morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2641] [Bug] analyze-javascript-application reports an existing bytenode .jsc require target as not-found #945

New issue

Closed

opened 2026-10-15 18:29:47 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:29:47 +00:00

Owner

Originally created by @cyberpunk47 on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2641

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

require("./core.jsc") is reported as resolution_status: "not-found" even though core.jsc exists. The output is identical to when the file is deleted, coverage stays "complete", and the edge limitation says no candidate "exists in the inventoried artifact container". So REA tells the agent a present module is absent.

Reproduction

mkdir sample-app && cd sample-app
echo 'module.exports = { summarize: (items) => ({ count: items.length }) };' > core.js
printf 'require("bytenode");\nconst core = require("./core.jsc");\n' > main.js
echo '{ "name": "sample-app", "version": "1.0.0", "main": "main.js" }' > package.json
npx bytenode@1 -c core.js && rm core.js
cd ..
rea analyze-javascript-application ./sample-app --format json

Then delete sample-app/core.jsc and run again: same result.

Expected behavior

A present but unanalysed target should be reported as such (e.g. the existing unavailable status with its sha256 and size), not as absent. A really missing file should stay not-found.

Impact and scope

Evidence integrity: a present file is reported absent. Also affects .wasm and other non-JavaScript targets. .js/.cjs/.mjs/.ts/.json/.node resolve correctly. No crash.

REA version

6.4.0 (main @ 18831491c)

Runtime and platform

Node.js 22.22 and 22.23, Linux x64

Target and artifact context

Electron-style app directory with a bytenode .jsc (bytenode 1.x, Node 22.22). First 16 bytes: 28 06 de c0 74 fe da 79 48 01 00 00 e5 76 a6 a5

Interface

CLI

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

{ "specifier": "./core.jsc", "module_link_kind": "require", "resolution_status": "not-found", "resolved_path": null }
coverage: {"status":"complete","truncated":false,"omitted_count":0}

Typed outcome or recovery expected

No response

Analysis or suspected cause

Source-derived: JavaScriptArtifactFiles.ts skips files with no JavaScript-relevant kind (if (kind === undefined) continue;), so the resolver can't tell them apart from missing files.

Additional context

Related: #2228 (asks REA to parse .jsc). This issue is narrower: a present .jsc must not be reported as absent. A PR with a fix and regression tests follows.

Originally created by @cyberpunk47 on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2641 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `require("./core.jsc")` is reported as `resolution_status: "not-found"` even though `core.jsc` exists. The output is identical to when the file is deleted, coverage stays `"complete"`, and the edge limitation says no candidate "exists in the inventoried artifact container". So REA tells the agent a present module is absent. ### Reproduction ```bash mkdir sample-app && cd sample-app echo 'module.exports = { summarize: (items) => ({ count: items.length }) };' > core.js printf 'require("bytenode");\nconst core = require("./core.jsc");\n' > main.js echo '{ "name": "sample-app", "version": "1.0.0", "main": "main.js" }' > package.json npx bytenode@1 -c core.js && rm core.js cd .. rea analyze-javascript-application ./sample-app --format json ``` Then delete `sample-app/core.jsc` and run again: same result. ### Expected behavior A present but unanalysed target should be reported as such (e.g. the existing `unavailable` status with its sha256 and size), not as absent. A really missing file should stay `not-found`. ### Impact and scope Evidence integrity: a present file is reported absent. Also affects .wasm and other non-JavaScript targets. .js/.cjs/.mjs/.ts/.json/.node resolve correctly. No crash. ### REA version 6.4.0 (main @ 18831491c) ### Runtime and platform Node.js 22.22 and 22.23, Linux x64 ### Target and artifact context Electron-style app directory with a bytenode .jsc (bytenode 1.x, Node 22.22). First 16 bytes: 28 06 de c0 74 fe da 79 48 01 00 00 e5 76 a6 a5 ### Interface CLI ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence ```text { "specifier": "./core.jsc", "module_link_kind": "require", "resolution_status": "not-found", "resolved_path": null } coverage: {"status":"complete","truncated":false,"omitted_count":0} ``` ### Typed outcome or recovery expected _No response_ ### Analysis or suspected cause Source-derived: `JavaScriptArtifactFiles.ts` skips files with no JavaScript-relevant kind (`if (kind === undefined) continue;`), so the resolver can't tell them apart from missing files. ### Additional context Related: #2228 (asks REA to parse .jsc). This issue is narrower: a present .jsc must not be reported as absent. A PR with a fix and regression tests follows.

bsakaguchi

2026-10-15 18:29:47 +00:00

closed this issue
added the
triage

area: domain

bug
labels

bsakaguchi commented

2026-10-15 18:29:48 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in b58adafa4.

Present opaque require targets now retain inventoried identity and are unavailable, while genuinely absent targets remain not-found.

Validation: The exact present .jsc regression passed and checks SHA-256, size, candidate path and the absent-file control.

Verification scope: No .jsc decoding capability is claimed.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [b58adafa4](https://github.com/morluto/rea/commit/b58adafa4). Present opaque require targets now retain inventoried identity and are unavailable, while genuinely absent targets remain not-found. Validation: The exact present .jsc regression passed and checks SHA-256, size, candidate path and the absent-file control. Verification scope: No .jsc decoding capability is claimed.

bsakaguchi referenced this issue

2026-10-17 21:07:07 +00:00

[PR #945] [MERGED] perf(inspector): bound runtime script location authorization #2521

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#945

No description provided.

Rows
Columns