morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5946] [Bug] Missing browser-scenario environment secret is classified as unreadable output #3618

New issue

Closed

opened 2026-10-31 00:42:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:42:25 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5946

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

A schema-valid browser scenario declaring an environment-backed secret fails with unreadable_output / execution_failure when that variable is absent. Both message and remediation.action say to run rea doctor; neither names the unresolved variable or tells the caller to supply it. The built CLI reproduced this before any browser connection.

Reproduction

Run from the already-built source checkout with the repository-pinned Node.js on PATH. This executed procedure clears the environment, so REA_EXAMPLE_PASSWORD is absent. The declaration is used only for redaction, which the scenario contract permits. No browser or listening endpoint is needed because resolution fails before connection.

work_dir="$(mktemp -d)"
mkdir -p "$work_dir"/{home,cfg,data,cache,state,tmp}
env -i PATH="$PATH" HOME="$work_dir/home" \
  XDG_CONFIG_HOME="$work_dir/cfg" XDG_DATA_HOME="$work_dir/data" \
  XDG_CACHE_HOME="$work_dir/cache" XDG_STATE_HOME="$work_dir/state" \
  TMPDIR="$work_dir/tmp" REA_LOG_LEVEL=silent \
  node scripts/rea.mjs capture-browser-scenario \
  '{"browser":{"mode":"connect","cdp_endpoint":"http://127.0.0.1:9222","target_id":"stale-page"},"start_url":{"url":"http://127.0.0.1:3000/"},"actions":[{"step_id":"settle","action":"wait_for_timeout","duration_ms":1}],"secrets":[{"secret_id":"password","environment_variable":"REA_EXAMPLE_PASSWORD"}]}' \
  --json
result=$?
printf 'exit=%s\n' "$result"
rm -rf "$work_dir"

Expected behavior

Report the unresolved declared environment input and instruct the caller to define its variable in the environment starting REA, without disclosing secret values. Do not classify failure to obtain an input as unreadable provider output. The exact public code is an implementation choice. The scenario contract defines environment-backed declarations, including declarations solely for redaction; the input schema describes the same environment-variable references.

Impact and scope

P2: the typed diagnosis points to provider output instead of a missing required environment input and omits the applicable recovery. The reduced CLI request reproduced twice, once against an HTTP discovery fixture that received zero requests and once with the standalone procedure above. Supplying the declared environment variable is the source-derived workaround. Successful capture after that correction was not tested. No secret values, data loss, or security boundary crossing were observed.

REA version

rea-agents 6.7.0, source revision 52415975942a4b9c53a817915b313ccc404f280e.

Runtime and platform

Node.js v24.18.0; macOS 27.0.1 arm64. Existing built runtime with locked dependencies; no browser launched.

Target and artifact context

Valid connect-mode browser scenario with one wait action and one declared environment-backed secret solely for redaction. Secret resolution fails before target discovery or attachment.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

The procedure exits 1 and returns:

{"error":"Browser scenario capture failed","code":"unreadable_output","category":"execution_failure","message":"Analysis could not complete. Run `rea doctor`, then try again.","retryable":false,"remediation":{"action":"Analysis could not complete. Run `rea doctor`, then try again."},"details":{"operation":"capture_browser_scenario","reason":"secret_unavailable"}}

The missing-variable case against a loopback discovery fixture returned the same diagnostic without making an HTTP request. This demonstrates input admission failure rather than malformed browser output. The public CLI and normal provider were executed; no simulated provider injected the error.

Typed outcome or recovery expected

Identify the unresolved declaration or environment-variable name in a configuration/input failure and give the action needed to supply it. Keep the scenario unsuccessful until its required environment input exists. No particular retryability flag or new error code is required by this report.

Analysis or suspected cause

Source-derived: BrowserScenarioSecrets.resolve discards which declaration failed when it returns undefined. PlaywrightScenarioSession.open throws secret_unavailable before opening the browser. The projection map labels it unreadable_output; the reason lacks a tailored message, and presentation supplies doctor advice. Correct classification and actionable input recovery need the producing boundary to retain the missing declaration.

Additional context

Fetched main ce1f4b1bbaced57529d609f3007a76de583e11c4 leaves the relevant producer, mapping, category, and recovery behavior unchanged; its error-projection file only adds an unrelated captured-output inclusion control. No runtime replay on that newer revision was performed. MCP and successful real-browser capture were not exercised. The closed cross-field validation report concerns an undeclared reference; here the declaration is valid and the corresponding environment variable is absent. Last known good version: NOT_ENOUGH_INFO; none established.

