morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5733] [Docs] inspect_analysis_view parent lists omit supported pcap capture Evidence #3480

New issue

Closed

opened 2026-10-31 00:40:57 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:40:57 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5733

Before submitting

I searched the existing issues for a related documentation report.
I removed credentials, tokens, private paths, and sensitive target data.

Documentation location

The opening supported-parent enumeration in inspect_analysis_view's MCP tool description (src/contracts/analysisViewToolContracts.ts:20) and the unsupported-parent guidance in src/domain/analysisView/analysisView.ts:922 at the baseline below.

Problem

Both lists omit pcap capture Evidence, although pcap views work and the same MCP description later explicitly documents them. This gives callers inconsistent capability-discovery and recovery wording. The full description does explain the correct parent ID; this report concerns only the incomplete enumerations.

An independent verifier observed the opening list through the production stdio MCP server. It ends with inspect_model_artifact or inspect_web_network_capture Evidence and does not name inspect_pcap_capture. Later in that same description, the paragraph beginning For inspect_pcap_capture parents documents pcap facets and the required retained parent.

Expected content

Include pcap capture Evidence in both supported-parent lists, consistently with the later pcap paragraph and docs/pcap-analysis.md, “Inspect only the needed facts.” Preserve the existing refusal for a summary receipt's own Evidence ID and the successful view using its normalized_result.parent_evidence_id; this wording correction should not enable view-on-view parenting.

Supporting evidence

The independent verifier used a generated one-frame Ethernet/IPv4/UDP pcap containing hello, with documentation-only addresses 192.0.2.1 and 198.51.100.2. No traffic was acquired or sent. In one stdio MCP session:

Read tools/list and compare the opening parent list with the later pcap paragraph.
Call inspect_pcap_capture({path: capturePath, detail: "summary"}) and retain the returned Evidence as summary.
Call inspect_analysis_view with the request below, first using summary.evidence_id, then using summary.normalized_result.parent_evidence_id.

{
  source: { kind: "retained-evidence", evidence_id: parentId },
  view: { kind: "pcap", facet: "endpoints", offset: 0, limit: 5 }
}

The summary-ID request correctly returns unsupported_target, but its details.reason gives this incomplete list:

Parent Evidence operation "inspect_analysis_view" does not support analysis views. Use completed binary layout, JavaScript application, native function/inventory, artifact inventory/inspection, WASM, Mach-O, Interface Builder, EVM, managed artifact or member, Android package, Dart AOT, IL2CPP metadata, or web network capture Evidence.

The documented-parent control succeeds with parent_operation: inspect_pcap_capture, both endpoint addresses, packet_count: 1 for each, and coverage examined: 2, total: 2, exhausted: true. The refusal itself is expected; only its enumeration is incomplete.

Source-derived corroboration: src/domain/analysisView/analysisView.ts:1032 dispatches inspect_pcap_capture parents at the baseline. The MCP description's later pcap paragraph and the pcap guide agree with the successful control.

Additional context

rea-agents 6.7.0, verified source baseline 9d8e7803326a382cbbb3ffdb900f5e93e5442d68; Linux amd64, Node.js v24.22.0, TShark/Capinfos 4.0.17 (Debian package 4.0.17-0+deb12u3). The independent verifier ran the reproduction and an exact draft replay with real Wireshark tools and isolated HOME/XDG/temp directories. This submission reviewed that retained evidence rather than rerunning capture inspection.

Rechecked origin/main d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f: verified at baseline; main source-checked only. The contract description is unchanged; the domain file has unrelated resource-schema additions, while the refusal string and pcap dispatch remain unchanged (now lines 927 and 1037). No main runtime replay is claimed.

P3: incomplete wording with a working documented path; no incorrect capture facts or blocked pcap projection was observed. Use the summary's normalized_result.parent_evidence_id as documented.

Related #3194 and its superseded PR #3235 corrected CLI help, already present in this baseline; the two MCP/error surfaces reported here remain incomplete. #5279 concerns cancellation projection and #5711 concerns macOS capability advertising, with different restoration checks. Prepared with AI assistance.

