[GH-ISSUE #7599] [Bug] Bundled packet-capture skill makes the optional TShark override mandatory #4530

New issue

Closed

opened 2026-10-31 00:50:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:50:31 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7599

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

Source-only documentation finding. The packet-capture workflow in the bundled agent skill says that using inspect_packet_capture requires REA_TSHARK_COMMAND. The linked capture guide and the tool contract both allow an existing TShark installation on PATH with that variable unset. The authored skill and its generated package copy contain the same incorrect prerequisite.

I ran node scripts/rea.mjs inspect-packet-capture --help to confirm the public command exists. I did not run packet inspection or observe an agent refusing a valid setup.

Reproduction

Use source revision 65f1c447344a423fa2785847dbcea1e9a9e2454a, with its built runtime, and run node scripts/rea.mjs --version. Output: 6.8.0.
Run node scripts/rea.mjs inspect-packet-capture --help. It exits successfully and describes inspection of an existing capture with caller-supplied TShark.
Run the source-inspection commands in Relevant output or evidence. Compare the recorded-packet-capture skill entry with the linked guide and the named tool contract.
The skill makes the variable required; the guide explicitly calls it optional when TShark is on PATH. The generated bundled skill repeats the authored sentence.

Checked once at this revision. This is a deterministic text comparison; no packet capture or installed TShark is needed to reproduce it.

Expected behavior

The agent skill should state the same prerequisites as its linked capture guide and the advertised tool contract: Linux, util-linux prlimit, and TShark 4.x. An executable TShark in an absolute PATH directory is supported; REA_TSHARK_COMMAND is an optional absolute-path override. Explicit relative override values remain invalid.

Impact and scope

P3 for the verified wording defect. An agent reading the skill receives a stricter prerequisite than the tool requires. Whether that causes a failed task or unnecessary configuration was not tested. The capture guide and tool description already provide the correct selection rule, so users can consult either without changing REA. No packet output, provider failure, or data loss was observed.

REA version

Exact output of node scripts/rea.mjs --version:

6.8.0

Source revision: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; darwin; arm64. CLI commands ran with isolated HOME/XDG directories. No real TShark or Linux capture run was performed.

Target and artifact context

Bundled agent instructions for existing recorded packet captures; no analysis target was opened.

Interface

Other

Earliest failure stage

Unknown

Relevant output or evidence

Commands run from the repository root:

rg -n 'Requires Linux, util-linux prlimit and' .agents/skills/reverse-engineer-anything/SKILL.md skills/reverse-engineer-anything/SKILL.md
sed -n '9,23p' docs/packet-captures.md
rg -n 'Requires Linux, util-linux prlimit, and TShark 4.x' src/contracts/captures/captureToolContracts.ts

At the stated revision:

.agents/skills/reverse-engineer-anything/SKILL.md:160-162 says: Requires Linux, util-linux prlimit and REA_TSHARK_COMMAND (the variable is backtick-formatted in the file).
skills/reverse-engineer-anything/SKILL.md:161-163, the generated package skill, retains that requirement.
docs/packet-captures.md:15-23 specifies absolute override selection with PATH fallback and labels the override optional when TShark is on PATH.
src/contracts/captures/captureToolContracts.ts:31-36 advertises TShark 4.x on PATH or through the absolute override.

Production-source cross-check: src/pcap/PcapConfiguration.ts:89-104,143-159 selects PATH when the override is absent and locates an executable regular file in an absolute directory. src/captures/TsharkCaptureProvider.ts:152-175,267-271 uses that selection after its Linux guard and retains the limiter/version checks. src/server/createServer.ts:260-271,339-342 uses the same selection for packet-tool availability. Both CLI and MCP handlers reach the shared capture service.

A separate locator-only probe with an independently created disposable executable confirmed selection source path with the override absent. The fixture was deleted afterward. This did not execute TShark or establish successful packet inspection.

Typed outcome or recovery expected

Describe the environment variable as an optional absolute override and include PATH selection in the skill's prerequisite sentence.

Analysis or suspected cause

The source generator at scripts/generate-skill-metadata.mjs:19-55 carries the authored prose into the package skill while changing metadata and package references. Both copies therefore expose the same stale requirement. No runtime selection change is indicated by this finding.

