morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7569] [Bug] Relative Wireshark tool refusals drop the supplied path value #4507

New issue

Open

opened 2026-10-31 00:50:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:50:22 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7569

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Provider or capability discovery

Observed behavior

With REA_TSHARK_COMMAND=rel/tshark, node scripts/rea.mjs inspect-pcap-client --format json exits 1 and identifies the setting and its absolute-path constraint, but returns no field containing rel/tshark. With an absolute tshark fixture and REA_CAPINFOS_COMMAND=rel/capinfos, the command identifies the capinfos setting and constraint but likewise drops rel/capinfos.

Both errors retain capability_unavailable, the correct Wireshark supply guidance and retryable: false. The omission concerns the supplied value. The absolute fixture control exits 0.

Reproduction

From the prepared baseline checkout, use its required Node.js 24.22.1 on PATH. Run this inline program with Python 3. It creates two executable version-banner fixtures and isolated writable state, exercises the public CLI and removes its temporary fixtures on exit. No Wireshark installation or capture file is required.

python3 - <<'PYTHON'
import json, os, pathlib, subprocess, tempfile
with tempfile.TemporaryDirectory(prefix='pcap-selection-') as directory:
    root = pathlib.Path(directory).resolve()
    env = {'PATH': os.environ['PATH']}
    for key in ['HOME', 'TMPDIR', 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME',
                'XDG_DATA_HOME', 'XDG_STATE_HOME']:
        path = root / key.lower()
        path.mkdir()
        env[key] = str(path)
    for tool in ['tshark', 'capinfos']:
        path = root / tool
        path.write_text('#!/bin/sh\necho "' + tool + ' (Wireshark) 4.2.0"\n')
        path.chmod(0o755)
    cases = [
        ('relative-tshark', 'rel/tshark', 'rel/capinfos'),
        ('relative-capinfos', str(root / 'tshark'), 'rel/capinfos'),
        ('absolute-control', str(root / 'tshark'), str(root / 'capinfos')),
    ]
    for name, tshark, capinfos in cases:
        for attempt in range(2 if name.startswith('relative') else 1):
            result = subprocess.run(
                ['node', 'scripts/rea.mjs', 'inspect-pcap-client', '--format', 'json'],
                env=env | {'REA_TSHARK_COMMAND': tshark,
                           'REA_CAPINFOS_COMMAND': capinfos},
                text=True, capture_output=True, timeout=30)
            output = json.loads(result.stdout)
            if name.startswith('relative'):
                rejected = 'rel/tshark' if name == 'relative-tshark' else 'rel/capinfos'
                print(json.dumps({'case': name, 'attempt': attempt + 1,
                    'exit': result.returncode, 'output': output,
                    'rejected_value_present': rejected in result.stdout,
                    'stderr': result.stderr}))
            else:
                print(json.dumps({'case': name, 'exit': result.returncode,
                    'operation': output.get('operation'), 'stderr': result.stderr}))
PYTHON

Each relative case prints exit 1, rejected_value_present: false and empty stderr on both attempts. The absolute control prints exit 0 and operation inspect_pcap_client.

I ran this exact reduced program once, giving two attempts per relative setting and one absolute control. An earlier independent replay also reproduced each relative case twice and confirmed that missing-file and directory selections retain their selected paths.

Expected behavior

A refusal should retain the caller's supplied tool-path spelling in the message or structured diagnostic facts, alongside the existing setting name, absolute-path requirement and correction. The repository-wide caller-input preservation rule applies to selected paths even when validation rejects them. The absolute-path admission rule should remain in effect.

Impact and scope

P3, supported: the caller cannot read the rejected spelling from the returned diagnostic, although the error already identifies what setting to correct and how to correct it. No incorrect classification, invalid-input acceptance, analysis-result change or data loss was observed. The successful absolute-fixture control demonstrates the available configuration correction for this probe.

Observed scope is macOS CLI client inspection with controlled executable fixtures. MCP, other hosts, capture analysis and real Wireshark execution were not exercised. Natural frequency and last-known-good behavior are NOT_ENOUGH_INFO because neither was measured.

