[PR #400] [MERGED] fix(mcp): preserve investigation input policy #1953

New issue

Closed

opened 2026-10-16 21:12:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/400
Author: @N0zoM1z0
Created: 7/21/2026
Status: ✅ Merged
Merged: 7/21/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/javascript-mcp-investigation-permission

📝 Commits (2)

f4156d9 fix(mcp): preserve investigation input policy
846193c docs: refresh Node 24 TypeDoc output

📊 Changes

57 files changed (+460 additions, -182 deletions)

View changed files

📝 README.md (+5 -0)
📝 docs/api/assets/hierarchy.js (+1 -1)
📝 docs/api/assets/navigation.js (+1 -1)
📝 docs/api/assets/search.js (+1 -1)
📝 docs/api/classes/application_PermissionAuthority.PermissionAuthority.html (+14 -13)
📝 docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html (+1 -1)
📝 docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html (+1 -1)
📝 docs/api/functions/application_CapabilityInventory.buildCapabilityInventory.html (+1 -1)
📝 docs/api/functions/application_PermissionAuthority.createPermissionAuthority.html (+1 -1)
📝 docs/api/functions/application_Setup.detectClients.html (+1 -1)
📝 docs/api/functions/application_Setup.runSetup.html (+1 -1)
📝 docs/api/functions/application_Setup.systemSetupHost.html (+1 -1)
➕ docs/api/functions/application_SetupRegistrationEnvironment.registrationPermissionEnvironment.html (+44 -0)
📝 docs/api/functions/domain_analysisErrorPresentation.analysisErrorCategory.html (+1 -1)
📝 docs/api/functions/domain_analysisErrorPresentation.analysisErrorUserMessage.html (+1 -1)
📝 docs/api/functions/domain_analysisErrorPresentation.assertKnownAnalysisErrorTag.html (+1 -1)
📝 docs/api/functions/server_createServer.createServer.html (+1 -1)
📝 docs/api/functions/server_registerSessionStatusTool.registerSessionStatusTool.html (+1 -1)
📝 docs/api/functions/server_registerSessionTools.registerSessionTools.html (+1 -1)
📝 docs/api/functions/server_sessionAvailabilityPolicy.sessionAvailabilityPolicy.html (+4 -3)

...and 37 more files

📄 Description

Summary

persist an explicitly configured REA_INVESTIGATION_INPUT_ROOTS_JSON in managed MCP client registrations
report static JavaScript analysis availability from the investigation-root policy instead of Electron observation configuration
distinguish live MCP requests outside the administrator ceiling from elicitable grants, with truthful restart guidance
document the setup and restart workflow and regenerate API documentation

Root cause

The static JavaScript tool correctly failed closed when no investigation roots were configured, but rea setup omitted that non-secret policy from managed MCP registrations. The live capability inventory also grouped static analysis with Electron observation, and permission denials incorrectly advertised no restart even though a running MCP process cannot acquire a changed environment through elicitation or SIGHUP.

Impact

Operators can set the explicit investigation root before approved setup and have it retained in the registered MCP environment. Agents see the tool as policy-disabled before attempting it when the ceiling is empty, and receive accurate administrator-reconfiguration and restart instructions.

The security boundary remains fail-closed: elicitation can add a connection grant only within the configured administrator ceiling and cannot widen it.

Validation

npm run check
npm run verify:package with a Linux-only PATH (the inherited WSL PATH contains nonresponsive Windows npm/npx shims that exceed the verifier setup prompt deadline)
npm run knip
npm run jscpd
npm run scan:todos
focused MCP, permission, Electron, and CLI regression suites

Real Hopper and Ghidra verification was not run because no provider protocol or analysis behavior changed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/400 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/21/2026 **Status:** ✅ Merged **Merged:** 7/21/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/javascript-mcp-investigation-permission` --- ### 📝 Commits (2) - [`f4156d9`](https://github.com/morluto/rea/commit/f4156d9663a1847d5b3bbe29f98036b9c76606b4) fix(mcp): preserve investigation input policy - [`846193c`](https://github.com/morluto/rea/commit/846193c60305242b27f39c69715f332627ba1725) docs: refresh Node 24 TypeDoc output ### 📊 Changes **57 files changed** (+460 additions, -182 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+5 -0) 📝 `docs/api/assets/hierarchy.js` (+1 -1) 📝 `docs/api/assets/navigation.js` (+1 -1) 📝 `docs/api/assets/search.js` (+1 -1) 📝 `docs/api/classes/application_PermissionAuthority.PermissionAuthority.html` (+14 -13) 📝 `docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html` (+1 -1) 📝 `docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html` (+1 -1) 📝 `docs/api/functions/application_CapabilityInventory.buildCapabilityInventory.html` (+1 -1) 📝 `docs/api/functions/application_PermissionAuthority.createPermissionAuthority.html` (+1 -1) 📝 `docs/api/functions/application_Setup.detectClients.html` (+1 -1) 📝 `docs/api/functions/application_Setup.runSetup.html` (+1 -1) 📝 `docs/api/functions/application_Setup.systemSetupHost.html` (+1 -1) ➕ `docs/api/functions/application_SetupRegistrationEnvironment.registrationPermissionEnvironment.html` (+44 -0) 📝 `docs/api/functions/domain_analysisErrorPresentation.analysisErrorCategory.html` (+1 -1) 📝 `docs/api/functions/domain_analysisErrorPresentation.analysisErrorUserMessage.html` (+1 -1) 📝 `docs/api/functions/domain_analysisErrorPresentation.assertKnownAnalysisErrorTag.html` (+1 -1) 📝 `docs/api/functions/server_createServer.createServer.html` (+1 -1) 📝 `docs/api/functions/server_registerSessionStatusTool.registerSessionStatusTool.html` (+1 -1) 📝 `docs/api/functions/server_registerSessionTools.registerSessionTools.html` (+1 -1) 📝 `docs/api/functions/server_sessionAvailabilityPolicy.sessionAvailabilityPolicy.html` (+4 -3) _...and 37 more files_ </details> ### 📄 Description ## Summary - persist an explicitly configured `REA_INVESTIGATION_INPUT_ROOTS_JSON` in managed MCP client registrations - report static JavaScript analysis availability from the investigation-root policy instead of Electron observation configuration - distinguish live MCP requests outside the administrator ceiling from elicitable grants, with truthful restart guidance - document the setup and restart workflow and regenerate API documentation ## Root cause The static JavaScript tool correctly failed closed when no investigation roots were configured, but `rea setup` omitted that non-secret policy from managed MCP registrations. The live capability inventory also grouped static analysis with Electron observation, and permission denials incorrectly advertised no restart even though a running MCP process cannot acquire a changed environment through elicitation or SIGHUP. ## Impact Operators can set the explicit investigation root before approved setup and have it retained in the registered MCP environment. Agents see the tool as policy-disabled before attempting it when the ceiling is empty, and receive accurate administrator-reconfiguration and restart instructions. The security boundary remains fail-closed: elicitation can add a connection grant only within the configured administrator ceiling and cannot widen it. ## Validation - `npm run check` - `npm run verify:package` with a Linux-only PATH (the inherited WSL PATH contains nonresponsive Windows npm/npx shims that exceed the verifier setup prompt deadline) - `npm run knip` - `npm run jscpd` - `npm run scan:todos` - focused MCP, permission, Electron, and CLI regression suites Real Hopper and Ghidra verification was not run because no provider protocol or analysis behavior changed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:49 +00:00