morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #6001] [Bug] Artifact analysis views attribute an unsupported view kind to source #3668

New issue

Closed

opened 2026-10-31 00:42:53 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:42:53 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6001

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Built CLI inspect-analysis-view rejects a schema-valid page view over real inspect_artifact Evidence, but its structured issue points to ["source"]. The same inline source succeeds when only the view changes to summary. The rejected input is therefore the selected view; the issue message correctly says that artifact Evidence supports summary and inventory.

Reproduction

From a built checkout, create a one-entry ZIP, inspect it, and reuse the resulting Evidence in two requests. This workflow was executed once for each view:

python3 - <<'PYTHON'
import zipfile
with zipfile.ZipFile('fixture.zip', 'w') as archive:
    archive.writestr('main.js', 'console.log(1);\n')
PYTHON
node scripts/rea.mjs inspect-artifact fixture.zip --json > artifact.json
node --input-type=module <<'JS'
import { readFileSync, writeFileSync } from 'node:fs';
const evidence = JSON.parse(readFileSync('artifact.json', 'utf8'));
for (const [name, view] of Object.entries({
  rejected: {kind:'page', collection:'sections', offset:0, limit:1},
  control: {kind:'summary'}
})) {
  writeFileSync(name + '.json', JSON.stringify({
    source: {kind:'inline', evidence}, view
  }));
}
JS
node scripts/rea.mjs inspect-analysis-view rejected.json --json
node scripts/rea.mjs inspect-analysis-view control.json --json

The rejected request exits 1; the control exits 0 with summary Evidence. Both have empty stderr. No external native provider or simulated engine is involved.

Expected behavior

Keep the refusal and supported-view message, but locate this incompatible view at ["view"]. This matches the existing binary-layout incompatible-view handling. Artifact view documentation supports summary and inventory; this report does not request additional view kinds.

Impact and scope

P3: incorrect correction metadata for an already-rejected view. The supported-view message remains useful, and changing to summary succeeded with the same source. No incorrect success, valid-input analysis failure, data loss, or downstream automated recovery failure was observed. Scope is the artifact projector's incompatible-kind branch, shared by inspect_artifact and inventory_artifact; only inspect_artifact through CLI was executed. Frequency in normal use is unknown.

REA version

rea-agents 6.7.0; source revision 5241597594.

Runtime and platform

Node.js v26.12.0; macOS 27.0.1 arm64; existing built runtime and locked dependencies.

Target and artifact context

Synthetic ZIP containing one JavaScript entry; actual inspect_artifact Evidence reused inline without modification.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Relevant fields from actual rejected-request stdout:

{
  "code": "invalid_request",
  "category": "invalid_input",
  "retryable": false,
  "details": {
    "operation": "inspect_analysis_view",
    "issues": [{
      "path": ["source"],
      "reason": "invalid_value",
      "message": "Artifact Evidence supports summary and inventory views."
    }]
  }
}

The summary control returned operation inspect_analysis_view and normalized_result.kind summary. This establishes that the original source can be authenticated and projected successfully.

Typed outcome or recovery expected

Keep invalid_request / invalid_input, retryable:false, and inspect_input_contract recovery for inspect_analysis_view. Attribute this refusal to view so callers can preserve the source and choose summary or inventory.

Analysis or suspected cause

Source-derived: inputError always sets the source path. The incompatible-kind branch reuses it. The dispatcher selects this projector for both artifact parent operations.

Additional context

PR #3122 changes malformed pcap parent paths and shares the web-network parser; its diff does not touch this artifact branch. #5950, #5971 and #5980 concern native matching, Android and Kuna validation producers. #1695 / #1705 concern collection-selector schema fidelity, and #5338 concerns artifact page validation costs. None changes this incompatible-view error.

Fetched upstream main c538a843cb retains the relevant helper and rejection unchanged. That later source was inspected, not executed. MCP shares the production service by source inspection and was not separately exercised.

