morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5398] [Bug] Missing CLI arguments expose raw validator details instead of documented guidance #3268

New issue

Closed

opened 2026-10-31 00:38:36 +00:00 by bsakaguchi · 4 comments

bsakaguchi commented

2026-10-31 00:38:36 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5398

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

node scripts/rea.mjs decompile --json with its required path omitted exits 1 and writes a VALIDATION_ERROR JSON document to stdout. The message contains raw validator wording and a serialized Details: array; fieldErrors repeats the validator representation. Stderr is empty. The replacement guidance recorded as implemented in the error inventory is absent.

Independent verification also reproduced this with node scripts/rea.mjs --json analyze and with an unrecognized search --kind value.

Reproduction

In the built source checkout at the revision below, run:

node scripts/rea.mjs decompile --json

This was run once by an independent verifier with configuration, home/XDG directories, temporary storage, and compile cache isolated. No target, analysis provider, or external API was needed. It exited 1 with the output described below. node scripts/rea.mjs decompile --help confirms Usage: rea decompile <path> [address] [options].

Expected behavior

Source-derived contract: docs/user-visible-errors.csv:36, identifier 24.95, explicitly covers omitted or mistyped command arguments and marks this replacement as implemented and verified:

REA could not read the command arguments. Check the named argument and its expected type, then try again.

Return that guidance with useful correction information, without embedding the raw validator issue list. Preserve argument names, omission information, allowed values, and exit status 1.

Impact and scope

P3 diagnostic wording defect. Each of the three tested invalid invocations reproduced once. They still reject invalid input and identify the affected field, so callers can correct their invocation. No analysis-result corruption, data loss, or security boundary crossing was demonstrated. TTY formatting, other output formats, and MCP were not tested.

REA version

6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8.

Runtime and platform

Node.js v26.12.0; macOS (darwin), arm64. No native analysis provider was used.

Target and artifact context

Not applicable: the minimal reproduction omits the target path and fails during argument parsing.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

The independently captured JSON for the minimal reproduction has code: "VALIDATION_ERROR". Its decoded message begins:

Invalid input: expected string, received undefined

Details: [

The remainder of the message serializes a validator issue with expected: "string", code: "invalid_type", and path: ["path"]. The sibling fieldErrors array repeats the message with path: "path", missing: true, expected: "string", and received: "".

The invalid search-kind case reports Invalid option: expected one of "strings"|"procedures", followed by another serialized Details: array, with the field diagnostic naming kind.

Expected source: docs/user-visible-errors.csv:36 at the tested revision. Failure source: the public CLI invocations; scripts/rea.mjs:83-119 delegates to the dispatcher, and src/cli/coreBinaryCommands.ts:159-167 declares the required path. Existing tests/boundary/cli/cliOutput.test.ts:424-486 asserts raw validation wording and field coordinates.

Typed outcome or recovery expected

Keep rejecting invalid input with exit 1 and enough information to correct the named argument. Use the registered guidance without the raw issue dump. This report does not require an error-envelope redesign or a specific field layout.

As an independently executed control, supplying a missing-file path and address to decompile passed argument validation and returned target_unavailable. Preserve that distinction.

Analysis or suspected cause

Source-derived observation: the existing CLI boundary tests expect raw validator wording, while inventory entry 24.95 promises the replacement guidance. The observed runtime behavior matches those test expectations rather than the copy inventory.

Additional context

Prepared with AI assistance and independently reproduced before submission. A source comparison against current upstream main e84468c0bb0476412ac0c8161f7c2ecc9a6864ca found no changes since the tested baseline in the cited dispatcher, command, inventory, or boundary-test files; no new runtime reproduction on that later revision is claimed.

