[PR #2982] [MERGED] feat(analysis-view): report observed query parameter names #5537

New issue

Closed

opened 2026-10-31 01:07:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:07:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2982
Author: @wunianze666-netizen
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: codex/api-query-parameter-names

📝 Commits (1)

f73ea13 feat(analysis-view): report observed query parameter names

📊 Changes

11 files changed (+368 additions, -10 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/references/evidence-workflows.md (+4 -0)
📝 docs/web-network-captures.md (+20 -1)
📝 src/application/analysisView/AnalysisViewService.ts (+4 -1)
📝 src/domain/analysisView/WebNetworkApiSurfaceAccumulator.test.ts (+30 -0)
📝 src/domain/analysisView/WebNetworkApiSurfaceAccumulator.ts (+62 -3)
📝 src/domain/analysisView/webNetworkApiSurfaceView.test.ts (+104 -1)
📝 src/domain/analysisView/webNetworkApiSurfaceView.ts (+23 -1)
📝 src/domain/browserObservation.ts (+2 -1)
📝 src/domain/recordedTransportUrl.ts (+18 -2)
📝 tests/boundary/cli/analysisViewCli.test.ts (+50 -0)
📝 tests/boundary/mcp/analysisViewMcp.test.ts (+51 -0)

📄 Description

Problem and resulting behavior

Historical API-surface views omit observed query parameter names. For /products?category=books&page=1 and /products?category=games&sort=price, callers currently have to inspect individual records to recover category, page and sort.

This adds opt-in view.include_query_parameter_names: true and per-group {name, record_ordinals} entries. Omitted/default requests keep their existing output, including the published default example.

Fixes #2913.

Implementation and scope

Share WHATWG form-query name decoding with browser URL inspection while preserving the recorded encoded path used for grouping.
Retain empty/Unicode names, decoded plus distinctions and caller-selected ordinal order; deduplicate a name's ordinal within one record.
Reserve query-parser scratch and admit complete group mutations before allocating retained names/ordinals. Query values and fragments are omitted from the inventory.
Preserve sensitive-parent refusals, original URLs, parent Evidence identity, coverage and existing inferred path-template semantics.
Update the authored skill reference and historical-capture guide. Generated catalogs, skills, native artifacts and local receipts remain uncommitted.

This is an existing static selected-view extension. It adds no provider, target execution, request replay, network acquisition or mutation authority. A separate maintainer provider/authority decision is not applicable.

Validation

On Windows x64 with pinned Node 24.18.0/npm 11.16.0, with the final implementation rebased onto main 0bc422d:

38 source tests across API view, accumulator and browser URL inspection passed.
11 compiled CLI boundary tests and 15 production MCP boundary tests passed, including new selected-query regressions and unchanged default-example reproduction.
docs:check passed, including 5 README consistency tests.
The complete npm run check passed: typecheck, lint, formatting, knip, metadata and architecture guards. Test discovery and git diff --check also passed.
The source checkout's missing Windows controls were supplied from the exact qualified npm 6.4.0 artifact/manifest pair; verify:windows-native:artifact passed. These ignored files are excluded from the PR.
A separate downstream client exercised actual production stdio MCP HAR inspection on two captures, consumed selected query-name Evidence, and matched exact groups/source SHA-256 with its independent HAR engine. The published npm 6.4.0 path was also verified separately for older-server compatibility.

No real Ghidra/Hopper/IDA or live browser-target investigation was needed or verified. No performance improvement is claimed; full-task agent tokens and process-family CPU/peak memory were not benchmarked. Representation-expansion and repeated-name resource regressions are covered.

Compatibility

The selection and output field are optional. Existing default views, Evidence examples, capture decoder profiles and source identities remain compatible. Query inventories establish observed names, not required parameters, value types, complete server schemas or handler identity.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2982 **Author:** [@wunianze666-netizen](https://github.com/wunianze666-netizen) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/api-query-parameter-names` --- ### 📝 Commits (1) - [`f73ea13`](https://github.com/morluto/rea/commit/f73ea131f8844f602d3659da6be610059f71558e) feat(analysis-view): report observed query parameter names ### 📊 Changes **11 files changed** (+368 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/references/evidence-workflows.md` (+4 -0) 📝 `docs/web-network-captures.md` (+20 -1) 📝 `src/application/analysisView/AnalysisViewService.ts` (+4 -1) 📝 `src/domain/analysisView/WebNetworkApiSurfaceAccumulator.test.ts` (+30 -0) 📝 `src/domain/analysisView/WebNetworkApiSurfaceAccumulator.ts` (+62 -3) 📝 `src/domain/analysisView/webNetworkApiSurfaceView.test.ts` (+104 -1) 📝 `src/domain/analysisView/webNetworkApiSurfaceView.ts` (+23 -1) 📝 `src/domain/browserObservation.ts` (+2 -1) 📝 `src/domain/recordedTransportUrl.ts` (+18 -2) 📝 `tests/boundary/cli/analysisViewCli.test.ts` (+50 -0) 📝 `tests/boundary/mcp/analysisViewMcp.test.ts` (+51 -0) </details> ### 📄 Description ## Problem and resulting behavior Historical API-surface views omit observed query parameter names. For /products?category=books&page=1 and /products?category=games&sort=price, callers currently have to inspect individual records to recover category, page and sort. This adds opt-in `view.include_query_parameter_names: true` and per-group `{name, record_ordinals}` entries. Omitted/default requests keep their existing output, including the published default example. Fixes #2913. ## Implementation and scope - Share WHATWG form-query name decoding with browser URL inspection while preserving the recorded encoded path used for grouping. - Retain empty/Unicode names, decoded plus distinctions and caller-selected ordinal order; deduplicate a name's ordinal within one record. - Reserve query-parser scratch and admit complete group mutations before allocating retained names/ordinals. Query values and fragments are omitted from the inventory. - Preserve sensitive-parent refusals, original URLs, parent Evidence identity, coverage and existing inferred path-template semantics. - Update the authored skill reference and historical-capture guide. Generated catalogs, skills, native artifacts and local receipts remain uncommitted. This is an existing static selected-view extension. It adds no provider, target execution, request replay, network acquisition or mutation authority. A separate maintainer provider/authority decision is not applicable. ## Validation On Windows x64 with pinned Node 24.18.0/npm 11.16.0, with the final implementation rebased onto main 0bc422d: - 38 source tests across API view, accumulator and browser URL inspection passed. - 11 compiled CLI boundary tests and 15 production MCP boundary tests passed, including new selected-query regressions and unchanged default-example reproduction. - docs:check passed, including 5 README consistency tests. - The complete npm run check passed: typecheck, lint, formatting, knip, metadata and architecture guards. Test discovery and git diff --check also passed. - The source checkout's missing Windows controls were supplied from the exact qualified npm 6.4.0 artifact/manifest pair; verify:windows-native:artifact passed. These ignored files are excluded from the PR. - A separate downstream client exercised actual production stdio MCP HAR inspection on two captures, consumed selected query-name Evidence, and matched exact groups/source SHA-256 with its independent HAR engine. The published npm 6.4.0 path was also verified separately for older-server compatibility. No real Ghidra/Hopper/IDA or live browser-target investigation was needed or verified. No performance improvement is claimed; full-task agent tokens and process-family CPU/peak memory were not benchmarked. Representation-expansion and repeated-name resource regressions are covered. ## Compatibility The selection and output field are optional. Existing default views, Evidence examples, capture decoder profiles and source identities remain compatible. Query inventories establish observed names, not required parameters, value types, complete server schemas or handler identity. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:07:25 +00:00