morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #6448] [Bug] evidence-import silently discards extra positional arguments #3863

New issue

Closed

opened 2026-10-31 00:44:44 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:44:44 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6448

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

node scripts/rea.mjs evidence-import "$WORK/bundle.json" ignored --json succeeds with exit 0 and the same import result as the invocation without ignored. Adding two extra positionals also succeeds. Neither stdout nor stderr identifies the discarded tokens.

Reproduction

Prepare a fresh checkout at the tested revision:

git checkout 9eb829aca34be36ff112826337996f6139f82eff
npm ci && npm run build:cached

Then run from the checkout root:

WORK=$(mktemp -d)
export HOME="$WORK/home"
mkdir -p "$HOME"
printf '%s' '{"artifacts":[],"captures":[],"environments":[],"providers":[],"records":[],"scenarios":[],"unknowns":[]}' > "$WORK/bundle.json"

node scripts/rea.mjs evidence-import "$WORK/bundle.json" --json
echo "exit=$?"
node scripts/rea.mjs evidence-import "$WORK/bundle.json" ignored --json
echo "exit=$?"
node scripts/rea.mjs evidence-import "$WORK/bundle.json" ignored second --json
echo "exit=$?"

Each CLI variant was executed once against an already installed and built checkout. Both extra-argument variants reproduced the behavior. Dependency installation and the build preparation above were not repeated during this reproduction.

Expected behavior

Reject surplus positional tokens before importing, with a nonzero exit status and enough information to correct the invocation.

The command declaration accepts one scalar path. Observed help advertises Usage: rea evidence-import <path>, and observed --schema --json advertises only required string path with additionalProperties: false. REA's contract design rule requires strict inputs and preservation of caller choices; the repository rule also requires preserving caller-selected inputs. The rejection expectation follows from these rules and the closed advertised shape; the documentation does not specify an exact error code for surplus positionals.

Impact and scope

P2: a bounded argument-validation failure. A malformed invocation returns plausible success without revealing that some caller input was discarded. The observed import still uses the first bundle path; no data corruption, lost Evidence, or wrong-target analysis was demonstrated. Supplying exactly the advertised path works and is an observed workaround.

The same probe found providers ignored --json succeeding with provider/status JSON and exit 0, while providers --bogus --json returned exit 1. These are corroborating CLI parser observations, each run once. MCP, other commands, other platforms, and real-world frequency were not tested.

REA version

6.7.0 (source 9eb829aca3)

Runtime and platform

Node.js v26.12.1; macOS 27.0.1; arm64. No analysis provider was launched.

Target and artifact context

A local JSON bundle containing empty arrays for artifacts, captures, environments, providers, records, scenarios, and unknowns. No executable target or remote service is needed.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

All three import invocations above produced this stdout and exit 0, with empty stderr:

{"imported":0,"unknowns_added":0,"total":0}

The argument-schema output from node scripts/rea.mjs evidence-import --schema --json was:

{"args":{"type":"object","properties":{"path":{"type":"string","description":"Evidence bundle JSON path"}},"required":["path"],"additionalProperties":false}}

The unknown-flag control returned exit 1 and:

{"code":"UNKNOWN","message":"Unknown flag: --bogus"}

Typed outcome or recovery expected

A parse/validation failure that identifies unexpected positional input and tells the caller to use the declared argument shape. Preserve successful one-path imports and existing unknown-flag rejection. No particular new error code is required by this report.

Analysis or suspected cause

Source-derived: REA uses the pinned Incur 0.6.1 dependency. In that installed package, src/Parser.ts:94-112 assigns positional tokens only while iterating the declared schema keys, then validates the resulting object without checking whether tokens remain. Extra tokens therefore never reach schema validation. This handling lives in the third-party framework; REA does not configure a strict positional-count check. REA's serve wrapper delegates through output normalization and sensitive-value handling.

REA's schema agreement tests check advertised names and required inputs; no explicit extra-positional rejection regression was found there. The expectation above rests on REA's contract rules and advertised shape, rather than a claim that this exact input already has a failing test.

