morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7533] [Bug] IDA doctor hides timeoutMs range failures behind a registration-format diagnostic #4476

New issue

Closed

opened 2026-10-31 00:50:08 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:50:08 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7533

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Provider or capability discovery

Observed behavior

With a command/args IDA registration containing timeoutMs: 2147483648 or timeoutMs: 0, node scripts/rea.mjs doctor --provider ida --json exits 1 and correctly rejects the registration, but says it must contain a command/args or local URL registration. The file already contains command/args. The diagnostic omits timeoutMs and the failed numeric bound.

node scripts/rea.mjs providers --json also returns this generic reason and generic structured setting constraint for the IDA candidate. It correctly retains configured: true and an unavailable status.

Reproduction

From the built baseline checkout, use Node.js v24.22.1 and run the following with that Node binary first on PATH. Each iteration changes only the timeout value and isolates configuration state:

d=$(mktemp -d)
for value in 2147483648 0 1 2147483647; do
  printf '{"command":"provider-must-not-launch","args":[],"timeoutMs":%s}\n' "$value" > "$d/ida.json"
  env -i PATH="$PATH" HOME="$d" \
    XDG_CONFIG_HOME="$d/config" XDG_CACHE_HOME="$d/cache" \
    XDG_DATA_HOME="$d/data" XDG_STATE_HOME="$d/state" TMPDIR="$d" \
    REA_ANALYSIS_PROVIDER=ida REA_IDA_MCP_CONFIG="$d/ida.json" \
    node scripts/rea.mjs doctor --provider ida --json
  printf 'timeoutMs=%s exit=%s\n' "$value" "$?"
done
rm -rf "$d"

Both invalid values return the generic registration diagnostic below. Values 1 and 2147483647 return exit 0 and a valid registration check. The deliberately nonlaunchable command requires no IDA installation.

Both invalid numeric cases and both valid endpoints were executed three times with isolated directories, including the shell reproduction above. An omitted-timeout control passed once. A relative workspace root, a native/headless conflict, and a nonlocal endpoint each returned their correct specific constraint in separate controls.

Expected behavior

Keep rejecting values outside the documented integer range 1 through 2147483647, and identify timeoutMs and the failed constraint in the diagnostic. Preserve safe field/range facts in the configuration setting constraint instead of diagnosing a missing registration shape. Configuration diagnostics should preserve meaningful failure reasons; discovery should continue validating without starting IDA.

Impact and scope

P3: the demonstrated defect is misleading diagnostic wording and loss of the corresponding structured constraint. Both invalid registrations remain unavailable; valid minimum, maximum and omitted-timeout controls pass. Correcting the value to either valid endpoint restores the configuration check. Consulting the documented range is a practical workaround.

Observed scope is CLI doctor and provider discovery on this host. No analysis target, real IDA engine, MCP session, database mutation, data loss, or security boundary crossing was involved. Real-engine readiness and occurrence frequency were not tested.

REA version

Exact node scripts/rea.mjs --version stdout:

6.8.0

Source baseline: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; arm64. No IDA engine or upstream MCP server used.

Target and artifact context

Small local registration JSON files with a deliberately nonlaunchable stdio command. No analysis target or IDA database.

Interface

CLI

Earliest failure stage

Setup or provider admission

Relevant output or evidence

Trimmed registration check from node scripts/rea.mjs doctor --provider ida --json, identical for both invalid numeric values:

{
  "name": "registration",
  "ok": false,
  "code": "invalid_configuration",
  "detail": "REA_IDA_MCP_CONFIG must contain an IDA MCP command/args or local url registration; see docs/ida-provider.md.",
  "remediation": "Set REA_IDA_MCP_CONFIG to your upstream IDA MCP registration JSON; see docs/ida-provider.md.",
  "classification": "config_drift"
}

Both invocations had exit 1, healthy: false, IDA configured: true and available: false, and empty stderr. Both valid endpoints had exit 0 and healthy: true; their registration detail explicitly said no IDA process was launched.

