morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3908] [Bug] project-open refusals replace the artifact path with the endpoint #1521

New issue

Closed

opened 2026-10-16 21:06:35 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-16 21:06:35 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3908

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

A supported open_jeb_project refusal identifies the JEB MCP service URL as the unsupported artifact. When the producer supplies a generic refusal reason, the returned error omits the caller-selected artifact path. This source-only finding concerns error identity, independently of whether a real JEB engine can analyze that artifact.

The selected path reaches the producer correctly. When the producer refuses it, #requireSuccess constructs the unsupported-target error using this.#endpoint.toString() as its path. The service returns this failure before Evidence creation, so retained request parameters or a raw producer response do not recover the artifact identity. The CLI projects the error directly. Runtime reproduction was not run; no REA exit status or real-provider result is claimed.

Reproduction

These steps are proposed and unexecuted. Use the baseline below and a reachable local JEB MCP producer advertising open_project. A controlled producer can return the supported failure envelope without launching JEB or opening an artifact.

Invoke rea open-jeb-project /targets/Example.apk --format json with the default endpoint http://127.0.0.1:8425/mcp, a nonaborted request, and successful normal connection cleanup.
For the upstream open_project request {"file_path":"/targets/Example.apk"}, return {"success":false,"message":"The input file could not be processed"} as structuredContent, with content: []. This is an accepted producer failure shape, not an observed message from a particular JEB release.
Inspect the projected error. The traced branches yield code: "unsupported_target", details.operation: "open_jeb_project", details.path: "http://127.0.0.1:8425/mcp", and details.reason: "The input file could not be processed". The derived message is Unsupported target for open_jeb_project at http://127.0.0.1:8425/mcp: The input file could not be processed. It omits /targets/Example.apk.

Expected behavior

An artifact refusal must retain /targets/Example.apk as the selected target and preserve the engine reason. The service endpoint must remain distinguishable from the artifact identity. The documented operation opens an engine-host artifact path and preserves failure envelopes. The unsupported-target error's path is the supplied artifact identity used in its message.

Impact and scope

Impact level: P2
Assessment status: supported
Impact basis: A bounded artifact-refusal path replaces target identity with a service URL and can misattribute failed project inputs in automated processing. No successful analysis result or data loss is implicated.

REA version

Reviewed release: rea-agents-6.5.0, revision 3b79af28e80785afce9f5998d8f03289402a1847. The source review compared fetched main at cf0a38ad9774ee9acff3164052688f7a58a1c72c and found the relevant refusal construction, public admission, and failure return unchanged. Runtime/platform and real JEB version are NOT_ENOUGH_INFO because no runtime reproduction or provider launch occurred. No operating-system-specific branch is required by this source proof. Real-engine wording, prevalence, and a last-known-good release remain unknown.

Runtime and platform

REA runtime reproduction was not run. Runtime and platform details for any smaller premise checks are recorded in the version/environment field above. Real-provider versions and end-to-end output are NOT_ENOUGH_INFO because no provider was launched.

Target and artifact context

Engine-host APK path submitted to JEB open_project; supported message-only producer refusal before Evidence creation.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

Expected source: AGENTS.md:13 requires caller-selected input/path preservation; docs/jeb-analysis.md:26-39 defines engine-host path resolution and failure-envelope preservation; src/domain/analysisErrorCore.ts:7-21 defines the unsupported-target artifact path and message.
Failure source: src/jeb/JebProvider.ts:383-394 substitutes the endpoint for the target. The accepted envelope and public return path are traced below.
Evidence provenance: static
Local verification: static-proof
Reproduction completeness: complete

The primary violation evidence is the supplied production-source trace; no premise experiment was needed. Runtime reproduction was not run. The proof uses a valid public request, supported producer failure, reachable branches, and ordinary successful cleanup. Reproduction completeness applies to the stated public error-mapping input; real-engine behavior and frequency remain untested.

The public path begins at src/cli/jebCommands.ts:42-51, which registers the command; :22-33 calls JebAnalysisService.execute and projects its error. src/application/jeb/JebAnalysisService.ts:17-29 selects the operation schema. src/application/ProviderOperationExecution.ts:46-52 admits the nonaborted request and returns provider failures before creating Evidence.

src/domain/jeb/jebAnalysis.ts:12-16,77-80 accepts the nonempty NUL-free path. src/domain/localPath.ts:15-20 requires no local existence check; the documented engine resolves the path. The default endpoint passes src/jeb/JebProvider.ts:106-114. Dispatch at :184-186 reaches #openProject, which forwards file_path at :278-286.

src/jeb/JebMcpConnection.ts:204-215 invokes and decodes the tool result. Its :35-68 accepts this object failure envelope, including an MCP tool-error envelope. JebProvider.ts:43-56,90-96 accepts the generic message; the cited constructor then throws the endpoint-based error. The provider's :165-168,402-403 returns that AnalysisError unchanged. src/domain/analysisErrorProjection.ts:200,248-253 projects the unsupported-target code and incorrect path. No client-information success reply is needed because the failure precedes #engine at JebProvider.ts:288.

