[GH-ISSUE #5528] [Bug] rea mcp shell completion suggests unrelated root commands #3364

Closed
opened 2026-10-31 00:39:35 +00:00 by bsakaguchi · 2 comments
Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5528

Before submitting

  • I searched the open and closed issues for a related report.
  • I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

The Bash hook generated by rea completions bash offers unrelated root commands after rea mcp . The independently reproduced baseline returns 158 candidates, including setup, although rea mcp --help lists only add and doctor. Both valid subcommands are present; 156 candidates are invalid in this position. Prefix filtering also retains invalid continuations: rea mcp ad offers address-to-file-offset alongside add.

Reproduction

From the source checkout at the revision below, with its locked dependencies installed and runtime built, run this generated-hook probe using Bash 4.4 or newer. The shell function binds completion to that checkout:

bash <<'BASH'
rea() { node scripts/rea.mjs "$@"; }
source <(rea completions bash)
for prefix in '' d ad; do
  COMP_WORDS=(rea mcp "$prefix")
  COMP_CWORD=2
  _incur_complete_rea
  printf 'prefix=<%s> candidates=%d\n' "$prefix" "${#COMPREPLY[@]}"
  if [[ -n "$prefix" ]]; then
    printf '%s\n' "${COMPREPLY[@]}"
  fi
done
BASH

Compare node scripts/rea.mjs mcp --help, then run the suggested continuation node scripts/rea.mjs mcp setup. These commands were executed by an independent verifier; the public probe exited 0 without stderr and produced the counts below.

Expected behavior

rea mcp --help advertises Usage: rea mcp <command> with exactly add and doctor. Completion after rea mcp should offer those two names; prefix d should offer only doctor, and ad only add. rea completions --help documents sourcing this generated hook.

Impact and scope

Interactive command discovery offers continuations the CLI rejects, including extra matches for specific prefixes. This is a bounded functional defect (P2). Help and fully typed subcommands provide a practical workaround: both mcp add --help and mcp doctor --help succeeded. The generated Bash callback was reproduced for all three prefixes, and the exact public probe was separately rerun with the same counts. Other shells were not tested; no security boundary or analysis-provider behavior was exercised.

REA version

6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8; locked Incur 0.6.1.

Runtime and platform

macOS arm64; Bash 5.3.20(1)-release. NOT_ENOUGH_INFO: the verifier did not record the exact Node.js or macOS version.

Target and artifact context

Generated Bash completion script and the built source CLI. No binary target or provider was needed. Verification used isolated home/XDG directories and made no external API calls.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

Observed generated-hook output:

prefix=<> candidates=158
prefix=<d> candidates=10
doctor
debug-with-gdb
debug-with-rizin
decompile
demangle-swift
decode-signal-recording
decode-interface-builder
decode-android-resources
decompile-jeb-item
discover-webmcp-tools
prefix=<ad> candidates=2
address-to-file-offset
add

The empty-prefix list begins with setup. node scripts/rea.mjs mcp setup exited 1 with COMMAND_NOT_FOUND: 'setup' is not a command for 'rea mcp'.

The root control, COMPLETE=bash _COMPLETE_INDEX=1 node scripts/rea.mjs -- rea "", exited 0 with 159 candidates: 157 registered commands plus mcp and completions.

Typed outcome or recovery expected

Return only valid MCP subcommand candidates for the active prefix. Preserve root command completion and access to both documented MCP subcommands. Repeating the probe should yield counts 2, 1, and 1 for the empty, d, and ad prefixes respectively.

Analysis or suspected cause

Source-derived reasoning: this completion behavior originates in bundled Incur 0.6.1. In node_modules/incur/src/Completions.ts:69, the built-in mcp token is absent from the registered-command map, leaving root scope active; line 163 emits root command names. node_modules/incur/src/Cli.ts:921 calls that resolver, then lines 943–949 append built-in MCP subcommands without removing the unrelated root candidates. doctor is already a root command, so 157 root names plus add produce 158 candidates. REA enables Incur MCP registration in src/cli.ts:92; scripts/rea.mjs:17 routes completion invocations to the CLI runtime. The appropriate fix location is left to maintainers.

Additional context

Prepared with AI assistance and independently reproduced. Upstream checked through c374c2fe7290b914d73d9e27af38b498753ec593: since the tested baseline, the only change in the cited REA files or dependency manifests adds another root command; completion routing and the locked dependency are unchanged. Current-main candidate totals were not measured.