Provider discovery's IDA candidate had availability.code: "open_options_invalid", diagnostics.configured: true, live_connection_probed: false, and this configuration_details.settings entry:

{
  "setting": "REA_IDA_MCP_CONFIG",
  "constraint": "REA_IDA_MCP_CONFIG must contain an IDA MCP command/args or local url registration; see docs/ida-provider.md."
}

Contract and implementation locations at the baseline:

docs/ida-provider.md:217-219 documents the timeout range and discovery without starting IDA.
AGENTS.md, Architecture and Cleanup, requires preservation of meaningful failure reasons. src/domain/configurationErrors.ts:6-15 defines setting/failed-constraint facts.
src/ida/IdaConfiguration.ts:21-39 enforces the numeric range; lines 167-185 select the generic diagnostic when projected issues have no message.
src/domain/inputIssueProjection.ts:112-115,174-182 preserves numeric bounds as structured out_of_range facts without a message.
src/ida/IdaDoctor.ts:38-62 exposes the configuration error as the registration detail.

Typed outcome or recovery expected

Retain the failed check, invalid_configuration code and unavailable state. Explain that timeoutMs must be an integer from 1 to 2147483647, or provide the specific violated bound, without echoing unrelated registration values.

Analysis or suspected cause

Source-derived: numeric validation already produces safe field/bound metadata. The IDA configuration owner keeps only projected issues with a textual message, so it drops those numeric facts and uses the registration-format fallback. Custom refinement messages survive that filter, which explains the successful original-case controls.

Additional context

Related closed issue #5828 demonstrated three custom constraints: native/headless mode, a nonlocal endpoint, and relative workspaceRoot. Its stated expectation enumerates those cases, and all three now return specific reasons on this baseline. This report covers the distinct numeric-bound constraint those examples and regression tests did not exercise.

