[GH-ISSUE #2913] [Feature] Report observed query parameter names in API surfaces #1024

New issue

Closed

opened 2026-10-15 18:30:27 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:30:27 +00:00

Owner

Originally created by @zhangguiping-xydt on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2913

Problem

When reconstructing a web client's API usage, an analyst needs to know which query parameter names were actually observed for each endpoint. The retained api-surface view currently groups method/origin/path and response facts but omits parameter-name inventories, so the caller must revisit every original record.

For /api/products?category=books&page=1 and /api/products?category=games&sort=price, the desired endpoint inventory is category, page, sort, with original record references. These observations do not establish required parameters, value types, or a complete server schema.

Desired outcome and success criteria

Add opt-in query parameter name reporting to the existing API-surface view; preserve its default output.
Aggregate distinct observed names per group in deterministic order, retaining original record ordinals.
Preserve empty names, duplicates' set semantics, encoded names and literal plus/space distinctions according to the documented query parser.
Copy no parameter values or fragments into the inventory, and preserve existing explicit-sensitive-value refusals.
Keep paging, Evidence provenance, original URLs and representation budgets intact.
Share behavior across compiled CLI and retained/portable MCP Evidence without reopening the capture.

Expected interaction with targets

Read existing captured data. This projection adds no process launch, target execution, network access, request replay or file mutation.

Verification available so far

Source inspection of main 1b6c899: view request/result schema has no query-name selection or result field. This is a capability request, not a claim of an implemented or measured result.

Proposed checks: encoded/repeated/empty names, query values absent from output, fragment exclusion, grouping and paging, resource admission, explicit-sensitive parent refusal, and actual compiled CLI/stdio MCP calls on an independently recorded local capture.

Alternatives considered

Complete capture pages contain the original URLs, but require repeated manual aggregation. Passive browser inspection already exposes per-request names; it does not provide an aggregated historical API-surface view.

Implementation available

Implementation: github.com/zhangguiping-xydt/rea@d2cf479d99

The branch has passed focused tests, static checks, documentation checks and exact-commit compiled CLI / production stdio MCP verification using real locally recorded traffic. Original working capture files were removed before retained-Evidence projection/comparison; provenance and paging were checked.

Originally created by @zhangguiping-xydt on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2913 ## Problem When reconstructing a web client's API usage, an analyst needs to know which query parameter names were actually observed for each endpoint. The retained `api-surface` view currently groups method/origin/path and response facts but omits parameter-name inventories, so the caller must revisit every original record. For `/api/products?category=books&page=1` and `/api/products?category=games&sort=price`, the desired endpoint inventory is `category`, `page`, `sort`, with original record references. These observations do not establish required parameters, value types, or a complete server schema. ## Desired outcome and success criteria - Add opt-in query parameter name reporting to the existing API-surface view; preserve its default output. - Aggregate distinct observed names per group in deterministic order, retaining original record ordinals. - Preserve empty names, duplicates' set semantics, encoded names and literal plus/space distinctions according to the documented query parser. - Copy no parameter values or fragments into the inventory, and preserve existing explicit-sensitive-value refusals. - Keep paging, Evidence provenance, original URLs and representation budgets intact. - Share behavior across compiled CLI and retained/portable MCP Evidence without reopening the capture. ## Expected interaction with targets Read existing captured data. This projection adds no process launch, target execution, network access, request replay or file mutation. ## Verification available so far Source inspection of main `1b6c899`: [view request/result schema](https://github.com/morluto/rea/blob/1b6c899b031421dcf2d725a63e67d99375028d6e/src/domain/analysisView/webNetworkApiSurfaceView.ts#L14) has no query-name selection or result field. This is a capability request, not a claim of an implemented or measured result. Proposed checks: encoded/repeated/empty names, query values absent from output, fragment exclusion, grouping and paging, resource admission, explicit-sensitive parent refusal, and actual compiled CLI/stdio MCP calls on an independently recorded local capture. ## Alternatives considered Complete capture pages contain the original URLs, but require repeated manual aggregation. Passive browser inspection already exposes per-request names; it does not provide an aggregated historical API-surface view. ### Implementation available Implementation: https://github.com/zhangguiping-xydt/rea/commit/d2cf479d99722d8a8b64bb9739da52086999a952 The branch has passed focused tests, static checks, documentation checks and exact-commit compiled CLI / production stdio MCP verification using real locally recorded traffic. Original working capture files were removed before retained-Evidence projection/comparison; provenance and paging were checked.

bsakaguchi

2026-10-15 18:30:27 +00:00