Originally created by @coygeek on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5946 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Process capture or runtime observation ### Observed behavior A schema-valid browser scenario declaring an environment-backed secret fails with `unreadable_output` / `execution_failure` when that variable is absent. Both `message` and `remediation.action` say to run `rea doctor`; neither names the unresolved variable or tells the caller to supply it. The built CLI reproduced this before any browser connection. ### Reproduction Run from the already-built source checkout with the repository-pinned Node.js on PATH. This executed procedure clears the environment, so `REA_EXAMPLE_PASSWORD` is absent. The declaration is used only for redaction, which the scenario contract permits. No browser or listening endpoint is needed because resolution fails before connection. ```bash work_dir="$(mktemp -d)" mkdir -p "$work_dir"/{home,cfg,data,cache,state,tmp} env -i PATH="$PATH" HOME="$work_dir/home" \ XDG_CONFIG_HOME="$work_dir/cfg" XDG_DATA_HOME="$work_dir/data" \ XDG_CACHE_HOME="$work_dir/cache" XDG_STATE_HOME="$work_dir/state" \ TMPDIR="$work_dir/tmp" REA_LOG_LEVEL=silent \ node scripts/rea.mjs capture-browser-scenario \ '{"browser":{"mode":"connect","cdp_endpoint":"http://127.0.0.1:9222","target_id":"stale-page"},"start_url":{"url":"http://127.0.0.1:3000/"},"actions":[{"step_id":"settle","action":"wait_for_timeout","duration_ms":1}],"secrets":[{"secret_id":"password","environment_variable":"REA_EXAMPLE_PASSWORD"}]}' \ --json result=$? printf 'exit=%s\n' "$result" rm -rf "$work_dir" ``` ### Expected behavior Report the unresolved declared environment input and instruct the caller to define its variable in the environment starting REA, without disclosing secret values. Do not classify failure to obtain an input as unreadable provider output. The exact public code is an implementation choice. The [scenario contract](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/docs/browser-scenario-contract.md#L182-L192) defines environment-backed declarations, including declarations solely for redaction; the [input schema](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/browserScenario.ts#L28-L34) describes the same environment-variable references. ### Impact and scope P2: the typed diagnosis points to provider output instead of a missing required environment input and omits the applicable recovery. The reduced CLI request reproduced twice, once against an HTTP discovery fixture that received zero requests and once with the standalone procedure above. Supplying the declared environment variable is the source-derived workaround. Successful capture after that correction was not tested. No secret values, data loss, or security boundary crossing were observed. ### REA version `rea-agents` 6.7.0, source revision `52415975942a4b9c53a817915b313ccc404f280e`. ### Runtime and platform Node.js v24.18.0; macOS 27.0.1 arm64. Existing built runtime with locked dependencies; no browser launched. ### Target and artifact context Valid connect-mode browser scenario with one wait action and one declared environment-backed secret solely for redaction. Secret resolution fails before target discovery or attachment. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence The procedure exits 1 and returns: ```json {"error":"Browser scenario capture failed","code":"unreadable_output","category":"execution_failure","message":"Analysis could not complete. Run `rea doctor`, then try again.","retryable":false,"remediation":{"action":"Analysis could not complete. Run `rea doctor`, then try again."},"details":{"operation":"capture_browser_scenario","reason":"secret_unavailable"}} ``` The missing-variable case against a loopback discovery fixture returned the same diagnostic without making an HTTP request. This demonstrates input admission failure rather than malformed browser output. The public CLI and normal provider were executed; no simulated provider injected the error. ### Typed outcome or recovery expected Identify the unresolved declaration or environment-variable name in a configuration/input failure and give the action needed to supply it. Keep the scenario unsuccessful until its required environment input exists. No particular retryability flag or new error code is required by this report. ### Analysis or suspected cause Source-derived: [BrowserScenarioSecrets.resolve](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/browser/BrowserScenarioSecrets.ts#L256-L270) discards which declaration failed when it returns `undefined`. [PlaywrightScenarioSession.open](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/browser/PlaywrightScenarioSession.ts#L146-L153) throws `secret_unavailable` before opening the browser. The [projection map](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisErrorProjection.ts#L174-L194) labels it `unreadable_output`; the reason lacks a tailored message, and [presentation](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisErrorPresentation.ts#L303-L308) supplies doctor advice. Correct classification and actionable input recovery need the producing boundary to retain the missing declaration. ### Additional context Fetched main `ce1f4b1bbaced57529d609f3007a76de583e11c4` leaves the relevant producer, mapping, category, and recovery behavior unchanged; its error-projection file only adds an unrelated captured-output inclusion control. No runtime replay on that newer revision was performed. MCP and successful real-browser capture were not exercised. The closed cross-field validation report concerns an undeclared reference; here the declaration is valid and the corresponding environment variable is absent. Last known good version: NOT_ENOUGH_INFO; none established.

bsakaguchi closed this issue

2026-10-31 00:42:25 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3618

No description provided.

Rows
Columns