morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #6196] [CLOSED] fix(analysis-view): locate malformed pcap parents at the view source #7198

New issue

Closed

opened 2026-11-01 21:46:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:46:04 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6196
Author: @Bilalmesk
Created: 10/22/2026
Status: ❌ Closed

Base: main ← Head: fix/pcap-analysis-view-parent-path

📝 Commits (1)

ea58c5d fix(analysis-view): locate malformed pcap parents at the view source

📊 Changes

2 files changed (+100 additions, -14 deletions)

View changed files

📝 src/domain/analysisView/pcapCaptureView.ts (+6 -14)
📝 tests/boundary/mcp/analysisViewMcp.test.ts (+94 -0)

📄 Description

Summary

Fixes #6130.

inspect_analysis_view now reports malformed inspect_pcap_capture parent fields beneath source.normalized_result, matching the shared analysis-view parent convention. Previously the pcap parser passed raw schema issues and the unwrapped result to the error projector, so target.path: 123 was reported at ["target","path"] instead of ["source","normalized_result","target","path"].

Problem and expected behavior

For digest-valid pcap Evidence whose normalized result has target.path: 123, both inline and retained Evidence are rejected as invalid_request / invalid_input / retryable: false, but the issue path omitted the resolved parent source prefix.

Expected and now returned:

{"path":["source","normalized_result","target","path"],"reason":"invalid_type","expected":"string"}

The refusal, classification, and recovery operation are unchanged, and a valid parent still succeeds.

Change and scope

src/domain/analysisView/pcapCaptureView.ts: delegate parent validation to parseAnalysisViewResult, the shared helper already used by other analysis-view producers, instead of locally calling analysisInputErrorFromIssues with unwrapped issues.
tests/boundary/mcp/analysisViewMcp.test.ts: add a public MCP regression covering a valid control plus inline and retained malformed pcap Evidence.

Not included: changes to webNetworkCaptureView or other producers. They already use the shared convention or are outside this issue.

Contract and boundary impact

Semantic owner and earliest changed stage: analysis-view input validation for pcap parents (projectPcapCaptureView), during request validation.
Contribution scope fit and linked maintainer decision: ordinary bug fix within existing boundaries; not applicable.
CLI and MCP/tool-catalog contract: MCP diagnostic issue path only; tool schemas, catalog, and error classification are unchanged.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: the parent Evidence is still rejected and retained unchanged; only the issue location is rebased.
Target selection, authority, upstream behavior, and cleanup details: not applicable; the regression uses synthetic Evidence and starts no provider.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Expected effects: no target interaction. The regression constructs synthetic Evidence in memory and reads no packet file.

Evidence and regression coverage

Tests added or updated: an MCP-boundary regression that first confirms a valid pcap parent succeeds, then rejects the same Evidence with target.path: 123 through both inline and retained-evidence sources and asserts the full issue path, reason, expected type, classification, and retryable: false.
Base reproduction or other evidence: the published MCP reproduction in #6130 records ["target","path"] on base 2604059; a direct projectAnalysisView reproduction on the same base also returned ["target","path"]. With the source change, both MCP source kinds return the prefixed path.
User-visible MCP output (if applicable): the malformed cases return code: "invalid_request", category: "invalid_input", retryable: false, and details.issues[0] = {"path":["source","normalized_result","target","path"],"reason":"invalid_type","expected":"string"}.
Remaining proof gaps: no real pcap file or Wireshark tools were used; scope is summary projection over synthetic Evidence through the in-memory MCP transport. The CLI, Evidence-file source, and real capture production were not exercised.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

node node_modules/vitest/vitest.mjs run tests/boundary/mcp/analysisViewMcp.test.ts --maxWorkers=1 --reporter=dot — 22 passed.
node node_modules/vitest/vitest.mjs run src/domain/analysisView/pcapCaptureView.test.ts --maxWorkers=1 --reporter=verbose — 1 passed.
npm run typecheck — passed.
npm run lint — 0 errors, 2116 existing warnings; module boundaries checked.
npm run format:check — all matched files use the correct format.
npm run verify:test-discovery — all 1955 test files discovered exactly once.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: not applicable; no provider, browser, or OS interaction.
Package or release metadata impact: none.
Security, privacy, process, or containment review: none; no target access, process launch, or filesystem mutation.

