full check is on https://github.com/morluto/rea/pull/1445. Three right answers turn into `unknown`, which is safe. One related form still slips through: a reference that a function call returns. It needs no slot, so I filed it as #1449. Thanks, N0zoM1z0, for the fix in about an hour and a half. 🤖 Generated with Claude Code (Opus 5.5) 🦊
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels   
area: bridge

   
area: bridge

   
area: build

   
area: build

   
area: build

   
area: cli

   
area: domain

   
area: evidence

   
area: mcp

   
area: native

   
area: providers

   
area: runtime

   
area: server

   
area: setup

   
area: tests

   
bug

   
design

   
documentation

   
enhancement

   
enhancement

   
enhancement

   
experiment

   
help wanted

   
i18n

   
invalid

   
P0: critical

   
P1: high

   
P2: medium

   
P2: medium

   
P2: medium

   
P3: low

   
performance

   
provider-request

   
pull-request
Mirrored from GitHub Pull Request

  
question

   
roadmap

   
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#490
No description provided.