Related #3894 concerns truncated piped JSON, and #2180 concerns missing correction metadata after handler admission. Neither reports this argument-parser copy mismatch. Historical merged #107 introduced the error inventory and described sanitized CLI validation; this report concerns the behavior independently observed on the revision above.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5398 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area CLI ### Observed behavior `node scripts/rea.mjs decompile --json` with its required path omitted exits 1 and writes a `VALIDATION_ERROR` JSON document to stdout. The message contains raw validator wording and a serialized `Details:` array; `fieldErrors` repeats the validator representation. Stderr is empty. The replacement guidance recorded as implemented in the error inventory is absent. Independent verification also reproduced this with `node scripts/rea.mjs --json analyze` and with an unrecognized `search --kind` value. ### Reproduction In the built source checkout at the revision below, run: ```sh node scripts/rea.mjs decompile --json ``` This was run once by an independent verifier with configuration, home/XDG directories, temporary storage, and compile cache isolated. No target, analysis provider, or external API was needed. It exited 1 with the output described below. `node scripts/rea.mjs decompile --help` confirms `Usage: rea decompile <path> [address] [options]`. ### Expected behavior Source-derived contract: `docs/user-visible-errors.csv:36`, identifier `24.95`, explicitly covers omitted or mistyped command arguments and marks this replacement as implemented and verified: > REA could not read the command arguments. Check the named argument and its expected type, then try again. Return that guidance with useful correction information, without embedding the raw validator issue list. Preserve argument names, omission information, allowed values, and exit status 1. ### Impact and scope P3 diagnostic wording defect. Each of the three tested invalid invocations reproduced once. They still reject invalid input and identify the affected field, so callers can correct their invocation. No analysis-result corruption, data loss, or security boundary crossing was demonstrated. TTY formatting, other output formats, and MCP were not tested. ### REA version 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. ### Runtime and platform Node.js v26.12.0; macOS (darwin), arm64. No native analysis provider was used. ### Target and artifact context Not applicable: the minimal reproduction omits the target path and fails during argument parsing. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence The independently captured JSON for the minimal reproduction has `code: "VALIDATION_ERROR"`. Its decoded `message` begins: ```text Invalid input: expected string, received undefined Details: [ ``` The remainder of the message serializes a validator issue with `expected: "string"`, `code: "invalid_type"`, and `path: ["path"]`. The sibling `fieldErrors` array repeats the message with `path: "path"`, `missing: true`, `expected: "string"`, and `received: ""`. The invalid search-kind case reports `Invalid option: expected one of "strings"|"procedures"`, followed by another serialized `Details:` array, with the field diagnostic naming `kind`. Expected source: `docs/user-visible-errors.csv:36` at the tested revision. Failure source: the public CLI invocations; `scripts/rea.mjs:83-119` delegates to the dispatcher, and `src/cli/coreBinaryCommands.ts:159-167` declares the required path. Existing `tests/boundary/cli/cliOutput.test.ts:424-486` asserts raw validation wording and field coordinates. ### Typed outcome or recovery expected Keep rejecting invalid input with exit 1 and enough information to correct the named argument. Use the registered guidance without the raw issue dump. This report does not require an error-envelope redesign or a specific field layout. As an independently executed control, supplying a missing-file path and address to `decompile` passed argument validation and returned `target_unavailable`. Preserve that distinction. ### Analysis or suspected cause Source-derived observation: the existing CLI boundary tests expect raw validator wording, while inventory entry `24.95` promises the replacement guidance. The observed runtime behavior matches those test expectations rather than the copy inventory. ### Additional context Prepared with AI assistance and independently reproduced before submission. A source comparison against current upstream main `e84468c0bb0476412ac0c8161f7c2ecc9a6864ca` found no changes since the tested baseline in the cited dispatcher, command, inventory, or boundary-test files; no new runtime reproduction on that later revision is claimed. Related #3894 concerns truncated piped JSON, and #2180 concerns missing correction metadata after handler admission. Neither reports this argument-parser copy mismatch. Historical merged #107 introduced the error inventory and described sanitized CLI validation; this report concerns the behavior independently observed on the revision above.

bsakaguchi closed this issue

2026-10-31 00:38:36 +00:00

bsakaguchi commented

2026-10-31 00:38:37 +00:00

Author

Owner

@dark13b commented on GitHub (Oct 20, 2026):

I'd like to work on this one.

I'll reproduce the decompile --json case from a source checkout first, then route omitted and mistyped command arguments to the documented 24.95 guidance while keeping the argument name, omission details, allowed values, and exit status 1. A draft PR with a regression test will follow.

@dark13b commented on GitHub (Oct 20, 2026): I'd like to work on this one. I'll reproduce the `decompile --json` case from a source checkout first, then route omitted and mistyped command arguments to the documented 24.95 guidance while keeping the argument name, omission details, allowed values, and exit status 1. A draft PR with a regression test will follow.

bsakaguchi commented

2026-10-31 00:38:37 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 20, 2026):

TL;DR: This still happens on main on Linux. Running decompile --json with no path prints the raw validator text.

Edit: The tests in PR #5471 now cover search --kind. See here.

Checked on main b3aadaf47 (Node 24.18.0). decompile --json with no path exits 1 and prints VALIDATION_ERROR. The message still holds the raw validator text plus a serialized Details: array, and fieldErrors repeats it. Stderr is empty.