Originally created by @coygeek on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6001 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior Built CLI `inspect-analysis-view` rejects a schema-valid `page` view over real `inspect_artifact` Evidence, but its structured issue points to `["source"]`. The same inline source succeeds when only the view changes to `summary`. The rejected input is therefore the selected view; the issue message correctly says that artifact Evidence supports summary and inventory. ### Reproduction From a built checkout, create a one-entry ZIP, inspect it, and reuse the resulting Evidence in two requests. This workflow was executed once for each view: ```sh python3 - <<'PYTHON' import zipfile with zipfile.ZipFile('fixture.zip', 'w') as archive: archive.writestr('main.js', 'console.log(1);\n') PYTHON node scripts/rea.mjs inspect-artifact fixture.zip --json > artifact.json node --input-type=module <<'JS' import { readFileSync, writeFileSync } from 'node:fs'; const evidence = JSON.parse(readFileSync('artifact.json', 'utf8')); for (const [name, view] of Object.entries({ rejected: {kind:'page', collection:'sections', offset:0, limit:1}, control: {kind:'summary'} })) { writeFileSync(name + '.json', JSON.stringify({ source: {kind:'inline', evidence}, view })); } JS node scripts/rea.mjs inspect-analysis-view rejected.json --json node scripts/rea.mjs inspect-analysis-view control.json --json ``` The rejected request exits 1; the control exits 0 with summary Evidence. Both have empty stderr. No external native provider or simulated engine is involved. ### Expected behavior Keep the refusal and supported-view message, but locate this incompatible view at `["view"]`. This matches the existing [binary-layout incompatible-view handling](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisView/binaryLayoutView.ts#L112-L119). [Artifact view documentation](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/docs/mcp-contracts.md#L355-L367) supports summary and inventory; this report does not request additional view kinds. ### Impact and scope P3: incorrect correction metadata for an already-rejected view. The supported-view message remains useful, and changing to summary succeeded with the same source. No incorrect success, valid-input analysis failure, data loss, or downstream automated recovery failure was observed. Scope is the artifact projector's incompatible-kind branch, shared by inspect_artifact and inventory_artifact; only inspect_artifact through CLI was executed. Frequency in normal use is unknown. ### REA version rea-agents 6.7.0; source revision 52415975942a4b9c53a817915b313ccc404f280e. ### Runtime and platform Node.js v26.12.0; macOS 27.0.1 arm64; existing built runtime and locked dependencies. ### Target and artifact context Synthetic ZIP containing one JavaScript entry; actual inspect_artifact Evidence reused inline without modification. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence Relevant fields from actual rejected-request stdout: ```json { "code": "invalid_request", "category": "invalid_input", "retryable": false, "details": { "operation": "inspect_analysis_view", "issues": [{ "path": ["source"], "reason": "invalid_value", "message": "Artifact Evidence supports summary and inventory views." }] } } ``` The summary control returned operation inspect_analysis_view and normalized_result.kind summary. This establishes that the original source can be authenticated and projected successfully. ### Typed outcome or recovery expected Keep invalid_request / invalid_input, retryable:false, and inspect_input_contract recovery for inspect_analysis_view. Attribute this refusal to view so callers can preserve the source and choose summary or inventory. ### Analysis or suspected cause Source-derived: [inputError](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisView/artifactInventoryView.ts#L124-L131) always sets the source path. [The incompatible-kind branch](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisView/artifactInventoryView.ts#L222-L236) reuses it. [The dispatcher](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisView/analysisView.ts#L1001-L1002) selects this projector for both artifact parent operations. ### Additional context PR #3122 changes malformed pcap parent paths and shares the web-network parser; its diff does not touch this artifact branch. #5950, #5971 and #5980 concern native matching, Android and Kuna validation producers. #1695 / #1705 concern collection-selector schema fidelity, and #5338 concerns artifact page validation costs. None changes this incompatible-view error. Fetched upstream main c538a843cb49f7156f86beb3b21501e03255af9a retains the relevant helper and rejection unchanged. That later source was inspected, not executed. MCP shares the production service by source inspection and was not separately exercised.

bsakaguchi closed this issue

2026-10-31 00:42:53 +00:00

bsakaguchi commented

2026-10-31 00:42:54 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

artifactInventoryView now accepts an explicit source/view error field and passes view for an unsupported view kind; source-authentication errors still use source. The public-CLI regression creates real inspect_artifact Evidence, requests page, and asserts invalid_request with [view] and the unchanged supported-view message. The same test also exercises supported inventory projection.

Implementation: artifactInventoryView.ts, artifactInventoryView.ts.

The relevant regression checks in analysisViewCli.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. artifactInventoryView now accepts an explicit source/view error field and passes view for an unsupported view kind; source-authentication errors still use source. The public-CLI regression creates real inspect_artifact Evidence, requests page, and asserts invalid_request with [view] and the unchanged supported-view message. The same test also exercises supported inventory projection. Implementation: [artifactInventoryView.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/domain/analysisView/artifactInventoryView.ts#L126), [artifactInventoryView.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/domain/analysisView/artifactInventoryView.ts#L243). The relevant regression checks in [analysisViewCli.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/cli/analysisViewCli.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3668

No description provided.

Rows
Columns