Related #5481 requests shell completion generally; it does not report this reproduced MCP scope defect. This report concerns invalid subcommand candidates only.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5528 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area CLI ### Observed behavior The Bash hook generated by `rea completions bash` offers unrelated root commands after `rea mcp `. The independently reproduced baseline returns 158 candidates, including `setup`, although `rea mcp --help` lists only `add` and `doctor`. Both valid subcommands are present; 156 candidates are invalid in this position. Prefix filtering also retains invalid continuations: `rea mcp ad` offers `address-to-file-offset` alongside `add`. ### Reproduction From the source checkout at the revision below, with its locked dependencies installed and runtime built, run this generated-hook probe using Bash 4.4 or newer. The shell function binds completion to that checkout: ```sh bash <<'BASH' rea() { node scripts/rea.mjs "$@"; } source <(rea completions bash) for prefix in '' d ad; do COMP_WORDS=(rea mcp "$prefix") COMP_CWORD=2 _incur_complete_rea printf 'prefix=<%s> candidates=%d\n' "$prefix" "${#COMPREPLY[@]}" if [[ -n "$prefix" ]]; then printf '%s\n' "${COMPREPLY[@]}" fi done BASH ``` Compare `node scripts/rea.mjs mcp --help`, then run the suggested continuation `node scripts/rea.mjs mcp setup`. These commands were executed by an independent verifier; the public probe exited 0 without stderr and produced the counts below. ### Expected behavior `rea mcp --help` advertises `Usage: rea mcp <command>` with exactly `add` and `doctor`. Completion after `rea mcp ` should offer those two names; prefix `d` should offer only `doctor`, and `ad` only `add`. `rea completions --help` documents sourcing this generated hook. ### Impact and scope Interactive command discovery offers continuations the CLI rejects, including extra matches for specific prefixes. This is a bounded functional defect (P2). Help and fully typed subcommands provide a practical workaround: both `mcp add --help` and `mcp doctor --help` succeeded. The generated Bash callback was reproduced for all three prefixes, and the exact public probe was separately rerun with the same counts. Other shells were not tested; no security boundary or analysis-provider behavior was exercised. ### REA version 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`; locked Incur 0.6.1. ### Runtime and platform macOS arm64; Bash 5.3.20(1)-release. NOT_ENOUGH_INFO: the verifier did not record the exact Node.js or macOS version. ### Target and artifact context Generated Bash completion script and the built source CLI. No binary target or provider was needed. Verification used isolated home/XDG directories and made no external API calls. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence Observed generated-hook output: ```text prefix=<> candidates=158 prefix=<d> candidates=10 doctor debug-with-gdb debug-with-rizin decompile demangle-swift decode-signal-recording decode-interface-builder decode-android-resources decompile-jeb-item discover-webmcp-tools prefix=<ad> candidates=2 address-to-file-offset add ``` The empty-prefix list begins with `setup`. `node scripts/rea.mjs mcp setup` exited 1 with `COMMAND_NOT_FOUND`: `'setup' is not a command for 'rea mcp'.` The root control, `COMPLETE=bash _COMPLETE_INDEX=1 node scripts/rea.mjs -- rea ""`, exited 0 with 159 candidates: 157 registered commands plus `mcp` and `completions`. ### Typed outcome or recovery expected Return only valid MCP subcommand candidates for the active prefix. Preserve root command completion and access to both documented MCP subcommands. Repeating the probe should yield counts 2, 1, and 1 for the empty, `d`, and `ad` prefixes respectively. ### Analysis or suspected cause Source-derived reasoning: this completion behavior originates in bundled Incur 0.6.1. In `node_modules/incur/src/Completions.ts:69`, the built-in `mcp` token is absent from the registered-command map, leaving root scope active; line 163 emits root command names. `node_modules/incur/src/Cli.ts:921` calls that resolver, then lines 943–949 append built-in MCP subcommands without removing the unrelated root candidates. `doctor` is already a root command, so 157 root names plus `add` produce 158 candidates. REA enables Incur MCP registration in `src/cli.ts:92`; `scripts/rea.mjs:17` routes completion invocations to the CLI runtime. The appropriate fix location is left to maintainers. ### Additional context Prepared with AI assistance and independently reproduced. Upstream checked through `c374c2fe7290b914d73d9e27af38b498753ec593`: since the tested baseline, the only change in the cited REA files or dependency manifests adds another root command; completion routing and the locked dependency are unchanged. Current-main candidate totals were not measured. Related #5481 requests shell completion generally; it does not report this reproduced MCP scope defect. This report concerns invalid subcommand candidates only.
Author
Owner

@matbrgz commented on GitHub (Oct 20, 2026):

Cross-referencing with canonical issue #5481 and siblings #5526 and #5527. Addresses sub-command option parsing and root command suggestions during rea mcp shell completion. Cataloged under Cluster AW in consolidation tracker #4330.

<!-- gh-comment-id:6293045092 --> @matbrgz commented on GitHub (Oct 20, 2026): Cross-referencing with canonical issue #5481 and siblings #5526 and #5527. Addresses sub-command option parsing and root command suggestions during `rea mcp` shell completion. Cataloged under Cluster AW in consolidation tracker #4330.
Author
Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

REA now supplies its own completion tree containing builtin mcp/add/doctor before calling Incur completion. Unit assertions check exact empty/d/ad candidates and root preservation; the public launcher Bash regression sources generated hook and requires mcp=add doctor with no stderr. The locked Incur version staying unchanged does not imply this remains broken because the REA integration now owns scope.

Implementation: completions.ts, completions.test.ts.

The relevant regression checks in completions.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

<!-- gh-comment-id:6380727543 --> @coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. REA now supplies its own completion tree containing builtin mcp/add/doctor before calling Incur completion. Unit assertions check exact empty/d/ad candidates and root preservation; the public launcher Bash regression sources generated hook and requires mcp=add doctor with no stderr. The locked Incur version staying unchanged does not imply this remains broken because the REA integration now owns scope. Implementation: [completions.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/cli/completions.ts#L47), [completions.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/cli/completions.test.ts#L38). The relevant regression checks in [completions.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/cli/completions.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#3364
No description provided.