morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5423] [Bug] Signature inspection omits its temporary filesystem-write effect from discovery #3286

New issue

Closed

opened 2026-10-31 00:38:48 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:38:48 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5423

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Provider or capability discovery

Observed behavior

node scripts/rea.mjs capabilities --json advertises only launches_process for the native-macos group containing inspect_signature, although node scripts/rea.mjs inspect-signature <path> --json creates a private temporary snapshot. An independent verifier reproduced the mismatch on a regular-file copy of the running Node executable: with an unwritable temporary parent, inspection exited 1 at signature-snapshot-create; restoring write permission on that same parent made the same input succeed.

Reproduction

From the built source revision below on macOS, with Node v24.18.0 on PATH, an ordinary user ran the following isolated reproduction:

export VERIFY_WORK="$(mktemp -d)"
mkdir -p "$VERIFY_WORK/home" "$VERIFY_WORK/config" "$VERIFY_WORK/data" \
  "$VERIFY_WORK/cache" "$VERIFY_WORK/state" "$VERIFY_WORK/temp" "$VERIFY_WORK/output"
node -e 'require("node:fs").copyFileSync(process.execPath, process.env.VERIFY_WORK + "/target-macho")'
export HOME="$VERIFY_WORK/home"
export XDG_CONFIG_HOME="$VERIFY_WORK/config"
export XDG_DATA_HOME="$VERIFY_WORK/data"
export XDG_CACHE_HOME="$VERIFY_WORK/cache"
export XDG_STATE_HOME="$VERIFY_WORK/state"
export TMPDIR="$VERIFY_WORK/temp"
chmod 500 "$TMPDIR"
node scripts/rea.mjs capabilities --json > "$VERIFY_WORK/output/capabilities.json"
node scripts/rea.mjs inspect-signature "$VERIFY_WORK/target-macho" --json > "$VERIFY_WORK/output/denied.json"
chmod 700 "$TMPDIR"
node scripts/rea.mjs inspect-signature "$VERIFY_WORK/target-macho" --json > "$VERIFY_WORK/output/writable.json"

The capability query exited 0 and omitted the filesystem effect. The denied inspection exited 1; the writable inspection exited 0. The verifier also ran the capability query with writable temporary storage and observed the same omission. This is a controlled denied/writable comparison, not a measured intermittent-failure rate.

Expected behavior

Capability discovery should include may_write_filesystem for inspect_signature, and canonical tool effects should include writesFilesystem, because the operation owns temporary filesystem work. docs/tool-design.md:65 requires truthful filesystem and process effects; src/contracts/toolEffects.ts:1 explicitly includes temporary work across supported inputs. Inspection need not succeed when its temporary parent is unwritable.

Impact and scope

Callers cannot discover this operation's temporary filesystem-write requirement and may choose an environment where inspection fails. The verified workaround is a writable private TMPDIR; changing only its permission restored successful inspection and left the temporary parent empty afterward. This is a bounded metadata defect (P2). Downstream policy integrations and population frequency were not measured. No security-policy bypass or read-only annotation error was established; existing process/session effects already make the tool's read-only hint false.

REA version

6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8 (prebuilt runtime).

Runtime and platform

Node.js v24.18.0; macOS 27.0.1 arm64; ordinary user with isolated HOME and XDG directories.

Target and artifact context

Regular-file copy of the running Node executable, a Mach-O arm64 executable. No external API or network access was needed for the reproduction.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

Observed CLI results from the commands above:

The capability group containing demangle_swift, inspect_macho, inspect_plist, inspect_signature, and list_architectures had exactly effects: ["launches_process"].
Denied temporary storage: execution_failure, retryable: false, diagnostics phase: signature-snapshot-create, and EACCES from mkdtemp.
Writable temporary storage: exit 0, normalized_result.signed: true, identifier node; temporary parent empty after completion.

Source-derived corroboration at the reported revision: src/native/NativeMacOSProviderMetadata.ts:45-47 excludes signature inspection from filesystem effects. src/contracts/toolEffects.ts:47,592 maps it to nativeEvidence, leaving writesFilesystem false. A live MCP metadata response was not tested.

Typed outcome or recovery expected

Discovery should disclose the filesystem-write effect before execution. The denied-storage failure remains a valid control; this report requests truthful effect metadata, not success without writable temporary storage or a change to error classification.

Analysis or suspected cause

Source-derived: src/cli/utilityCommands.ts:180 routes the CLI command to inspect_signature. src/native/NativeMacOSProvider.ts:586-615 admits the executable Mach-O and invokes snapshot binding. src/native/SignatureTargetBinding.ts:105-118,301,348-350 allocates a private root and creates and writes the snapshot. These required effects are absent from both metadata declarations described above.

