morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #6203] [CLOSED] fix(analysis-view): preserve HAR grouping parent diagnostics #7201

New issue

Closed

opened 2026-11-01 21:46:06 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:46:06 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6203
Author: @monsterlag
Created: 10/22/2026
Status: ❌ Closed

Base: main ← Head: fix/issue-6044-ff8f

📝 Commits (1)

179f002 fix(analysis-view): preserve HAR grouping parent diagnostics

📊 Changes

3 files changed (+143 additions, -11 deletions)

View changed files

📝 src/domain/analysisView/WebNetworkProjectionAccumulator.ts (+10 -8)
📝 src/domain/analysisView/analysisView.test.ts (+54 -0)
📝 tests/boundary/mcp/analysisViewMcp.test.ts (+79 -3)

📄 Description

Note

AI-generated; human owner review pending. This pull request was written by an AI coding agent and checked by a separate AI review agent, which re-ran the tests described below. It is opened as a draft: its human owner, @monsterlag, reviews the final diff and completes the readiness declarations before marking it ready for review.

Summary

Fixes #6044. Preserve nested parent-schema diagnostics for HAR api-surface, environment-manifest, and environment-state views, matching summary.

Problem and expected behavior

A digest-valid inspect_web_network_capture parent with a string at artifact.bytes was rejected with only source / invalid_value by grouping views. The owning schema's field path, expected type, and internal parse cause were discarded. Callers should receive correction details beneath source.normalized_result without changing the refusal or recovery.

Change and scope

Use the existing secret-safe analysisInputErrorFromIssues projection in shared HAR admission, with prefixed paths, matching wrapped input, and the original cause. Keep representation admission before parsing, the owned-parser cache, and format, subject-identity, and sensitive-value gates unchanged. Grouping algorithms and other parent operations are unchanged; no additional abstraction or unrelated cleanup is needed.

Contract and boundary impact

Semantic owner and earliest changed stage: admitHarCaptureParent, when the owned capture schema rejects a parent result.
Contribution scope fit and linked maintainer decision: routine bug fix within existing boundaries; advance scope decision not applicable.
CLI and MCP/tool-catalog contract: more precise existing error metadata; no schema, tool, or catalog changes.
Provider, bridge, target-format, or platform compatibility: unchanged; no provider integration changes.
Evidence, artifact, provenance, or reconstruction contract: authenticated malformed parents remain rejected; successful views retain parent Evidence links.
Target selection, authority, upstream behavior, and cleanup details: unchanged; projection reads supplied captured data and starts no provider.
Generated metadata, package, or installation impact: none.

Expected effects: reads existing captured data only; no new target execution, mutation, network access, or protection recovery.

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Domain regressions cover all three grouping kinds plus summary: wrong-type versus missing artifact.bytes, the nested issue path, expected number, retained ZodError, and valid-parent controls.
MCP regressions cover all three grouping kinds with authenticated inline and retained Evidence, corrected controls, unchanged non-retryable input-contract recovery, omission of the invalid value from diagnostics, zero provider launches, and a subsequent ping.
Executed against the original production branch: domain tests had 3 failed / 34 passed, with summary passing; MCP tests had 3 failed / 21 passed. All three failures showed the generic diagnostic instead of the expected nested issue. Restoring the fix passes both suites.
Existing capacity, sensitive-parent, subject-identity, and CLI cases also pass.

Representative MCP issue after the fix:

{"path":["source","normalized_result","artifact","bytes"],"reason":"invalid_type","expected":"number"}

Classification remains invalid_request / invalid_input, retryable: false, with inspect_input_contract recovery for inspect_analysis_view.

