morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #946] [MERGED] fix(contracts): align CLI/MCP boundary contracts #2523

New issue

Closed

opened 2026-10-17 21:07:08 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:07:08 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/946
Author: @morluto
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: codex/luna-schema-boundaries

📝 Commits (10+)

edf4e42 fix(cli): validate native scenario and preserve JSON paths
8708260 fix(process): reject invalid UTF-8 JSON inputs
c2c8977 fix(cli): retain missing JSON path diagnostics
10315a4 test(cli): cover relative brace and bracket JSON paths
034312c test(cli): reject missing native scenario steps
d14a01f Merge remote-tracking branch 'origin/main' into codex/luna-schema-boundaries
25ce10f fix(mcp): advertise reserved process environment key
29f8c3f fix(process): reject NUL in process scenario values
887fee1 fix(process): advertise NUL input constraints to MCP
b9ca5f6 fix(cli): report scenario input schema issues

📊 Changes

26 files changed (+897 additions, -58 deletions)

View changed files

📝 docs/product-catalog.json (+2 -2)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 src/application/ProcessCli.ts (+5 -1)
📝 src/cli/electronCommands.ts (+19 -3)
📝 src/cli/utilityCommands.ts (+52 -23)
📝 src/cliBrowserScenarioCommands.ts (+8 -1)
📝 src/cliJsonInput.ts (+15 -2)
📝 src/domain/inputIssueProjection.test.ts (+37 -0)
📝 src/domain/inputIssueProjection.ts (+17 -1)
📝 src/domain/managed/managedNativeVerificationSchemas.ts (+4 -1)
📝 src/domain/native/nativeUiObservation.ts (+20 -4)
📝 src/domain/processCapture.ts (+6 -4)
📝 src/domain/processScenario.test.ts (+18 -0)
📝 src/domain/processScenario.ts (+13 -5)
📝 src/generatedMcpToolCatalog.ts (+1 -1)
📝 tests/boundary/cli/jsonInputStatus.test.ts (+128 -1)
➕ tests/boundary/cli/nativeUiScenarioInputCli.test.ts (+74 -0)
📝 tests/boundary/cli/processCli.test.ts (+75 -0)
➕ tests/boundary/cli/scenarioCliInputDiagnostics.test.ts (+64 -0)

...and 6 more files

📄 Description

Summary

Align CLI and MCP boundary behavior with canonical Zod contracts, and make semantic output constraints visible to SDK clients. The changes combine confirmed input bugs with documentation of output invariants that JSON Schema cannot enforce.

Input behavior

Process scenarios reject NUL in strings passed to OS process, path, and environment APIs, while preserving NUL in captured stdin event data. A baseline CLI reproduction showed that a NUL argument launched Node's interactive REPL, timed out, and still produced successful capture Evidence; validation now rejects it before dispatch.
The process-owned REA_PROCESS_RUN_ID environment key is rejected by both SDK-advertised input JSON Schema and Zod. The exact-key behavior preserves acceptance of a key with a trailing newline, matching existing server semantics.
CLI scenario and JSON-file paths retain actionable validation paths, malformed UTF-8, missing-file, and read-failure distinctions rather than collapsing them into generic errors.
A native UI scenario validation error now identifies the canonical operation capture_native_ui_scenario rather than the hyphenated CLI command. An actual CLI regression supplies an unusable target and malformed/missing steps, proving validation returns before provider dispatch.
Malformed inline JSON beginning with { or [ is still reported as invalid input when attempting to interpret it as an overlong filename fails with ENAMETOOLONG. Explicit .json paths preserve their read-failed diagnostic and selected path. Compiled CLI regressions cover both cases.

Output contract guidance

Canonical output schemas now describe native screenshot byte/hash/dimension checks, process-capture commitments and journal/lifecycle invariants, and managed-native summary count relationships. These descriptions guide SDK clients; the corresponding semantic validation remains enforced by Zod and the application producers, because standard JSON Schema cannot express those content and cross-field checks.

Generated catalog and verification metadata are regenerated from the canonical contracts. SDK/Ajv and Zod parity tests exercise actual JADX fixture outputs, process captures, and managed artifact/workflow producer results, alongside malformed semantic edge cases. The managed MCP producer test reuses one SDK catalog listing and Ajv instance for its five output assertions; this keeps the real-producer checks while reducing local test time from 6.56s to 1.51s.

Verification

After merging current main (ef1a0cc6):

Focused CLI and MCP suites: 4 files, 64 tests passed
npm run check:fast
npm run format:check
npm run docs:check
git diff --check

The docs check reports the managed conformance manifest as complete:false.

