[PR #602] [MERGED] fix(skill): remove obsolete grants and audit tool effects #2103

New issue

Closed

opened 2026-10-16 21:14:18 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:14:18 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/602
Author: @N0zoM1z0
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/skill-permissions-and-tool-metadata

📝 Commits (2)

2aa6c82 fix(skill): remove obsolete grants and audit tool effects
8f0550b Merge remote-tracking branch 'origin/main' into fix/skill-permissions-and-tool-metadata

📊 Changes

18 files changed (+195 additions, -39 deletions)

View changed files

📝 docs/mcp-contracts.md (+14 -0)
📝 docs/product-catalog.json (+3 -3)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 skills/reverse-engineer-anything/SKILL.md (+6 -2)
📝 skills/reverse-engineer-anything/references/evidence-workflows.md (+3 -2)
📝 skills/reverse-engineer-anything/references/native-and-artifacts.md (+8 -6)
📝 skills/reverse-engineer-anything/references/runtime-observation.md (+15 -11)
📝 src/application/ArtifactExtraction.ts (+1 -1)
📝 src/application/BrowserObservationService.test.ts (+36 -1)
📝 src/artifacts/ArtifactProvider.ts (+4 -1)
📝 src/contracts/toolEffects.ts (+15 -5)
📝 src/generatedMcpToolCatalog.ts (+1 -1)
📝 src/generatedPackageMetadata.ts (+1 -1)
📝 src/server/registerBrowserScenarioTool.ts (+1 -1)
📝 src/server/registerBrowserTools.ts (+1 -1)
📝 tests/boundary/filesystem/setupSkill.test.ts (+34 -1)
📝 tests/boundary/mcp/toolRegistrationOptions.test.ts (+22 -0)
📝 tests/boundary/providers/native/artifactProvider.extraction.test.ts (+28 -0)

📄 Description

Changes

Related to #545 and the permission-system removal in #555.

Upgrade the shipped skill to v24 and remove obsolete filesystem grants, per-call approval flags, Electron file-root configuration, and DMG approval flags. Calls follow the user-requested investigation directly. Keep setup plan confirmation, actual OS requirements, and process/archive lifecycle boundaries.
Correct the passive browser guide: endpoint/scope come from requests; ordinary local URL queries are retained, while credentials remain redacted.
Audit canonical tool effects: declare possible DMG process/temp-directory effects, mark fresh extraction non-idempotent, and mark comparisons of supplied captures/PNGs as closed-world. Align artifact-provider capability effects with temporary mount-directory writes.
Retain non-read-only hints for calls that add Evidence to the session; document that annotations are hints and that clients control their confirmation UI. Do not mislabel session mutations as read-only to suppress prompts.
Regenerate package, skill, MCP, and product metadata from source.

Verification

npm run test:focused -- <11 affected test files>: 40 tests passed, including skill transaction/backup/idempotence, SDK tools/list annotations, actual local capture/PNG comparisons, artifact extraction/containment/cancellation, DMG launcher/cleanup seam, setup confirmation, browser MCP and scenario MCP, CLI catalog parity.
npm run check: typecheck, lint, format, knip, package metadata.
npm run docs:check: generated catalogs, skill metadata, documentation facts, completion ledger, error schema.

No local real Hopper/Ghidra run: their adapters and analysis operations are unchanged. Native macOS DMG behavior is covered locally through the launcher seam; no local macOS/hdiutil claim is made.

