[GH-ISSUE #3194] [Bug] inspect-analysis-view help omits supported web-capture Evidence #1133

New issue

Closed

opened 2026-10-15 18:31:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:31:22 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3194

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

node scripts/rea.mjs inspect-analysis-view --help exits 0 and describes completed layout, JavaScript application and native function Evidence only. It omits complete web-capture Evidence, although the documented CLI workflow accepts it. Independent verification submitted the same digest-valid synthetic HAR parent through the public CLI with summary and api-surface views. Both commands exited 0 and returned the requested views with parent_operation: inspect_web_network_capture.

Reproduction

Start from a clean checkout at 58300885207133422af235e0f2b10658cf958b03 and select the repository's pinned development toolchain. Install dependencies and build:
```
npm ci
npm run build:cached
```
Read the command help:
```
node scripts/rea.mjs inspect-analysis-view --help
```
The description lists only layout, JavaScript application and native function Evidence.

Create a complete inline Evidence request. The parent models one retained HAR record and needs no capture file or decoder:

cat > sample.json <<'JSON'
{
  "source": {
    "kind": "inline",
    "evidence": {
      "evidence_id": "ev_f5c6544861400fa214819c76e78e892c29d9e74c46bf80a65b4499dcf06fa173",
      "subject": {
        "name": "sample.har",
        "digest": {
          "sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
        },
        "local_path": "sample.har",
        "format": "file",
        "architecture": null
      },
      "provider": {
        "id": "fixture",
        "name": "fixture",
        "version": "1"
      },
      "analysis_profile": null,
      "predicate_type": "rea.analysis",
      "operation": "inspect_web_network_capture",
      "parameters": {
        "sensitive_value_count": 0
      },
      "raw_result": null,
      "normalized_result": {
        "artifact": {
          "path": "sample.har",
          "sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
          "bytes": 1
        },
        "format": "har",
        "decoder": {
          "id": "fixture",
          "name": "fixture",
          "version": "1"
        },
        "container": {
          "reported": {},
          "numeric_literals": [],
          "redactions": [],
          "records_pointer": "/log/entries"
        },
        "total_records": 1,
        "records": [
          {
            "ordinal": 0,
            "location": {
              "kind": "json-pointer",
              "pointer": "/log/entries/0"
            },
            "reported": {
              "request": {
                "method": "GET",
                "url": "https://api.example.test/items/1"
              },
              "response": {
                "status": 200
              }
            },
            "binary_fields": [],
            "numeric_literals": [],
            "redactions": [],
            "limitations": []
          }
        ],
        "runtime_attribution": "unknown",
        "limitations": []
      },
      "confidence": "observed",
      "authority": "shipped-artifact",
      "environment": null,
      "limitations": [],
      "relationship_coverage": null,
      "locations": [],
      "evidence_links": []
    }
  },
  "view": {
    "kind": "summary"
  }
}
JSON

Request the summary:
```
node scripts/rea.mjs inspect-analysis-view sample.json --json
```
Verification observed exit 0, normalized_result.kind: summary, normalized_result.parent_operation: inspect_web_network_capture, and summary.retained_records: 1.

Change only the view and request the api-surface projection:

node --input-type=module <<'JS'
import { readFileSync, writeFileSync } from 'node:fs';
const request = JSON.parse(readFileSync('sample.json', 'utf8'));
request.view = { kind: 'api-surface' };
writeFileSync('sample.json', JSON.stringify(request, null, 2) + '\n');
JS
node scripts/rea.mjs inspect-analysis-view sample.json --json

Verification observed exit 0, normalized_result.kind: api-surface, the same parent operation, and one GET group.

Expected behavior

The help should accurately describe supported complete Evidence inputs, including the documented web-capture workflow. docs/web-network-captures.md:50-55 directs CLI callers to save complete inspection JSON and pass it as inline Evidence to inspect-analysis-view, with the same summary and capture-page contracts. src/contracts/analysisViewToolContracts.ts:19 documents web-capture input and the api-surface view. A general accurate description is sufficient; the help does not need to enumerate every supported parent operation or imply that arbitrary parents are accepted.

