morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #85] [MERGED] feat(analysis): harden agent workflows and evidence boundaries #1823

New issue

Closed

opened 2026-10-16 21:11:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:11:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/85
Author: @morluto
Created: 7/13/2026
Status: ✅ Merged
Merged: 7/13/2026
Merged by: @morluto

Base: main ← Head: codex/rea-low-mid-batch

📝 Commits (10+)

f8e8ea3 fix(bridge): harden bounded Hopper boundaries
898d6b0 fix(lifecycle): validate owned Hopper process identity
b1912b1 feat(cli): align terminal workflows with MCP
bce3398 fix(process): default capture networking to loopback
0d36976 test(verification): strengthen conformance and real-Hopper checks
efc9bd2 docs: document CLI safety and provider evaluation
a7b84a9 test(docs): keep localized claims and tool counts aligned
d806480 docs: correct pull request tool inventory
329fdf6 refactor(cli): share direct analysis tool types
9526389 fix(process): keep network approval fail-closed

📊 Changes

32 files changed (+1054 additions, -158 deletions)

View changed files

📝 .github/pull_request_template.md (+1 -1)
📝 README.md (+21 -7)
📝 README_ar.md (+2 -1)
📝 bridge/hopper_bridge.py (+18 -4)
➕ docs/provider-evaluation.md (+59 -0)
📝 scripts/verify-conformance-fixtures.mjs (+22 -1)
📝 scripts/verify-package.mjs (+102 -2)
📝 scripts/verify-real-hopper.mjs (+15 -0)
📝 src/application/BinarySession.ts (+10 -1)
📝 src/application/DirectAnalysis.ts (+44 -14)
📝 src/application/EnhancedTools.ts (+2 -0)
📝 src/application/EvidenceBundleCommands.ts (+35 -1)
📝 src/application/ProcessOwnership.ts (+32 -0)
📝 src/application/RealHopperAssertions.ts (+17 -0)
📝 src/cli.ts (+196 -91)
➕ src/cliEvidenceCommands.ts (+89 -0)
➕ src/cliLogging.ts (+32 -0)
📝 src/contracts/toolOutputSchemas.ts (+7 -5)
📝 src/domain/errors.ts (+12 -1)
📝 src/domain/hopperValues.ts (+25 -5)

...and 12 more files

📄 Description

Description

This branch addresses selected small REA issue gaps around agent-first analysis and evidence handling:

bounds Hopper search results without building a second full match list;
validates pagination metadata and classifies bridge diagnostics without exposing tracebacks;
adds CLI parity for inspect, function, search, xrefs, trace, capabilities, providers, and Evidence v2 bundle comparison;
keeps CLI function dossiers attributed to the producing Hopper provider;
checks launcher command and parent identity before process-group cleanup;
strengthens source-fixture and real-Hopper verification against false positives;
records the current static-analysis provider evaluation and admission gate.

The MCP inventory remains 68 tools. The CLI and MCP use the same application services and Evidence v2/domain comparison code. No new provider implementation or fabricated Hopper metadata is included.

Related issues: #16, #19, #23, #26, #28, #29, #30, #53, #55, #56.

Type of change

Bug fix
New feature
Documentation update
Refactoring (no contract behavior change)
Tool contract change (session status output only; the 68-tool inventory is unchanged)

Review order

src/domain/hopperValues.ts, src/hopper/protocol.ts, bridge/hopper_bridge.py, and their boundary tests.
src/application/DirectAnalysis.ts, src/cli.ts, src/cliEvidenceCommands.ts, and Evidence bundle commands.
src/application/ProcessOwnership.ts and the verification scripts.
Documentation and PR-template consistency updates.

Testing performed

npm run check — passed; 54 test files, 342 tests.
npm run verify:package — passed; packaged CLI, Evidence commands, setup lifecycle, and 68-tool MCP smoke.
npm pack --dry-run — passed; 135 package files, no generated Python bytecode.
npm run verify:fixtures — not available on this Linux host; the fixture builder requires macOS and Xcode command-line tools.
Real Hopper verification — not run; this host has no Hopper installation or desktop runtime.
Autoreview against origin/main — clean after three in-scope fixes: network approval, provider provenance, and final-page pagination semantics.

Tool contract impact

No MCP tool was added or removed. Session status now exposes the deterministic list of configured providers. The new rea compare CLI command uses the existing canonical Evidence v2 bundle comparison contract.

