[GH-ISSUE #2607] fix(browser): retain endpoint evidence from decorated source #922

New issue

Closed

opened 2026-10-15 18:29:36 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:29:36 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2607

Summary

Static bundle analysis treats a decorated captured source as unparseable and loses its literal endpoint candidate. REA's shared JavaScript parser handles the same source without errors, and bundle analysis handles the endpoint when the decorator is removed.

Steps to reproduce

At the source baseline below, use the single-script page-inspection fixture in src/domain/webBundleAnalyzer.test.ts with this captured source text.

@sealed class Widget {}
fetch('/decorated');

Call analyzeCapturedWebBundle and inspect endpoint candidates and completeness.
Run analyzeJavaScriptStaticSource on the same text as a shared-parser control, then repeat bundle analysis after removing @sealed as a syntax control.

Expected behavior

The captured text should receive the shared parser's supported decorator handling and retain /decorated as an endpoint candidate without a parse failure. This is static analysis of source data and does not require proof that the decorated script executes successfully in a browser.

Actual behavior

The observed bundle result was partial with zero parsed scripts, one parse failure, zero visited nodes, and no endpoints. The shared source analyzer reported complete with zero errors and retained /decorated. Removing the decorator let the bundle analyzer retain the same endpoint.

Evidence

Expected source: src/domain/javascript/javascriptSourceParser.ts:9-38 explicitly retains decorator support to prevent loss of derived facts; AGENTS.md, Architecture and Cleanup, requires one interpretation owner and use of its parsed facts; docs/browser-observation.md:19 advertises static endpoint derivation from captured source.
Failure source: src/domain/webBundleAnalyzerInspection.ts:60-73 independently selects only JSX and TypeScript parsing and returns before traversal when decorated source fails.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

One focused domain observation test passed while asserting the faulty decorated result and both successful controls. It also confirmed partial analysis for function broken( {. Verification used production source analyzers and a validated inspection; live-browser acceptance, script execution, and CLI capture were not exercised.

Restoration check

Retain /decorated and report no parse failure for the decorated input. Keep the undecorated and shared-parser controls successful, and keep genuinely unparseable input partial with a meaningful gap. Preserve static analysis without executing captured code.

Runtime or environment

Source revision: 8b181716ac. Node.js v26.10.0, npm 11.19.1, and lockfile-installed dependencies.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A specific source syntax supported by the shared parser loses endpoint evidence in bundle analysis. The result reports the gap, but it does not retain the otherwise extractable endpoint.
Workaround status: unverified
Workaround basis: The shared analyzer directly retained the endpoint in the control, but practical user-facing access to an equivalent analysis of captured bundle artifacts was not verified.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2607 ## Summary Static bundle analysis treats a decorated captured source as unparseable and loses its literal endpoint candidate. REA's shared JavaScript parser handles the same source without errors, and bundle analysis handles the endpoint when the decorator is removed. ## Steps to reproduce 1. At the source baseline below, use the single-script page-inspection fixture in `src/domain/webBundleAnalyzer.test.ts` with this captured source text. ```js @sealed class Widget {} fetch('/decorated'); ``` 2. Call `analyzeCapturedWebBundle` and inspect endpoint candidates and `completeness`. 3. Run `analyzeJavaScriptStaticSource` on the same text as a shared-parser control, then repeat bundle analysis after removing `@sealed` as a syntax control. ## Expected behavior The captured text should receive the shared parser's supported decorator handling and retain `/decorated` as an endpoint candidate without a parse failure. This is static analysis of source data and does not require proof that the decorated script executes successfully in a browser. ## Actual behavior The observed bundle result was partial with zero parsed scripts, one parse failure, zero visited nodes, and no endpoints. The shared source analyzer reported complete with zero errors and retained `/decorated`. Removing the decorator let the bundle analyzer retain the same endpoint. ## Evidence - Expected source: `src/domain/javascript/javascriptSourceParser.ts:9-38` explicitly retains decorator support to prevent loss of derived facts; `AGENTS.md`, Architecture and Cleanup, requires one interpretation owner and use of its parsed facts; `docs/browser-observation.md:19` advertises static endpoint derivation from captured source. - Failure source: `src/domain/webBundleAnalyzerInspection.ts:60-73` independently selects only JSX and TypeScript parsing and returns before traversal when decorated source fails. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete One focused domain observation test passed while asserting the faulty decorated result and both successful controls. It also confirmed partial analysis for `function broken( {`. Verification used production source analyzers and a validated inspection; live-browser acceptance, script execution, and CLI capture were not exercised. ## Restoration check Retain `/decorated` and report no parse failure for the decorated input. Keep the undecorated and shared-parser controls successful, and keep genuinely unparseable input partial with a meaningful gap. Preserve static analysis without executing captured code. ## Runtime or environment Source revision: 8b181716aca2cb467be499cba226abfb5ae19141. Node.js v26.10.0, npm 11.19.1, and lockfile-installed dependencies. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A specific source syntax supported by the shared parser loses endpoint evidence in bundle analysis. The result reports the gap, but it does not retain the otherwise extractable endpoint. - Workaround status: unverified - Workaround basis: The shared analyzer directly retained the endpoint in the control, but practical user-facing access to an equivalent analysis of captured bundle artifacts was not verified.

bsakaguchi

2026-10-15 18:29:36 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi commented

2026-10-15 18:29:37 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in 88afcc738bff8ea2023b504e9ce2254d8bc8ba5a.

Captured endpoint analysis uses the canonical JavaScript parser modes, preserving evidence from decorated source.

Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit.

Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [88afcc738bff8ea2023b504e9ce2254d8bc8ba5a](https://github.com/morluto/rea/commit/88afcc738bff8ea2023b504e9ce2254d8bc8ba5a). Captured endpoint analysis uses the canonical JavaScript parser modes, preserving evidence from decorated source. Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit. Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

bsakaguchi referenced this issue

2026-10-16 21:09:17 +00:00

[GH-ISSUE #4303] [Feature] Map launchd, XPC, privileged-helper, login-item and system-extension relationships #1705

bsakaguchi referenced this issue

2026-10-16 21:09:22 +00:00

[GH-ISSUE #4312] [Feature] Report Mach-O placements that violate Apple's documented bundle layout rules #1716

bsakaguchi referenced this issue

2026-10-16 21:17:38 +00:00

[PR #922] [MERGED] feat(apple): project macOS bundle anatomy in application graphs #2348

bsakaguchi referenced this issue

2026-10-16 21:17:42 +00:00

[PR #927] [MERGED] feat(artifacts): trace Mach-O dylib resolution in bundles #2354