morluto/rea

Fork

You've already forked rea

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

Code Issues 1.3k Projects Packages Wiki Activity

[PR #1593] [CLOSED] fix(plist): report binary plist proto keys that results omit #2993

New issue

Closed

opened 2026-10-17 21:12:39 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:12:39 +00:00

Owner

Copy link

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1593
Author: @Adolanium
Created: 10/10/2026
Status: ❌ Closed

Base: main ← Head: fix/binary-plist-prototype-keys

📝 Commits (1)

8339a5c fix(plist): report binary plist proto keys that results omit

📊 Changes

5 files changed (+220 additions, -26 deletions)

View changed files

📝 src/artifacts/apple/InterfaceBuilderAnalysis.ts (+12 -6)
📝 src/artifacts/apple/InterfaceBuilderDecodeBudget.ts (+71 -8)
📝 src/artifacts/apple/KeyedArchiveReader.test.ts (+81 -0)
📝 src/artifacts/apple/KeyedArchiveReader.ts (+16 -12)
📝 tests/boundary/filesystem/interfaceBuilderBundle.test.ts (+40 -0)

📄 Description

Summary

Fixes #1594

Binary property lists can store a dictionary key __proto__. REA omits that key from results. XML plists already report how many such entries were omitted. Binary plists reported a count of zero, so the omission was silent.

Problem and expected behavior

plist.parseBinary assigns each dictionary entry with dict[key] = value. The key __proto__ changes that object's prototype, and Object.entries then drops the entry. projectPlistValue never sees it. Keyed archive decoding and Interface Builder decoding passed omittedPrototypeKeys: 0 after parseBinary.

XML decoding already counts the same key and adds this limitation:

1 dictionary entry keyed __proto__ was omitted because REA results cannot represent that key.

A binary archive with that key should add the same limitation. An ordinary binary archive should stay free of it.

Change and scope

The binary plist walk already visits every dictionary before parseBinary. It now counts key references whose object is the ASCII or UTF-16BE string __proto__, including an extended size field. A key object shared by two dictionaries counts twice. A value equal to that string does not count. Keyed archive decoding and Interface Builder plist decoding pass the count into the existing limitation. XML decoding is unchanged. NIBArchive documents still report no plist prototype-key omission.

Contract and boundary impact

Semantic owner and earliest changed stage: keyed archive and Interface Builder plist projection, at result projection.
CLI and MCP/tool-catalog contract: inspect_keyed_archive and Interface Builder analysis can include the existing omission limitation for a binary plist. No new fields or parameters.
Provider, bridge, target-format, or platform compatibility: binary plist on every supported platform. XML plist results stay the same.
Evidence, artifact, provenance, or reconstruction contract: the __proto__ entry stays omitted, and the limitation states the count. Archive bytes and hashes stay the source bytes.
Process execution, authorization, cleanup, or containment impact: none.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated: KeyedArchiveReader.test.ts covers one ASCII __proto__ key, two dictionaries that share that key, a UTF-16BE key with an extended size, and an ordinary binary archive. interfaceBuilderBundle.test.ts covers a binary .nib whose limitation marks archive decoding partial.
Base reproduction or other evidence: on revision 02ef2b1c, those binary fixtures decode with omittedPrototypeKeys: 0 and no prototype-key limitation. The tests assert the limitation text, so they fail on that revision.
User-visible CLI/MCP output (if applicable): 1 dictionary entry keyed __proto__ was omitted because REA results cannot represent that key. Interface Builder prefixes that sentence with the archive path.
Remaining proof gaps: the fixtures are synthetic bplist00 bytes. This run did not round-trip them through macOS plutil or ibtool.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:focused -- src/artifacts/apple/KeyedArchiveReader.test.ts — 10 passed.
npm run test:focused -- tests/boundary/filesystem/interfaceBuilderBundle.test.ts — 17 passed, 24 skipped.
npx tsc --noEmit --pretty false — exit 0.
npx oxlint on the five changed files — 0 errors. Pre-existing complexity and length warnings remain on untouched functions.
git push pre-push npm run check:fast — typecheck and lint, 2 successful.