The inspected test at src/jeb/JebProvider.test.ts:108-130 establishes message-only success:false envelopes as an intended refusal format, but checks the reason rather than artifact identity. This is test-source evidence, not a test execution. The target path in the fixture is synthetic public input, and the local service URL is part of the supported request, not a real deployment identifier.

Typed outcome or recovery expected

For the same request and failure envelope, preserve the refusal classification and engine reason while identifying /targets/Example.apk as the target. Change the path to /targets/Other.apk while holding endpoint and message fixed; the returned artifact identity must follow the request. Changing only the endpoint must not change that identity. Keep successful project opening and a connection failure as controls so restoration preserves project results and endpoint-unavailability classification. These checks are proposed and unexecuted.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A bounded artifact-refusal path replaces target identity with a service URL and can misattribute failed project inputs in automated processing. No successful analysis result or data loss is implicated.
Workaround status: available
Workaround basis: Callers can retain the original requested path alongside the refusal and use it to interpret the preserved engine reason. This needs no device action or source change; it does not repair the returned error itself.

Originally created by @coygeek on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3908 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Native analysis or decompilation ## Observed behavior A supported `open_jeb_project` refusal identifies the JEB MCP service URL as the unsupported artifact. When the producer supplies a generic refusal reason, the returned error omits the caller-selected artifact path. This source-only finding concerns error identity, independently of whether a real JEB engine can analyze that artifact. The selected path reaches the producer correctly. When the producer refuses it, `#requireSuccess` constructs the unsupported-target error using `this.#endpoint.toString()` as its path. The service returns this failure before Evidence creation, so retained request parameters or a raw producer response do not recover the artifact identity. The CLI projects the error directly. Runtime reproduction was not run; no REA exit status or real-provider result is claimed. ## Reproduction These steps are proposed and unexecuted. Use the baseline below and a reachable local JEB MCP producer advertising `open_project`. A controlled producer can return the supported failure envelope without launching JEB or opening an artifact. 1. Invoke `rea open-jeb-project /targets/Example.apk --format json` with the default endpoint `http://127.0.0.1:8425/mcp`, a nonaborted request, and successful normal connection cleanup. 2. For the upstream `open_project` request `{"file_path":"/targets/Example.apk"}`, return `{"success":false,"message":"The input file could not be processed"}` as `structuredContent`, with `content: []`. This is an accepted producer failure shape, not an observed message from a particular JEB release. 3. Inspect the projected error. The traced branches yield `code: "unsupported_target"`, `details.operation: "open_jeb_project"`, `details.path: "http://127.0.0.1:8425/mcp"`, and `details.reason: "The input file could not be processed"`. The derived message is `Unsupported target for open_jeb_project at http://127.0.0.1:8425/mcp: The input file could not be processed`. It omits `/targets/Example.apk`. ## Expected behavior An artifact refusal must retain `/targets/Example.apk` as the selected target and preserve the engine reason. The service endpoint must remain distinguishable from the artifact identity. The documented operation opens an engine-host artifact path and preserves failure envelopes. The unsupported-target error's path is the supplied artifact identity used in its message. ## Impact and scope - Impact level: P2 - Assessment status: supported - Impact basis: A bounded artifact-refusal path replaces target identity with a service URL and can misattribute failed project inputs in automated processing. No successful analysis result or data loss is implicated. ## REA version Reviewed release: `rea-agents-6.5.0`, revision `3b79af28e80785afce9f5998d8f03289402a1847`. The source review compared fetched main at `cf0a38ad9774ee9acff3164052688f7a58a1c72c` and found the relevant refusal construction, public admission, and failure return unchanged. Runtime/platform and real JEB version are `NOT_ENOUGH_INFO` because no runtime reproduction or provider launch occurred. No operating-system-specific branch is required by this source proof. Real-engine wording, prevalence, and a last-known-good release remain unknown. ## Runtime and platform REA runtime reproduction was not run. Runtime and platform details for any smaller premise checks are recorded in the version/environment field above. Real-provider versions and end-to-end output are NOT_ENOUGH_INFO because no provider was launched. ## Target and artifact context Engine-host APK path submitted to JEB open_project; supported message-only producer refusal before Evidence creation. ## Interface CLI ## Earliest failure stage Transport or result projection ## Relevant output or evidence - Expected source: [AGENTS.md:13](https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/AGENTS.md#L13) requires caller-selected input/path preservation; [docs/jeb-analysis.md:26-39](https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/docs/jeb-analysis.md#L26-L39) defines engine-host path resolution and failure-envelope preservation; [src/domain/analysisErrorCore.ts:7-21](https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/domain/analysisErrorCore.ts#L7-L21) defines the unsupported-target artifact path and message. - Failure source: [src/jeb/JebProvider.ts:383-394](https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/jeb/JebProvider.ts#L383-L394) substitutes the endpoint for the target. The accepted envelope and public return path are traced below. - Evidence provenance: static - Local verification: static-proof - Reproduction completeness: complete The primary violation evidence is the supplied production-source trace; no premise experiment was needed. Runtime reproduction was not run. The proof uses a valid public request, supported producer failure, reachable branches, and ordinary successful cleanup. Reproduction completeness applies to the stated public error-mapping input; real-engine behavior and frequency remain untested. The public path begins at `src/cli/jebCommands.ts:42-51`, which registers the command; `:22-33` calls `JebAnalysisService.execute` and projects its error. `src/application/jeb/JebAnalysisService.ts:17-29` selects the operation schema. `src/application/ProviderOperationExecution.ts:46-52` admits the nonaborted request and returns provider failures before creating Evidence. `src/domain/jeb/jebAnalysis.ts:12-16,77-80` accepts the nonempty NUL-free path. `src/domain/localPath.ts:15-20` requires no local existence check; the documented engine resolves the path. The default endpoint passes `src/jeb/JebProvider.ts:106-114`. Dispatch at `:184-186` reaches `#openProject`, which forwards `file_path` at `:278-286`. `src/jeb/JebMcpConnection.ts:204-215` invokes and decodes the tool result. Its `:35-68` accepts this object failure envelope, including an MCP tool-error envelope. `JebProvider.ts:43-56,90-96` accepts the generic message; the cited constructor then throws the endpoint-based error. The provider's `:165-168,402-403` returns that AnalysisError unchanged. `src/domain/analysisErrorProjection.ts:200,248-253` projects the unsupported-target code and incorrect path. No client-information success reply is needed because the failure precedes `#engine` at `JebProvider.ts:288`. The inspected test at `src/jeb/JebProvider.test.ts:108-130` establishes message-only `success:false` envelopes as an intended refusal format, but checks the reason rather than artifact identity. This is test-source evidence, not a test execution. The target path in the fixture is synthetic public input, and the local service URL is part of the supported request, not a real deployment identifier. ## Typed outcome or recovery expected For the same request and failure envelope, preserve the refusal classification and engine reason while identifying `/targets/Example.apk` as the target. Change the path to `/targets/Other.apk` while holding endpoint and message fixed; the returned artifact identity must follow the request. Changing only the endpoint must not change that identity. Keep successful project opening and a connection failure as controls so restoration preserves project results and endpoint-unavailability classification. These checks are proposed and unexecuted. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A bounded artifact-refusal path replaces target identity with a service URL and can misattribute failed project inputs in automated processing. No successful analysis result or data loss is implicated. - Workaround status: available - Workaround basis: Callers can retain the original requested path alongside the refusal and use it to interpret the preserved engine reason. This needs no device action or source change; it does not repair the returned error itself.

