289aef6838
* fix(managed): keep caller-input details in managed workflow errors
The managed workflows wrapped every rejected input as
`new AnalysisInputError(op, { cause })` with no issues. The projected
result said "Correct the listed arguments and retry" and listed nothing:
- `rea import-managed-reconstruction`,
`rea project-managed-application-graph` and
`rea verify-managed-native-boundaries` lost every schema issue for
malformed JSON;
- domain checks such as a reconstruction text hash mismatch, or Evidence
from the wrong operation, lost their message on CLI and MCP;
- `rea compare-managed-members` with a missing file did not say which
path failed.
Add managedInputError, which projects Zod issues with their paths and
keeps a domain TypeError's message, as the JavaScript workflows already
do. Return the BinaryTargetError from an unopenable comparison path
unchanged, with details.path, as every other path-based command does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): keep nested Evidence schema issues off request paths
A ZodError raised after the request parsed comes from a nested
Evidence result, so its issue paths are relative to that result.
Projecting it against the whole request reported, for example,
artifact.sha256 as a missing request field. Keep request-relative
projection for the raw request's schema failures. Report nested schema
failures as root issues whose message names the nested location.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(managed): type the malformed nested Evidence fixture
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(workflows): keep input details in the remaining workflow services
Inventory projection (project_android_application_graph and
project_apple_application_graph), build_reconstruction_obligation_ledger
and evaluate_reconstruction_coverage had the same issue-less
`AnalysisInputError({ cause })` as the managed services. For example,
evaluating coverage for an unknown boundary returned "Correct the listed
arguments" with no issues, dropping "Unknown reconstruction boundary: X"
on CLI and MCP.
Move the helpers to src/application/workflowInputError.ts and use them
for these services: requestInputError for raw request schema failures,
workflowInputError for nested schema and domain constraint failures.
Classification is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
65 lines
2.3 KiB
TypeScript
65 lines
2.3 KiB
TypeScript
import { z } from "zod";
|
|
|
|
import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
|
|
import { type AnalysisError } from "../../domain/analysisErrorBase.js";
|
|
import { createEvidence, type Evidence } from "../../domain/evidence.js";
|
|
import { jsonValueSchema } from "../../domain/jsonValue.js";
|
|
import {
|
|
managedNativeVerificationInputSchema,
|
|
verifyManagedNativeBoundaries,
|
|
type ManagedNativeVerificationInput,
|
|
type ManagedNativeVerificationResult,
|
|
} from "../../domain/managed/managedNativeVerification.js";
|
|
import { err, ok, type Result } from "../../domain/result.js";
|
|
import { MANAGED_WORKFLOW_PROVIDER } from "../InvestigationProviders.js";
|
|
import {
|
|
requestInputError,
|
|
workflowInputError,
|
|
} from "../workflowInputError.js";
|
|
|
|
const OPERATION = "verify_managed_native_boundaries" as const;
|
|
|
|
/** Verify managed/native boundary declarations against native Evidence. */
|
|
export const verifyManagedNativeBoundariesEvidence = (
|
|
rawInput: unknown,
|
|
): Result<Evidence, AnalysisError> => {
|
|
const parsed = managedNativeVerificationInputSchema.safeParse(rawInput);
|
|
if (!parsed.success)
|
|
return err(requestInputError(OPERATION, parsed.error, rawInput));
|
|
try {
|
|
const result = verifyManagedNativeBoundaries(parsed.data);
|
|
return ok(createManagedNativeVerificationEvidence(parsed.data, result));
|
|
} catch (cause: unknown) {
|
|
return err(
|
|
cause instanceof TypeError || cause instanceof z.ZodError
|
|
? workflowInputError(OPERATION, cause)
|
|
: new AnalysisProtocolError(
|
|
"Managed/native verification produced an invalid result",
|
|
{ cause },
|
|
),
|
|
);
|
|
}
|
|
};
|
|
|
|
const createManagedNativeVerificationEvidence = (
|
|
input: ManagedNativeVerificationInput,
|
|
result: ManagedNativeVerificationResult,
|
|
): Evidence =>
|
|
createEvidence(undefined, MANAGED_WORKFLOW_PROVIDER, {
|
|
predicateType: "rea.managed-native-verification",
|
|
operation: OPERATION,
|
|
parameters: {
|
|
managed_boundaries_evidence_id: input.managed_boundaries.evidence_id,
|
|
native_evidence_ids: jsonValueSchema.parse(
|
|
input.native_observations.map(({ evidence_id: id }) => id),
|
|
),
|
|
},
|
|
result: jsonValueSchema.parse(result),
|
|
rawResult: null,
|
|
confidence: "inferred",
|
|
authority: "analyst-inference",
|
|
environment: null,
|
|
limitations: result.limitations,
|
|
evidenceLinks: result.evidence_links,
|
|
});
|