morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2625] fix(browser): limit parse-gap attribution to affected scripts #941

New issue

Closed

opened 2026-10-15 18:29:45 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:29:45 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2625

Summary

A bundle containing one valid script and one unparseable script reports both scripts as affected by the JavaScript parse gap. The valid script's endpoint evidence is retained, but the returned uncertainty scope incorrectly includes its identity.

Steps to reproduce

At the source baseline below, create a page inspection using the fixture in src/domain/webBundleAnalyzer.test.ts with two included source artifacts and distinct script keys.
Set the first source to fetch('/ok'); and the second to function broken( {. Use keys scr_ followed by 64 ones and scr_ followed by 64 twos, respectively.
Call analyzeCapturedWebBundle and inspect completeness, observations.endpoints, and the javascript_ast entry in unknowns.

Expected behavior

The parse-gap entry should identify the second script, whose source cannot be parsed. The successfully parsed first script should retain its endpoint evidence without receiving that parse-gap attribution.

Actual behavior

The local observation returned one parsed script and one parse failure, with overall status partial. It retained /ok at the first script's location. The javascript_ast entry nevertheless listed both script keys as affected. A valid-only control returned no parse-gap entry.

Evidence

Expected source: AGENTS.md, Architecture and Cleanup, requires preserving identity and uncertainty; src/domain/webBundleAnalysis.ts:211-216 defines the unknown's script scope; src/domain/webBundleAnalyzerResult.ts:109-155 identifies specific affected subsets for the neighboring source and source-map gaps.
Failure source: src/domain/webBundleAnalyzerResult.ts:118-128 assigns every included source script to the JavaScript parse gap whenever any parse failure occurs.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

One focused observation test passed while asserting the faulty two-key attribution, the retained endpoint, the one-failure count, and the valid-only control. This covered the production domain analyzer with a schema-validated inspection, without a live browser or CLI capture.

Restoration check

For the mixed input, retain the endpoint and partial status, but list only the second key in the parse-gap entry. Keep the valid-only control free of that entry. An all-invalid input should still identify each unparseable script, so removing the gap entirely does not restore the contract.

Runtime or environment

Source revision: 8b181716ac. Node.js v26.10.0, npm 11.19.1, and lockfile-installed dependencies.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The uncertainty scope is inaccurate for mixed valid and invalid captures. The observed failure affects evidence interpretation; a downstream exclusion or other consumer failure was not demonstrated.
Workaround status: unverified
Workaround basis: The failure count does not reveal which script failed. Separate per-script analysis might recover the identities, but that workflow was not tested.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2625 ## Summary A bundle containing one valid script and one unparseable script reports both scripts as affected by the JavaScript parse gap. The valid script's endpoint evidence is retained, but the returned uncertainty scope incorrectly includes its identity. ## Steps to reproduce 1. At the source baseline below, create a page inspection using the fixture in `src/domain/webBundleAnalyzer.test.ts` with two included source artifacts and distinct script keys. 2. Set the first source to `fetch('/ok');` and the second to `function broken( {`. Use keys `scr_` followed by 64 ones and `scr_` followed by 64 twos, respectively. 3. Call `analyzeCapturedWebBundle` and inspect `completeness`, `observations.endpoints`, and the `javascript_ast` entry in `unknowns`. ## Expected behavior The parse-gap entry should identify the second script, whose source cannot be parsed. The successfully parsed first script should retain its endpoint evidence without receiving that parse-gap attribution. ## Actual behavior The local observation returned one parsed script and one parse failure, with overall status `partial`. It retained `/ok` at the first script's location. The `javascript_ast` entry nevertheless listed both script keys as affected. A valid-only control returned no parse-gap entry. ## Evidence - Expected source: `AGENTS.md`, Architecture and Cleanup, requires preserving identity and uncertainty; `src/domain/webBundleAnalysis.ts:211-216` defines the unknown's script scope; `src/domain/webBundleAnalyzerResult.ts:109-155` identifies specific affected subsets for the neighboring source and source-map gaps. - Failure source: `src/domain/webBundleAnalyzerResult.ts:118-128` assigns every included source script to the JavaScript parse gap whenever any parse failure occurs. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete One focused observation test passed while asserting the faulty two-key attribution, the retained endpoint, the one-failure count, and the valid-only control. This covered the production domain analyzer with a schema-validated inspection, without a live browser or CLI capture. ## Restoration check For the mixed input, retain the endpoint and partial status, but list only the second key in the parse-gap entry. Keep the valid-only control free of that entry. An all-invalid input should still identify each unparseable script, so removing the gap entirely does not restore the contract. ## Runtime or environment Source revision: 8b181716aca2cb467be499cba226abfb5ae19141. Node.js v26.10.0, npm 11.19.1, and lockfile-installed dependencies. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The uncertainty scope is inaccurate for mixed valid and invalid captures. The observed failure affects evidence interpretation; a downstream exclusion or other consumer failure was not demonstrated. - Workaround status: unverified - Workaround basis: The failure count does not reveal which script failed. Separate per-script analysis might recover the identities, but that workflow was not tested.

bsakaguchi

2026-10-15 18:29:45 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi commented

2026-10-15 18:29:46 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Web-bundle analysis now attributes parser uncertainty only to the script that failed parsing, while preserving findings from the valid script. The mixed-input regression passes on current main.

Root cause: A global parse-failure count assigned every included script key to javascript_ast uncertainty.

Validation: src/domain/webBundleAnalyzer.test.ts: 'attributes failed parse uncertainty only to its affected source' uses malformed plus valid source, retains valid endpoint, and asserts only the malformed key is affected; recovered-parse variant is also covered. These assertions passed in CI at 500e32399; the reviewed implementation is present on current main. Fix: e6c6fdd21.

Verification scope: The named mixed-input regression does not include an all-scripts-invalid control, although the current projection iterates the failed-script set directly. No live browser capture claimed.

@morluto commented on GitHub (Oct 14, 2026): Web-bundle analysis now attributes parser uncertainty only to the script that failed parsing, while preserving findings from the valid script. The mixed-input regression passes on current main. Root cause: A global parse-failure count assigned every included script key to javascript_ast uncertainty. Validation: src/domain/webBundleAnalyzer.test.ts: 'attributes failed parse uncertainty only to its affected source' uses malformed plus valid source, retains valid endpoint, and asserts only the malformed key is affected; recovered-parse variant is also covered. These assertions passed in [CI at 500e32399](https://github.com/morluto/rea/actions/runs/38514789942); the reviewed implementation is present on current main. Fix: [e6c6fdd21](https://github.com/morluto/rea/commit/e6c6fdd21). Verification scope: The named mixed-input regression does not include an all-scripts-invalid control, although the current projection iterates the failed-script set directly. No live browser capture claimed.

bsakaguchi referenced this issue

2026-10-17 21:07:04 +00:00

[PR #941] [MERGED] perf(evidence): scale imports and dependency graphs #2518

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#941

No description provided.

Rows
Columns