REA version

Exact stdout from node scripts/rea.mjs --version:

6.8.0

Source baseline: 65f1c447344a423fa2785847dbcea1e9a9e2454a. The npm version lookup also returned 6.8.0; reproduction used the checkout's existing build.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1, build 26A434; arm64. The shell fixtures print Wireshark 4.2.0 version banners; they are not real Wireshark tools.

Target and artifact context

No capture or analysis target. The command inspects configured client executables. HOME, TMPDIR and all four XDG writable-state roots are isolated by the reproduction.

Interface

CLI

Earliest failure stage

Setup or provider admission

Relevant output or evidence

The reduced program captures complete JSON stdout, exit status and stderr. The first tshark result contains this complete error object:

{"code":"capability_unavailable","category":"unsupported_provider","message":"REA_TSHARK_COMMAND must be an absolute path to the tshark binary. Supply Wireshark 4.x tshark and capinfos on PATH or through absolute REA_TSHARK_COMMAND and REA_CAPINFOS_COMMAND; REA does not install them.","retryable":false,"remediation":{"action":"REA_TSHARK_COMMAND must be an absolute path to the tshark binary. Supply Wireshark 4.x tshark and capinfos on PATH or through absolute REA_TSHARK_COMMAND and REA_CAPINFOS_COMMAND; REA does not install them."},"details":{"provider_id":"pcap","operation":"inspect_pcap_client","reason":"REA_TSHARK_COMMAND must be an absolute path to the tshark binary"}}

The capinfos case has the same shape with REA_CAPINFOS_COMMAND and capinfos in the reason. Its complete serialized stdout contains no rel/capinfos. The absolute control returned:

{"case":"absolute-control","exit":0,"operation":"inspect_pcap_client","stderr":""}

Expected-source check at this baseline: AGENTS.md:13 expressly requires preserving caller-selected paths; lines 19 and 33 require retaining facts and source values across boundaries. docs/pcap-analysis.md:10-34 documents the absolute selections and capture-free client probe, including macOS probe availability. Its path-disclosure sentence at lines 35-36 specifically covers directory/unreadable-tool failures, so that sentence alone is not the contract for this relative-path report. docs/installation.md:1511-1532 describes Ghidra diagnostics, not this pcap refusal.

Failure-source check: src/pcap/PcapConfiguration.ts:90-103 detects the rejected value and stores it as configured on the configuration failure. src/pcap/PcapProvider.ts:762-765 converts that failure using its message and cause without forwarding the diagnostic map. src/pcap/PcapConfiguration.ts:57-65 supplies the correct message/remediation guidance already visible above. These source observations explain the executed public result.

Typed outcome or recovery expected

Keep the existing non-retryable capability refusal and supply-tools guidance. Include the rejected configured value in a caller-visible message or structured fact. The same check should cover each tool setting independently; the absolute-fixture control should continue succeeding.

Analysis or suspected cause

Source-derived: the selector preserves the value internally, but the provider's conversion forwards only the failure's text and cause. The text names the variable and requirement without including the value. That combination explains why the final error retains the reason but loses the supplied spelling. No fix was implemented or tested.

Additional context

Open and closed issues, issue comments, and open/closed/merged PRs were searched. Related closures address different contracts: #6433 covers directory-selected tool classification and path disclosure, which the independent directory control now satisfies; #1184 covers lost Ghidra setting names and constraints; #5826 covers IDA identity reasons; #4375 covers colliding Hopper diagnostic maps. None restores the relative Wireshark value in this reproduction.