See the issue references above. Larger provider and real-Hopper work remains platform-gated or outside this focused batch.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/85 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/13/2026 **Status:** ✅ Merged **Merged:** 7/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/rea-low-mid-batch` --- ### 📝 Commits (10+) - [`f8e8ea3`](https://github.com/morluto/rea/commit/f8e8ea35ff08ce5071acbccab188df808708b71c) fix(bridge): harden bounded Hopper boundaries - [`898d6b0`](https://github.com/morluto/rea/commit/898d6b0192126030cedd7e5c2cb76f40568cda05) fix(lifecycle): validate owned Hopper process identity - [`b1912b1`](https://github.com/morluto/rea/commit/b1912b18e1723c594a030b16acf01341f083455b) feat(cli): align terminal workflows with MCP - [`bce3398`](https://github.com/morluto/rea/commit/bce3398dbe3a3b20952f37573a656aa77b168977) fix(process): default capture networking to loopback - [`0d36976`](https://github.com/morluto/rea/commit/0d369762770d2d92dd72c7dcb2f2f90a64b206ff) test(verification): strengthen conformance and real-Hopper checks - [`efc9bd2`](https://github.com/morluto/rea/commit/efc9bd270f58a5aaba15edb07cee135d2c54db83) docs: document CLI safety and provider evaluation - [`a7b84a9`](https://github.com/morluto/rea/commit/a7b84a9b4b7ea4336c0f327e13b2948a8d94fba9) test(docs): keep localized claims and tool counts aligned - [`d806480`](https://github.com/morluto/rea/commit/d806480e41bcb623448a258ddffeb75082fe1e1f) docs: correct pull request tool inventory - [`329fdf6`](https://github.com/morluto/rea/commit/329fdf6fe8f3a2bf9679b13a8ce5cb16cf946129) refactor(cli): share direct analysis tool types - [`9526389`](https://github.com/morluto/rea/commit/9526389f815f0937fc01198ff3a8a850c6c1c81a) fix(process): keep network approval fail-closed ### 📊 Changes **32 files changed** (+1054 additions, -158 deletions) <details> <summary>View changed files</summary> 📝 `.github/pull_request_template.md` (+1 -1) 📝 `README.md` (+21 -7) 📝 `README_ar.md` (+2 -1) 📝 `bridge/hopper_bridge.py` (+18 -4) ➕ `docs/provider-evaluation.md` (+59 -0) 📝 `scripts/verify-conformance-fixtures.mjs` (+22 -1) 📝 `scripts/verify-package.mjs` (+102 -2) 📝 `scripts/verify-real-hopper.mjs` (+15 -0) 📝 `src/application/BinarySession.ts` (+10 -1) 📝 `src/application/DirectAnalysis.ts` (+44 -14) 📝 `src/application/EnhancedTools.ts` (+2 -0) 📝 `src/application/EvidenceBundleCommands.ts` (+35 -1) 📝 `src/application/ProcessOwnership.ts` (+32 -0) 📝 `src/application/RealHopperAssertions.ts` (+17 -0) 📝 `src/cli.ts` (+196 -91) ➕ `src/cliEvidenceCommands.ts` (+89 -0) ➕ `src/cliLogging.ts` (+32 -0) 📝 `src/contracts/toolOutputSchemas.ts` (+7 -5) 📝 `src/domain/errors.ts` (+12 -1) 📝 `src/domain/hopperValues.ts` (+25 -5) _...and 12 more files_ </details> ### 📄 Description ## Description This branch addresses selected small REA issue gaps around agent-first analysis and evidence handling: - bounds Hopper search results without building a second full match list; - validates pagination metadata and classifies bridge diagnostics without exposing tracebacks; - adds CLI parity for inspect, function, search, xrefs, trace, capabilities, providers, and Evidence v2 bundle comparison; - keeps CLI function dossiers attributed to the producing Hopper provider; - checks launcher command and parent identity before process-group cleanup; - strengthens source-fixture and real-Hopper verification against false positives; - records the current static-analysis provider evaluation and admission gate. The MCP inventory remains 68 tools. The CLI and MCP use the same application services and Evidence v2/domain comparison code. No new provider implementation or fabricated Hopper metadata is included. Related issues: #16, #19, #23, #26, #28, #29, #30, #53, #55, #56. ## Type of change - [x] Bug fix - [x] New feature - [x] Documentation update - [x] Refactoring (no contract behavior change) - [x] Tool contract change (session status output only; the 68-tool inventory is unchanged) ## Review order 1. `src/domain/hopperValues.ts`, `src/hopper/protocol.ts`, `bridge/hopper_bridge.py`, and their boundary tests. 2. `src/application/DirectAnalysis.ts`, `src/cli.ts`, `src/cliEvidenceCommands.ts`, and Evidence bundle commands. 3. `src/application/ProcessOwnership.ts` and the verification scripts. 4. Documentation and PR-template consistency updates. ## Testing performed - `npm run check` — passed; 54 test files, 342 tests. - `npm run verify:package` — passed; packaged CLI, Evidence commands, setup lifecycle, and 68-tool MCP smoke. - `npm pack --dry-run` — passed; 135 package files, no generated Python bytecode. - `npm run verify:fixtures` — not available on this Linux host; the fixture builder requires macOS and Xcode command-line tools. - Real Hopper verification — not run; this host has no Hopper installation or desktop runtime. - Autoreview against `origin/main` — clean after three in-scope fixes: network approval, provider provenance, and final-page pagination semantics. ## Tool contract impact No MCP tool was added or removed. Session status now exposes the deterministic list of configured providers. The new `rea compare` CLI command uses the existing canonical Evidence v2 bundle comparison contract. ## Related issues See the issue references above. Larger provider and real-Hopper work remains platform-gated or outside this focused batch. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:11:25 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 00:55:45 +00:00

[PR #1823] [MERGED] fix(artifacts): mark Windows host executables by extension #4839

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1823

No description provided.

Rows
Columns