morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1180] [MERGED] feat(mcp): select views of retained analysis results #2704

New issue

Closed

opened 2026-10-17 21:09:15 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:09:15 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1180
Author: @mvanhorn
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/inspect-analysis-view

📝 Commits (5)

6b6aeda feat(mcp): select views of retained analysis results
fb626e4 fix(mcp): stabilize inspect_analysis_view types and skill metadata
8de8d67 chore: integrate current main for analysis view review
ea0aa95 fix(analysis-view): preserve facts and reuse validated graphs
045b937 docs(analysis-view): explain exact source-map selectors

📊 Changes

39 files changed (+2610 additions, -31 deletions)

View changed files

📝 docs/binary-diagnostics.md (+7 -0)
📝 docs/javascript-application-workflows.md (+9 -6)
📝 docs/javascript-artifact-reconstruction.md (+7 -6)
📝 docs/mcp-contracts.md (+15 -2)
📝 docs/mcp-prompts.md (+3 -1)
📝 scripts/lib/catalog-builders.mjs (+5 -0)
📝 scripts/lib/catalog-core.mjs (+1 -0)
📝 skill-src/reverse-engineer-anything/SKILL.md (+8 -7)
📝 skill-src/reverse-engineer-anything/references/evidence-workflows.md (+4 -1)
📝 skill-src/reverse-engineer-anything/references/javascript-applications.md (+9 -5)
📝 skill-src/reverse-engineer-anything/references/native-and-artifacts.md (+9 -0)
📝 src/application/CapabilityInventory.test.ts (+4 -0)
📝 src/application/InvestigationProviders.ts (+7 -0)
➕ src/application/analysisView/AnalysisViewService.test.ts (+176 -0)
➕ src/application/analysisView/AnalysisViewService.ts (+132 -0)
📝 src/cli.ts (+2 -0)
➕ src/cli/analysisViewCommands.ts (+53 -0)
📝 src/cliCommandNames.ts (+1 -0)
➕ src/contracts/analysisViewToolContracts.ts (+63 -0)
📝 src/contracts/contractSnapshot.test.ts (+2 -0)

...and 19 more files

📄 Description

Summary

Agents can now project a summary, one section or module, or a stable page from already completed layout or JavaScript application Evidence after a large MCP result, without repeating analysis.

Fixes #1050

Demo

Complete result (~2 MB)	Summary view (~5 KB)	One module	Page from retained result

The sample is a generated local app, not third-party code.

Problem and expected behavior

A completed inspect_binary_layout or analyze_javascript_application result can exceed the MCP stdio receive buffer once Evidence wrapping and repeated encodings are applied. Callers still need a compact overview, a single section or module, or a bounded page of identity rows from that retained record.

inspect_analysis_view (CLI inspect-analysis-view) reads inline Evidence or an exact same-session evidence_id and returns only the selected projection. It does not start Hopper, Ghidra, IDA, or JavaScript reconstruction. Page limit is a caller-selected positive integer. Actual serialized size determines transport admission; oversized views retain complete derived Evidence and return its reference for recovery.

Change and scope

New application workflow behind shared CLI and MCP adapters:

Domain projectors for binary layout (summary, facet mitigations|linkage, item sections|symbols, page) and JavaScript applications (summary, item modules, page).
Source is a discriminated union: { kind: "retained-evidence", evidence_id } or { kind: "inline", evidence }.
Output is evidenceResultOf the view. view_digest is SHA-256 of the canonical projected JSON and changes when the projection changes; it is not the parent digest.
Derived Evidence uses ANALYSIS_VIEW_PROVIDER, predicate rea.analysis-view, parent authority, and evidence_links to the parent.
Authored skill text in skill-src/ (skill version 34). Catalog regenerated; build outputs not committed.

Out of scope: other parent operations, rewriting executable bytes, saving or closing an attached GUI database, and paging arbitrary JSON with --filter-output.

Contract and boundary impact

Semantic owner and earliest changed stage: domain src/domain/analysisView/, then application AnalysisViewService, CLI/MCP adapters.
CLI and MCP/tool-catalog contract: new inspect_analysis_view / inspect-analysis-view on TOOL_CONTRACTS; kind application; effects session Evidence write only (inspect_analysis_view: evidence).
Provider, bridge, target-format, or platform compatibility: none. Views do not launch a deep provider.
Evidence, artifact, provenance, or reconstruction contract: derived view Evidence; parent identity and limitations preserved; JavaScript summaries include application/semantic coverage and unknown counts without embedding full graphs. Module items preserve recorded property values and source locations; pages include only JavaScript assets, bundled modules and source modules.
Process execution, authorization, cleanup, or containment impact: none beyond recording the derived Evidence record.
Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in skill-src/ and never commit build outputs): ANALYSIS_VIEW_PROVIDER added to catalog-core/builders; authored skill version 34; src/generatedPackageMetadata.ts skillVersion 34.

