morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2858] [MERGED] fix(browser): preserve script-specific parser uncertainty #5441

New issue

Closed

opened 2026-10-31 01:06:40 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:06:40 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2858
Author: @zhangguiping-xydt
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/browser-bundle-parse-coverage

📝 Commits (1)

c6902d3 fix(browser): preserve script-specific parser uncertainty

📊 Changes

3 files changed (+68 additions, -13 deletions)

View changed files

📝 src/domain/webBundleAnalyzer.test.ts (+42 -0)
📝 src/domain/webBundleAnalyzerInspection.ts (+7 -3)
📝 src/domain/webBundleAnalyzerResult.ts (+19 -10)

📄 Description

Summary

Fixes #2627 and #2625. Preserve parser recovery uncertainty in captured bundle analysis and attribute parse gaps only to the affected source artifacts.

Problem and expected behavior

What Problem This Solves

The configured Babel parser can return an AST together with recovery errors. Bundle analysis ignores those errors and reports complete coverage. Separately, a thrown parse failure marks every captured script as affected, including successfully analyzed peers.

User Impact

Agents receive partial coverage and the correct affected script identities, while useful route/endpoint findings remain available. A parser recovery diagnostic is not a claim that the browser rejected the script.

Change and scope

Why This Change Was Made

Retain failed and recovered script keys at the producing parser boundary. Derive the existing hard-failure count from failed keys, use both inventories for completeness, and project each inventory into its own explanatory unknown. Recovered scripts still count as parsed and retain their findings. This replaces the count-only representation that lost attribution.

Contract and boundary impact

Owner: captured JavaScript parsing and bundle-result projection.
Scope/maintainer decision: ordinary correction of existing passive analysis; advance decision not applicable.
CLI/MCP/catalog: no new field or schema. parse_failures still counts hard failures; recovery is visible through existing partial status/unknowns.
Evidence: source identities, usable findings, and the distinction between recovery and failure are preserved.
Provider, authority, cleanup: no new execution, mutation, provider, or network destination; live proof uses an owned page and Chrome profile.
Package, generated metadata, installation, migration: none.

Evidence and regression coverage

Evidence

Executed on Linux x64, Node 24.18.0 / npm 11.16.0, Chrome 138.0.7204.157. Load a localhost HTML page with a classic /app.js script:

function legacy(a,a) { return a; }
function request() { fetch('/partial'); }
window.legacyResult = legacy(1,2);

Chrome accepts the classic script; an independent page read returns window.legacyResult === 2. The configured bundle parser nevertheless recovers with a duplicate-parameter diagnostic. This makes parser uncertainty reachable through actual Chrome capture without a fabricated CDP reply or an executable malformed-source claim.

Run node scripts/rea.mjs analyze-web-bundle <loopback-cdp-endpoint> <target-id> --observation-ms 0 --format json. Also call analyze_web_bundle over stdio MCP with the same endpoint/target, allowed_origins: [pageOrigin], include_script_sources: true, and observation_ms: 0.

Both real public adapters	Before `cbe769b`	`c6902d3`
Completeness	`complete`	`partial`
Parsed / hard-failed scripts	1 / 0	1 / 0
Recovery explanation	absent	`javascript_ast` unknown, naming the affected script
`/partial` endpoint	retained	retained

The producer is unchanged between live-before cbe769b and branch base 6e25cc3. Two added regressions fail on that base (2 failed / 23 passed): recovered-error coverage and hard-failure attribution. They pair the affected source with a good script and verify the good script is absent from the parse-gap identities while its endpoint survives. Existing valid-source and hard-failure controls remain covered.

Validation performed

npm run test:focused -- src/domain/webBundleAnalyzer.test.ts — 25 passed.
npm run build:cached — passed; final compiled CLI and real stdio MCP return the corrected result above.
npm run check — attempted; pre-existing formatting failures in src/domain/functionComparison.test.ts and src/ida/IdaOperationRunner.ts, unchanged from base 6e25cc3.
Other check stages (typecheck, lint:built, knip, metadata:check) and npm run verify:architecture-guards — passed. Changed-file formatting and git diff --check pass.
CI pending at submission.

Compatibility, safety, and release

No public schema, dependency, or release changes. What was not tested: other OS/browser versions, the published package, and the full browser verifier. The unrecoverable-source attribution case is a source-analyzer regression, not a claim that Chrome emitted a parsed-script event for invalid JavaScript. No private application data or credentials are used.

