[GH-ISSUE #2523] fix(javascript): GraphQL header comments hide named operations #840

New issue

Closed

opened 2026-10-15 18:28:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:28:54 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2523

Summary

JavaScript static analysis omits a named GraphQL query when a line comment separates the query keyword from its name. The query starts at the beginning of a string literal and otherwise uses the same syntax as a recognized control. The omission leaves the recovered network endpoint list incomplete for this input.

Steps to reproduce

Use the source checkout and installed lockfile dependencies described under Runtime or environment.
Add a focused test next to the JavaScript static-analysis tests using this fixture.
Run npm run test:focused -- src/domain/javascript/graphqlHeaderComment.test.ts after saving the fixture under that name.

import { expect, it } from "vitest";
import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js";

it("recovers a named query with an ignored header comment", () => {
  const query = "query # comment\nGetUser { user }";
  const source = `const document = ${JSON.stringify(query)};`;
  const endpoints = analyzeJavaScriptStaticSource(source).endpoints
    .filter(endpoint => endpoint.mechanism.startsWith("graphql:"))
    .map(({ kind, value, mechanism }) => ({ kind, value, mechanism }));
  expect(endpoints).toEqual([
    { kind: "network", value: "GetUser", mechanism: "graphql:query" },
  ]);
});

Expected behavior

The analysis reports the named query GetUser as a network endpoint with mechanism graphql:query. The operation begins at the start of the literal, as required by the documented recognition scope. A GraphQL line comment is an ignored token and does not change the operation's name or kind.

Actual behavior

A local observation test using the fixture returned an empty GraphQL endpoint list. Calling the text recognizer directly also returned undefined. The equivalent query with whitespace or a comma instead of the comment returned GetUser, as did a query with a comment before the keyword. The observation test exited successfully because it asserted these current results; the restoration assertion above describes the missing endpoint.

Evidence

Expected source: docs/javascript-artifact-reconstruction.md:269 promises recognition of named operations at the start of strings or cooked templates; src/domain/javascript/javascriptRpcEndpoints.ts:157 identifies GraphQL October 2021 OperationDefinition as the header grammar.
Failure source: src/domain/javascript/javascriptRpcEndpoints.ts:160 restricts header separators to whitespace and commas, while the comment-consumption loop at line 170 applies only before the keyword. The focused test through the static-analysis entry point returned no endpoint for the fixture.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

The focused verification ran one test in 1.18 seconds and exited 0. It also checked that anonymous operations and ordinary prose stayed unrecognized. This report concerns static recovery; it does not claim a network request was executed.

Restoration check

The fixture returns exactly the GetUser network endpoint with mechanism graphql:query. Whitespace, comma-separated and leading-comment controls continue returning the same endpoint, and anonymous operations and ordinary prose continue returning none.

Runtime or environment

Source baseline 8b181716aca2cb467be499cba226abfb5ae19141, Node v26.10.0, npm 11.19.1, Vitest 5.0.3, with installed lockfile dependencies.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The observed failure silently drops a supported named operation from static endpoint recovery for the bounded input shape containing a header comment. No wider analysis failure or data loss was observed.
Workaround status: unverified
Workaround basis: Comment-free controls work, but editing a supplied application artifact may not preserve the analyst's required input. No supported scanner option that changes this recognition was established.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2523 ## Summary JavaScript static analysis omits a named GraphQL query when a line comment separates the query keyword from its name. The query starts at the beginning of a string literal and otherwise uses the same syntax as a recognized control. The omission leaves the recovered network endpoint list incomplete for this input. ## Steps to reproduce 1. Use the source checkout and installed lockfile dependencies described under Runtime or environment. 2. Add a focused test next to the JavaScript static-analysis tests using this fixture. 3. Run `npm run test:focused -- src/domain/javascript/graphqlHeaderComment.test.ts` after saving the fixture under that name. ```ts import { expect, it } from "vitest"; import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js"; it("recovers a named query with an ignored header comment", () => { const query = "query # comment\nGetUser { user }"; const source = `const document = ${JSON.stringify(query)};`; const endpoints = analyzeJavaScriptStaticSource(source).endpoints .filter(endpoint => endpoint.mechanism.startsWith("graphql:")) .map(({ kind, value, mechanism }) => ({ kind, value, mechanism })); expect(endpoints).toEqual([ { kind: "network", value: "GetUser", mechanism: "graphql:query" }, ]); }); ``` ## Expected behavior The analysis reports the named query GetUser as a network endpoint with mechanism `graphql:query`. The operation begins at the start of the literal, as required by the documented recognition scope. A GraphQL line comment is an ignored token and does not change the operation's name or kind. ## Actual behavior A local observation test using the fixture returned an empty GraphQL endpoint list. Calling the text recognizer directly also returned undefined. The equivalent query with whitespace or a comma instead of the comment returned GetUser, as did a query with a comment before the keyword. The observation test exited successfully because it asserted these current results; the restoration assertion above describes the missing endpoint. ## Evidence - Expected source: `docs/javascript-artifact-reconstruction.md:269` promises recognition of named operations at the start of strings or cooked templates; `src/domain/javascript/javascriptRpcEndpoints.ts:157` identifies GraphQL October 2021 OperationDefinition as the header grammar. - Failure source: `src/domain/javascript/javascriptRpcEndpoints.ts:160` restricts header separators to whitespace and commas, while the comment-consumption loop at line 170 applies only before the keyword. The focused test through the static-analysis entry point returned no endpoint for the fixture. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete The focused verification ran one test in 1.18 seconds and exited 0. It also checked that anonymous operations and ordinary prose stayed unrecognized. This report concerns static recovery; it does not claim a network request was executed. ## Restoration check The fixture returns exactly the GetUser network endpoint with mechanism `graphql:query`. Whitespace, comma-separated and leading-comment controls continue returning the same endpoint, and anonymous operations and ordinary prose continue returning none. ## Runtime or environment Source baseline `8b181716aca2cb467be499cba226abfb5ae19141`, Node v26.10.0, npm 11.19.1, Vitest 5.0.3, with installed lockfile dependencies. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The observed failure silently drops a supported named operation from static endpoint recovery for the bounded input shape containing a header comment. No wider analysis failure or data loss was observed. - Workaround status: unverified - Workaround basis: Comment-free controls work, but editing a supplied application artifact may not preserve the analyst's required input. No supported scanner option that changes this recognition was established.

bsakaguchi

2026-10-15 18:28:54 +00:00