bsakaguchi commented

2026-10-16 21:06:36 +00:00

Author

Owner

@yankikucuk commented on GitHub (Oct 15, 2026):

Working on this. Reproduced through rea open-jeb-project /targets/Example.apk --format json against a controlled producer that refuses open_project with a message-only envelope: details.path was the MCP URL. The refusal now names the caller-selected target (the artifact path for open_jeb_project, the item address for decompile_jeb_item); the endpoint remains the subject only for engine-wide operations. Classification and engine reason are unchanged; your path-follows-request and endpoint-change controls are covered by provider tests. Draft PR follows shortly.

@yankikucuk commented on GitHub (Oct 15, 2026): Working on this. Reproduced through `rea open-jeb-project /targets/Example.apk --format json` against a controlled producer that refuses `open_project` with a message-only envelope: `details.path` was the MCP URL. The refusal now names the caller-selected target (the artifact path for open_jeb_project, the item address for decompile_jeb_item); the endpoint remains the subject only for engine-wide operations. Classification and engine reason are unchanged; your path-follows-request and endpoint-change controls are covered by provider tests. Draft PR follows shortly.

bsakaguchi referenced this issue

2026-10-16 21:06:59 +00:00

[GH-ISSUE #3939] [Bug] Nested HERMES_HOME roots use another root's active profile during setup #1548

bsakaguchi referenced this issue

2026-10-17 21:12:08 +00:00

[PR #1528] [MERGED] fix(setup): follow and validate Hermes sticky profiles #2946

bsakaguchi closed this issue

2026-10-31 00:31:13 +00:00

bsakaguchi commented

2026-10-31 00:31:14 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

The open path passes request.input.path into requireSuccess, which chooses targetPath over endpoint when building unsupported-target errors. Exact generic message-only refusal regression asserts the selected engine-host artifact path and reason. The commenter also discussed item-address identity, but original issue scope is artifact project-open and that trigger is repaired; decompile_jeb_item still lacks an explicit target argument and should be assessed separately if desired.

Implementation: JebProvider.ts, JebProvider.ts.

The relevant regression checks in JebProvider.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. The open path passes request.input.path into requireSuccess, which chooses targetPath over endpoint when building unsupported-target errors. Exact generic message-only refusal regression asserts the selected engine-host artifact path and reason. The commenter also discussed item-address identity, but original issue scope is artifact project-open and that trigger is repaired; decompile_jeb_item still lacks an explicit target argument and should be assessed separately if desired. Implementation: [JebProvider.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/jeb/JebProvider.ts#L349), [JebProvider.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/jeb/JebProvider.ts#L461). The relevant regression checks in [JebProvider.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/jeb/JebProvider.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1521

No description provided.

Rows
Columns