Compatibility, safety, and release

Breaking changes or migration steps: none. A binary plist that omitted a __proto__ entry now reports the same limitation XML plists already report. Interface Builder coverage for that archive becomes partial with reason dictionary_entries_omitted.
Real Hopper/Ghidra, browser, or OS coverage: none required. Decoding uses the pinned plist package and local fixtures.
Package or release metadata impact: none.
Security, privacy, process, or containment review: the omitted key is still absent from the projected result. The assignment changes only that dictionary object's prototype. Object.prototype stays unchanged. The limitation makes the omission visible.

Review checklist

This PR addresses a concrete problem or an agreed enhancement.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1593 **Author:** [@Adolanium](https://github.com/Adolanium) **Created:** 10/10/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/binary-plist-prototype-keys` --- ### 📝 Commits (1) - [`8339a5c`](https://github.com/morluto/rea/commit/8339a5c74b5cbd7bda50f4f025df317f80f9aadc) fix(plist): report binary plist __proto__ keys that results omit ### 📊 Changes **5 files changed** (+220 additions, -26 deletions) <details> <summary>View changed files</summary> 📝 `src/artifacts/apple/InterfaceBuilderAnalysis.ts` (+12 -6) 📝 `src/artifacts/apple/InterfaceBuilderDecodeBudget.ts` (+71 -8) 📝 `src/artifacts/apple/KeyedArchiveReader.test.ts` (+81 -0) 📝 `src/artifacts/apple/KeyedArchiveReader.ts` (+16 -12) 📝 `tests/boundary/filesystem/interfaceBuilderBundle.test.ts` (+40 -0) </details> ### 📄 Description ## Summary Fixes #1594 Binary property lists can store a dictionary key `__proto__`. REA omits that key from results. XML plists already report how many such entries were omitted. Binary plists reported a count of zero, so the omission was silent. ## Problem and expected behavior `plist.parseBinary` assigns each dictionary entry with `dict[key] = value`. The key `__proto__` changes that object's prototype, and `Object.entries` then drops the entry. `projectPlistValue` never sees it. Keyed archive decoding and Interface Builder decoding passed `omittedPrototypeKeys: 0` after `parseBinary`. XML decoding already counts the same key and adds this limitation: `1 dictionary entry keyed __proto__ was omitted because REA results cannot represent that key.` A binary archive with that key should add the same limitation. An ordinary binary archive should stay free of it. ## Change and scope The binary plist walk already visits every dictionary before `parseBinary`. It now counts key references whose object is the ASCII or UTF-16BE string `__proto__`, including an extended size field. A key object shared by two dictionaries counts twice. A value equal to that string does not count. Keyed archive decoding and Interface Builder plist decoding pass the count into the existing limitation. XML decoding is unchanged. NIBArchive documents still report no plist prototype-key omission. ## Contract and boundary impact - Semantic owner and earliest changed stage: keyed archive and Interface Builder plist projection, at result projection. - CLI and MCP/tool-catalog contract: `inspect_keyed_archive` and Interface Builder analysis can include the existing omission limitation for a binary plist. No new fields or parameters. - Provider, bridge, target-format, or platform compatibility: binary plist on every supported platform. XML plist results stay the same. - Evidence, artifact, provenance, or reconstruction contract: the `__proto__` entry stays omitted, and the limitation states the count. Archive bytes and hashes stay the source bytes. - Process execution, authorization, cleanup, or containment impact: none. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: `KeyedArchiveReader.test.ts` covers one ASCII `__proto__` key, two dictionaries that share that key, a UTF-16BE key with an extended size, and an ordinary binary archive. `interfaceBuilderBundle.test.ts` covers a binary `.nib` whose limitation marks archive decoding partial. - Base reproduction or other evidence: on revision `02ef2b1c`, those binary fixtures decode with `omittedPrototypeKeys: 0` and no prototype-key limitation. The tests assert the limitation text, so they fail on that revision. - User-visible CLI/MCP output (if applicable): `1 dictionary entry keyed __proto__ was omitted because REA results cannot represent that key.` Interface Builder prefixes that sentence with the archive path. - Remaining proof gaps: the fixtures are synthetic `bplist00` bytes. This run did not round-trip them through macOS `plutil` or `ibtool`. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- src/artifacts/apple/KeyedArchiveReader.test.ts` — 10 passed. - `npm run test:focused -- tests/boundary/filesystem/interfaceBuilderBundle.test.ts` — 17 passed, 24 skipped. - `npx tsc --noEmit --pretty false` — exit 0. - `npx oxlint` on the five changed files — 0 errors. Pre-existing complexity and length warnings remain on untouched functions. - `git push` pre-push `npm run check:fast` — typecheck and lint, 2 successful. ## Compatibility, safety, and release - Breaking changes or migration steps: none. A binary plist that omitted a `__proto__` entry now reports the same limitation XML plists already report. Interface Builder coverage for that archive becomes `partial` with reason `dictionary_entries_omitted`. - Real Hopper/Ghidra, browser, or OS coverage: none required. Decoding uses the pinned `plist` package and local fixtures. - Package or release metadata impact: none. - Security, privacy, process, or containment review: the omitted key is still absent from the projected result. The assignment changes only that dictionary object's prototype. `Object.prototype` stays unchanged. The limitation makes the omission visible. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:12:39 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:07:30 +00:00