Additional context

Open and closed issue searches found no duplicate. Related #5398 concerns raw diagnostics for rejected missing/mistyped arguments, and #6252 concerns explicit literal exclusion in parser diagnostics; neither concerns accepting surplus positional tokens. The first affected release is NOT_ENOUGH_INFO: only the revision stated above was reproduced.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6448 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area CLI ### Observed behavior `node scripts/rea.mjs evidence-import "$WORK/bundle.json" ignored --json` succeeds with exit 0 and the same import result as the invocation without `ignored`. Adding two extra positionals also succeeds. Neither stdout nor stderr identifies the discarded tokens. ### Reproduction Prepare a fresh checkout at the tested revision: ```sh git checkout 9eb829aca34be36ff112826337996f6139f82eff npm ci && npm run build:cached ``` Then run from the checkout root: ```sh WORK=$(mktemp -d) export HOME="$WORK/home" mkdir -p "$HOME" printf '%s' '{"artifacts":[],"captures":[],"environments":[],"providers":[],"records":[],"scenarios":[],"unknowns":[]}' > "$WORK/bundle.json" node scripts/rea.mjs evidence-import "$WORK/bundle.json" --json echo "exit=$?" node scripts/rea.mjs evidence-import "$WORK/bundle.json" ignored --json echo "exit=$?" node scripts/rea.mjs evidence-import "$WORK/bundle.json" ignored second --json echo "exit=$?" ``` Each CLI variant was executed once against an already installed and built checkout. Both extra-argument variants reproduced the behavior. Dependency installation and the build preparation above were not repeated during this reproduction. ### Expected behavior Reject surplus positional tokens before importing, with a nonzero exit status and enough information to correct the invocation. The [command declaration](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/src/cliEvidenceCommands.ts#L20-L29) accepts one scalar `path`. Observed help advertises `Usage: rea evidence-import <path>`, and observed `--schema --json` advertises only required string `path` with `additionalProperties: false`. REA's [contract design rule](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/docs/tool-design.md#L46-L50) requires strict inputs and preservation of caller choices; the [repository rule](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/AGENTS.md#L13) also requires preserving caller-selected inputs. The rejection expectation follows from these rules and the closed advertised shape; the documentation does not specify an exact error code for surplus positionals. ### Impact and scope P2: a bounded argument-validation failure. A malformed invocation returns plausible success without revealing that some caller input was discarded. The observed import still uses the first bundle path; no data corruption, lost Evidence, or wrong-target analysis was demonstrated. Supplying exactly the advertised path works and is an observed workaround. The same probe found `providers ignored --json` succeeding with provider/status JSON and exit 0, while `providers --bogus --json` returned exit 1. These are corroborating CLI parser observations, each run once. MCP, other commands, other platforms, and real-world frequency were not tested. ### REA version 6.7.0 (source 9eb829aca34be36ff112826337996f6139f82eff) ### Runtime and platform Node.js v26.12.1; macOS 27.0.1; arm64. No analysis provider was launched. ### Target and artifact context A local JSON bundle containing empty arrays for artifacts, captures, environments, providers, records, scenarios, and unknowns. No executable target or remote service is needed. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence All three import invocations above produced this stdout and exit 0, with empty stderr: ```json {"imported":0,"unknowns_added":0,"total":0} ``` The argument-schema output from `node scripts/rea.mjs evidence-import --schema --json` was: ```json {"args":{"type":"object","properties":{"path":{"type":"string","description":"Evidence bundle JSON path"}},"required":["path"],"additionalProperties":false}} ``` The unknown-flag control returned exit 1 and: ```json {"code":"UNKNOWN","message":"Unknown flag: --bogus"} ``` ### Typed outcome or recovery expected A parse/validation failure that identifies unexpected positional input and tells the caller to use the declared argument shape. Preserve successful one-path imports and existing unknown-flag rejection. No particular new error code is required by this report. ### Analysis or suspected cause Source-derived: REA uses the pinned [Incur 0.6.1 dependency](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/package.json#L354). In that installed package, `src/Parser.ts:94-112` assigns positional tokens only while iterating the declared schema keys, then validates the resulting object without checking whether tokens remain. Extra tokens therefore never reach schema validation. This handling lives in the third-party framework; REA does not configure a strict positional-count check. REA's [serve wrapper](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/src/cli.ts#L176-L182) delegates through output normalization and sensitive-value handling. REA's [schema agreement tests](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/tests/boundary/cli/cliInputSchemaRequired.test.ts#L82) check advertised names and required inputs; no explicit extra-positional rejection regression was found there. The expectation above rests on REA's contract rules and advertised shape, rather than a claim that this exact input already has a failing test. ### Additional context Open and closed issue searches found no duplicate. Related [#5398](https://github.com/morluto/rea/issues/5398) concerns raw diagnostics for rejected missing/mistyped arguments, and [#6252](https://github.com/morluto/rea/issues/6252) concerns explicit literal exclusion in parser diagnostics; neither concerns accepting surplus positional tokens. The first affected release is NOT_ENOUGH_INFO: only the revision stated above was reproduced.

bsakaguchi closed this issue

2026-10-31 00:44:44 +00:00

bsakaguchi commented

2026-10-31 00:44:45 +00:00

Author

Owner

@morluto commented on GitHub (Oct 23, 2026):

Resolved on main in ca8b6727c. CLI admission uses the pinned parser with inert token schemas to retain and reject surplus positionals before handler execution. Executed import/valid-control and alias/variadic/default-transform controls pass. Validation: tests/boundary/cli/strictPositionals.test.ts — rejects surplus public CLI inputs before importing and retains the one-path control; recorded execution at 9cd46d619. Three strictPositionals tests passed; the enclosing command exited1 because a separate Bash fallback test failed. Do not report the whole group green. Test and owner source unchanged since this receipt.

@morluto commented on GitHub (Oct 23, 2026): Resolved on main in [ca8b6727c](https://github.com/morluto/rea/commit/ca8b6727c3a978b466229498112dbc21d29acbaa). CLI admission uses the pinned parser with inert token schemas to retain and reject surplus positionals before handler execution. Executed import/valid-control and alias/variadic/default-transform controls pass. Validation: `tests/boundary/cli/strictPositionals.test.ts` — rejects surplus public CLI inputs before importing and retains the one-path control; recorded execution at `9cd46d619`. Three strictPositionals tests passed; the enclosing command exited1 because a separate Bash fallback test failed. Do not report the whole group green. Test and owner source unchanged since this receipt.

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425

bsakaguchi referenced this issue

2026-11-01 21:42:56 +00:00

[PR #5115] [CLOSED] fix(setup): accept and preserve Codex per-tool settings (#3862, #3863) #6771