[PR #6462] [MERGED] fix(javascript): accept retained empty endpoint seeds #7357

Closed
opened 2026-11-01 21:47:17 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6462
Author: @Lew1sWong
Created: 10/23/2026
Status: ✅ Merged
Merged: 11/3/2026
Merged by: @morluto

Base: main ← Head: fix/js-semantic-empty-event-seed


📝 Commits (1)

  • 2dd67e4 fix(javascript): accept retained empty endpoint seeds

📊 Changes

2 files changed (+64 additions, -1 deletions)

View changed files

📝 src/domain/javascript/javascriptSemanticQuerySchemas.ts (+3 -1)
📝 tests/acceptance/applications/javascriptEventPayload.test.ts (+61 -0)

📄 Description

Summary

trace-javascript-semantics now accepts {"kind":"endpoint","value":""}, so a retained empty literal endpoint can be selected by its preserved value instead of being refused with invalid_request.

This is the endpoint half of the defect reported in #6458. The event half ({"kind":"event","name":""}) landed on main in cf5e4f6fa and that issue is closed. No separate issue covers the endpoint seed; the reproduction is below.

Problem and expected behavior

analyze-javascript-application preserves the complete literal request endpoint in properties.endpoint, including "" (requestEndpoint returns the literal unchanged). The seed schema in javascriptSemanticQuerySchemas.ts still declares value: z.string().min(1) for endpoint, so a seed carrying the retained value fails input validation before matching, while the sibling event seed already accepts "".

Expected: the empty endpoint seed reaches exact matching and selects the retained request node, the same way the empty event seed does.

Change and scope

  • Drop the minimum length from the endpoint seed. Matching is unchanged: exact equality against the preserved property, so "" matches only empty literal endpoints and never a dynamic (null) endpoint.
  • Not changed: boundary-field keeps its minimum, because boundary nodes take field from the boundary method name and never produce an empty value.

Contribution scope: ordinary fix within existing boundaries; maintainer scope decision not applicable.

Contract and boundary impact

  • Semantic owner and earliest changed stage: the semantic query seed schema, shared by CLI and MCP through applicationWorkflowInputContracts.

  • Contribution scope fit and linked maintainer decision: not applicable (bug fix).

  • CLI and MCP/tool-catalog contract: the trace_javascript_semantics input schema relaxes minLength: 1 on the endpoint value. Previously valid inputs stay valid.

  • Provider, bridge, target-format, or platform compatibility: none.

  • Evidence, artifact, provenance, or reconstruction contract: none; trace Evidence shape is unchanged.

  • Target selection, authority, upstream behavior, and cleanup details: not applicable.

  • Generated metadata, package, or installation impact: none committed. npm run docs:check passes.

  • Read existing files or captured data.

Evidence and regression coverage

  • Test added: tests/acceptance/applications/javascriptEventPayload.test.ts gains a public CLI workflow. It analyzes an app whose only request is fetch(""), confirms the graph retains a request node with endpoint: "", traces with {"kind":"endpoint","value":""}, and asserts seed_node_ids equal exactly the retained empty-endpoint nodes.
  • Base reproduction (macOS arm64, e54bf1006; main at 317bf3fe2 still declares value: z.string().min(1) for the endpoint seed): the same app and seed through the CLI return invalid_request with issues: [{"path":["query","seed","value"],"reason":"out_of_range","minimum":1}]. On this branch the trace succeeds with the request node as its seed.
  • Mutation check: with .min(1) restored on the endpoint seed, the new test fails with that invalid_request; with the change it passes.
  • Remaining proof gaps: MCP was not exercised separately. It parses the same input contract, and the existing test in this file covers the MCP trace path.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Node 24.22.1, macOS 27.0 arm64. Head 2dd67e478 on 317bf3fe2.

  • npm run check:fast — passed (typecheck, lint 0 errors)
  • npm run knip — exit 1 with 9 findings (unused exports/types, duplicate exports) in analysisView.ts, artifactGraph.ts, javascriptRpcEndpoints.ts, javascriptSemanticOpaqueEffects.ts and analysisResourceLimits.ts; the identical 9 findings appear on unmodified 317bf3fe2, and none is in a file this PR touches
  • npm run docs:check — passed
  • npm run test:focused -- on src/domain/javascript, src/contracts, tests/conformance/contracts, and every test that references the semantic query or trace-javascript-semantics — 215 files, 5086 passed, 3 skipped
  • Full npm run check:pr — not run
  • Rebased onto 317bf3fe2, whose push CI is green, to clear the earlier CI failure: on d5eb4321b the only failure was tests/process-global/pwntoolsStageRetirement.test.ts, which failed identically in main's own push CI at b675073b7 and 4557791a2 at the time.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; the input schema only accepts more values.
  • Real Hopper/Ghidra, browser, or OS coverage: not applicable.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: static analysis of caller-selected Evidence only.