Evidence and regression coverage

Tests added or updated: domain projectors; application retained/inline/stale-id paths; MCP schema advertisement and retained layout/JS views; CLI JSON file and malformed-input paths; catalog, capability inventory, JSON-input status, and prompt contract follow-ups.
Base reproduction or other evidence: on 70e5c247 the tool is absent from TOOL_CONTRACTS and the CLI.
User-visible CLI/MCP output (if applicable): generated local sample . Complete analysis 1,983,271 bytes; CLI summary 4,966 bytes; one module 7,448 bytes; page 5,165 bytes. MCP retained summary/item/page 6,932 / 9,967 / 7,267 bytes. Coverage for the page view: examined=8, total=22, next_offset=8, exhausted=false.
Remaining proof gaps: real Hopper/Ghidra layout Evidence was not exercised on this host.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm ci — pass (374 packages, 0 vulnerabilities)
npm run test:focused -- src/domain/analysisView/analysisView.test.ts src/application/analysisView/AnalysisViewService.test.ts tests/boundary/mcp/analysisViewMcp.test.ts tests/boundary/cli/analysisViewCli.test.ts tests/boundary/cli/productCatalog.test.ts tests/boundary/mcp/binaryDiagnosticsMcp.test.ts tests/boundary/mcp/retainedApplicationEvidenceMcp.test.ts src/contracts/toolContracts.test.ts src/application/CapabilityInventory.test.ts src/contracts/promptContracts.test.ts tests/boundary/cli/jsonInputStatus.test.ts src/contracts/contractSnapshot.test.ts — pass (12 files, 95 tests)
npm run check:fast — pass
npm run check — pass (typecheck, lint, format, knip, metadata:check; 6/6 turbo tasks)
npm run docs:check — pass
npm run verify:test-discovery — pass (“Discovered all 654 test files exactly once.”)

Compatibility, safety, and release

Breaking changes or migration steps: none. Additive tool and CLI command.
Real Hopper/Ghidra, browser, or OS coverage: not run. Layout views are covered with fixture layout Evidence; JavaScript views ran against a generated local sample.
Package or release metadata impact: skill version 34; catalog family totals include ANALYSIS_VIEW_TOOL_CONTRACTS.
Security, privacy, process, or containment review: views read caller-supplied or same-session Evidence only. Transport credentials are not introduced. Page limit is a measured stdio-budget bound.

Review checklist

This PR addresses a concrete problem or an agreed enhancement.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

Maintainer follow-up verification

Current main integrated; follow-up ea0aa95a fixes retained-graph reparsing, module selection, captured-value preservation, semantic coverage, subject identity handling and the duplicate-code gate. The original demo remains above.