[PR #2993] [CLOSED] fix(checks): restore the lint and format baseline on the default branch #5548

No Branch/Tag specified

main

codex/procedure-reference-stacked

release-please--branches--main--components--rea-agents

release-please--branches--main--components--rea-agents--release-notes

codex/kuna-independent-retry

codex/byte-search-overlay-coverage

codex/open-failure-target-receipt

codex/kuna-xref-evidence

codex/ghidra-ambiguous-procedure-recovery

codex/function-source-bundle

codex/trace-function-integration-prototype

codex/snapshot-source-closure

codex/recorded-evidence-array-pages

codex/evidence-recovery-redesign

codex/trace-feature-address-scope

codex/call-discovery-scope

codex/ghidra-literal-candidate-evidence

codex/decompile-directory-independent-retry

codex/retry-provenance-base

codex/value-flow-capability-experiment

codex/ghidra-containing-instruction

cursor/readme-discord-button-ef9f

dependabot/github_actions/actions/setup-node-7.1.0

dependabot/github_actions/actions/upload-artifact-7.0.2

dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df

codex/kuna-1989

fix/8559-native-ui-fixture-ownership

fix/8555-go-verifier-mcp-ownership

codex/provider-capability-recovery

fix/8642-rizin-target-stdin

codex/ghidra-memory-effect-scope

codex/ghidra-annotation-entry-selector

codex/ghidra-readonly-recovery

codex/ghidra-regex-verifier-recovery

codex/evidence-discovery-view-guidance

fix/8545-bulk-append-overflow

fix/8428-navigation-refusal-alternatives

codex/address-context-recovery

codex/matching-member-limitations

codex/unknown-scope-contract

codex/evidence-view-guidance

feat/8373-native-trace-views

codex/ghidra-snapshot-verifier-binding

codex/elf-export-visibility

codex/evidence-view-recovery

codex/native-reference-cli-help

codex/provider-candidate-observation-scope

codex/kuna-session-verification

codex/ghidra-switch-lifetime-guidance

codex/pseudocode-paging-discovery

codex/clarify-evidence-view-support

codex/kuna-xrefs-selector-recovery

codex/context-capacity-recovery

codex/evidence-closure-large-links

codex/same-function-evidence-identity

codex/ghidra-verifier-inspected-jdk

codex/audit-guided-workflows

codex/crash-prompt-retained-dossiers

codex/analysis-view-error-recovery

codex/kuna-verifier-target-selection

codex/ghidra-selected-project-call-coverage

codex/docs-native-analysis-scope

codex/ghidra-java-socket-boundary

codex/ghidra-retained-snapshot-verifier

codex/ghidra-search-inventory-facts

fix/8284-zero-argument-parameter-bindings

fix/8198-ui-action-handler-offset

fix/8257-elf-entry-label-identity

fix/8304-deferred-output-schema-projection

fix/8277-call-path-computed-target-uncertainty

fix/pr-8089-conflicts

fix/ci-static-duplicate-export

dependabot/npm_and_yarn/lint-staged-17.6.0

dependabot/github_actions/actions/download-artifact-8.0.2

dependabot/npm_and_yarn/write-file-atomic-8.0.0

dependabot/npm_and_yarn/canonicalize-5.1.0

dependabot/github_actions/actions/cache/restore-6.1.0

dependabot/npm_and_yarn/toon-format/toon-4.4.0

dependabot/github_actions/actions/deploy-pages-5.0.1

codex/review-fixes-pr-2403

codex/review-fixes-pr-2400

codex/process-terminal-width

