[PR #6087] [CLOSED] fix(javascript): record unavailable HTML reference parsing for undecodable text #7143

Closed
opened 2026-11-01 21:45:42 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6087
Author: @wentaohong
Created: 10/21/2026
Status: ❌ Closed

Base: main ← Head: fix/5951-undecodable-html-scope


📝 Commits (1)

  • 5abd7e5 fix(javascript): record unavailable HTML reference parsing for undecodable text

📊 Changes

2 files changed (+58 additions, -0 deletions)

View changed files

📝 src/application/javascript/JavaScriptArtifactGraphStructure.ts (+7 -0)
📝 tests/boundary/filesystem/javascriptArtifactReconstruction.test.ts (+51 -0)

📄 Description

Summary

Fixes #5951. analyze-javascript-application returned partial Evidence for a selected index.html containing invalid UTF-8, but the graph had no unknown processing scope for that file, so consumers enumerating unknown scopes could not discover that HTML reference discovery was skipped.

Problem and expected behavior

Smallest trigger: a directory artifact with package.json, main.js, data.json, and index.html = <script src="main.js"></script> followed by byte 0xff, all four files selected. Observed on the base revision: text_status: "invalid-utf8", parse_status: null, coverage partial, zero unknown nodes, zero HTML loads. The invalid-UTF-8 JSON control in the same run did produce a parse-json-module unknown.

Expected: keep the HTML inventory observation and partial coverage, and record one unknown scope for index.html with operation: "parse-html-script-references", artifact-byte authority, and a decoding limitation — the same structured form as unreadable JSON and JavaScript inputs.

Change and scope

One branch in addJavaScriptArtifactFiles (src/application/javascript/JavaScriptArtifactGraphStructure.ts): when a selected HTML file's text is unavailable, project the existing javascriptArtifactAnalysisScopes.html scope via addUnavailableStaticParseScope with limitation HTML text was unavailable: <reason>.

The branch sits in the existing else if chain after the outside-analysis-scope, interruption (analysis_failure), and JavaScript branches, so unselected and interrupted HTML keep their single existing scope instead of gaining a duplicate. No reader, analysis, schema, CLI/MCP, or docs changes. Ordinary fix within existing boundaries; no maintainer scope decision required.

Contract and boundary impact

  • Semantic owner and earliest changed stage: application-layer graph projection (JavaScriptArtifactGraphStructure); artifact reading and HTML extraction are unchanged.
  • Contribution scope fit and linked maintainer decision: routine bug fix; not applicable.
  • CLI and MCP/tool-catalog contract: unchanged surface; both adapters share this workflow and gain the additional unknown node/edge for undecodable HTML only.
  • Provider, bridge, target-format, or platform compatibility: none. Directory and ASAR files share the same projection; ASAR was not separately exercised (see proof gaps).
  • Evidence, artifact, provenance, or reconstruction contract: additive — one unknown node with unavailable Evidence for undecodable selected HTML. Inventory text_status, coverage, and valid-HTML output are unchanged.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): read-only static analysis of caller-selected files; no target execution.
  • Generated metadata, package, or installation impact: none.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: keeps undecodable HTML script-reference discovery as an explicit unknown in tests/boundary/filesystem/javascriptArtifactReconstruction.test.ts. It reconstructs a directory artifact whose index.html is a script tag plus 0xff and asserts the preserved invalid-utf8 inventory, partial coverage, exactly one parse-html-script-references unknown with artifact-bytes/unavailable/unknown Evidence, and no fabricated load edge.
  • Base reproduction or other evidence: executed. The new test failed on the base revision with expected [] to have a length of 1 (zero unknowns for index.html). The issue's four-case public CLI script was also run against the built CLI after the fix:
    • invalid-html: unknown: [{path: "index.html", operation: "parse-html-script-references"}], coverage partial (fixed; was unknown: []).
    • valid-empty-html: unknown: [], coverage complete (unchanged).
    • valid-reference-html: unknown: [], html_loads: 1, coverage complete (unchanged).
    • invalid-json-control: unknown: [{path: "data.json", operation: "parse-json-module"}] (unchanged).
  • User-visible CLI/MCP output (if applicable): see the four-case output above (CLI). MCP shares the workflow; no separate MCP run was performed.
  • Remaining proof gaps: ASAR-contained undecodable HTML and interrupted HTML rely on the shared projection and else if ordering (source-derived, not separately executed). No real-provider coverage applies to this static path.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run test:focused -- tests/boundary/filesystem/javascriptArtifactReconstruction.test.ts — 14 passed (new test failed before the fix, passes after).
  • npm run test:local -- src/application/javascript/JavaScriptArtifactGraphStructure.test.ts — 16 passed.
  • npm run test:changed — 19 passed (3 files).
  • npm run check:fast — typecheck and lint passed.
  • npm run build:cached + issue four-case CLI script (analyze-javascript-application via scripts/rea.mjs) — output above; all four invocations exited successfully.

Note: #6073 already proposes an equivalent fix for this issue. Close this PR in favor of that one if it lands first.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; additive unknown for previously silent gap.
  • Real Hopper/Ghidra, browser, or OS coverage: not applicable (static JavaScript/HTML artifact analysis; tested on macOS arm64, Node 24.18.0).
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no new execution, network, or mutation; limitation text only echoes the fixed text-unavailable reason.