Impact and scope

This is a P3 wording and capability-discovery defect. A caller relying on command help receives an incomplete description of accepted inputs. The verified web-capture summary and api-surface views work when invoked directly, so following the web-capture guide provides a practical workaround. Verification found no incorrect analysis result or blocked execution path in those requests. Other parent kinds were inspected in source but were not individually executed.

REA version

6.4.0 (main at 5830088520)

Runtime and platform

Node.js 24.21.0; macOS. The verifier did not record the OS version or architecture. The development pin is Node.js 24.18.0; the observed runtime is within the documented supported Node 24 range.

Target and artifact context

Digest-valid complete inline Evidence with operation inspect_web_network_capture, format har, and one synthetic GET record. sample.har is a subject label; the reproduction creates the inline JSON only. Verification did not decode HAR bytes, run a capture decoder, or contact a network service.

Interface

CLI

Earliest failure stage

Unknown

Relevant output or evidence

The verifier recorded this help line and the following selected result fields:

rea inspect-analysis-view — Project a selected view of completed layout, JavaScript application or native function Evidence JSON

summary request: exit 0
normalized_result.kind: summary
normalized_result.parent_operation: inspect_web_network_capture
summary.retained_records: 1

api-surface request: exit 0
normalized_result.kind: api-surface
normalized_result.parent_operation: inspect_web_network_capture
GET groups: 1

Typed outcome or recovery expected

Keep the successful web-capture views while correcting the description. Unsupported parents must still receive a typed unsupported_target result. The verifier's separate digest-valid inspect_recorded_crash summary control exited 1 with that code and a message identifying the operation as unsupported.

Analysis or suspected cause

Source-derived at the stated baseline: src/cli/analysisViewCommands.ts:74 registers the incomplete description. Lines 85-97 validate the common input and invoke the shared view service. src/domain/analysisView/analysisView.ts:730-827 includes explicit web-capture and pcap branches and additional retained-parent projectors. This source corroborates broader support; verification executed the web-capture summary and api-surface paths and the unsupported-parent control only.

Additional context

Related to #2454, which corrected MCP guidance recommending an unsupported native summary view; this report concerns the CLI help omitting an already supported web-capture parent input. Independent verification used prepared dependencies and a compiled runtime; it did not rerun npm ci or npm run build:cached. Those commands describe clean-checkout setup. P3 reflects the observed wording defect and the working documented workaround.