Related context: issue #3403 and merged PR #3407 describe shared TShark selection and the intentional addition of PATH support. They do not report this remaining skill sentence. Issue #5244 concerns missing advertised tool names, which requires a different correction.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7599 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Documentation ### Observed behavior Source-only documentation finding. The packet-capture workflow in the bundled agent skill says that using `inspect_packet_capture` requires `REA_TSHARK_COMMAND`. The linked capture guide and the tool contract both allow an existing TShark installation on `PATH` with that variable unset. The authored skill and its generated package copy contain the same incorrect prerequisite. I ran `node scripts/rea.mjs inspect-packet-capture --help` to confirm the public command exists. I did not run packet inspection or observe an agent refusing a valid setup. ### Reproduction 1. Use source revision `65f1c447344a423fa2785847dbcea1e9a9e2454a`, with its built runtime, and run `node scripts/rea.mjs --version`. Output: `6.8.0`. 2. Run `node scripts/rea.mjs inspect-packet-capture --help`. It exits successfully and describes inspection of an existing capture with caller-supplied TShark. 3. Run the source-inspection commands in Relevant output or evidence. Compare the recorded-packet-capture skill entry with the linked guide and the named tool contract. 4. The skill makes the variable required; the guide explicitly calls it optional when TShark is on `PATH`. The generated bundled skill repeats the authored sentence. Checked once at this revision. This is a deterministic text comparison; no packet capture or installed TShark is needed to reproduce it. ### Expected behavior The agent skill should state the same prerequisites as its linked capture guide and the advertised tool contract: Linux, util-linux `prlimit`, and TShark 4.x. An executable TShark in an absolute `PATH` directory is supported; `REA_TSHARK_COMMAND` is an optional absolute-path override. Explicit relative override values remain invalid. ### Impact and scope P3 for the verified wording defect. An agent reading the skill receives a stricter prerequisite than the tool requires. Whether that causes a failed task or unnecessary configuration was not tested. The capture guide and tool description already provide the correct selection rule, so users can consult either without changing REA. No packet output, provider failure, or data loss was observed. ### REA version Exact output of `node scripts/rea.mjs --version`: ```text 6.8.0 ``` Source revision: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js `v24.22.1`; `darwin`; `arm64`. CLI commands ran with isolated HOME/XDG directories. No real TShark or Linux capture run was performed. ### Target and artifact context Bundled agent instructions for existing recorded packet captures; no analysis target was opened. ### Interface Other ### Earliest failure stage Unknown ### Relevant output or evidence Commands run from the repository root: ```sh rg -n 'Requires Linux, util-linux prlimit and' .agents/skills/reverse-engineer-anything/SKILL.md skills/reverse-engineer-anything/SKILL.md sed -n '9,23p' docs/packet-captures.md rg -n 'Requires Linux, util-linux prlimit, and TShark 4.x' src/contracts/captures/captureToolContracts.ts ``` At the stated revision: - `.agents/skills/reverse-engineer-anything/SKILL.md:160-162` says: `Requires Linux, util-linux prlimit and REA_TSHARK_COMMAND` (the variable is backtick-formatted in the file). - `skills/reverse-engineer-anything/SKILL.md:161-163`, the generated package skill, retains that requirement. - `docs/packet-captures.md:15-23` specifies absolute override selection with `PATH` fallback and labels the override optional when TShark is on `PATH`. - `src/contracts/captures/captureToolContracts.ts:31-36` advertises TShark 4.x on `PATH` or through the absolute override. Production-source cross-check: `src/pcap/PcapConfiguration.ts:89-104,143-159` selects `PATH` when the override is absent and locates an executable regular file in an absolute directory. `src/captures/TsharkCaptureProvider.ts:152-175,267-271` uses that selection after its Linux guard and retains the limiter/version checks. `src/server/createServer.ts:260-271,339-342` uses the same selection for packet-tool availability. Both CLI and MCP handlers reach the shared capture service. A separate locator-only probe with an independently created disposable executable confirmed selection source `path` with the override absent. The fixture was deleted afterward. This did not execute TShark or establish successful packet inspection. ### Typed outcome or recovery expected Describe the environment variable as an optional absolute override and include `PATH` selection in the skill's prerequisite sentence. ### Analysis or suspected cause The source generator at `scripts/generate-skill-metadata.mjs:19-55` carries the authored prose into the package skill while changing metadata and package references. Both copies therefore expose the same stale requirement. No runtime selection change is indicated by this finding. Related context: [issue #3403](https://github.com/morluto/rea/issues/3403) and [merged PR #3407](https://github.com/morluto/rea/pull/3407) describe shared TShark selection and the intentional addition of `PATH` support. They do not report this remaining skill sentence. [Issue #5244](https://github.com/morluto/rea/issues/5244) concerns missing advertised tool names, which requires a different correction.

bsakaguchi closed this issue

2026-10-31 00:50:31 +00:00

bsakaguchi referenced this issue

2026-10-31 01:13:19 +00:00

[PR #4530] [MERGED] fix(plist): ignore inherited XML entity lookup properties #6290