33 focused source/schema/CLI/MCP tests pass across six files, including oversized escaped observations, retained recovery and subsequent calls.
npm run check:ci -- --concurrency=1 and pre-push npm run check:fast pass.
Native Windows complete Notion 7.6.1: one analysis, followed by summary, module and stable/disjoint pages through the pinned SDK with its default receive buffer. Text and structured views match. Evidence identity and retained trace digest match the previously verified complete analysis.
Summary: 53.6 ms / 40,562 bytes; module: 31.5 ms / 40,302 bytes; pages: 24.3–28.7 ms / 35,052–35,408 bytes. Process-family peak 1.25 GiB; all owned processes close successfully.
This local lane uses a compiled source snapshot and reused isolated pinned dependencies. CI covers the genuine package and platform gates. The final guidance-only follow-up 045b9370 also passes all seven pinned-SDK schema tests and pre-push checks. CI run 37883418585 passes all 22 checks on the final exact head.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1180 **Author:** [@mvanhorn](https://github.com/mvanhorn) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/inspect-analysis-view` --- ### 📝 Commits (5) - [`6b6aeda`](https://github.com/morluto/rea/commit/6b6aeda4f9c8395be78e715ff8509a20ead5bdce) feat(mcp): select views of retained analysis results - [`fb626e4`](https://github.com/morluto/rea/commit/fb626e4c3fd0d9ce4db00328dc0d1373ce6dd1c5) fix(mcp): stabilize inspect_analysis_view types and skill metadata - [`8de8d67`](https://github.com/morluto/rea/commit/8de8d6749545d68bf8912315173d25fecbf2e31a) chore: integrate current main for analysis view review - [`ea0aa95`](https://github.com/morluto/rea/commit/ea0aa95a0c006205d0725023e2e1bd085683d7e5) fix(analysis-view): preserve facts and reuse validated graphs - [`045b937`](https://github.com/morluto/rea/commit/045b9370083aa13f01c60699402a3a7ca33e57c1) docs(analysis-view): explain exact source-map selectors ### 📊 Changes **39 files changed** (+2610 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `docs/binary-diagnostics.md` (+7 -0) 📝 `docs/javascript-application-workflows.md` (+9 -6) 📝 `docs/javascript-artifact-reconstruction.md` (+7 -6) 📝 `docs/mcp-contracts.md` (+15 -2) 📝 `docs/mcp-prompts.md` (+3 -1) 📝 `scripts/lib/catalog-builders.mjs` (+5 -0) 📝 `scripts/lib/catalog-core.mjs` (+1 -0) 📝 `skill-src/reverse-engineer-anything/SKILL.md` (+8 -7) 📝 `skill-src/reverse-engineer-anything/references/evidence-workflows.md` (+4 -1) 📝 `skill-src/reverse-engineer-anything/references/javascript-applications.md` (+9 -5) 📝 `skill-src/reverse-engineer-anything/references/native-and-artifacts.md` (+9 -0) 📝 `src/application/CapabilityInventory.test.ts` (+4 -0) 📝 `src/application/InvestigationProviders.ts` (+7 -0) ➕ `src/application/analysisView/AnalysisViewService.test.ts` (+176 -0) ➕ `src/application/analysisView/AnalysisViewService.ts` (+132 -0) 📝 `src/cli.ts` (+2 -0) ➕ `src/cli/analysisViewCommands.ts` (+53 -0) 📝 `src/cliCommandNames.ts` (+1 -0) ➕ `src/contracts/analysisViewToolContracts.ts` (+63 -0) 📝 `src/contracts/contractSnapshot.test.ts` (+2 -0) _...and 19 more files_ </details> ### 📄 Description ## Summary Agents can now project a summary, one section or module, or a stable page from already completed layout or JavaScript application Evidence after a large MCP result, without repeating analysis. Fixes #1050 ## Demo ![Analysis view demo](https://raw.githubusercontent.com/mvanhorn/pr-demo-assets/main/rea/analysis-view/demo.gif) <video src="https://raw.githubusercontent.com/mvanhorn/pr-demo-assets/main/rea/analysis-view/demo.mp4" controls width="720"></video> | Complete result (~2 MB) | Summary view (~5 KB) | One module | Page from retained result | |---|---|---|---| | ![full](https://raw.githubusercontent.com/mvanhorn/pr-demo-assets/main/rea/analysis-view/inspect-analysis-view-01-large-result.png) | ![summary](https://raw.githubusercontent.com/mvanhorn/pr-demo-assets/main/rea/analysis-view/inspect-analysis-view-02-summary.png) | ![module](https://raw.githubusercontent.com/mvanhorn/pr-demo-assets/main/rea/analysis-view/inspect-analysis-view-03-one-module.png) | ![page](https://raw.githubusercontent.com/mvanhorn/pr-demo-assets/main/rea/analysis-view/inspect-analysis-view-04-page.png) | The sample is a generated local app, not third-party code. ## Problem and expected behavior A completed `inspect_binary_layout` or `analyze_javascript_application` result can exceed the MCP stdio receive buffer once Evidence wrapping and repeated encodings are applied. Callers still need a compact overview, a single section or module, or a bounded page of identity rows from that retained record. `inspect_analysis_view` (CLI `inspect-analysis-view`) reads inline Evidence or an exact same-session `evidence_id` and returns only the selected projection. It does not start Hopper, Ghidra, IDA, or JavaScript reconstruction. Page `limit` is a caller-selected positive integer. Actual serialized size determines transport admission; oversized views retain complete derived Evidence and return its reference for recovery. ## Change and scope New application workflow behind shared CLI and MCP adapters: - Domain projectors for binary layout (`summary`, `facet` mitigations|linkage, `item` sections|symbols, `page`) and JavaScript applications (`summary`, `item` modules, `page`). - Source is a discriminated union: `{ kind: "retained-evidence", evidence_id }` or `{ kind: "inline", evidence }`. - Output is `evidenceResultOf` the view. `view_digest` is SHA-256 of the canonical projected JSON and changes when the projection changes; it is not the parent digest. - Derived Evidence uses `ANALYSIS_VIEW_PROVIDER`, predicate `rea.analysis-view`, parent authority, and `evidence_links` to the parent. - Authored skill text in `skill-src/` (skill version 34). Catalog regenerated; build outputs not committed. Out of scope: other parent operations, rewriting executable bytes, saving or closing an attached GUI database, and paging arbitrary JSON with `--filter-output`. ## Contract and boundary impact - Semantic owner and earliest changed stage: domain `src/domain/analysisView/`, then application `AnalysisViewService`, CLI/MCP adapters. - CLI and MCP/tool-catalog contract: new `inspect_analysis_view` / `inspect-analysis-view` on `TOOL_CONTRACTS`; kind `application`; effects session Evidence write only (`inspect_analysis_view: evidence`). - Provider, bridge, target-format, or platform compatibility: none. Views do not launch a deep provider. - Evidence, artifact, provenance, or reconstruction contract: derived view Evidence; parent identity and limitations preserved; JavaScript summaries include application/semantic coverage and unknown counts without embedding full graphs. Module items preserve recorded property values and source locations; pages include only JavaScript assets, bundled modules and source modules. - Process execution, authorization, cleanup, or containment impact: none beyond recording the derived Evidence record. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `skill-src/` and never commit build outputs): `ANALYSIS_VIEW_PROVIDER` added to catalog-core/builders; authored skill version 34; `src/generatedPackageMetadata.ts` skillVersion 34. ## Evidence and regression coverage - Tests added or updated: domain projectors; application retained/inline/stale-id paths; MCP schema advertisement and retained layout/JS views; CLI JSON file and malformed-input paths; catalog, capability inventory, JSON-input status, and prompt contract follow-ups. - Base reproduction or other evidence: on `70e5c247` the tool is absent from `TOOL_CONTRACTS` and the CLI. - User-visible CLI/MCP output (if applicable): generated local sample . Complete analysis 1,983,271 bytes; CLI summary 4,966 bytes; one module 7,448 bytes; page 5,165 bytes. MCP retained summary/item/page 6,932 / 9,967 / 7,267 bytes. Coverage for the page view: `examined=8`, `total=22`, `next_offset=8`, `exhausted=false`. - Remaining proof gaps: real Hopper/Ghidra layout Evidence was not exercised on this host. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm ci` — pass (374 packages, 0 vulnerabilities) - `npm run test:focused -- src/domain/analysisView/analysisView.test.ts src/application/analysisView/AnalysisViewService.test.ts tests/boundary/mcp/analysisViewMcp.test.ts tests/boundary/cli/analysisViewCli.test.ts tests/boundary/cli/productCatalog.test.ts tests/boundary/mcp/binaryDiagnosticsMcp.test.ts tests/boundary/mcp/retainedApplicationEvidenceMcp.test.ts src/contracts/toolContracts.test.ts src/application/CapabilityInventory.test.ts src/contracts/promptContracts.test.ts tests/boundary/cli/jsonInputStatus.test.ts src/contracts/contractSnapshot.test.ts` — pass (12 files, 95 tests) - `npm run check:fast` — pass - `npm run check` — pass (typecheck, lint, format, knip, metadata:check; 6/6 turbo tasks) - `npm run docs:check` — pass - `npm run verify:test-discovery` — pass (“Discovered all 654 test files exactly once.”) ## Compatibility, safety, and release - Breaking changes or migration steps: none. Additive tool and CLI command. - Real Hopper/Ghidra, browser, or OS coverage: not run. Layout views are covered with fixture layout Evidence; JavaScript views ran against a generated local sample. - Package or release metadata impact: skill version 34; catalog family totals include `ANALYSIS_VIEW_TOOL_CONTRACTS`. - Security, privacy, process, or containment review: views read caller-supplied or same-session Evidence only. Transport credentials are not introduced. Page limit is a measured stdio-budget bound. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. ## Maintainer follow-up verification Current main integrated; follow-up `ea0aa95a` fixes retained-graph reparsing, module selection, captured-value preservation, semantic coverage, subject identity handling and the duplicate-code gate. The original demo remains above. - 33 focused source/schema/CLI/MCP tests pass across six files, including oversized escaped observations, retained recovery and subsequent calls. - `npm run check:ci -- --concurrency=1` and pre-push `npm run check:fast` pass. - Native Windows complete Notion 7.6.1: one analysis, followed by summary, module and stable/disjoint pages through the pinned SDK with its default receive buffer. Text and structured views match. Evidence identity and retained trace digest match the previously verified complete analysis. - Summary: 53.6 ms / 40,562 bytes; module: 31.5 ms / 40,302 bytes; pages: 24.3–28.7 ms / 35,052–35,408 bytes. Process-family peak 1.25 GiB; all owned processes close successfully. - This local lane uses a compiled source snapshot and reused isolated pinned dependencies. CI covers the genuine package and platform gates. The final guidance-only follow-up `045b9370` also passes all seven pinned-SDK schema tests and pre-push checks. [CI run 37883418585](https://github.com/morluto/rea/actions/runs/37883418585) passes all 22 checks on the final exact head. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:09:15 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:05:46 +00:00

[PR #2704] [MERGED] fix(dotnet): name the truncated instruction when an operand leaves the method body #5328

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2704

No description provided.

Rows
Columns