Author readiness

Human owner: @Lew1sWong

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🤖 Generated with Claude Code


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6462 **Author:** [@Lew1sWong](https://github.com/Lew1sWong) **Created:** 10/23/2026 **Status:** ✅ Merged **Merged:** 11/3/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/js-semantic-empty-event-seed` --- ### 📝 Commits (1) - [`2dd67e4`](https://github.com/morluto/rea/commit/2dd67e478be463c36d8fc2dd1e4e3fad252d16e0) fix(javascript): accept retained empty endpoint seeds ### 📊 Changes **2 files changed** (+64 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/javascriptSemanticQuerySchemas.ts` (+3 -1) 📝 `tests/acceptance/applications/javascriptEventPayload.test.ts` (+61 -0) </details> ### 📄 Description ## Summary `trace-javascript-semantics` now accepts `{"kind":"endpoint","value":""}`, so a retained empty literal endpoint can be selected by its preserved value instead of being refused with `invalid_request`. This is the endpoint half of the defect reported in #6458. The event half (`{"kind":"event","name":""}`) landed on `main` in cf5e4f6fa and that issue is closed. No separate issue covers the endpoint seed; the reproduction is below. ## Problem and expected behavior `analyze-javascript-application` preserves the complete literal request endpoint in `properties.endpoint`, including `""` (`requestEndpoint` returns the literal unchanged). The seed schema in `javascriptSemanticQuerySchemas.ts` still declares `value: z.string().min(1)` for `endpoint`, so a seed carrying the retained value fails input validation before matching, while the sibling `event` seed already accepts `""`. Expected: the empty endpoint seed reaches exact matching and selects the retained request node, the same way the empty event seed does. ## Change and scope - Drop the minimum length from the `endpoint` seed. Matching is unchanged: exact equality against the preserved property, so `""` matches only empty literal endpoints and never a dynamic (`null`) endpoint. - **Not changed:** `boundary-field` keeps its minimum, because boundary nodes take `field` from the boundary method name and never produce an empty value. Contribution scope: ordinary fix within existing boundaries; maintainer scope decision not applicable. ## Contract and boundary impact - Semantic owner and earliest changed stage: the semantic query seed schema, shared by CLI and MCP through `applicationWorkflowInputContracts`. - Contribution scope fit and linked maintainer decision: not applicable (bug fix). - CLI and MCP/tool-catalog contract: the `trace_javascript_semantics` input schema relaxes `minLength: 1` on the endpoint `value`. Previously valid inputs stay valid. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: none; trace Evidence shape is unchanged. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: none committed. `npm run docs:check` passes. - [x] Read existing files or captured data. ## Evidence and regression coverage - Test added: `tests/acceptance/applications/javascriptEventPayload.test.ts` gains a public CLI workflow. It analyzes an app whose only request is `fetch("")`, confirms the graph retains a request node with `endpoint: ""`, traces with `{"kind":"endpoint","value":""}`, and asserts `seed_node_ids` equal exactly the retained empty-endpoint nodes. - Base reproduction (macOS arm64, `e54bf1006`; `main` at `317bf3fe2` still declares `value: z.string().min(1)` for the endpoint seed): the same app and seed through the CLI return `invalid_request` with `issues: [{"path":["query","seed","value"],"reason":"out_of_range","minimum":1}]`. On this branch the trace succeeds with the request node as its seed. - Mutation check: with `.min(1)` restored on the endpoint seed, the new test fails with that `invalid_request`; with the change it passes. - Remaining proof gaps: MCP was not exercised separately. It parses the same input contract, and the existing test in this file covers the MCP trace path. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Node 24.22.1, macOS 27.0 arm64. Head `2dd67e478` on `317bf3fe2`. - `npm run check:fast` — passed (typecheck, lint 0 errors) - `npm run knip` — exit 1 with 9 findings (unused exports/types, duplicate exports) in `analysisView.ts`, `artifactGraph.ts`, `javascriptRpcEndpoints.ts`, `javascriptSemanticOpaqueEffects.ts` and `analysisResourceLimits.ts`; the identical 9 findings appear on unmodified `317bf3fe2`, and none is in a file this PR touches - `npm run docs:check` — passed - `npm run test:focused --` on `src/domain/javascript`, `src/contracts`, `tests/conformance/contracts`, and every test that references the semantic query or `trace-javascript-semantics` — 215 files, 5086 passed, 3 skipped - Full `npm run check:pr` — not run - Rebased onto `317bf3fe2`, whose push CI is green, to clear the earlier CI failure: on `d5eb4321b` the only failure was `tests/process-global/pwntoolsStageRetirement.test.ts`, which failed identically in `main`'s own push CI at `b675073b7` and `4557791a2` at the time. ## Compatibility, safety, and release - Breaking changes or migration steps: none; the input schema only accepts more values. - Real Hopper/Ghidra, browser, or OS coverage: not applicable. - Package or release metadata impact: none. - Security, privacy, process, or containment review: static analysis of caller-selected Evidence only. ## Author readiness Human owner: @Lew1sWong - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi changed title from [PR #6462] fix(javascript): accept retained empty endpoint seeds to [PR #6462] [MERGED] fix(javascript): accept retained empty endpoint seeds 2026-11-03 02:27:12 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7357
No description provided.