Remaining proof gaps: the new regression uses synthetic normalized HAR data and an SDK in-memory MCP connection, not a browser or external decoder. The browser-scenario parent branch is not changed. The complete deterministic suite remains for CI.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Executed on Linux with pinned Node 24.18.0 and npm 11.16.0:

npm ci — completed; reported one high-severity dependency advisory. No dependency changes made.
npm run test:local -- src/domain/analysisView/analysisView.test.ts — expected pre-fix failure: 3 failed, 34 passed.
npm run test:focused -- tests/boundary/mcp/analysisViewMcp.test.ts — expected pre-fix failure: 3 failed, 21 passed.
npm run test:local -- src/domain/analysisView/analysisView.test.ts src/domain/analysisView/webNetworkApiSurfaceView.test.ts src/domain/analysisView/environmentManifestView.test.ts src/domain/analysisView/environmentStateView.test.ts src/domain/analysisView/webNetworkCaptureView.test.ts — 194 passed across 5 files.
npm run test:focused -- tests/boundary/mcp/analysisViewMcp.test.ts tests/boundary/cli/analysisViewCli.test.ts — 46 passed across 2 files.
npm run check:fast — passed typecheck and lint.
npm run check — passed all 6 tasks and architecture guards; lint reported 0 errors and 2,122 repository warnings.
npm run verify:test-discovery — all 1,957 test files discovered exactly once.
git diff --check — passed; pre-commit formatting and lint also completed.

Initial post-fix validation exposed missing parsed defaults in the new domain control and nullable fixture-digest typing. Both test setup issues were corrected before the final fail-before/pass-after runs.

Compatibility, safety, and release

Breaking changes or migration steps: none; malformed parents remain refused with improved correction metadata.
Real Hopper/Ghidra, browser, or OS coverage: Linux synthetic-data and existing compiled CLI checks only; no real provider or browser verification claimed.
Package or release metadata impact: none; no generated artifacts or dependency changes committed.
Security, privacy, process, or containment review: uses the existing secret-safe issue projector, retains pre-parse admission, and does not expose the rejected field value in the public diagnostic.

