[PR #486] [MERGED] feat(native): add investigation features #2023

New issue

Closed

opened 2026-10-16 21:13:27 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:27 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/486
Author: @morluto
Created: 9/29/2026
Status: ✅ Merged
Merged: 9/29/2026
Merged by: @morluto

Base: main ← Head: codex/rea-native-investigation-features

📝 Commits (10+)

fdb2817 feat(native): add UI and dispatch investigation workflows
2903511 feat(ghidra): support macOS host validation
63aa7c6 docs: update native investigation capabilities
790a0ac feat(artifacts): decode compiled Interface Builder archives
9020ba2 feat(ghidra): expose bounded p-code value flow
3635954 test(ghidra): split host and cross-format verification
d9022a1 fix(verify): follow complete result contracts
2aacb9d refactor: remove unused authorization and schema helpers
5fb4ad9 refactor: remove unused evidence result alias
2ac3725 Merge origin/main into native investigation features

📊 Changes

87 files changed (+6772 additions, -376 deletions)

View changed files

📝 AGENTS.md (+1 -0)
📝 README.md (+19 -15)
📝 README_ar.md (+2 -2)
📝 README_ja.md (+2 -2)
📝 README_ko.md (+2 -2)
📝 README_zh.md (+2 -2)
📝 bridge/ghidra/ReaGhidraBridge.java (+549 -22)
📝 docs/installation.md (+10 -5)
➕ docs/native-investigation.md (+78 -0)
📝 docs/product-catalog.json (+25 -12)
📝 docs/provider-evaluation.md (+23 -15)
📝 docs/roadmap.md (+7 -2)
📝 docs/testing.md (+32 -0)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 knip.json (+3 -1)
📝 package.json (+3 -0)
📝 scripts/lib/browser-scenario-verifier.mjs (+0 -17)
➕ scripts/verify-interface-builder.mjs (+103 -0)
📝 scripts/verify-package-artifact.mjs (+8 -13)
📝 scripts/verify-package-capabilities.mjs (+1 -1)

...and 67 more files

📄 Description

Summary

This PR adds read-only native investigation support around an analyst question: which authored UI action is connected to which symbolized handler, and what resolved direct calls follow it? The CLI and MCP share one provider-backed workflow; callers no longer assemble or submit an evidence graph.

The PR also decodes compiled Apple NIB archives and improves one evidence-validated AArch64 byte jump-table form in Ghidra. Issue coverage remains partial for #480, #482, #483, #484, and #487; details and unsupported cases are listed below.

Changes

Decode compiled Interface Builder archives into evidence-linked object and connection graphs. Add a source-owned AppKit XIB integration fixture compiled with ibtool.
Add trace_native_ui_action, which reads the open target's UI graph and native symbol inventory, verifies target digests match, joins a unique authored selector to a symbolized Objective-C handler, and follows bounded direct calls. It returns ambiguity, unresolved calls, coverage, limitations, target identity, and provider identity inline.
Replace the old caller-built graph input with the analyst-facing selector/object query. CLI and MCP use the same input and output contract.
Recover and verify the optimized AArch64 byte-indexed relative jump-table pattern only when the bound, load, base, branch, and recovered targets agree. Unsupported patterns remain unknown.
Keep Ghidra host and cross-format verification lanes separate.

Issue coverage

#480: compiled NIB decoding and real AppKit acceptance pass. Compiled storyboard acceptance remains unverified because this machine has no iOS simulator platform installed.
#481: real read-only Ghidra host acceptance passes on macOS Apple Silicon with Ghidra 12.1.4 and JDK 21, including debug and stripped Mach-O fixtures.
#482: Ghidra function dossiers expose bounded intra-function high-p-code def-use. Cross-function argument, return, and shared-memory slices remain unsupported.
#483: authored Objective-C selector matching and bounded direct-call traversal are implemented. Swift witness/vtable dispatch, closure/thunk resolution, and indirect runtime dispatch remain unresolved.
#484: typed metadata currently includes symbol-derived Objective-C method and Swift mangled-name records. Runtime sections, ivar layouts, protocol conformances, witness/vtable tables, and relative pointers are not decoded yet.
#487: the optimized dense AArch64 ELF byte-table fixture recovers 40 mappings with zero residual unknowns. The host Mach-O fixture still has five residual unknowns; sparse, stripped, and other table layouts are not claimed as recovered.

