[GH-ISSUE #1882] [Bug] Retained prefixed source maps lose original-source evidence during application analysis #636

New issue

Closed

opened 2026-10-15 18:26:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:49 +00:00

Owner

Originally created by @xu91102 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1882

Before submitting

Searched open and closed issues and recent pull requests for related reports, including #1642 (browser collection/point tracing).
This report uses a source-owned fixture without credentials or private target data.

Area

Evidence, artifacts, or reconstruction — retained JavaScript source maps.

Observed behavior

Analyzing an application directory drops the original-source declarations from a retained source map that starts with the standard )]}' response prefix. The CLI exits successfully but marks graph coverage partial. Removing only the prefix restores complete coverage and the original source node.

Browser collection and point tracing already understand this prefix. Browser collection preserves the response text and digest, so analyzing those retained bytes should use the same parsing view rather than reject the response framing as JSON.

Reproduction

In a built source checkout, create fixture/bundle.js:

export const answer = 42;
//# sourceMappingURL=bundle.js.map

Create fixture/bundle.js.map with these exact two lines:

)]}'
{"version":3,"sources":["original.ts"],"sourcesContent":["export const answer: number = 42;"],"names":[],"mappings":"AAAA"}

Run:

node scripts/rea.mjs analyze-javascript-application "$(pwd)/fixture" --json > observed.json
node --input-type=module -e '
import fs from "node:fs";
const graph = JSON.parse(fs.readFileSync("observed.json", "utf8")).normalized_result.graph;
console.log(graph.coverage.status);
console.log(graph.nodes.filter(n => n.identity.strategy === "source-map-original").map(n => n.identity.original_source));
'

Observed twice on the affected base:

partial
[]

Delete only the first line of the map and repeat. The control returns:

complete
[ 'original.ts' ]

Expected behavior

Recover original.ts and its embedded content digest from the retained map. Normalize the BOM/response-prefix only for parsing, preserving the original map's bytes, SHA-256, source declaration, and provenance. Malformed JSON or prefix-only input must remain invalid.

ECMA-426 FetchSourceMap defines the HTTP response framing. The fixture models an already retained response, not a request to fetch a remote map.

Impact and scope

Offline application reconstruction can lose original-source evidence from maps that REA can already collect or trace. No browser or native analysis engine is needed to reproduce the directory-analysis failure.

Version and runtime

Source revision: fb94d9dde0ccda83ae520ac6fb22b1d283562cf3 (main).
Node 24.18.0, npm 11.16.0, macOS 27.0.1 arm64.
Interface: CLI.
Earliest failure stage: retained source-map text parsing.

Source-derived analysis

JavaScriptArtifactAnalysis.ts passes retained map text directly to JSON.parse, whereas browser collection and point tracing use sourceMapJsonText. Sharing the existing normalization at the format-owning domain boundary would keep these consumers consistent.

Originally created by @xu91102 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1882 ### Before submitting - [x] Searched open and closed issues and recent pull requests for related reports, including #1642 (browser collection/point tracing). - [x] This report uses a source-owned fixture without credentials or private target data. ### Area Evidence, artifacts, or reconstruction — retained JavaScript source maps. ### Observed behavior Analyzing an application directory drops the original-source declarations from a retained source map that starts with the standard `)]}'` response prefix. The CLI exits successfully but marks graph coverage partial. Removing only the prefix restores complete coverage and the original source node. Browser collection and point tracing already understand this prefix. Browser collection preserves the response text and digest, so analyzing those retained bytes should use the same parsing view rather than reject the response framing as JSON. ### Reproduction In a built source checkout, create `fixture/bundle.js`: ```js export const answer = 42; //# sourceMappingURL=bundle.js.map ``` Create `fixture/bundle.js.map` with these exact two lines: ```text )]}' {"version":3,"sources":["original.ts"],"sourcesContent":["export const answer: number = 42;"],"names":[],"mappings":"AAAA"} ``` Run: ```sh node scripts/rea.mjs analyze-javascript-application "$(pwd)/fixture" --json > observed.json node --input-type=module -e ' import fs from "node:fs"; const graph = JSON.parse(fs.readFileSync("observed.json", "utf8")).normalized_result.graph; console.log(graph.coverage.status); console.log(graph.nodes.filter(n => n.identity.strategy === "source-map-original").map(n => n.identity.original_source)); ' ``` Observed twice on the affected base: ```text partial [] ``` Delete only the first line of the map and repeat. The control returns: ```text complete [ 'original.ts' ] ``` ### Expected behavior Recover `original.ts` and its embedded content digest from the retained map. Normalize the BOM/response-prefix only for parsing, preserving the original map's bytes, SHA-256, source declaration, and provenance. Malformed JSON or prefix-only input must remain invalid. [ECMA-426 FetchSourceMap](https://tc39.es/ecma426/#sec-fetchsourcemap) defines the HTTP response framing. The fixture models an already retained response, not a request to fetch a remote map. ### Impact and scope Offline application reconstruction can lose original-source evidence from maps that REA can already collect or trace. No browser or native analysis engine is needed to reproduce the directory-analysis failure. ### Version and runtime - Source revision: `fb94d9dde0ccda83ae520ac6fb22b1d283562cf3` (`main`). - Node 24.18.0, npm 11.16.0, macOS 27.0.1 arm64. - Interface: CLI. - Earliest failure stage: retained source-map text parsing. ### Source-derived analysis `JavaScriptArtifactAnalysis.ts` passes retained map text directly to `JSON.parse`, whereas browser collection and point tracing use `sourceMapJsonText`. Sharing the existing normalization at the format-owning domain boundary would keep these consumers consistent.

bsakaguchi

2026-10-15 18:26:49 +00:00