Author readiness

Human owner:

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6196 **Author:** [@Bilalmesk](https://github.com/Bilalmesk) **Created:** 10/22/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/pcap-analysis-view-parent-path` --- ### 📝 Commits (1) - [`ea58c5d`](https://github.com/morluto/rea/commit/ea58c5d2528d16cac064a1b514b667c9d361253d) fix(analysis-view): locate malformed pcap parents at the view source ### 📊 Changes **2 files changed** (+100 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/analysisView/pcapCaptureView.ts` (+6 -14) 📝 `tests/boundary/mcp/analysisViewMcp.test.ts` (+94 -0) </details> ### 📄 Description ## Summary Fixes #6130. `inspect_analysis_view` now reports malformed `inspect_pcap_capture` parent fields beneath `source.normalized_result`, matching the shared analysis-view parent convention. Previously the pcap parser passed raw schema issues and the unwrapped result to the error projector, so `target.path: 123` was reported at `["target","path"]` instead of `["source","normalized_result","target","path"]`. ## Problem and expected behavior For digest-valid pcap Evidence whose normalized result has `target.path: 123`, both inline and retained Evidence are rejected as `invalid_request` / `invalid_input` / `retryable: false`, but the issue path omitted the resolved parent source prefix. Expected and now returned: ```json {"path":["source","normalized_result","target","path"],"reason":"invalid_type","expected":"string"} ``` The refusal, classification, and recovery operation are unchanged, and a valid parent still succeeds. ## Change and scope - `src/domain/analysisView/pcapCaptureView.ts`: delegate parent validation to `parseAnalysisViewResult`, the shared helper already used by other analysis-view producers, instead of locally calling `analysisInputErrorFromIssues` with unwrapped issues. - `tests/boundary/mcp/analysisViewMcp.test.ts`: add a public MCP regression covering a valid control plus inline and retained malformed pcap Evidence. Not included: changes to `webNetworkCaptureView` or other producers. They already use the shared convention or are outside this issue. ## Contract and boundary impact - Semantic owner and earliest changed stage: analysis-view input validation for pcap parents (`projectPcapCaptureView`), during request validation. - Contribution scope fit and linked maintainer decision: ordinary bug fix within existing boundaries; not applicable. - CLI and MCP/tool-catalog contract: MCP diagnostic issue path only; tool schemas, catalog, and error classification are unchanged. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: the parent Evidence is still rejected and retained unchanged; only the issue location is rebased. - Target selection, authority, upstream behavior, and cleanup details: not applicable; the regression uses synthetic Evidence and starts no provider. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. Expected effects: no target interaction. The regression constructs synthetic Evidence in memory and reads no packet file. ## Evidence and regression coverage - Tests added or updated: an MCP-boundary regression that first confirms a valid pcap parent succeeds, then rejects the same Evidence with `target.path: 123` through both `inline` and `retained-evidence` sources and asserts the full issue path, reason, expected type, classification, and `retryable: false`. - Base reproduction or other evidence: the published MCP reproduction in #6130 records `["target","path"]` on base `2604059`; a direct `projectAnalysisView` reproduction on the same base also returned `["target","path"]`. With the source change, both MCP source kinds return the prefixed path. - User-visible MCP output (if applicable): the malformed cases return `code: "invalid_request"`, `category: "invalid_input"`, `retryable: false`, and `details.issues[0]` = `{"path":["source","normalized_result","target","path"],"reason":"invalid_type","expected":"string"}`. - Remaining proof gaps: no real pcap file or Wireshark tools were used; scope is summary projection over synthetic Evidence through the in-memory MCP transport. The CLI, Evidence-file source, and real capture production were not exercised. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [ ] Artifact identity, source provenance, and failed attempts remain preserved. - [ ] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `node node_modules/vitest/vitest.mjs run tests/boundary/mcp/analysisViewMcp.test.ts --maxWorkers=1 --reporter=dot` — 22 passed. - `node node_modules/vitest/vitest.mjs run src/domain/analysisView/pcapCaptureView.test.ts --maxWorkers=1 --reporter=verbose` — 1 passed. - `npm run typecheck` — passed. - `npm run lint` — 0 errors, 2116 existing warnings; module boundaries checked. - `npm run format:check` — all matched files use the correct format. - `npm run verify:test-discovery` — all 1955 test files discovered exactly once. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable; no provider, browser, or OS interaction. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none; no target access, process launch, or filesystem mutation. ## Author readiness Human owner:  - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:46:04 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-03 00:29:32 +00:00

[GH-ISSUE #5653] [Tracker] New issue intake by area (October 2026) #3423

bsakaguchi changed title from ~~[PR #6196] [CLOSED] fix(analysis-view): locate malformed pcap parents at the view source~~ to [PR #6196] fix(analysis-view): locate malformed pcap parents at the view source

2026-11-04 16:32:42 +00:00

bsakaguchi changed title from ~~[PR #6196] fix(analysis-view): locate malformed pcap parents at the view source~~ to [PR #6196] [CLOSED] fix(analysis-view): locate malformed pcap parents at the view source

2026-11-04 17:28:47 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7198

No description provided.

Rows
Columns