morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8411] [Bug] analyze-javascript-application on GitHub Desktop 3.6.5 fails at the final Evidence checkpoint and keeps nothing #6592

New issue

Closed

opened 2026-11-01 21:12:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:12:31 +00:00

Owner

Originally created by @Plastic-time on GitHub (Nov 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8411

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

I ran analyze-javascript-application on GitHub Desktop 3.6.5 for Windows with default settings. It runs for 228 s, finishes the analysis, and then exits 1 at the final checkpoint:

resource_constraint: Insufficient heap headroom to authenticate the Evidence checkpoint
reported_limits:
  projected_value_bytes:        1,406,099,444
  serialized_json_utf16_bytes:    467,779,272
  authentication_bytes:         3,747,757,432
  available_heap_bytes:         3,194,732,944

The --evidence_output file is not written, so the whole run is lost. Stdout carries the complete partial Evidence instead of the summary (234 MB); that part is #7787.

The payload shows that the semantic graph filled its default node cap exactly: 100,000 nodes, 90,390 relations and 74,989 unknowns, 205 MiB in total. Most of that came from the bundled copilot/* SDK files. Meanwhile renderer.js, the app's 3.1 MB main UI bundle, hit the 1024 MiB worker heap and is only listed as a limitation, and so are crash.js and copilot/app.js.

With every option at its default, the analyzer retains more than the CLI's default heap can authenticate at the end.

Reproduction

Install GitHub Desktop 3.6.5 for Windows (https://desktop.github.com/, MIT, source at https://github.com/desktop/desktop). The installer puts the app in %LOCALAPPDATA%\GitHubDesktop\app-3.6.5.
Run rea analyze-javascript-application "%LOCALAPPDATA%\GitHubDesktop\app-3.6.5\resources\app" --detail summary --evidence_output out.json --format json.
After about 4 minutes the command exits 1 with the error above, and out.json does not exist.

Workaround: with NODE_OPTIONS=--max-old-space-size=8192, the same command exits 0 after 208 s. It writes out.json (233,889,503 bytes) and prints the 19 KB summary. So the analysis itself fits; only the CLI process's default heap is too small for the final authentication.

Expected behavior

Default limits that fit together, so that a default run either completes or degrades, for example by keeping the Evidence that fits. A finished analysis should not be discarded at the last step. If more heap is the only way through, the remediation could name the lever. At the moment it says "Review the reported worker memory limits and available host memory".

Impact and scope

A mainstream open-source Electron app cannot be analyzed as a whole with default settings, and the failure only shows up after minutes of work. Measured on one machine: one run with the default heap failed, one run with an 8 GB heap succeeded. Not tried on Linux or macOS.

REA version

6.8.0 (rea --version), source commit 6e9ee97a6 on main

Runtime and platform

Node 24.22.1; Windows 11 x64 (10.0.26200); 32 GB RAM

Target and artifact context

GitHub Desktop 3.6.5 for Windows, resources/app directory (Electron; 256 relevant files, 39 MB of text read, 152 JavaScript files parsed)

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

Statistics from the partial Evidence: relevant_files 256, parsed_javascript_files 152, visited_ast_nodes 1,302,766, findings 4,991. Sizes inside normalized_result: semantic_graph 205.1 MiB (nodes 83.8, relations 55.8, unknowns 49.0, fingerprints 9.3, coverage 5.7) and graph 17.9 MiB.

Analysis or suspected cause

Authentication is estimated at about 8× the UTF-16 size of the serialized Evidence (3.75 GB for 468 MB). The default node and unknown caps do not bound that size. #2092 (bounding semantic graphs by serialized bytes) looks like it would address this. Related: #7787 (--evidence_output and stdout on failure), #8294 and #6127 (worker heap on single large files).

Originally created by @Plastic-time on GitHub (Nov 1, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8411 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior I ran `analyze-javascript-application` on GitHub Desktop 3.6.5 for Windows with default settings. It runs for 228 s, finishes the analysis, and then exits 1 at the final checkpoint: ```text resource_constraint: Insufficient heap headroom to authenticate the Evidence checkpoint reported_limits: projected_value_bytes: 1,406,099,444 serialized_json_utf16_bytes: 467,779,272 authentication_bytes: 3,747,757,432 available_heap_bytes: 3,194,732,944 ``` The `--evidence_output` file is not written, so the whole run is lost. Stdout carries the complete partial Evidence instead of the summary (234 MB); that part is #7787. The payload shows that the semantic graph filled its default node cap exactly: 100,000 nodes, 90,390 relations and 74,989 unknowns, 205 MiB in total. Most of that came from the bundled `copilot/*` SDK files. Meanwhile `renderer.js`, the app's 3.1 MB main UI bundle, hit the 1024 MiB worker heap and is only listed as a limitation, and so are `crash.js` and `copilot/app.js`. With every option at its default, the analyzer retains more than the CLI's default heap can authenticate at the end. ### Reproduction 1. Install GitHub Desktop 3.6.5 for Windows (https://desktop.github.com/, MIT, source at https://github.com/desktop/desktop). The installer puts the app in `%LOCALAPPDATA%\GitHubDesktop\app-3.6.5`. 2. Run `rea analyze-javascript-application "%LOCALAPPDATA%\GitHubDesktop\app-3.6.5\resources\app" --detail summary --evidence_output out.json --format json`. 3. After about 4 minutes the command exits 1 with the error above, and `out.json` does not exist. Workaround: with `NODE_OPTIONS=--max-old-space-size=8192`, the same command exits 0 after 208 s. It writes `out.json` (233,889,503 bytes) and prints the 19 KB summary. So the analysis itself fits; only the CLI process's default heap is too small for the final authentication. ### Expected behavior Default limits that fit together, so that a default run either completes or degrades, for example by keeping the Evidence that fits. A finished analysis should not be discarded at the last step. If more heap is the only way through, the remediation could name the lever. At the moment it says "Review the reported worker memory limits and available host memory". ### Impact and scope A mainstream open-source Electron app cannot be analyzed as a whole with default settings, and the failure only shows up after minutes of work. Measured on one machine: one run with the default heap failed, one run with an 8 GB heap succeeded. Not tried on Linux or macOS. ### REA version 6.8.0 (`rea --version`), source commit 6e9ee97a6 on `main` ### Runtime and platform Node 24.22.1; Windows 11 x64 (10.0.26200); 32 GB RAM ### Target and artifact context GitHub Desktop 3.6.5 for Windows, `resources/app` directory (Electron; 256 relevant files, 39 MB of text read, 152 JavaScript files parsed) ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence Statistics from the partial Evidence: `relevant_files` 256, `parsed_javascript_files` 152, `visited_ast_nodes` 1,302,766, `findings` 4,991. Sizes inside `normalized_result`: `semantic_graph` 205.1 MiB (nodes 83.8, relations 55.8, unknowns 49.0, fingerprints 9.3, coverage 5.7) and `graph` 17.9 MiB. ### Analysis or suspected cause Authentication is estimated at about 8× the UTF-16 size of the serialized Evidence (3.75 GB for 468 MB). The default node and unknown caps do not bound that size. #2092 (bounding semantic graphs by serialized bytes) looks like it would address this. Related: #7787 (`--evidence_output` and stdout on failure), #8294 and #6127 (worker heap on single large files).

bsakaguchi closed this issue

2026-11-04 12:09:25 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6592

No description provided.

Rows
Columns