Not run

analyze, ~~search --kind~~, TTY output, other formats, MCP.

Thanks, coygeek, for the clear report.

Commands

node scripts/rea.mjs decompile --json

Exit 1, stdout 536 bytes, stderr 0 bytes. Excerpt:

{"code":"VALIDATION_ERROR","message":"Invalid input: expected string, received undefined\n\nDetails: [\n  {\n    \"expected\": \"string\", ... \"path\": [\"path\"] ...}\n]","fieldErrors":[{"code":"invalid_type","missing":true,"path":"path","expected":"string", ...}]}

Isolated HOME, XDG and TMPDIR; run once.

Test setup

Box: Nobara 44 (Fedora 44 base), Linux 7.2.11
CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
RAM: 32 GB DDR4-3600
Node: 24.18.0
Head: b3aadaf47
Other: another job shared the box during the run

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 20, 2026): **TL;DR:** This still happens on main on Linux. Running `decompile --json` with no path prints the raw validator text. **Edit:** The tests in PR #5471 now cover `search --kind`. See [here](https://github.com/morluto/rea/pull/5471#issuecomment-6304589915). Checked on main b3aadaf47 (Node 24.18.0). `decompile --json` with no path exits 1 and prints `VALIDATION_ERROR`. The `message` still holds the raw validator text plus a serialized `Details:` array, and `fieldErrors` repeats it. Stderr is empty. ### Not run - `analyze`, ~~`search --kind`~~, TTY output, other formats, MCP. Thanks, coygeek, for the clear report. <details> <summary>Commands</summary> ```sh node scripts/rea.mjs decompile --json ``` Exit 1, stdout 536 bytes, stderr 0 bytes. Excerpt: ```json {"code":"VALIDATION_ERROR","message":"Invalid input: expected string, received undefined\n\nDetails: [\n {\n \"expected\": \"string\", ... \"path\": [\"path\"] ...}\n]","fieldErrors":[{"code":"invalid_type","missing":true,"path":"path","expected":"string", ...}]} ``` Isolated HOME, XDG and TMPDIR; run once. </details> <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.11 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 24.18.0 - Head: b3aadaf47 - Other: another job shared the box during the run </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-31 00:38:38 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 20, 2026):

Additional numeric triggers for this same argument-validation error, reproduced on rea-agents 6.7.0 at source commit 9d8e7803326a382cbbb3ffdb900f5e93e5442d68, Node.js v26.12.0, macOS 27.0.1 arm64:

work_dir="$(mktemp -d)"
mkdir -p "$work_dir/target" "$work_dir/home" "$work_dir/cfg" "$work_dir/data" "$work_dir/cache" "$work_dir/state" "$work_dir/temp"
printf 'example\n' > "$work_dir/target/readme.txt"
run_rea() {
  env -i PATH="$PATH" HOME="$work_dir/home" XDG_CONFIG_HOME="$work_dir/cfg" \
    XDG_DATA_HOME="$work_dir/data" XDG_CACHE_HOME="$work_dir/cache" \
    XDG_STATE_HOME="$work_dir/state" TMPDIR="$work_dir/temp" REA_LOG_LEVEL=silent \
    node scripts/rea.mjs "$@"
}
run_rea inspect-desktop-application "$work_dir/target" --max_entries 100001 --json
run_rea inspect-desktop-application "$work_dir/target" --max_probe_bytes -1 --json
run_rea inspect-desktop-application "$work_dir/target" --max_probe_bytes not-a-number --json
run_rea inspect-desktop-application "$work_dir/target" --max_entries 1.5 --json
run_rea analyze-javascript-application "$work_dir/target" --max-semantic-nodes 0 --json

Run from a built source checkout. Each invocation ran once, exited 1, returned VALIDATION_ERROR on stdout, and left stderr empty. In order, the decoded messages began:

Too big: expected number to be <=100000
Too small: expected number to be >=4096
Invalid input: expected number, received NaN
Invalid input: expected int, received number
Too small: expected number to be >=1

Each message then appended a serialized Details: issue array. The sibling fieldErrors retained the rejected field and its correction information; the semantic-node field is named maxSemanticNodes there.

The control run_rea inspect-desktop-application "$work_dir/target" --max_entries 100000 --json exited 0 and returned Evidence. run_rea decompile --json still reproduced the original missing-path diagnostic. No native analysis provider or external API was used.

Source-derived reasoning: these numeric options reach the same Incur Parser.zodParse → ValidationError → cause serialization path as the existing triggers. The common repair should preserve input rejection, exit status 1, and useful field/type/bound diagnostics while restoring the documented top-level guidance without the serialized issue dump. These are additional regression cases for the existing issue, not a separate defect.

