morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5176] [Bug] Non-DWARF objdump facets return an inapplicable DWARF debug-link warning #3176

New issue

Closed

opened 2026-10-31 00:37:31 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:37:31 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 19, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5176

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

With operation: "file_headers" and follow_debug_links: true, REA selects only -f but adds the Evidence limitation DWARF output may include local debug-link files whose identities are not bound to Evidence. The flag has no effect on the selected non-DWARF command. Omitting it selects the same argv without the warning.

Reproduction

In a source checkout with its locked dependencies installed, save the following as repro.mts. The fixture is a synthetic ELF header. The injected runner returns empty stdout/stderr and never starts objdump; this checks REA's command selection and Evidence projection, not GNU parsing or debug-file reads.

import { mkdtemp, writeFile, rm } from 'node:fs/promises';
import { resolve } from 'node:path';
import { createReverseEngineeringService } from './src/composition/reverseEngineering.ts';

const directory = await mkdtemp('./objdump-probe-');
const path = resolve(directory, 'fixture.elf');
const elf = Buffer.alloc(64);
elf.set([0x7f, 0x45, 0x4c, 0x46, 2, 1, 1]);
elf.writeUInt16LE(1, 16);
elf.writeUInt16LE(62, 18);
elf.writeUInt32LE(1, 20);
elf.writeUInt16LE(64, 52);
elf.writeUInt16LE(64, 58);
await writeFile(path, elf);
const service = createReverseEngineeringService(
  { HOME: resolve(directory), XDG_CONFIG_HOME: resolve(directory) },
  { run: async () => ({ stdout: '', stderr: '' }) },
);
try {
  for (const input of [
    { path, operation: 'file_headers', follow_debug_links: true },
    { path, operation: 'file_headers' },
    { path, operation: 'dwarf', follow_debug_links: true },
  ]) {
    const result = await service.inspectWithObjdump(input);
    if (!result.ok) throw result.error;
    const evidence = result.value;
    console.log(JSON.stringify({
      operation: input.operation,
      args: evidence.parameters.command_arguments.slice(0, -1),
      dwarf_warning: evidence.limitations.some(text => text.startsWith('DWARF output')),
    }));
  }
} finally {
  await service.close();
  await rm(directory, { recursive: true, force: true });
}

Run node --import tsx repro.mts. This source-boundary replay was executed on the main baseline below.

{"operation":"file_headers","args":["-f"],"dwarf_warning":true}
{"operation":"file_headers","args":["-f"],"dwarf_warning":false}
{"operation":"dwarf","args":["-W","-WK"],"dwarf_warning":true}

Expected behavior

Evidence for a non-DWARF facet should omit the DWARF-specific debug-link warning because the selected operation does not request DWARF output or select DWARF link flags. The guide scopes debug-link following to DWARF. Keep the warning for the enabled DWARF control, where the selected arguments include -W and -WK.

Impact and scope

Observed with a mock runner for all six non-DWARF artifact facets: file_headers, section_headers, symbols, relocations, disassemble, and disassemble_all. The replay found only an inapplicable warning; raw results and command arguments were unchanged by the flag. This is P3 wording impact. Omitting follow_debug_links is a verified workaround for these facets. Real-provider behavior and real-world frequency were not measured.

REA version

Current main source revision 9af0b6113c was executed through the production service with an injected runner. Latest published release: rea-agents 6.7.0, tag rea-agents-6.7.0, revision 27dc42d102. The relevant schema, command builder, service, CLI/MCP registration, composition and documentation are identical between these baselines; a separate release runtime was not executed.

Runtime and platform

Node.js v24.18.0; Darwin 27.0.0 arm64; locked source dependencies. No GNU objdump binary was invoked.

Target and artifact context

Synthetic 64-byte ELF64 little-endian x86-64 relocatable header, used only as a regular local artifact for hashing; the mock runner does not parse it or read debug links.

Interface

Other — production application service with an injected runner. Public CLI/MCP routing was traced in source; neither transport was executed.

Earliest failure stage

Transport or result projection

Relevant output or evidence

Expected source: GNU objdump guide scopes debug-link following to DWARF; tool design guidance calls for relevant limitations.
Failure source: Executed production-service replay above; limitation condition tests the flag without the artifact facet. The command builder uses the flag only for DWARF.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

Command selection and Evidence projection used a mock runner. Public CLI/MCP reachability and release equivalence were checked in source.