Merged PR #2507 adds the correct host-tool guidance and explicitly leaves the existing reason unchanged. Merged PR #3407 shares tool selection and restores missing-path messages. Their described corrections remain present here. #5844 and merged PR #5862 correct a separate JADX relative-JAR branch that reported supplied input as unset. This pcap refusal already distinguishes rejected configuration and requires its own value-preservation correction. No regression of those closures is claimed.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7569 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Provider or capability discovery ### Observed behavior With `REA_TSHARK_COMMAND=rel/tshark`, `node scripts/rea.mjs inspect-pcap-client --format json` exits 1 and identifies the setting and its absolute-path constraint, but returns no field containing `rel/tshark`. With an absolute tshark fixture and `REA_CAPINFOS_COMMAND=rel/capinfos`, the command identifies the capinfos setting and constraint but likewise drops `rel/capinfos`. Both errors retain `capability_unavailable`, the correct Wireshark supply guidance and `retryable: false`. The omission concerns the supplied value. The absolute fixture control exits 0. ### Reproduction 1. From the prepared baseline checkout, use its required Node.js 24.22.1 on PATH. Run this inline program with Python 3. It creates two executable version-banner fixtures and isolated writable state, exercises the public CLI and removes its temporary fixtures on exit. No Wireshark installation or capture file is required. ```sh python3 - <<'PYTHON' import json, os, pathlib, subprocess, tempfile with tempfile.TemporaryDirectory(prefix='pcap-selection-') as directory: root = pathlib.Path(directory).resolve() env = {'PATH': os.environ['PATH']} for key in ['HOME', 'TMPDIR', 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME']: path = root / key.lower() path.mkdir() env[key] = str(path) for tool in ['tshark', 'capinfos']: path = root / tool path.write_text('#!/bin/sh\necho "' + tool + ' (Wireshark) 4.2.0"\n') path.chmod(0o755) cases = [ ('relative-tshark', 'rel/tshark', 'rel/capinfos'), ('relative-capinfos', str(root / 'tshark'), 'rel/capinfos'), ('absolute-control', str(root / 'tshark'), str(root / 'capinfos')), ] for name, tshark, capinfos in cases: for attempt in range(2 if name.startswith('relative') else 1): result = subprocess.run( ['node', 'scripts/rea.mjs', 'inspect-pcap-client', '--format', 'json'], env=env | {'REA_TSHARK_COMMAND': tshark, 'REA_CAPINFOS_COMMAND': capinfos}, text=True, capture_output=True, timeout=30) output = json.loads(result.stdout) if name.startswith('relative'): rejected = 'rel/tshark' if name == 'relative-tshark' else 'rel/capinfos' print(json.dumps({'case': name, 'attempt': attempt + 1, 'exit': result.returncode, 'output': output, 'rejected_value_present': rejected in result.stdout, 'stderr': result.stderr})) else: print(json.dumps({'case': name, 'exit': result.returncode, 'operation': output.get('operation'), 'stderr': result.stderr})) PYTHON ``` 2. Each relative case prints exit 1, `rejected_value_present: false` and empty stderr on both attempts. The absolute control prints exit 0 and operation `inspect_pcap_client`. I ran this exact reduced program once, giving two attempts per relative setting and one absolute control. An earlier independent replay also reproduced each relative case twice and confirmed that missing-file and directory selections retain their selected paths. ### Expected behavior A refusal should retain the caller's supplied tool-path spelling in the message or structured diagnostic facts, alongside the existing setting name, absolute-path requirement and correction. The repository-wide caller-input preservation rule applies to selected paths even when validation rejects them. The absolute-path admission rule should remain in effect. ### Impact and scope P3, supported: the caller cannot read the rejected spelling from the returned diagnostic, although the error already identifies what setting to correct and how to correct it. No incorrect classification, invalid-input acceptance, analysis-result change or data loss was observed. The successful absolute-fixture control demonstrates the available configuration correction for this probe. Observed scope is macOS CLI client inspection with controlled executable fixtures. MCP, other hosts, capture analysis and real Wireshark execution were not exercised. Natural frequency and last-known-good behavior are NOT_ENOUGH_INFO because neither was measured. ### REA version Exact stdout from `node scripts/rea.mjs --version`: ```text 6.8.0 ``` Source baseline: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. The npm version lookup also returned `6.8.0`; reproduction used the checkout's existing build. ### Runtime and platform Node.js `v24.22.1`; macOS `27.0.1`, build `26A434`; arm64. The shell fixtures print Wireshark 4.2.0 version banners; they are not real Wireshark tools. ### Target and artifact context No capture or analysis target. The command inspects configured client executables. HOME, TMPDIR and all four XDG writable-state roots are isolated by the reproduction. ### Interface CLI ### Earliest failure stage Setup or provider admission ### Relevant output or evidence The reduced program captures complete JSON stdout, exit status and stderr. The first tshark result contains this complete error object: ```json {"code":"capability_unavailable","category":"unsupported_provider","message":"REA_TSHARK_COMMAND must be an absolute path to the tshark binary. Supply Wireshark 4.x tshark and capinfos on PATH or through absolute REA_TSHARK_COMMAND and REA_CAPINFOS_COMMAND; REA does not install them.","retryable":false,"remediation":{"action":"REA_TSHARK_COMMAND must be an absolute path to the tshark binary. Supply Wireshark 4.x tshark and capinfos on PATH or through absolute REA_TSHARK_COMMAND and REA_CAPINFOS_COMMAND; REA does not install them."},"details":{"provider_id":"pcap","operation":"inspect_pcap_client","reason":"REA_TSHARK_COMMAND must be an absolute path to the tshark binary"}} ``` The capinfos case has the same shape with `REA_CAPINFOS_COMMAND` and `capinfos` in the reason. Its complete serialized stdout contains no `rel/capinfos`. The absolute control returned: ```json {"case":"absolute-control","exit":0,"operation":"inspect_pcap_client","stderr":""} ``` Expected-source check at this baseline: `AGENTS.md:13` expressly requires preserving caller-selected paths; lines 19 and 33 require retaining facts and source values across boundaries. `docs/pcap-analysis.md:10-34` documents the absolute selections and capture-free client probe, including macOS probe availability. Its path-disclosure sentence at lines 35-36 specifically covers directory/unreadable-tool failures, so that sentence alone is not the contract for this relative-path report. `docs/installation.md:1511-1532` describes Ghidra diagnostics, not this pcap refusal. Failure-source check: `src/pcap/PcapConfiguration.ts:90-103` detects the rejected value and stores it as `configured` on the configuration failure. `src/pcap/PcapProvider.ts:762-765` converts that failure using its message and cause without forwarding the diagnostic map. `src/pcap/PcapConfiguration.ts:57-65` supplies the correct message/remediation guidance already visible above. These source observations explain the executed public result. ### Typed outcome or recovery expected Keep the existing non-retryable capability refusal and supply-tools guidance. Include the rejected configured value in a caller-visible message or structured fact. The same check should cover each tool setting independently; the absolute-fixture control should continue succeeding. ### Analysis or suspected cause Source-derived: the selector preserves the value internally, but the provider's conversion forwards only the failure's text and cause. The text names the variable and requirement without including the value. That combination explains why the final error retains the reason but loses the supplied spelling. No fix was implemented or tested. ### Additional context Open and closed issues, issue comments, and open/closed/merged PRs were searched. Related closures address different contracts: [#6433](https://github.com/morluto/rea/issues/6433) covers directory-selected tool classification and path disclosure, which the independent directory control now satisfies; [#1184](https://github.com/morluto/rea/issues/1184) covers lost Ghidra setting names and constraints; [#5826](https://github.com/morluto/rea/issues/5826) covers IDA identity reasons; [#4375](https://github.com/morluto/rea/issues/4375) covers colliding Hopper diagnostic maps. None restores the relative Wireshark value in this reproduction. [Merged PR #2507](https://github.com/morluto/rea/pull/2507) adds the correct host-tool guidance and explicitly leaves the existing reason unchanged. [Merged PR #3407](https://github.com/morluto/rea/pull/3407) shares tool selection and restores missing-path messages. Their described corrections remain present here. [#5844](https://github.com/morluto/rea/issues/5844) and [merged PR #5862](https://github.com/morluto/rea/pull/5862) correct a separate JADX relative-JAR branch that reported supplied input as unset. This pcap refusal already distinguishes rejected configuration and requires its own value-preservation correction. No regression of those closures is claimed.

bsakaguchi referenced this issue

2026-10-31 01:13:14 +00:00

[PR #4507] [MERGED] fix(cutter): read the active document from core configuration #6276

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4507

No description provided.

Rows
Columns