Fetched upstream main at 52c84f6f58fa3cc7b39326654c6d3f261f957957; the cited dispatcher, validation declarations, error inventory, boundary tests, and lockfile have no changes from the tested baseline. This is a source comparison, not a runtime test of that later revision. PR #5471 remains open; its build was not tested here. Prepared with AI assistance and independently reviewed.

@coygeek commented on GitHub (Oct 20, 2026): Additional numeric triggers for this same argument-validation error, reproduced on `rea-agents` 6.7.0 at source commit `9d8e7803326a382cbbb3ffdb900f5e93e5442d68`, Node.js v26.12.0, macOS 27.0.1 arm64: ```sh work_dir="$(mktemp -d)" mkdir -p "$work_dir/target" "$work_dir/home" "$work_dir/cfg" "$work_dir/data" "$work_dir/cache" "$work_dir/state" "$work_dir/temp" printf 'example\n' > "$work_dir/target/readme.txt" run_rea() { env -i PATH="$PATH" HOME="$work_dir/home" XDG_CONFIG_HOME="$work_dir/cfg" \ XDG_DATA_HOME="$work_dir/data" XDG_CACHE_HOME="$work_dir/cache" \ XDG_STATE_HOME="$work_dir/state" TMPDIR="$work_dir/temp" REA_LOG_LEVEL=silent \ node scripts/rea.mjs "$@" } run_rea inspect-desktop-application "$work_dir/target" --max_entries 100001 --json run_rea inspect-desktop-application "$work_dir/target" --max_probe_bytes -1 --json run_rea inspect-desktop-application "$work_dir/target" --max_probe_bytes not-a-number --json run_rea inspect-desktop-application "$work_dir/target" --max_entries 1.5 --json run_rea analyze-javascript-application "$work_dir/target" --max-semantic-nodes 0 --json ``` Run from a built source checkout. Each invocation ran once, exited 1, returned `VALIDATION_ERROR` on stdout, and left stderr empty. In order, the decoded messages began: - `Too big: expected number to be <=100000` - `Too small: expected number to be >=4096` - `Invalid input: expected number, received NaN` - `Invalid input: expected int, received number` - `Too small: expected number to be >=1` Each message then appended a serialized `Details:` issue array. The sibling `fieldErrors` retained the rejected field and its correction information; the semantic-node field is named `maxSemanticNodes` there. The control `run_rea inspect-desktop-application "$work_dir/target" --max_entries 100000 --json` exited 0 and returned Evidence. `run_rea decompile --json` still reproduced the original missing-path diagnostic. No native analysis provider or external API was used. Source-derived reasoning: these numeric options reach the same Incur `Parser.zodParse` → `ValidationError` → cause serialization path as the existing triggers. The common repair should preserve input rejection, exit status 1, and useful field/type/bound diagnostics while restoring the documented top-level guidance without the serialized issue dump. These are additional regression cases for the existing issue, not a separate defect. Fetched upstream main at `52c84f6f58fa3cc7b39326654c6d3f261f957957`; the cited dispatcher, validation declarations, error inventory, boundary tests, and lockfile have no changes from the tested baseline. This is a source comparison, not a runtime test of that later revision. PR #5471 remains open; its build was not tested here. Prepared with AI assistance and independently reviewed.

bsakaguchi commented

2026-10-31 00:38:38 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

Shared middleware catches Incur ValidationError, supplies documented 24.95 top-level guidance, preserves fieldErrors, and retains original cause without passing it to the constructor that appends Details. It is installed after all commands. A createCli/serve regression exercises missing analyze/decompile, invalid search --kind, exit 1, exact guidance, no Details, and path/missing/expected or enum metadata.

Implementation: argumentErrors.ts, cli.ts.

The relevant regression checks in argumentGuidance.test.ts, cliOutput.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. Shared middleware catches Incur ValidationError, supplies documented 24.95 top-level guidance, preserves fieldErrors, and retains original cause without passing it to the constructor that appends Details. It is installed after all commands. A createCli/serve regression exercises missing analyze/decompile, invalid search --kind, exit 1, exact guidance, no Details, and path/missing/expected or enum metadata. Implementation: [argumentErrors.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/cli/argumentErrors.ts#L6), [cli.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/cli.ts#L170). The relevant regression checks in [argumentGuidance.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/cli/argumentGuidance.test.ts), [cliOutput.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/cli/cliOutput.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3268

No description provided.

Rows
Columns