Typed outcome or recovery expected

Return an accurate limitation for the selected facet. The enabled non-DWARF request should keep the same command arguments and raw result as its omitted-flag control. The enabled DWARF control should retain the external-debug-file limitation and -WK selection.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: The observed defect adds an inapplicable DWARF warning to non-DWARF Evidence without changing command selection or raw results.
Workaround status: available
Workaround basis: Omitting the flag selects the same non-DWARF arguments and removes the warning in the executed control.

Originally created by @coygeek on GitHub (Oct 19, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5176 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior With `operation: "file_headers"` and `follow_debug_links: true`, REA selects only `-f` but adds the Evidence limitation `DWARF output may include local debug-link files whose identities are not bound to Evidence.` The flag has no effect on the selected non-DWARF command. Omitting it selects the same argv without the warning. ## Reproduction 1. In a source checkout with its locked dependencies installed, save the following as `repro.mts`. The fixture is a synthetic ELF header. The injected runner returns empty stdout/stderr and never starts objdump; this checks REA's command selection and Evidence projection, not GNU parsing or debug-file reads. ```ts import { mkdtemp, writeFile, rm } from 'node:fs/promises'; import { resolve } from 'node:path'; import { createReverseEngineeringService } from './src/composition/reverseEngineering.ts'; const directory = await mkdtemp('./objdump-probe-'); const path = resolve(directory, 'fixture.elf'); const elf = Buffer.alloc(64); elf.set([0x7f, 0x45, 0x4c, 0x46, 2, 1, 1]); elf.writeUInt16LE(1, 16); elf.writeUInt16LE(62, 18); elf.writeUInt32LE(1, 20); elf.writeUInt16LE(64, 52); elf.writeUInt16LE(64, 58); await writeFile(path, elf); const service = createReverseEngineeringService( { HOME: resolve(directory), XDG_CONFIG_HOME: resolve(directory) }, { run: async () => ({ stdout: '', stderr: '' }) }, ); try { for (const input of [ { path, operation: 'file_headers', follow_debug_links: true }, { path, operation: 'file_headers' }, { path, operation: 'dwarf', follow_debug_links: true }, ]) { const result = await service.inspectWithObjdump(input); if (!result.ok) throw result.error; const evidence = result.value; console.log(JSON.stringify({ operation: input.operation, args: evidence.parameters.command_arguments.slice(0, -1), dwarf_warning: evidence.limitations.some(text => text.startsWith('DWARF output')), })); } } finally { await service.close(); await rm(directory, { recursive: true, force: true }); } ``` 2. Run `node --import tsx repro.mts`. This source-boundary replay was executed on the main baseline below. ```json {"operation":"file_headers","args":["-f"],"dwarf_warning":true} {"operation":"file_headers","args":["-f"],"dwarf_warning":false} {"operation":"dwarf","args":["-W","-WK"],"dwarf_warning":true} ``` ## Expected behavior Evidence for a non-DWARF facet should omit the DWARF-specific debug-link warning because the selected operation does not request DWARF output or select DWARF link flags. The guide scopes debug-link following to DWARF. Keep the warning for the enabled DWARF control, where the selected arguments include `-W` and `-WK`. ## Impact and scope Observed with a mock runner for all six non-DWARF artifact facets: `file_headers`, `section_headers`, `symbols`, `relocations`, `disassemble`, and `disassemble_all`. The replay found only an inapplicable warning; raw results and command arguments were unchanged by the flag. This is P3 wording impact. Omitting `follow_debug_links` is a verified workaround for these facets. Real-provider behavior and real-world frequency were not measured. ## REA version Current main source revision 9af0b6113c81803f88ec7d242e8fabaaa5d7f1f3 was executed through the production service with an injected runner. Latest published release: rea-agents 6.7.0, tag `rea-agents-6.7.0`, revision 27dc42d10249f0410904a75c0997842eb03b931c. The relevant schema, command builder, service, CLI/MCP registration, composition and documentation are identical between these baselines; a separate release runtime was not executed. ## Runtime and platform Node.js v24.18.0; Darwin 27.0.0 arm64; locked source dependencies. No GNU objdump binary was invoked. ## Target and artifact context Synthetic 64-byte ELF64 little-endian x86-64 relocatable header, used only as a regular local artifact for hashing; the mock runner does not parse it or read debug links. ## Interface Other — production application service with an injected runner. Public CLI/MCP routing was traced in source; neither transport was executed. ## Earliest failure stage Transport or result projection ## Relevant output or evidence - Expected source: [GNU objdump guide](https://github.com/morluto/rea/blob/9af0b6113c81803f88ec7d242e8fabaaa5d7f1f3/docs/reverse-engineering-tools.md#L17-L19) scopes debug-link following to DWARF; [tool design guidance](https://github.com/morluto/rea/blob/9af0b6113c81803f88ec7d242e8fabaaa5d7f1f3/docs/tool-design.md#L49-L55) calls for relevant limitations. - Failure source: Executed production-service replay above; [limitation condition](https://github.com/morluto/rea/blob/9af0b6113c81803f88ec7d242e8fabaaa5d7f1f3/src/application/reverse/ReverseEngineeringService.ts#L583-L588) tests the flag without the artifact facet. The [command builder](https://github.com/morluto/rea/blob/9af0b6113c81803f88ec7d242e8fabaaa5d7f1f3/src/objdump/ObjdumpCommand.ts#L11-L25) uses the flag only for DWARF. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete Command selection and Evidence projection used a mock runner. Public CLI/MCP reachability and release equivalence were checked in source. ## Typed outcome or recovery expected Return an accurate limitation for the selected facet. The enabled non-DWARF request should keep the same command arguments and raw result as its omitted-flag control. The enabled DWARF control should retain the external-debug-file limitation and `-WK` selection. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: The observed defect adds an inapplicable DWARF warning to non-DWARF Evidence without changing command selection or raw results. - Workaround status: available - Workaround basis: Omitting the flag selects the same non-DWARF arguments and removes the warning in the executed control.