codex/test-brittleness-cleanup

verify/7167-browser-connect-macos

fix/7167-browser-connect

feat/native-matching-allowance-setting

feat/browser-scenario-dry-run

test/managed-caller-parameters-20261024

codex/parser-fortythird-boundaries

fix/6926-pinvoke-platform-decorations-20261023

fix/6889-har-body-encoding-20261023

fix/6888-sqlite-schema-budget-20261023

fix/dependency-security-gates-6708

cursor/evidence-overwrite-rebase-b4ac

feat/4057-verify-native-exports

fix/windows-acl-observer-overhead-20261022

cursor/erlang-beam-restack-4476

cursor/pe-certificate-review-bf32

fix/6116-javascript-application-fs-errors

fix/6061-unmapped-runtime-script-unknown

feat/browser-scenario-summary

fix/pe-certificates

codex/verify-3407

cursor/rebase-5699

cursor/rebase-5352

cursor/rebase-5600

cursor/fix-cli-schema-omission-10a8

codex/audit-hopper-shutdown-reasons-20261021

fix/demangle-swift-omitted-record

fix/nib-boolean-value-types

cursor/cancellation-partial-observation-a5ac

fix/ib-object-limit-reasons

fix/electron-fuse-limit-advice

fix/kuna-doctor-dangling-cache

fix/fixed-budget-refusal-advice

fix/js-ipc-listener-dedup

fix/js-return-member-provenance

fix/dmg-integrity-retry-advice

fix/ida-doctor-readiness

fix/kuna-version-probe-output-drain

fix/legacy-swift-runtime-name-matching

fix/dylib-lazy-load-commands

fix/browser-scenario-startup-cancel

fix/swift-nested-punycode-classification

fix/compare-unselected-scopes

fix/objc-method-budget-coverage

fix/dmg-mounted-root-observations

audit/ci-tests-20261019-round2

release/6.7.0

fix/wabt-cleanup-retry-resolution

fix/electron-fuse-elf-pe-architecture

fix/native-plist-descriptor-ownership

fix/kuna-caller-cleanup-ownership

experiment/atomic-codemode-20261016

review/first-contributor-3776

fix/call-resolution-full-read-cycles

fix/member-mutation-selection-repeat

experiment/atomic-re-tools-20261015

perf/member-mutation-lazy-origins

perf/static-network-mutation-index

fix/hopper-startup-lifecycle

audit/3050-windows-proof-20261015

feat/windows-window-capture-2183

audit/3049-windows-proof-20261015

audit/3735-macos-fixtures-20261015

fix/batch-decompile-null-pseudocode

fix/kuna-inventory-honors-jobs

experiment/browser-codemode-tool-design-20261015

fix/hopper-clean-runtime-argv

codex/review-2049-27f1b367

review-fixes/pr-2787-routing

fix/3360-scoped-this-emitters

fix/3367-replaced-global-effects

fix/3838-compact-any-value-items

test/hopper-download-probe-20261015

codex/windows-runtime-creation-red-green-20261015

codex/windows-readonly-root-red-green-20261015

codex/windows-root-share-red-green-20261015

codex/exp-1685-win-mcp-startup

codex/bug-sweep-20261015

investigate/2190-windows-package-phases

investigate/3543-macos-cli-deadline

perf/3281-reverse-tools-feedback-quality

fix/3406-hopper-doctor-fixture

fix/3341-wrapper-require-test-context

fix/3301-owned-uninstall-fixtures

fix/3164-compiler-input-ownership

fix/pcap-cleanup-stdout-newline-20261014

perf/interface-builder-summary

codex/review-fixes-pr-1977

fix/ghidra-effective-jvm-platform

fix/docs-turkish-rust-link-20261013

fix/main-maintenance-ci-20261010