Originally created by @coygeek on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5733 ### Before submitting - [x] I searched the existing issues for a related documentation report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Documentation location The opening supported-parent enumeration in `inspect_analysis_view`'s MCP tool description (`src/contracts/analysisViewToolContracts.ts:20`) and the unsupported-parent guidance in `src/domain/analysisView/analysisView.ts:922` at the baseline below. ### Problem Both lists omit pcap capture Evidence, although pcap views work and the same MCP description later explicitly documents them. This gives callers inconsistent capability-discovery and recovery wording. The full description does explain the correct parent ID; this report concerns only the incomplete enumerations. An independent verifier observed the opening list through the production stdio MCP server. It ends with `inspect_model_artifact or inspect_web_network_capture Evidence` and does not name `inspect_pcap_capture`. Later in that same description, the paragraph beginning `For inspect_pcap_capture parents` documents pcap facets and the required retained parent. ### Expected content Include pcap capture Evidence in both supported-parent lists, consistently with the later pcap paragraph and `docs/pcap-analysis.md`, “Inspect only the needed facts.” Preserve the existing refusal for a summary receipt's own Evidence ID and the successful view using its `normalized_result.parent_evidence_id`; this wording correction should not enable view-on-view parenting. ### Supporting evidence The independent verifier used a generated one-frame Ethernet/IPv4/UDP pcap containing `hello`, with documentation-only addresses 192.0.2.1 and 198.51.100.2. No traffic was acquired or sent. In one stdio MCP session: 1. Read `tools/list` and compare the opening parent list with the later pcap paragraph. 2. Call `inspect_pcap_capture({path: capturePath, detail: "summary"})` and retain the returned Evidence as `summary`. 3. Call `inspect_analysis_view` with the request below, first using `summary.evidence_id`, then using `summary.normalized_result.parent_evidence_id`. ```js { source: { kind: "retained-evidence", evidence_id: parentId }, view: { kind: "pcap", facet: "endpoints", offset: 0, limit: 5 } } ``` The summary-ID request correctly returns `unsupported_target`, but its `details.reason` gives this incomplete list: ```text Parent Evidence operation "inspect_analysis_view" does not support analysis views. Use completed binary layout, JavaScript application, native function/inventory, artifact inventory/inspection, WASM, Mach-O, Interface Builder, EVM, managed artifact or member, Android package, Dart AOT, IL2CPP metadata, or web network capture Evidence. ``` The documented-parent control succeeds with `parent_operation: inspect_pcap_capture`, both endpoint addresses, `packet_count: 1` for each, and coverage `examined: 2`, `total: 2`, `exhausted: true`. The refusal itself is expected; only its enumeration is incomplete. Source-derived corroboration: `src/domain/analysisView/analysisView.ts:1032` dispatches `inspect_pcap_capture` parents at the baseline. The MCP description's later pcap paragraph and the pcap guide agree with the successful control. ### Additional context `rea-agents` 6.7.0, verified source baseline `9d8e7803326a382cbbb3ffdb900f5e93e5442d68`; Linux amd64, Node.js v24.22.0, TShark/Capinfos 4.0.17 (Debian package 4.0.17-0+deb12u3). The independent verifier ran the reproduction and an exact draft replay with real Wireshark tools and isolated HOME/XDG/temp directories. This submission reviewed that retained evidence rather than rerunning capture inspection. Rechecked origin/main `d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f`: verified at baseline; main source-checked only. The contract description is unchanged; the domain file has unrelated resource-schema additions, while the refusal string and pcap dispatch remain unchanged (now lines 927 and 1037). No main runtime replay is claimed. P3: incomplete wording with a working documented path; no incorrect capture facts or blocked pcap projection was observed. Use the summary's `normalized_result.parent_evidence_id` as documented. Related #3194 and its superseded PR #3235 corrected CLI help, already present in this baseline; the two MCP/error surfaces reported here remain incomplete. #5279 concerns cancellation projection and #5711 concerns macOS capability advertising, with different restoration checks. Prepared with AI assistance.

bsakaguchi closed this issue

2026-10-31 00:40:57 +00:00

bsakaguchi commented

2026-10-31 00:40:58 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 21, 2026):

Confirmed: the two enumerations are out of sync with the tool actually accepting pcap capture Evidence — the opening supported-parent list in analysisViewToolContracts.ts:20 ends at inspect_web_network_capture while the later "For inspect_pcap_capture parents" paragraph and docs/pcap-analysis.md both document it. Callers doing capability discovery off that list would never learn pcap views exist, which is worse than a cosmetic docs gap. Suggest adding pcap capture Evidence to both the opening enumeration and the unsupported-parent guidance (analysisView.ts:922) and, ideally, generating the parent lists from the same source so they can not drift again.

@XinwangTao commented on GitHub (Oct 21, 2026): Confirmed: the two enumerations are out of sync with the tool actually accepting pcap capture Evidence — the opening supported-parent list in analysisViewToolContracts.ts:20 ends at inspect_web_network_capture while the later "For inspect_pcap_capture parents" paragraph and docs/pcap-analysis.md both document it. Callers doing capability discovery off that list would never learn pcap views exist, which is worse than a cosmetic docs gap. Suggest adding pcap capture Evidence to both the opening enumeration and the unsupported-parent guidance (analysisView.ts:922) and, ideally, generating the parent lists from the same source so they can not drift again.

bsakaguchi commented

2026-10-31 00:40:58 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

The two stale exhaustive prose lists have been removed. The public contract now directs callers to compatible parent/view descriptions and explicitly documents inspect_pcap_capture; unsupported-parent recovery no longer enumerates an incomplete set and directs summary receipts to parent_evidence_id. The result parent-operation schema includes inspect_pcap_capture and pcap dispatch is present.

Implementation: analysisViewToolContracts.ts, analysisView.ts.

The relevant regression checks in pcapCaptureView.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. The two stale exhaustive prose lists have been removed. The public contract now directs callers to compatible parent/view descriptions and explicitly documents inspect_pcap_capture; unsupported-parent recovery no longer enumerates an incomplete set and directs summary receipts to parent_evidence_id. The result parent-operation schema includes inspect_pcap_capture and pcap dispatch is present. Implementation: [analysisViewToolContracts.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/contracts/analysisViewToolContracts.ts#L20), [analysisView.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/domain/analysisView/analysisView.ts#L1245). The relevant regression checks in [pcapCaptureView.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/domain/analysisView/pcapCaptureView.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 00:43:58 +00:00

[GH-ISSUE #6208] [Bug] Second-argument utilityProcess.fork options lose the service name #3778

bsakaguchi referenced this issue

2026-10-31 01:09:17 +00:00

[PR #3480] [MERGED] fix(javascript): preserve exact static property keys #5769

bsakaguchi referenced this issue

2026-10-31 01:09:42 +00:00

[PR #3559] [CLOSED] fix(electron): block and record shell.trashItem #5823

bsakaguchi referenced this issue

2026-10-31 01:10:56 +00:00

[PR #3998] [MERGED] fix(javascript): retain static paths through TypeScript wrappers #5983