Verification

npm run test:local -- --run src/application/EnhancedNativeInvestigation.test.ts src/domain/nativeInvestigationGraph.test.ts — passed (9 tests).
npm run check:fast — passed (typecheck and lint; lint reports warnings and no errors).
npm run docs:check — passed.
npm run verify:interface-builder — passed: 8 objects, 2 connections, NSButton action runAction:, complete hierarchy, no truncation.
GHIDRA_INSTALL_DIR=/Users/will/Applications/ghidra_12.1.4_PUBLIC JAVA_HOME=/Users/will/Applications/temurin-jdk-21-macos-arm64/Contents/Home npm run verify:ghidra — passed on macOS host-native debug and stripped Mach-O fixtures; cleanup verified.
The same environment with npm run verify:ghidra:aarch64-jump-table — passed: 40 mappings, zero residual unknowns, cleanup verified.

Real Hopper verification was not performed. Cross-format PE/Mach-O linker coverage was not performed; the installed clang toolchain lacks the required linkers.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/486 **Author:** [@morluto](https://github.com/morluto) **Created:** 9/29/2026 **Status:** ✅ Merged **Merged:** 9/29/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/rea-native-investigation-features` --- ### 📝 Commits (10+) - [`fdb2817`](https://github.com/morluto/rea/commit/fdb28171566319e488a5ae042640a096eb3b8ea3) feat(native): add UI and dispatch investigation workflows - [`2903511`](https://github.com/morluto/rea/commit/290351184d3a891d4f77324f98f3356598571002) feat(ghidra): support macOS host validation - [`63aa7c6`](https://github.com/morluto/rea/commit/63aa7c6d3fa44c268c9fdb4300caf89dc25619dd) docs: update native investigation capabilities - [`790a0ac`](https://github.com/morluto/rea/commit/790a0ac589fd6b67ec091f215b999a5426ea5049) feat(artifacts): decode compiled Interface Builder archives - [`9020ba2`](https://github.com/morluto/rea/commit/9020ba2102ea7d86d5cca5d3d521c3134ed7da41) feat(ghidra): expose bounded p-code value flow - [`3635954`](https://github.com/morluto/rea/commit/3635954db9ca9a0ff95a042aa9253f085f3592b0) test(ghidra): split host and cross-format verification - [`d9022a1`](https://github.com/morluto/rea/commit/d9022a18b1b2f20e087a1757f6ce51ad5c0cde91) fix(verify): follow complete result contracts - [`2aacb9d`](https://github.com/morluto/rea/commit/2aacb9dc656b23ecd1993d6dd3427e83d6fa4a8f) refactor: remove unused authorization and schema helpers - [`5fb4ad9`](https://github.com/morluto/rea/commit/5fb4ad9c8e672ce085e85ad8ecef23f4e26bd4e1) refactor: remove unused evidence result alias - [`2ac3725`](https://github.com/morluto/rea/commit/2ac372582355ebf87a2105a3cdc7daa66465edfb) Merge origin/main into native investigation features ### 📊 Changes **87 files changed** (+6772 additions, -376 deletions) <details> <summary>View changed files</summary> 📝 `AGENTS.md` (+1 -0) 📝 `README.md` (+19 -15) 📝 `README_ar.md` (+2 -2) 📝 `README_ja.md` (+2 -2) 📝 `README_ko.md` (+2 -2) 📝 `README_zh.md` (+2 -2) 📝 `bridge/ghidra/ReaGhidraBridge.java` (+549 -22) 📝 `docs/installation.md` (+10 -5) ➕ `docs/native-investigation.md` (+78 -0) 📝 `docs/product-catalog.json` (+25 -12) 📝 `docs/provider-evaluation.md` (+23 -15) 📝 `docs/roadmap.md` (+7 -2) 📝 `docs/testing.md` (+32 -0) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `knip.json` (+3 -1) 📝 `package.json` (+3 -0) 📝 `scripts/lib/browser-scenario-verifier.mjs` (+0 -17) ➕ `scripts/verify-interface-builder.mjs` (+103 -0) 📝 `scripts/verify-package-artifact.mjs` (+8 -13) 📝 `scripts/verify-package-capabilities.mjs` (+1 -1) _...and 67 more files_ </details> ### 📄 Description ## Summary This PR adds read-only native investigation support