[GH-ISSUE #2624] fix(browser): preserve differing WebMCP declaration metadata #942

New issue

Closed

opened 2026-10-15 18:29:46 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:29:46 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2624

Summary

Analyzing a captured script containing two WebMCP declarations with the same tool name and schema property names but different descriptions returns only the first description. This drops declaration evidence from the static bundle analysis. Equivalent property sets written in different orders also produce duplicate inventory entries.

Steps to reproduce

At the source baseline below, use the single-script inspection fixture in src/domain/webBundleAnalyzer.test.ts with this JavaScript source.

document.modelContext.registerTool({name: "lookup", description: "first", inputSchema: {properties: {alpha: {}}}});
document.modelContext.registerTool({name: "lookup", description: "second", inputSchema: {properties: {alpha: {}}}});

Call analyzeCapturedWebBundle with that inspection and read observations.webmcp_declarations.
Repeat with two declarations named lookup, with no description and property objects {alpha: {}, beta: {}} and {beta: {}, alpha: {}}.

Expected behavior

Static bundle analysis should preserve both different descriptions as declaration evidence. Repeating equivalent recorded tool metadata with a different property order should produce one inventory record, consistent with the existing equivalent-declaration deduplication test.

Actual behavior

The first input returns one declaration with description first; description second is absent. The second input returns two records with the same name, null description, and schema_property_names: ["alpha", "beta"]. Both outputs were observed locally using the source analyzer with a validated page-inspection fixture.

Evidence

Expected source: AGENTS.md, Architecture and Cleanup, requires preserving identity and source evidence; docs/browser-observation.md:19 advertises static WebMCP declarations; src/domain/webBundleAnalyzer.test.ts:534-565 checks equivalent metadata deduplication.
Failure source: src/domain/webBundleAnalyzerInspection.ts:281-312 computes an identity without description and before canonicalizing the schema property list, then suppresses later matches.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

A temporary focused domain test observed both outputs and completed with one test passing because its assertions captured the faulty behavior. The absent-name versus empty-name variant also returned only the absent-name record. Verification covered the production source analyzer, not a live browser or CLI capture.

Restoration check

The first input must return both descriptions. The second must return one equivalent metadata record. Keep the existing computed-metadata deduplication test passing, and preserve the distinction between an absent name and an explicitly empty name. Retaining every call site would fail the equivalence control.

Runtime or environment

Source revision: 8b181716ac. Node.js v26.10.0, npm 11.19.1, and lockfile-installed dependencies. Input is captured JavaScript analyzed without execution.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Specific valid scripts lose declaration metadata or return duplicate inventory records. This affects the accuracy of static browser evidence without establishing a live registration or execution failure.
Workaround status: unverified
Workaround basis: The captured script remains available for manual inspection, but no alternate workflow was tested that returns an equivalent corrected inventory.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2624 ## Summary Analyzing a captured script containing two WebMCP declarations with the same tool name and schema property names but different descriptions returns only the first description. This drops declaration evidence from the static bundle analysis. Equivalent property sets written in different orders also produce duplicate inventory entries. ## Steps to reproduce 1. At the source baseline below, use the single-script inspection fixture in `src/domain/webBundleAnalyzer.test.ts` with this JavaScript source. ```js document.modelContext.registerTool({name: "lookup", description: "first", inputSchema: {properties: {alpha: {}}}}); document.modelContext.registerTool({name: "lookup", description: "second", inputSchema: {properties: {alpha: {}}}}); ``` 2. Call `analyzeCapturedWebBundle` with that inspection and read `observations.webmcp_declarations`. 3. Repeat with two declarations named `lookup`, with no description and property objects `{alpha: {}, beta: {}}` and `{beta: {}, alpha: {}}`. ## Expected behavior Static bundle analysis should preserve both different descriptions as declaration evidence. Repeating equivalent recorded tool metadata with a different property order should produce one inventory record, consistent with the existing equivalent-declaration deduplication test. ## Actual behavior The first input returns one declaration with description `first`; description `second` is absent. The second input returns two records with the same name, null description, and `schema_property_names: ["alpha", "beta"]`. Both outputs were observed locally using the source analyzer with a validated page-inspection fixture. ## Evidence - Expected source: `AGENTS.md`, Architecture and Cleanup, requires preserving identity and source evidence; `docs/browser-observation.md:19` advertises static WebMCP declarations; `src/domain/webBundleAnalyzer.test.ts:534-565` checks equivalent metadata deduplication. - Failure source: `src/domain/webBundleAnalyzerInspection.ts:281-312` computes an identity without description and before canonicalizing the schema property list, then suppresses later matches. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete A temporary focused domain test observed both outputs and completed with one test passing because its assertions captured the faulty behavior. The absent-name versus empty-name variant also returned only the absent-name record. Verification covered the production source analyzer, not a live browser or CLI capture. ## Restoration check The first input must return both descriptions. The second must return one equivalent metadata record. Keep the existing computed-metadata deduplication test passing, and preserve the distinction between an absent name and an explicitly empty name. Retaining every call site would fail the equivalence control. ## Runtime or environment Source revision: 8b181716aca2cb467be499cba226abfb5ae19141. Node.js v26.10.0, npm 11.19.1, and lockfile-installed dependencies. Input is captured JavaScript analyzed without execution. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Specific valid scripts lose declaration metadata or return duplicate inventory records. This affects the accuracy of static browser evidence without establishing a live registration or execution failure. - Workaround status: unverified - Workaround basis: The captured script remains available for manual inspection, but no alternate workflow was tested that returns an equivalent corrected inventory.

bsakaguchi

2026-10-15 18:29:46 +00:00