No live native UI, Hopper, or Ghidra provider verification was performed. The Android checks use the real REA JADX adapter with its protocol fixture; managed checks use REA's managed analysis on generated PE fixtures.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/946 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/luna-schema-boundaries` --- ### 📝 Commits (10+) - [`edf4e42`](https://github.com/morluto/rea/commit/edf4e425eee440c89bdc5e1db672d036662d5d02) fix(cli): validate native scenario and preserve JSON paths - [`8708260`](https://github.com/morluto/rea/commit/8708260ddffea13d3db06641cbf1cbf91cba24f6) fix(process): reject invalid UTF-8 JSON inputs - [`c2c8977`](https://github.com/morluto/rea/commit/c2c8977062cdddc03eb44aeb6d76097cbe995e95) fix(cli): retain missing JSON path diagnostics - [`10315a4`](https://github.com/morluto/rea/commit/10315a4de03451d234349c286f85d5b81330c97e) test(cli): cover relative brace and bracket JSON paths - [`034312c`](https://github.com/morluto/rea/commit/034312c294f8e314ab4d91848f683758c1ad8a67) test(cli): reject missing native scenario steps - [`d14a01f`](https://github.com/morluto/rea/commit/d14a01fe414c27e4189aaa66f775485be596d75d) Merge remote-tracking branch 'origin/main' into codex/luna-schema-boundaries - [`25ce10f`](https://github.com/morluto/rea/commit/25ce10f5ab88e4ce6c221971976f4aafd591ff0a) fix(mcp): advertise reserved process environment key - [`29f8c3f`](https://github.com/morluto/rea/commit/29f8c3f584448f2c3a8a3e79673d41a15491df31) fix(process): reject NUL in process scenario values - [`887fee1`](https://github.com/morluto/rea/commit/887fee160f07eb1c42dfbcbb3e7d42abe05b758d) fix(process): advertise NUL input constraints to MCP - [`b9ca5f6`](https://github.com/morluto/rea/commit/b9ca5f6d7eb8919a7a5662cbabf06666b7a238d0) fix(cli): report scenario input schema issues ### 📊 Changes **26 files changed** (+897 additions, -58 deletions) <details> <summary>View changed files</summary> 📝 `docs/product-catalog.json` (+2 -2) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `src/application/ProcessCli.ts` (+5 -1) 📝 `src/cli/electronCommands.ts` (+19 -3) 📝 `src/cli/utilityCommands.ts` (+52 -23) 📝 `src/cliBrowserScenarioCommands.ts` (+8 -1) 📝 `src/cliJsonInput.ts` (+15 -2) 📝 `src/domain/inputIssueProjection.test.ts` (+37 -0) 📝 `src/domain/inputIssueProjection.ts` (+17 -1) 📝 `src/domain/managed/managedNativeVerificationSchemas.ts` (+4 -1) 📝 `src/domain/native/nativeUiObservation.ts` (+20 -4) 📝 `src/domain/processCapture.ts` (+6 -4) 📝 `src/domain/processScenario.test.ts` (+18 -0) 📝 `src/domain/processScenario.ts` (+13 -5) 📝 `src/generatedMcpToolCatalog.ts` (+1 -1) 📝 `tests/boundary/cli/jsonInputStatus.test.ts` (+128 -1) ➕ `tests/boundary/cli/nativeUiScenarioInputCli.test.ts` (+74 -0) 📝 `tests/boundary/cli/processCli.test.ts` (+75 -0) ➕ `tests/boundary/cli/scenarioCliInputDiagnostics.test.ts` (+64 -0) _...and 6 more files_ </details> ### 📄 Description ## Summary Align CLI and MCP boundary behavior with canonical Zod contracts, and make semantic output constraints visible to SDK clients. The changes combine confirmed input bugs with documentation of output invariants that JSON Schema cannot enforce. ### Input behavior - Process scenarios reject NUL in strings passed to OS process, path, and environment APIs, while preserving NUL in captured stdin event data. A baseline CLI reproduction showed that a NUL argument launched Node's interactive REPL, timed out, and still produced successful capture Evidence; validation now rejects it before dispatch. - The process-owned `REA_PROCESS_RUN_ID` environment key is rejected by both SDK-advertised input JSON Schema and Zod. The exact-key behavior preserves acceptance of a key with a trailing newline, matching existing server semantics. - CLI scenario and JSON-file paths retain actionable validation paths, malformed UTF-8, missing-file, and read-failure distinctions rather than collapsing them into generic errors. - A native UI scenario validation error now identifies the canonical operation `capture_native_ui_scenario` rather than the hyphenated CLI command. An actual CLI regression supplies an unusable target and malformed/missing steps, proving validation returns before provider dispatch. - Malformed inline JSON beginning with `{` or `[` is still reported as invalid input when attempting to interpret it as an overlong filename fails with `ENAMETOOLONG`. Explicit `.json` paths preserve their `read-failed` diagnostic and selected path. Compiled CLI regressions cover both cases. ### Output contract guidance Canonical output schemas now describe native screenshot byte/hash/dimension checks, process-capture commitments and journal/lifecycle invariants, and managed-native summary count relationships. These descriptions guide SDK clients; the corresponding semantic validation remains enforced by Zod and the application producers, because standard JSON Schema cannot express those content and cross-field checks. Generated catalog and verification metadata are regenerated from the canonical contracts. SDK/Ajv and Zod parity tests exercise actual JADX fixture outputs, process captures, and managed artifact/workflow producer results, alongside malformed semantic edge cases. The managed MCP producer test reuses one SDK catalog listing and Ajv instance for its five output assertions; this keeps the real-producer checks while reducing local test time from 6.56s to 1.51s. ## Verification After merging current `main` (`ef1a0cc6`): - Focused CLI and MCP suites: 4 files, 64 tests passed - `npm run check:fast` - `npm run format:check` - `npm run docs:check` - `git diff --check` The docs check reports the managed conformance manifest as `complete:false`. No live native UI, Hopper, or Ghidra provider verification was performed. The Android checks use the real REA JADX adapter with its protocol fixture; managed checks use REA's managed analysis on generated PE fixtures. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:07:08 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:07:00 +00:00

[PR #2900] [CLOSED] fix(javascript): recognize comments in GraphQL operation headers #5483

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2523

No description provided.

Rows
Columns