around an analyst question: which authored UI action is connected to which symbolized handler, and what resolved direct calls follow it? The CLI and MCP share one provider-backed workflow; callers no longer assemble or submit an evidence graph. The PR also decodes compiled Apple NIB archives and improves one evidence-validated AArch64 byte jump-table form in Ghidra. Issue coverage remains partial for #480, #482, #483, #484, and #487; details and unsupported cases are listed below. ## Changes - Decode compiled Interface Builder archives into evidence-linked object and connection graphs. Add a source-owned AppKit XIB integration fixture compiled with `ibtool`. - Add `trace_native_ui_action`, which reads the open target's UI graph and native symbol inventory, verifies target digests match, joins a unique authored selector to a symbolized Objective-C handler, and follows bounded direct calls. It returns ambiguity, unresolved calls, coverage, limitations, target identity, and provider identity inline. - Replace the old caller-built graph input with the analyst-facing selector/object query. CLI and MCP use the same input and output contract. - Recover and verify the optimized AArch64 byte-indexed relative jump-table pattern only when the bound, load, base, branch, and recovered targets agree. Unsupported patterns remain unknown. - Keep Ghidra host and cross-format verification lanes separate. ## Issue coverage - #480: compiled NIB decoding and real AppKit acceptance pass. Compiled storyboard acceptance remains unverified because this machine has no iOS simulator platform installed. - #481: real read-only Ghidra host acceptance passes on macOS Apple Silicon with Ghidra 12.1.4 and JDK 21, including debug and stripped Mach-O fixtures. - #482: Ghidra function dossiers expose bounded intra-function high-p-code def-use. Cross-function argument, return, and shared-memory slices remain unsupported. - #483: authored Objective-C selector matching and bounded direct-call traversal are implemented. Swift witness/vtable dispatch, closure/thunk resolution, and indirect runtime dispatch remain unresolved. - #484: typed metadata currently includes symbol-derived Objective-C method and Swift mangled-name records. Runtime sections, ivar layouts, protocol conformances, witness/vtable tables, and relative pointers are not decoded yet. - #487: the optimized dense AArch64 ELF byte-table fixture recovers 40 mappings with zero residual unknowns. The host Mach-O fixture still has five residual unknowns; sparse, stripped, and other table layouts are not claimed as recovered. ## Verification - `npm run test:local -- --run src/application/EnhancedNativeInvestigation.test.ts src/domain/nativeInvestigationGraph.test.ts` — passed (9 tests). - `npm run check:fast` — passed (typecheck and lint; lint reports warnings and no errors). - `npm run docs:check` — passed. - `npm run verify:interface-builder` — passed: 8 objects, 2 connections, `NSButton` action `runAction:`, complete hierarchy, no truncation. - `GHIDRA_INSTALL_DIR=/Users/will/Applications/ghidra_12.1.4_PUBLIC JAVA_HOME=/Users/will/Applications/temurin-jdk-21-macos-arm64/Contents/Home npm run verify:ghidra` — passed on macOS host-native debug and stripped Mach-O fixtures; cleanup verified. - The same environment with `npm run verify:ghidra:aarch64-jump-table` — passed: 40 mappings, zero residual unknowns, cleanup verified. Real Hopper verification was not performed. Cross-format PE/Mach-O linker coverage was not performed; the installed clang toolchain lacks the required linkers. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:27 +00:00