From 1a945ce9ff773168099ef896df4d088fd8daf63b Mon Sep 17 00:00:00 2001
From: Vishal Tambi <138616107+vishal-tambi@users.noreply.github.com>
Date: Thu, 22 Oct 2026 01:20:52 +0530
Subject: [PATCH] fix(cli): reject an empty JavaScript application path (#5265)

---
 src/cli/electronCommands.ts                   |  4 ++-
 .../javascriptSelectedPathEvidence.test.ts    | 25 +++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/src/cli/electronCommands.ts b/src/cli/electronCommands.ts
index 4dda8d7de6..12ef5591e1 100644
--- a/src/cli/electronCommands.ts
+++ b/src/cli/electronCommands.ts
@@ -297,7 +297,9 @@ const registerJavaScriptApplicationCommand = (
         logCliCommand(logger, CLI_COMMANDS.analyzeJavaScriptApplication, () =>
           runCliJavaScriptApplicationAnalysis(
             {
-              input_path: absoluteCallerPath(args.path),
+              // An empty path names no file; leave it for input validation.
+              input_path:
+                args.path === "" ? args.path : absoluteCallerPath(args.path),
               format: options.artifactFormat,
               integrity_policy: options.integrityPolicy,
               ...(options.maxSemanticNodes === undefined
diff --git a/tests/boundary/javascript/javascriptSelectedPathEvidence.test.ts b/tests/boundary/javascript/javascriptSelectedPathEvidence.test.ts
index d5372238ef..7a23bee1f4 100644
--- a/tests/boundary/javascript/javascriptSelectedPathEvidence.test.ts
+++ b/tests/boundary/javascript/javascriptSelectedPathEvidence.test.ts
@@ -140,3 +140,28 @@ cliTest(
     ).toBe(true);
   },
 );
+
+// Anchoring must not turn an empty selection into the working directory.
+cliTest.for([
+  {
+    command: "analyze-javascript-application",
+    rejection: {
+      code: "invalid_request",
+      details: { issues: [expect.objectContaining({ path: ["input_path"] })] },
+    },
+  },
+  { command: "analyze", rejection: { code: "VALIDATION_ERROR" } },
+])(
+  "$command rejects an empty path instead of analyzing the working directory",
+  async ({ command, rejection }, { cli }) => {
+    const root = await createTestTempDirectory("rea-js-empty-path-");
+    await writeFile(join(root, "main.js"), "export const value = 7;\n");
+    const response = await cli.run({
+      arguments: [command, "", "--json"],
+      cwd: root,
+      environment: { REA_LOG_LEVEL: "silent" },
+    });
+    expect(response.exitCode, response.stderr).toBe(1);
+    expect(response.json).toMatchObject(rejection);
+  },
+);