Author readiness

Human owner: @monsterlag

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6203 **Author:** [@monsterlag](https://github.com/monsterlag) **Created:** 10/22/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/issue-6044-ff8f` --- ### 📝 Commits (1) - [`179f002`](https://github.com/morluto/rea/commit/179f0020643c26a904b625ddb3cc27981beab3ee) fix(analysis-view): preserve HAR grouping parent diagnostics ### 📊 Changes **3 files changed** (+143 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/analysisView/WebNetworkProjectionAccumulator.ts` (+10 -8) 📝 `src/domain/analysisView/analysisView.test.ts` (+54 -0) 📝 `tests/boundary/mcp/analysisViewMcp.test.ts` (+79 -3) </details> ### 📄 Description > [!NOTE] > **AI-generated; human owner review pending.** This pull request was written by an AI coding agent and checked by a separate AI review agent, which re-ran the tests described below. It is opened as a draft: its human owner, @monsterlag, reviews the final diff and completes the readiness declarations before marking it ready for review. ## Summary Fixes #6044. Preserve nested parent-schema diagnostics for HAR `api-surface`, `environment-manifest`, and `environment-state` views, matching `summary`. ## Problem and expected behavior A digest-valid `inspect_web_network_capture` parent with a string at `artifact.bytes` was rejected with only `source` / `invalid_value` by grouping views. The owning schema's field path, expected type, and internal parse cause were discarded. Callers should receive correction details beneath `source.normalized_result` without changing the refusal or recovery. ## Change and scope Use the existing secret-safe `analysisInputErrorFromIssues` projection in shared HAR admission, with prefixed paths, matching wrapped input, and the original cause. Keep representation admission before parsing, the owned-parser cache, and format, subject-identity, and sensitive-value gates unchanged. Grouping algorithms and other parent operations are unchanged; no additional abstraction or unrelated cleanup is needed. ## Contract and boundary impact - Semantic owner and earliest changed stage: `admitHarCaptureParent`, when the owned capture schema rejects a parent result. - Contribution scope fit and linked maintainer decision: routine bug fix within existing boundaries; advance scope decision not applicable. - CLI and MCP/tool-catalog contract: more precise existing error metadata; no schema, tool, or catalog changes. - Provider, bridge, target-format, or platform compatibility: unchanged; no provider integration changes. - Evidence, artifact, provenance, or reconstruction contract: authenticated malformed parents remain rejected; successful views retain parent Evidence links. - Target selection, authority, upstream behavior, and cleanup details: unchanged; projection reads supplied captured data and starts no provider. - Generated metadata, package, or installation impact: none. Expected effects: reads existing captured data only; no new target execution, mutation, network access, or protection recovery. - [ ] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Domain regressions cover all three grouping kinds plus summary: wrong-type versus missing `artifact.bytes`, the nested issue path, expected `number`, retained `ZodError`, and valid-parent controls. - MCP regressions cover all three grouping kinds with authenticated inline and retained Evidence, corrected controls, unchanged non-retryable input-contract recovery, omission of the invalid value from diagnostics, zero provider launches, and a subsequent ping. - Executed against the original production branch: domain tests had **3 failed / 34 passed**, with summary passing; MCP tests had **3 failed / 21 passed**. All three failures showed the generic diagnostic instead of the expected nested issue. Restoring the fix passes both suites. - Existing capacity, sensitive-parent, subject-identity, and CLI cases also pass. Representative MCP issue after the fix: ```json {"path":["source","normalized_result","artifact","bytes"],"reason":"invalid_type","expected":"number"} ``` Classification remains `invalid_request` / `invalid_input`, `retryable: false`, with `inspect_input_contract` recovery for `inspect_analysis_view`. Remaining proof gaps: the new regression uses synthetic normalized HAR data and an SDK in-memory MCP connection, not a browser or external decoder. The browser-scenario parent branch is not changed. The complete deterministic suite remains for CI. For evidence-bearing changes: - [ ] Observed, derived, and inferred claims remain distinguishable. - [ ] Artifact identity, source provenance, and failed attempts remain preserved. - [ ] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Executed on Linux with pinned Node **24.18.0** and npm **11.16.0**: - `npm ci` — completed; reported one high-severity dependency advisory. No dependency changes made. - `npm run test:local -- src/domain/analysisView/analysisView.test.ts` — expected pre-fix failure: 3 failed, 34 passed. - `npm run test:focused -- tests/boundary/mcp/analysisViewMcp.test.ts` — expected pre-fix failure: 3 failed, 21 passed. - `npm run test:local -- src/domain/analysisView/analysisView.test.ts src/domain/analysisView/webNetworkApiSurfaceView.test.ts src/domain/analysisView/environmentManifestView.test.ts src/domain/analysisView/environmentStateView.test.ts src/domain/analysisView/webNetworkCaptureView.test.ts` — 194 passed across 5 files. - `npm run test:focused -- tests/boundary/mcp/analysisViewMcp.test.ts tests/boundary/cli/analysisViewCli.test.ts` — 46 passed across 2 files. - `npm run check:fast` — passed typecheck and lint. - `npm run check` — passed all 6 tasks and architecture guards; lint reported 0 errors and 2,122 repository warnings. - `npm run verify:test-discovery` — all 1,957 test files discovered exactly once. - `git diff --check` — passed; pre-commit formatting and lint also completed. Initial post-fix validation exposed missing parsed defaults in the new domain control and nullable fixture-digest typing. Both test setup issues were corrected before the final fail-before/pass-after runs. ## Compatibility, safety, and release - Breaking changes or migration steps: none; malformed parents remain refused with improved correction metadata. - Real Hopper/Ghidra, browser, or OS coverage: Linux synthetic-data and existing compiled CLI checks only; no real provider or browser verification claimed. - Package or release metadata impact: none; no generated artifacts or dependency changes committed. - Security, privacy, process, or containment review: uses the existing secret-safe issue projector, retains pre-parse admission, and does not expose the rejected field value in the public diagnostic. ## Author readiness Human owner: @monsterlag - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:46:06 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-03 13:39:49 +00:00

[PR #7201] [CLOSED] docs(setup): call FreeBuff setup support shipped, not proposed #7711

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7201

No description provided.

Rows
Columns