bsakaguchi closed this issue

2026-10-31 00:37:31 +00:00

bsakaguchi commented

2026-10-31 00:37:32 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 19, 2026):

Agree — the limitation should be scoped to the DWARF facet. The condition currently keys solely on follow_debug_links, but for non-DWARF operations the flag never changes the selected argv (-f stays -f), so emitting a DWARF-specific warning is pure noise and can mislead consumers into thinking the Evidence includes external debug files. Suggest gating the limitation on the resolved facet (dwarf) rather than the raw flag — that keeps the -W -WK control intact and the warning accurate for the six affected artifact facets.

@XinwangTao commented on GitHub (Oct 19, 2026): Agree — the limitation should be scoped to the DWARF facet. The condition currently keys solely on follow_debug_links, but for non-DWARF operations the flag never changes the selected argv (`-f` stays `-f`), so emitting a DWARF-specific warning is pure noise and can mislead consumers into thinking the Evidence includes external debug files. Suggest gating the limitation on the resolved facet (dwarf) rather than the raw flag — that keeps the `-W -WK` control intact and the warning accurate for the six affected artifact facets.

bsakaguchi commented

2026-10-31 00:37:32 +00:00

Author

Owner

@morluto commented on GitHub (Oct 21, 2026):

Closing as fixed on main by github.com/morluto/rea@c284168c4b, retained at current main 67a6477f01.

ReverseEngineeringService now includes the debug-link limitation only when the resolved operation is dwarf and follow_debug_links is true. The current composition regression matrix covers all six non-DWARF facets, symbol-selected disassembly, and enabled/disabled DWARF controls while asserting unchanged selected argv and captured results.

This audit verified the committed producer and regression coverage by source inspection. It did not rerun the runtime reproduction or establish additional real-provider/platform coverage.

@morluto commented on GitHub (Oct 21, 2026): Closing as fixed on main by https://github.com/morluto/rea/commit/c284168c4b1cd214ce7f504d43da28528d82d603, retained at current main 67a6477f011ae358fc333e5a6e26c86d932654ed. ReverseEngineeringService now includes the debug-link limitation only when the resolved operation is dwarf and follow_debug_links is true. The current composition regression matrix covers all six non-DWARF facets, symbol-selected disassembly, and enabled/disabled DWARF controls while asserting unchanged selected argv and captured results. This audit verified the committed producer and regression coverage by source inspection. It did not rerun the runtime reproduction or establish additional real-provider/platform coverage.

bsakaguchi referenced this issue

2026-10-31 00:39:08 +00:00

[GH-ISSUE #5462] [Bug] Native inspection admits universal static archives as Mach-O images #3320

bsakaguchi referenced this issue

2026-10-31 00:41:44 +00:00

[GH-ISSUE #5853] [Bug] Large JVM class files receive a FAT-specific target refusal #3548

bsakaguchi referenced this issue

2026-10-31 01:08:52 +00:00

[PR #3305] [CLOSED] fix(apple): stop JVM class lookalikes passing as FAT Mach-O #5715