The actual constraint-preservation change is commit 75dfd1c74722e68bc4e80007b4f9afd8a1d833cb, present in this baseline. No last-known-good numeric diagnostic or temporal regression was established. Searches across open/closed issues and PRs for IDA registration, timeoutMs diagnostics, numeric constraints, and the out-of-range value found no numeric-bound report.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7533 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Provider or capability discovery ### Observed behavior With a command/args IDA registration containing `timeoutMs: 2147483648` or `timeoutMs: 0`, `node scripts/rea.mjs doctor --provider ida --json` exits 1 and correctly rejects the registration, but says it must contain a command/args or local URL registration. The file already contains command/args. The diagnostic omits `timeoutMs` and the failed numeric bound. `node scripts/rea.mjs providers --json` also returns this generic reason and generic structured setting constraint for the IDA candidate. It correctly retains `configured: true` and an unavailable status. ### Reproduction 1. From the built baseline checkout, use Node.js v24.22.1 and run the following with that Node binary first on PATH. Each iteration changes only the timeout value and isolates configuration state: ```sh d=$(mktemp -d) for value in 2147483648 0 1 2147483647; do printf '{"command":"provider-must-not-launch","args":[],"timeoutMs":%s}\n' "$value" > "$d/ida.json" env -i PATH="$PATH" HOME="$d" \ XDG_CONFIG_HOME="$d/config" XDG_CACHE_HOME="$d/cache" \ XDG_DATA_HOME="$d/data" XDG_STATE_HOME="$d/state" TMPDIR="$d" \ REA_ANALYSIS_PROVIDER=ida REA_IDA_MCP_CONFIG="$d/ida.json" \ node scripts/rea.mjs doctor --provider ida --json printf 'timeoutMs=%s exit=%s\n' "$value" "$?" done rm -rf "$d" ``` 2. Both invalid values return the generic registration diagnostic below. Values `1` and `2147483647` return exit 0 and a valid registration check. The deliberately nonlaunchable command requires no IDA installation. Both invalid numeric cases and both valid endpoints were executed three times with isolated directories, including the shell reproduction above. An omitted-timeout control passed once. A relative workspace root, a native/headless conflict, and a nonlocal endpoint each returned their correct specific constraint in separate controls. ### Expected behavior Keep rejecting values outside the documented integer range `1` through `2147483647`, and identify `timeoutMs` and the failed constraint in the diagnostic. Preserve safe field/range facts in the configuration setting constraint instead of diagnosing a missing registration shape. Configuration diagnostics should preserve meaningful failure reasons; discovery should continue validating without starting IDA. ### Impact and scope P3: the demonstrated defect is misleading diagnostic wording and loss of the corresponding structured constraint. Both invalid registrations remain unavailable; valid minimum, maximum and omitted-timeout controls pass. Correcting the value to either valid endpoint restores the configuration check. Consulting the documented range is a practical workaround. Observed scope is CLI doctor and provider discovery on this host. No analysis target, real IDA engine, MCP session, database mutation, data loss, or security boundary crossing was involved. Real-engine readiness and occurrence frequency were not tested. ### REA version Exact `node scripts/rea.mjs --version` stdout: ```text 6.8.0 ``` Source baseline: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js v24.22.1; macOS 27.0.1; arm64. No IDA engine or upstream MCP server used. ### Target and artifact context Small local registration JSON files with a deliberately nonlaunchable stdio command. No analysis target or IDA database. ### Interface CLI ### Earliest failure stage Setup or provider admission ### Relevant output or evidence Trimmed registration check from `node scripts/rea.mjs doctor --provider ida --json`, identical for both invalid numeric values: ```json { "name": "registration", "ok": false, "code": "invalid_configuration", "detail": "REA_IDA_MCP_CONFIG must contain an IDA MCP command/args or local url registration; see docs/ida-provider.md.", "remediation": "Set REA_IDA_MCP_CONFIG to your upstream IDA MCP registration JSON; see docs/ida-provider.md.", "classification": "config_drift" } ``` Both invocations had exit 1, `healthy: false`, IDA `configured: true` and `available: false`, and empty stderr. Both valid endpoints had exit 0 and `healthy: true`; their registration detail explicitly said no IDA process was launched. Provider discovery's IDA candidate had `availability.code: "open_options_invalid"`, `diagnostics.configured: true`, `live_connection_probed: false`, and this `configuration_details.settings` entry: ```json { "setting": "REA_IDA_MCP_CONFIG", "constraint": "REA_IDA_MCP_CONFIG must contain an IDA MCP command/args or local url registration; see docs/ida-provider.md." } ``` Contract and implementation locations at the baseline: - `docs/ida-provider.md:217-219` documents the timeout range and discovery without starting IDA. - `AGENTS.md`, Architecture and Cleanup, requires preservation of meaningful failure reasons. `src/domain/configurationErrors.ts:6-15` defines setting/failed-constraint facts. - `src/ida/IdaConfiguration.ts:21-39` enforces the numeric range; lines 167-185 select the generic diagnostic when projected issues have no message. - `src/domain/inputIssueProjection.ts:112-115,174-182` preserves numeric bounds as structured out_of_range facts without a message. - `src/ida/IdaDoctor.ts:38-62` exposes the configuration error as the registration detail. ### Typed outcome or recovery expected Retain the failed check, `invalid_configuration` code and unavailable state. Explain that `timeoutMs` must be an integer from 1 to 2147483647, or provide the specific violated bound, without echoing unrelated registration values. ### Analysis or suspected cause Source-derived: numeric validation already produces safe field/bound metadata. The IDA configuration owner keeps only projected issues with a textual message, so it drops those numeric facts and uses the registration-format fallback. Custom refinement messages survive that filter, which explains the successful original-case controls. ### Additional context Related closed [issue #5828](https://github.com/morluto/rea/issues/5828) demonstrated three custom constraints: native/headless mode, a nonlocal endpoint, and relative workspaceRoot. Its stated expectation enumerates those cases, and all three now return specific reasons on this baseline. This report covers the distinct numeric-bound constraint those examples and regression tests did not exercise. The actual constraint-preservation change is commit `75dfd1c74722e68bc4e80007b4f9afd8a1d833cb`, present in this baseline. No last-known-good numeric diagnostic or temporal regression was established. Searches across open/closed issues and PRs for IDA registration, timeoutMs diagnostics, numeric constraints, and the out-of-range value found no numeric-bound report.

bsakaguchi closed this issue

2026-10-31 00:50:08 +00:00

bsakaguchi referenced this issue

2026-10-31 01:13:07 +00:00

[PR #4476] [MERGED] fix(browser): keep omitted JSON request bodies out of complete shape coverage #6261