classifyError 的 type/runtime 两支仍按文案分类,而 cel-js 把作者源码嵌进 message —— 字段名叫 parse_status 的记录,求值期故障被答成 kind: 'parse'

[baozhoutao]

范围外发现,出自 #6133 / PR #6202 的词表审计。按 Prime Directive #10 记录,不指派。

与 #6133 的关系

#6133 修的是 parse 期:PR #6202 把 ParseError 改成按错误类判定,那一支不再读文案。但 classifyError 的 type / runtime 两支刻意保留了原关键词表(理由见 PR #6202:cel-js 的 TypeChecker 按阶段而非按故障选错误类,整体结构化会迁移既有判定,需要单独定价)。

本单据记录的是:那两支上,#6133 的根因原封不动地还在,并且有一个具体的、今天就能踩到的表现。

事实(origin/main + PR #6202 之后的分类器,实测)

cel-js 的 formatErrorWithHighlight(lib/errors.js)把出错那一行源码拼进 message,求值期错误也不例外。于是关键词匹配的是作者可控的文本。同一个 no such overload 求值故障,只因字段名不同:

record.status > 1         EvaluationError -> kind = 'runtime'   ✅
record.parse_status > 1   EvaluationError -> kind = 'parse'     ❌
record.syntax_mode > 1    EvaluationError -> kind = 'parse'     ❌
record.unexpected_at > 1  EvaluationError -> kind = 'parse'     ❌

四条的首行文案完全一样(no such overload: dyn string > int),差别只在 message 尾部回显的源码行。

复现(仓库根):

import { Environment } from '@marcbachmann/cel-js';
const env = new Environment({ unlistedVariablesAreDyn: true, enableOptionalTypes: true });
try { env.evaluate('record.parse_status > 1', { record: { parse_status: 'open' } }); }
catch (e) { console.log(e.name, JSON.stringify(e.message)); }

为什么这条比 #6133 那格更别扭

kind 会原样进作者可见面(objectql rule-validator / cel-fault、rest 的 reason,位置见 #6133)。#6133 是"语法错被答成运行期错" —— 指错方向;这条是反向:表达式语法完全正确、在数据上求值失败,却被告知 parse,即"你的表达式写错了"。作者会去检查一个没有问题的表达式。ADR-0032 D1d 同样不满足。

type 一支同理:字段名叫 type(极常见)的记录,求值期故障会落 /type/ 判成 kind: 'type'。这一格危害小些(type 与 runtime 都指向求值期),但成因是同一个。

未量化 / 未主张

• 没有统计真实 metadata 里字段名含 parse / syntax / unexpected 的比例。type 的比例显然不低,但那一格危害小。
• 没有断言"必须整体结构化"。PR fix(formula): classifyError 把 cel-js 的 parse 错误按错误类归为 syntax/parse,不再误报 runtime (#6133) #6202 已实测:cel-js 求值期共 18 个 evaluation code,现关键词表对其中 17 个判定正确,唯一需要留在 type 的是 unknown_variable(check 期抛 TypeError、eval 期抛 EvaluationError,见 lib/type-checker.js:16 的 isEvaluating ? evaluationError : typeError)。所以逐 code 映射是可做的,只是没在 celEngine 的 classifyError 把「括号/方括号不配对」这类真语法错答成 kind: 'runtime',而该 kind 会原样出现在作者可见的拒写消息与 REST 响应体里 #6133 的 scope 里做。
• 没有排查 bounds 一支:/Exceeded max/ 同样是文案匹配,但 PR fix(formula): classifyError 把 cel-js 的 parse 错误按错误类归为 syntax/parse,不再误报 runtime (#6133) #6202 已把 limit_exceeded 结构化,该支现在只在非 cel-js 错误上生效。

建议方向(供 triage,不代裁)

沿 PR #6202 的同一条路走完:EvaluationError -> runtime、TypeError -> type,再用一张按 code(不是按文案)的小表把 unknown_variable 这类"声明类故障"挑回 type。收益是关键词表可以整个删掉,classifyError 不再有任何一支读作者可控的文本;代价是要为 18 个 evaluation code 各定一次价,并钉 fixture。

关联

#6133 / PR #6202(发现出处与已修的 parse 一支)。#6132(cel-to-filter 第三入口,另有一套 reason: 'parse-error' 词表)。ADR-0032 D1d。

[claude]

Triage: pm:queue + domain:engine-core. No release-board label — see below.

Domain anchoring

classifyError is packages/formula/src/cel-engine.ts:849, with its three call sites at :176, :892, :953 in the same file. packages/formula (CEL / matches-filter / RLS predicate evaluation) ⇒ domain:engine-core, same lane as its predecessor #6133 (pm:dispatched, domain:engine-core). Routed by landing site; the topic ("error classification / author-facing diagnostics") would have suggested services or cli, and neither is where the function lives.

Stale-premise check — origin/main 72847c5

The premise is sharper than filed, not staler. cel-engine.ts:817 now carries the comment PR #6202 left behind:

Why the class and not the message (#6133): classifyError used to decide …

— i.e. the file itself documents that reading the message was the root cause, and the fix was applied to exactly one branch. #6133 is closed completed, so the "parse branch fixed, type / runtime branches unchanged" split the body describes is the current state of main, and the restriction was deliberate (PR #6202's own reasoning: cel-js's TypeChecker picks error classes by phase, so structuring the rest needs its own pricing).

Why pm:queue rather than finding

The body is an out-of-scope finding by origin, but it does not read as observation-class: it names the function and line, gives a four-line reproduction that a dev can paste, and the harm is concrete and inverted — a syntactically valid expression that fails at evaluation is reported to the author as kind: 'parse', i.e. "your expression is malformed", sending them to inspect a correct expression. parse_status / syntax_mode are ordinary field names, and type (the second affected branch) is a very common one.

Two things make this cheap to price, which is the other half of why it is queueable rather than held: PR #6202 already measured the target surface — 18 cel-js evaluation codes, of which the current keyword table classifies 17 correctly, with unknown_variable the single case that must stay in type (lib/type-checker.js:16, isEvaluating ? evaluationError : typeError). So the by-code table the body suggests has a known size and a known exception list, not an open-ended audit.

PM mechanism assumption (verify, falsifying it is welcome): that the by-code mapping can replace the keyword table outright, so that no branch of classifyError reads author-controlled text. The body's own claim is narrower — it does not assert "must fully structure". Measure before committing to the full removal; a partial route that fixes the two message-reading branches while keeping a smaller table is an acceptable outcome if the measurement says so.

Not on the release board

The predecessor #6133 carried no target:* either. This is a wrong-diagnostic defect on an author-facing field: no data is lost, no contract is violated on the wire, nothing fails closed or open. It costs the author time, which is real, but it is not "the RC cannot ship" under any of the four blocking criteria. If a lane disagrees, the board is one label away.

Dedup (three repos, open issues and PRs)

⚠️ The GitHub search API is not reachable from this seat (/search/issues answers "sessions are bound to their configured repositories", returning a structurally empty result rather than an error). Dedup was done by paginating all 442 open issues and PRs across the three repos and matching locally on classifyError, cel-engine, kind: 'parse', EvaluationError.

No open shadow. #6133 is closed (the fixed branch), and #6132 (cel-to-filter's separate reason: 'parse-error' keyword table) is the third entrance the body names — related, distinct landing site, deliberately left as its own item.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code