Before merge

Concrete linked bugs with one shared representation fix.
Scope/authority resolved; focused Conventional Commit title.
Failing regressions, passing focused checks, real CLI/MCP outputs.
Observations, uncertainty, and source provenance remain distinct.
No generated contract/doc change required.
Final diff reviewed for unrelated edits, secrets, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2858 **Author:** [@zhangguiping-xydt](https://github.com/zhangguiping-xydt) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/browser-bundle-parse-coverage` --- ### 📝 Commits (1) - [`c6902d3`](https://github.com/morluto/rea/commit/c6902d3d95ed0bd92719897179580fbc8f3095f2) fix(browser): preserve script-specific parser uncertainty ### 📊 Changes **3 files changed** (+68 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/webBundleAnalyzer.test.ts` (+42 -0) 📝 `src/domain/webBundleAnalyzerInspection.ts` (+7 -3) 📝 `src/domain/webBundleAnalyzerResult.ts` (+19 -10) </details> ### 📄 Description ## Summary Fixes #2627 and #2625. Preserve parser recovery uncertainty in captured bundle analysis and attribute parse gaps only to the affected source artifacts. ## Problem and expected behavior ### What Problem This Solves The configured Babel parser can return an AST together with recovery errors. Bundle analysis ignores those errors and reports complete coverage. Separately, a thrown parse failure marks every captured script as affected, including successfully analyzed peers. ### User Impact Agents receive partial coverage and the correct affected script identities, while useful route/endpoint findings remain available. A parser recovery diagnostic is not a claim that the browser rejected the script. ## Change and scope ### Why This Change Was Made Retain failed and recovered script keys at the producing parser boundary. Derive the existing hard-failure count from failed keys, use both inventories for completeness, and project each inventory into its own explanatory unknown. Recovered scripts still count as parsed and retain their findings. This replaces the count-only representation that lost attribution. ## Contract and boundary impact - Owner: captured JavaScript parsing and bundle-result projection. - Scope/maintainer decision: ordinary correction of existing passive analysis; advance decision not applicable. - CLI/MCP/catalog: no new field or schema. `parse_failures` still counts hard failures; recovery is visible through existing partial status/unknowns. - Evidence: source identities, usable findings, and the distinction between recovery and failure are preserved. - Provider, authority, cleanup: no new execution, mutation, provider, or network destination; live proof uses an owned page and Chrome profile. - Package, generated metadata, installation, migration: none. ## Evidence and regression coverage ### Evidence Executed on Linux x64, Node 24.18.0 / npm 11.16.0, Chrome 138.0.7204.157. Load a localhost HTML page with a classic `/app.js` script: ```js function legacy(a,a) { return a; } function request() { fetch('/partial'); } window.legacyResult = legacy(1,2); ``` Chrome accepts the classic script; an independent page read returns `window.legacyResult === 2`. The configured bundle parser nevertheless recovers with a duplicate-parameter diagnostic. This makes parser uncertainty reachable through actual Chrome capture without a fabricated CDP reply or an executable malformed-source claim. Run `node scripts/rea.mjs analyze-web-bundle <loopback-cdp-endpoint> <target-id> --observation-ms 0 --format json`. Also call `analyze_web_bundle` over stdio MCP with the same endpoint/target, `allowed_origins: [pageOrigin]`, `include_script_sources: true`, and `observation_ms: 0`. | Both real public adapters | Before `cbe769b` | c6902d3 | | --- | --- | --- | | Completeness | `complete` | `partial` | | Parsed / hard-failed scripts | 1 / 0 | 1 / 0 | | Recovery explanation | absent | `javascript_ast` unknown, naming the affected script | | `/partial` endpoint | retained | retained | The producer is unchanged between live-before `cbe769b` and branch base `6e25cc3`. Two added regressions fail on that base (2 failed / 23 passed): recovered-error coverage and hard-failure attribution. They pair the affected source with a good script and verify the good script is absent from the parse-gap identities while its endpoint survives. Existing valid-source and hard-failure controls remain covered. ## Validation performed - `npm run test:focused -- src/domain/webBundleAnalyzer.test.ts` — 25 passed. - `npm run build:cached` — passed; final compiled CLI and real stdio MCP return the corrected result above. - `npm run check` — attempted; pre-existing formatting failures in `src/domain/functionComparison.test.ts` and `src/ida/IdaOperationRunner.ts`, unchanged from base `6e25cc3`. - Other check stages (`typecheck`, `lint:built`, `knip`, `metadata:check`) and `npm run verify:architecture-guards` — passed. Changed-file formatting and `git diff --check` pass. - CI pending at submission. ## Compatibility, safety, and release No public schema, dependency, or release changes. **What was not tested:** other OS/browser versions, the published package, and the full browser verifier. The unrecoverable-source attribution case is a source-analyzer regression, not a claim that Chrome emitted a parsed-script event for invalid JavaScript. No private application data or credentials are used. ## Before merge - [x] Concrete linked bugs with one shared representation fix. - [x] Scope/authority resolved; focused Conventional Commit title. - [x] Failing regressions, passing focused checks, real CLI/MCP outputs. - [x] Observations, uncertainty, and source provenance remain distinct. - [x] No generated contract/doc change required. - [x] Final diff reviewed for unrelated edits, secrets, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:06:40 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5441

No description provided.

Rows
Columns