Real browser verification passed using existing Headless Chrome143.0.7499.4: actual CLI/stdio MCP,9,331,407-byte PNG, passive capture/source maps, and owned/external scenario cleanup. An initial full Chrome143 run failed the existing screenshot-height assertion (1397 versus1536); the dedicated headless-shell run passed the complete verifier without code changes. The verifier run-lineage field remained unavailable; no lineage-coverage claim is made. Browser download into .codex was blocked by CDN403, so the successful run used an existing browser without changing host configuration.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/602 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/skill-permissions-and-tool-metadata` --- ### 📝 Commits (2) - [`2aa6c82`](https://github.com/morluto/rea/commit/2aa6c825cbbeaf0bfab1b7fd090d8dc9090ebd3c) fix(skill): remove obsolete grants and audit tool effects - [`8f0550b`](https://github.com/morluto/rea/commit/8f0550bc09bce5dec58a2b8f197c260c73cd8d54) Merge remote-tracking branch 'origin/main' into fix/skill-permissions-and-tool-metadata ### 📊 Changes **18 files changed** (+195 additions, -39 deletions) <details> <summary>View changed files</summary> 📝 `docs/mcp-contracts.md` (+14 -0) 📝 `docs/product-catalog.json` (+3 -3) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `skills/reverse-engineer-anything/SKILL.md` (+6 -2) 📝 `skills/reverse-engineer-anything/references/evidence-workflows.md` (+3 -2) 📝 `skills/reverse-engineer-anything/references/native-and-artifacts.md` (+8 -6) 📝 `skills/reverse-engineer-anything/references/runtime-observation.md` (+15 -11) 📝 `src/application/ArtifactExtraction.ts` (+1 -1) 📝 `src/application/BrowserObservationService.test.ts` (+36 -1) 📝 `src/artifacts/ArtifactProvider.ts` (+4 -1) 📝 `src/contracts/toolEffects.ts` (+15 -5) 📝 `src/generatedMcpToolCatalog.ts` (+1 -1) 📝 `src/generatedPackageMetadata.ts` (+1 -1) 📝 `src/server/registerBrowserScenarioTool.ts` (+1 -1) 📝 `src/server/registerBrowserTools.ts` (+1 -1) 📝 `tests/boundary/filesystem/setupSkill.test.ts` (+34 -1) 📝 `tests/boundary/mcp/toolRegistrationOptions.test.ts` (+22 -0) 📝 `tests/boundary/providers/native/artifactProvider.extraction.test.ts` (+28 -0) </details> ### 📄 Description ## Changes Related to #545 and the permission-system removal in #555. - Upgrade the shipped skill to v24 and remove obsolete filesystem grants, per-call approval flags, Electron file-root configuration, and DMG approval flags. Calls follow the user-requested investigation directly. Keep setup plan confirmation, actual OS requirements, and process/archive lifecycle boundaries. - Correct the passive browser guide: endpoint/scope come from requests; ordinary local URL queries are retained, while credentials remain redacted. - Audit canonical tool effects: declare possible DMG process/temp-directory effects, mark fresh extraction non-idempotent, and mark comparisons of supplied captures/PNGs as closed-world. Align artifact-provider capability effects with temporary mount-directory writes. - Retain non-read-only hints for calls that add Evidence to the session; document that annotations are hints and that clients control their confirmation UI. Do not mislabel session mutations as read-only to suppress prompts. - Regenerate package, skill, MCP, and product metadata from source. ## Verification - `npm run test:focused -- <11 affected test files>`: **40 tests passed**, including skill transaction/backup/idempotence, SDK tools/list annotations, actual local capture/PNG comparisons, artifact extraction/containment/cancellation, DMG launcher/cleanup seam, setup confirmation, browser MCP and scenario MCP, CLI catalog parity. - `npm run check`: typecheck, lint, format, knip, package metadata. - `npm run docs:check`: generated catalogs, skill metadata, documentation facts, completion ledger, error schema. No local real Hopper/Ghidra run: their adapters and analysis operations are unchanged. Native macOS DMG behavior is covered locally through the launcher seam; no local macOS/hdiutil claim is made. Real browser verification passed using existing Headless Chrome143.0.7499.4: actual CLI/stdio MCP,9,331,407-byte PNG, passive capture/source maps, and owned/external scenario cleanup. An initial full Chrome143 run failed the existing screenshot-height assertion (1397 versus1536); the dedicated headless-shell run passed the complete verifier without code changes. The verifier run-lineage field remained unavailable; no lineage-coverage claim is made. Browser download into `.codex` was blocked by CDN403, so the successful run used an existing browser without changing host configuration. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:14:18 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 00:59:04 +00:00

[PR #2103] [MERGED] test(clients): verify Qwen Code on native Windows #5030

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2103

No description provided.

Rows
Columns