[PR #1004] [MERGED] fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs #2571

New issue

Closed

opened 2026-10-17 21:07:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:07:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1004
Author: @morluto
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: fix/absolute-target-paths

📝 Commits (2)

500687b fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs
cdb4aec fix(cli): resolve operator-relative paths before shared absolute-path validation

📊 Changes

19 files changed (+350 additions, -27 deletions)

View changed files

📝 docs/product-catalog.json (+2 -2)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 src/browser/PlaywrightScenarioActions.test.ts (+1 -1)
📝 src/cli/electronCommands.ts (+6 -2)
📝 src/cli/firmwareCommands.ts (+5 -3)
📝 src/cliBrowserScenarioCommands.ts (+4 -2)
📝 src/cliJsonInput.ts (+35 -0)
📝 src/contracts/sessionLifecycleInputs.ts (+13 -1)
📝 src/contracts/sessionPathInputs.test.ts (+153 -0)
📝 src/contracts/sessionStatusContract.ts (+13 -1)
📝 src/contracts/sessionToolSchemas.ts (+12 -1)
📝 src/contracts/toolContractExamples.ts (+1 -1)
📝 src/domain/browserScenario.test.ts (+1 -1)
📝 src/domain/browserScenarioValues.ts (+12 -2)
📝 src/domain/firmware/firmwareAnalysis.ts (+11 -1)
📝 src/domain/javascript/electronActiveObservation.ts (+17 -4)
📝 tests/acceptance/nonBinaryComposition.test.ts (+18 -0)
📝 tests/boundary/filesystem/cliJsonInput.test.ts (+43 -2)

📄 Description

Summary

Follow-up to #948 (and #946's input-validation line): the same invisible server-cwd resolution applied to six more caller-supplied path fields. Each now fails fast with a named constraint instead of resolving against the MCP server working directory.

Changes

open_binary.path — was resolved via parseBinaryTarget(path, process.cwd())
import_evidence_bundle.path — was passed raw to bundle read (canonical example also fixed: evidence.json -> /tmp/evidence.json)
Firmware target.path (inspect + extract) — was passed raw to resolve(); output_directory was already provider-enforced
Browser launch executable_path — was passed raw to resolve() then spawned; bare names like chrome now fail with a clear message instead of a confusing launch failure
Electron executable_path/application_path/application_root — were passed raw to realpath() before spawn
Session expected_server_path — was passed raw to resolve() for identity comparison, producing false mismatches
Each field gains the shared isAbsoluteLocalPath refinement plus a catalog-visible description; 17 new schema cases; scenario fixtures updated to absolute paths

Explicitly unchanged (audited, rooted or out of scope): inspect_plist paths (resolved against the target bundle dir), filesystem observation paths (resolved against the caller-supplied working_directory), keyed-archive member paths (archive-relative), JS evidence member paths (evidence-relative under root_alias), provider-internal execution schemas, CLI-only doctor flows, CLI options (own resolve() against the operator cwd).

Verification

build:cached, check:fast, docs:check, format:check, git diff --check, jscpd (2.27% < 2.5%)
Focused suites: sessionPathInputs (33), sessionMcp, toolSchemaValidity, managedMcp, productCatalog, contractPresentation, electronMcp, browserScenarioMcp, scenarioCliInputDiagnostics, browserScenario, firmwareIntegration, CapabilityInventory — all green (win32-only cases skip on Linux, as in #948)
No live Hopper/Ghidra/browser provider verification (no provider code changed)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1004 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/absolute-target-paths` --- ### 📝 Commits (2) - [`500687b`](https://github.com/morluto/rea/commit/500687b1e327c203a8f66ae14baf58c56a704929) fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs - [`cdb4aec`](https://github.com/morluto/rea/commit/cdb4aeca7677f52ceeb07631755af959c166414f) fix(cli): resolve operator-relative paths before shared absolute-path validation ### 📊 Changes **19 files changed** (+350 additions, -27 deletions) <details> <summary>View changed files</summary> 📝 `docs/product-catalog.json` (+2 -2) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `src/browser/PlaywrightScenarioActions.test.ts` (+1 -1) 📝 `src/cli/electronCommands.ts` (+6 -2) 📝 `src/cli/firmwareCommands.ts` (+5 -3) 📝 `src/cliBrowserScenarioCommands.ts` (+4 -2) 📝 `src/cliJsonInput.ts` (+35 -0) 📝 `src/contracts/sessionLifecycleInputs.ts` (+13 -1) 📝 `src/contracts/sessionPathInputs.test.ts` (+153 -0) 📝 `src/contracts/sessionStatusContract.ts` (+13 -1) 📝 `src/contracts/sessionToolSchemas.ts` (+12 -1) 📝 `src/contracts/toolContractExamples.ts` (+1 -1) 📝 `src/domain/browserScenario.test.ts` (+1 -1) 📝 `src/domain/browserScenarioValues.ts` (+12 -2) 📝 `src/domain/firmware/firmwareAnalysis.ts` (+11 -1) 📝 `src/domain/javascript/electronActiveObservation.ts` (+17 -4) 📝 `tests/acceptance/nonBinaryComposition.test.ts` (+18 -0) 📝 `tests/boundary/filesystem/cliJsonInput.test.ts` (+43 -2) </details> ### 📄 Description ## Summary Follow-up to #948 (and #946's input-validation line): the same invisible server-cwd resolution applied to six more caller-supplied path fields. Each now fails fast with a named constraint instead of resolving against the MCP server working directory. ## Changes - `open_binary.path` — was resolved via `parseBinaryTarget(path, process.cwd())` - `import_evidence_bundle.path` — was passed raw to bundle read (canonical example also fixed: `evidence.json` -> `/tmp/evidence.json`) - Firmware `target.path` (inspect + extract) — was passed raw to `resolve()`; `output_directory` was already provider-enforced - Browser launch `executable_path` — was passed raw to `resolve()` then spawned; bare names like `chrome` now fail with a clear message instead of a confusing launch failure - Electron `executable_path`/`application_path`/`application_root` — were passed raw to `realpath()` before spawn - Session `expected_server_path` — was passed raw to `resolve()` for identity comparison, producing false mismatches - Each field gains the shared `isAbsoluteLocalPath` refinement plus a catalog-visible description; 17 new schema cases; scenario fixtures updated to absolute paths Explicitly unchanged (audited, rooted or out of scope): `inspect_plist` paths (resolved against the target bundle dir), filesystem observation paths (resolved against the caller-supplied `working_directory`), keyed-archive member paths (archive-relative), JS evidence member paths (evidence-relative under `root_alias`), provider-internal execution schemas, CLI-only doctor flows, CLI options (own `resolve()` against the operator cwd). ## Verification - `build:cached`, `check:fast`, `docs:check`, `format:check`, `git diff --check`, `jscpd` (2.27% < 2.5%) - Focused suites: sessionPathInputs (33), sessionMcp, toolSchemaValidity, managedMcp, productCatalog, contractPresentation, electronMcp, browserScenarioMcp, scenarioCliInputDiagnostics, browserScenario, firmwareIntegration, CapabilityInventory — all green (win32-only cases skip on Linux, as in #948) - No live Hopper/Ghidra/browser provider verification (no provider code changed) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:07:44 +00:00