Author readiness

Human owner:

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6087 **Author:** [@wentaohong](https://github.com/wentaohong) **Created:** 10/21/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/5951-undecodable-html-scope` --- ### 📝 Commits (1) - [`5abd7e5`](https://github.com/morluto/rea/commit/5abd7e5bcf45ac7b7ceae136eb65b6dce9e94bc8) fix(javascript): record unavailable HTML reference parsing for undecodable text ### 📊 Changes **2 files changed** (+58 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `src/application/javascript/JavaScriptArtifactGraphStructure.ts` (+7 -0) 📝 `tests/boundary/filesystem/javascriptArtifactReconstruction.test.ts` (+51 -0) </details> ### 📄 Description ## Summary Fixes #5951. `analyze-javascript-application` returned partial Evidence for a selected `index.html` containing invalid UTF-8, but the graph had no unknown processing scope for that file, so consumers enumerating unknown scopes could not discover that HTML reference discovery was skipped. ## Problem and expected behavior Smallest trigger: a directory artifact with `package.json`, `main.js`, `data.json`, and `index.html` = `<script src="main.js"></script>` followed by byte `0xff`, all four files selected. Observed on the base revision: `text_status: "invalid-utf8"`, `parse_status: null`, coverage `partial`, zero unknown nodes, zero HTML loads. The invalid-UTF-8 JSON control in the same run did produce a `parse-json-module` unknown. Expected: keep the HTML inventory observation and partial coverage, and record one unknown scope for `index.html` with `operation: "parse-html-script-references"`, artifact-byte authority, and a decoding limitation — the same structured form as unreadable JSON and JavaScript inputs. ## Change and scope One branch in `addJavaScriptArtifactFiles` (`src/application/javascript/JavaScriptArtifactGraphStructure.ts`): when a selected HTML file's text is unavailable, project the existing `javascriptArtifactAnalysisScopes.html` scope via `addUnavailableStaticParseScope` with limitation `HTML text was unavailable: <reason>.` The branch sits in the existing `else if` chain after the outside-analysis-scope, interruption (`analysis_failure`), and JavaScript branches, so unselected and interrupted HTML keep their single existing scope instead of gaining a duplicate. No reader, analysis, schema, CLI/MCP, or docs changes. Ordinary fix within existing boundaries; no maintainer scope decision required. ## Contract and boundary impact - Semantic owner and earliest changed stage: application-layer graph projection (`JavaScriptArtifactGraphStructure`); artifact reading and HTML extraction are unchanged. - Contribution scope fit and linked maintainer decision: routine bug fix; not applicable. - CLI and MCP/tool-catalog contract: unchanged surface; both adapters share this workflow and gain the additional unknown node/edge for undecodable HTML only. - Provider, bridge, target-format, or platform compatibility: none. Directory and ASAR files share the same projection; ASAR was not separately exercised (see proof gaps). - Evidence, artifact, provenance, or reconstruction contract: additive — one `unknown` node with unavailable Evidence for undecodable selected HTML. Inventory `text_status`, coverage, and valid-HTML output are unchanged. - Target selection, authority, upstream behavior, and cleanup details (if applicable): read-only static analysis of caller-selected files; no target execution. - Generated metadata, package, or installation impact: none. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `keeps undecodable HTML script-reference discovery as an explicit unknown` in `tests/boundary/filesystem/javascriptArtifactReconstruction.test.ts`. It reconstructs a directory artifact whose `index.html` is a script tag plus `0xff` and asserts the preserved `invalid-utf8` inventory, partial coverage, exactly one `parse-html-script-references` unknown with `artifact-bytes`/`unavailable`/`unknown` Evidence, and no fabricated load edge. - Base reproduction or other evidence: executed. The new test failed on the base revision with `expected [] to have a length of 1` (zero unknowns for `index.html`). The issue's four-case public CLI script was also run against the built CLI after the fix: - `invalid-html`: `unknown: [{path: "index.html", operation: "parse-html-script-references"}]`, coverage `partial` (fixed; was `unknown: []`). - `valid-empty-html`: `unknown: []`, coverage `complete` (unchanged). - `valid-reference-html`: `unknown: []`, `html_loads: 1`, coverage `complete` (unchanged). - `invalid-json-control`: `unknown: [{path: "data.json", operation: "parse-json-module"}]` (unchanged). - User-visible CLI/MCP output (if applicable): see the four-case output above (CLI). MCP shares the workflow; no separate MCP run was performed. - Remaining proof gaps: ASAR-contained undecodable HTML and interrupted HTML rely on the shared projection and `else if` ordering (source-derived, not separately executed). No real-provider coverage applies to this static path. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- tests/boundary/filesystem/javascriptArtifactReconstruction.test.ts` — 14 passed (new test failed before the fix, passes after). - `npm run test:local -- src/application/javascript/JavaScriptArtifactGraphStructure.test.ts` — 16 passed. - `npm run test:changed` — 19 passed (3 files). - `npm run check:fast` — typecheck and lint passed. - `npm run build:cached` + issue four-case CLI script (`analyze-javascript-application` via `scripts/rea.mjs`) — output above; all four invocations exited successfully. Note: [#6073](https://github.com/morluto/rea/pull/6073) already proposes an equivalent fix for this issue. Close this PR in favor of that one if it lands first. ## Compatibility, safety, and release - Breaking changes or migration steps: none; additive unknown for previously silent gap. - Real Hopper/Ghidra, browser, or OS coverage: not applicable (static JavaScript/HTML artifact analysis; tested on macOS arm64, Node 24.18.0). - Package or release metadata impact: none. - Security, privacy, process, or containment review: no new execution, network, or mutation; limitation text only echoes the fixed text-unavailable reason. ## Author readiness Human owner: <!-- @GitHub-handle --> - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-01 21:45:42 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7143
No description provided.