Originally created by @coygeek on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3194 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area CLI ### Observed behavior `node scripts/rea.mjs inspect-analysis-view --help` exits 0 and describes completed layout, JavaScript application and native function Evidence only. It omits complete web-capture Evidence, although the documented CLI workflow accepts it. Independent verification submitted the same digest-valid synthetic HAR parent through the public CLI with summary and api-surface views. Both commands exited 0 and returned the requested views with `parent_operation: inspect_web_network_capture`. ### Reproduction 1. Start from a clean checkout at `58300885207133422af235e0f2b10658cf958b03` and select the repository's pinned development toolchain. Install dependencies and build: ```sh npm ci npm run build:cached ``` 2. Read the command help: ```sh node scripts/rea.mjs inspect-analysis-view --help ``` The description lists only layout, JavaScript application and native function Evidence. 3. Create a complete inline Evidence request. The parent models one retained HAR record and needs no capture file or decoder: ```sh cat > sample.json <<'JSON' { "source": { "kind": "inline", "evidence": { "evidence_id": "ev_f5c6544861400fa214819c76e78e892c29d9e74c46bf80a65b4499dcf06fa173", "subject": { "name": "sample.har", "digest": { "sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" }, "local_path": "sample.har", "format": "file", "architecture": null }, "provider": { "id": "fixture", "name": "fixture", "version": "1" }, "analysis_profile": null, "predicate_type": "rea.analysis", "operation": "inspect_web_network_capture", "parameters": { "sensitive_value_count": 0 }, "raw_result": null, "normalized_result": { "artifact": { "path": "sample.har", "sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "bytes": 1 }, "format": "har", "decoder": { "id": "fixture", "name": "fixture", "version": "1" }, "container": { "reported": {}, "numeric_literals": [], "redactions": [], "records_pointer": "/log/entries" }, "total_records": 1, "records": [ { "ordinal": 0, "location": { "kind": "json-pointer", "pointer": "/log/entries/0" }, "reported": { "request": { "method": "GET", "url": "https://api.example.test/items/1" }, "response": { "status": 200 } }, "binary_fields": [], "numeric_literals": [], "redactions": [], "limitations": [] } ], "runtime_attribution": "unknown", "limitations": [] }, "confidence": "observed", "authority": "shipped-artifact", "environment": null, "limitations": [], "relationship_coverage": null, "locations": [], "evidence_links": [] } }, "view": { "kind": "summary" } } JSON ``` 4. Request the summary: ```sh node scripts/rea.mjs inspect-analysis-view sample.json --json ``` Verification observed exit 0, `normalized_result.kind: summary`, `normalized_result.parent_operation: inspect_web_network_capture`, and `summary.retained_records: 1`. 5. Change only the view and request the api-surface projection: ```sh node --input-type=module <<'JS' import { readFileSync, writeFileSync } from 'node:fs'; const request = JSON.parse(readFileSync('sample.json', 'utf8')); request.view = { kind: 'api-surface' }; writeFileSync('sample.json', JSON.stringify(request, null, 2) + '\n'); JS node scripts/rea.mjs inspect-analysis-view sample.json --json ``` Verification observed exit 0, `normalized_result.kind: api-surface`, the same parent operation, and one GET group. ### Expected behavior The help should accurately describe supported complete Evidence inputs, including the documented web-capture workflow. `docs/web-network-captures.md:50-55` directs CLI callers to save complete inspection JSON and pass it as inline Evidence to `inspect-analysis-view`, with the same summary and capture-page contracts. `src/contracts/analysisViewToolContracts.ts:19` documents web-capture input and the api-surface view. A general accurate description is sufficient; the help does not need to enumerate every supported parent operation or imply that arbitrary parents are accepted. ### Impact and scope This is a P3 wording and capability-discovery defect. A caller relying on command help receives an incomplete description of accepted inputs. The verified web-capture summary and api-surface views work when invoked directly, so following the web-capture guide provides a practical workaround. Verification found no incorrect analysis result or blocked execution path in those requests. Other parent kinds were inspected in source but were not individually executed. ### REA version 6.4.0 (main at 58300885207133422af235e0f2b10658cf958b03) ### Runtime and platform Node.js 24.21.0; macOS. The verifier did not record the OS version or architecture. The development pin is Node.js 24.18.0; the observed runtime is within the documented supported Node 24 range. ### Target and artifact context Digest-valid complete inline Evidence with operation `inspect_web_network_capture`, format `har`, and one synthetic GET record. `sample.har` is a subject label; the reproduction creates the inline JSON only. Verification did not decode HAR bytes, run a capture decoder, or contact a network service. ### Interface CLI ### Earliest failure stage Unknown ### Relevant output or evidence The verifier recorded this help line and the following selected result fields: ```text rea inspect-analysis-view — Project a selected view of completed layout, JavaScript application or native function Evidence JSON summary request: exit 0 normalized_result.kind: summary normalized_result.parent_operation: inspect_web_network_capture summary.retained_records: 1 api-surface request: exit 0 normalized_result.kind: api-surface normalized_result.parent_operation: inspect_web_network_capture GET groups: 1 ``` ### Typed outcome or recovery expected Keep the successful web-capture views while correcting the description. Unsupported parents must still receive a typed `unsupported_target` result. The verifier's separate digest-valid `inspect_recorded_crash` summary control exited 1 with that code and a message identifying the operation as unsupported. ### Analysis or suspected cause Source-derived at the stated baseline: `src/cli/analysisViewCommands.ts:74` registers the incomplete description. Lines 85-97 validate the common input and invoke the shared view service. `src/domain/analysisView/analysisView.ts:730-827` includes explicit web-capture and pcap branches and additional retained-parent projectors. This source corroborates broader support; verification executed the web-capture summary and api-surface paths and the unsupported-parent control only. ### Additional context Related to #2454, which corrected MCP guidance recommending an unsupported native summary view; this report concerns the CLI help omitting an already supported web-capture parent input. Independent verification used prepared dependencies and a compiled runtime; it did not rerun `npm ci` or `npm run build:cached`. Those commands describe clean-checkout setup. P3 reflects the observed wording defect and the working documented workaround.

bsakaguchi

2026-10-15 18:31:22 +00:00