fix/recover-binary-session-process-effects

codex/review-fixes-pr-2457

codex/ci-required-cancellation-gate

fix/main-format-baseline-20261013

fix/setup-preserve-entry-fields

cursor/restore-main-checks-1ffc

fix/ghidra-bridge-hashmap-import

codex/shared-ci-jadx-json-default-20261013

codex/shared-ci-ghidra-test-groups-20261013

codex/shared-ci-java-fixture-format-20261013

codex/fix-intrinsic-invocation-boundaries

test/release-preflight-reusable-jobs

test/js-parameter-provenance-expectation

fix/linux-hopper-verification-current

test/2419-ghidra-elf-probe-size

followup/pr-1544-native-ida

codex/fold-pr-2230-contribution

docs/readme-responsible-use

fix/issue-2064

fix/issue-2050

fix/issue-2053

fix/issue-1968

fix/issue-1945

experiment/codemode-bridge-20261011

fix/tool-effects-negative-wording-1904-20261012

fix/1842-electron-interop-provenance

feat/recover-javascript-multi-input

refactor/website-i18n-prep

fix/nativeaot-pe-virtual-extent

fix/browser-verifier-ci-hang

fix/pe-resources-input-selection

docs/beginner-friendly-guides

docs/beginner-setup-guide

fix/javascript-analysis-worker-1563

fix/1649-ghidra-duplicate-names

fix/javascript-export-keys-integration-1369

test/maintenance-boundary-contracts-20261011

review/javascript-export-keys-1369

review/process-live-progress-1483

test/javascript-1495-growth-ratio

fix/ci-escape-timing

docs/normalized-terminal-geometry-1450

release/6.3.0

archive/release-6.3.0-pr1381

release/6.2.0

fix/electron-preload-dynamic-override

fix/javascript-self-referential-bundler-edges

release/6.1.0

cursor/grok-client-cherry-pick-0b56

feat/signature-posture

feat/dyld-shared-cache

feat/artifact-integrity-policy

feat/pkg-inventory

release/6.0.0

chore/sync-release-5.0.0

release/5.0.0

cursor/cloud-agent-node-787e

fix/javascript-xhr-open-endpoints

review/pr-711-realpath-fallback-wording

cleanup/replay-confinement

codex/test-suite-performance

codex/issue-foundations

codex/address-open-issues-2026-07-20

agent/javascript-vite-rollup-esbuild-adapters

agent/process-cleanup

agent/triage-integration

agent/unknown-commands-registry

feat/mcp-identity-metadata

morlvps/issue_cleanup

codex/installer-redesign

morl/roadmap-investigation-core

morl/roadmap-investigation-docs

release-please--branches--main--components--rea

rea-agents-6.8.0

rea-agents-6.7.0

rea-agents-6.6.0

experiment/atomic-codemode-wait-runtime-20261016

rea-agents-6.5.0

rea-agents-6.4.0

rea-agents-6.3.0

rea-agents-6.2.0

rea-agents-6.1.0

rea-agents-6.0.0

rea-agents-5.0.0

rea-agents-4.1.0

rea-agents-4.0.1

rea-agents-4.0.0

rea-agents-3.2.1

rea-agents-3.2.0

rea-agents-3.1.0

rea-agents-3.0.0

rea-agents-2.7.0

rea-agents-2.6.0

rea-agents-2.5.1

rea-agents-2.5.0

rea-agents-2.4.0

rea-agents-2.3.0

rea-agents-2.2.0

rea-agents-2.1.0

rea-agents-2.0.0

rea-agents-1.7.0

rea-agents-1.6.0

rea-agents-1.5.0

rea-agents-1.4.0

rea-agents-1.3.0

rea-agents-1.2.0

rea-agents-1.1.0

rea-agents-1.0.0

rea-agents-0.5.0

rea-agents-0.4.0

rea-agents-0.3.0

rea-0.2.1

rea-0.2.0

Labels

Clear labels

Mirrored from GitHub Pull Request

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2993

Reference in a new issue

Repository