Additional context

Prepared with AI assistance and independently reproduced by a separate verifier. Submission-time comparison against upstream main found no change to the signature effect declarations or snapshot implementation since the reported revision; the only change in the cited files added an unrelated tool effect entry. No fix or post-fix restoration was tested. NOT_ENOUGH_INFO: the last known good version and first affected version have not been established.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5423 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Provider or capability discovery ### Observed behavior `node scripts/rea.mjs capabilities --json` advertises only `launches_process` for the `native-macos` group containing `inspect_signature`, although `node scripts/rea.mjs inspect-signature <path> --json` creates a private temporary snapshot. An independent verifier reproduced the mismatch on a regular-file copy of the running Node executable: with an unwritable temporary parent, inspection exited 1 at `signature-snapshot-create`; restoring write permission on that same parent made the same input succeed. ### Reproduction From the built source revision below on macOS, with Node v24.18.0 on PATH, an ordinary user ran the following isolated reproduction: ```sh export VERIFY_WORK="$(mktemp -d)" mkdir -p "$VERIFY_WORK/home" "$VERIFY_WORK/config" "$VERIFY_WORK/data" \ "$VERIFY_WORK/cache" "$VERIFY_WORK/state" "$VERIFY_WORK/temp" "$VERIFY_WORK/output" node -e 'require("node:fs").copyFileSync(process.execPath, process.env.VERIFY_WORK + "/target-macho")' export HOME="$VERIFY_WORK/home" export XDG_CONFIG_HOME="$VERIFY_WORK/config" export XDG_DATA_HOME="$VERIFY_WORK/data" export XDG_CACHE_HOME="$VERIFY_WORK/cache" export XDG_STATE_HOME="$VERIFY_WORK/state" export TMPDIR="$VERIFY_WORK/temp" chmod 500 "$TMPDIR" node scripts/rea.mjs capabilities --json > "$VERIFY_WORK/output/capabilities.json" node scripts/rea.mjs inspect-signature "$VERIFY_WORK/target-macho" --json > "$VERIFY_WORK/output/denied.json" chmod 700 "$TMPDIR" node scripts/rea.mjs inspect-signature "$VERIFY_WORK/target-macho" --json > "$VERIFY_WORK/output/writable.json" ``` The capability query exited 0 and omitted the filesystem effect. The denied inspection exited 1; the writable inspection exited 0. The verifier also ran the capability query with writable temporary storage and observed the same omission. This is a controlled denied/writable comparison, not a measured intermittent-failure rate. ### Expected behavior Capability discovery should include `may_write_filesystem` for `inspect_signature`, and canonical tool effects should include `writesFilesystem`, because the operation owns temporary filesystem work. `docs/tool-design.md:65` requires truthful filesystem and process effects; `src/contracts/toolEffects.ts:1` explicitly includes temporary work across supported inputs. Inspection need not succeed when its temporary parent is unwritable. ### Impact and scope Callers cannot discover this operation's temporary filesystem-write requirement and may choose an environment where inspection fails. The verified workaround is a writable private `TMPDIR`; changing only its permission restored successful inspection and left the temporary parent empty afterward. This is a bounded metadata defect (P2). Downstream policy integrations and population frequency were not measured. No security-policy bypass or read-only annotation error was established; existing process/session effects already make the tool's read-only hint false. ### REA version 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8` (prebuilt runtime). ### Runtime and platform Node.js v24.18.0; macOS 27.0.1 arm64; ordinary user with isolated HOME and XDG directories. ### Target and artifact context Regular-file copy of the running Node executable, a Mach-O arm64 executable. No external API or network access was needed for the reproduction. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence Observed CLI results from the commands above: - The capability group containing `demangle_swift`, `inspect_macho`, `inspect_plist`, `inspect_signature`, and `list_architectures` had exactly `effects: ["launches_process"]`. - Denied temporary storage: `execution_failure`, `retryable: false`, diagnostics `phase: signature-snapshot-create`, and `EACCES` from `mkdtemp`. - Writable temporary storage: exit 0, `normalized_result.signed: true`, identifier `node`; temporary parent empty after completion. Source-derived corroboration at the reported revision: `src/native/NativeMacOSProviderMetadata.ts:45-47` excludes signature inspection from filesystem effects. `src/contracts/toolEffects.ts:47,592` maps it to `nativeEvidence`, leaving `writesFilesystem` false. A live MCP metadata response was not tested. ### Typed outcome or recovery expected Discovery should disclose the filesystem-write effect before execution. The denied-storage failure remains a valid control; this report requests truthful effect metadata, not success without writable temporary storage or a change to error classification. ### Analysis or suspected cause Source-derived: `src/cli/utilityCommands.ts:180` routes the CLI command to `inspect_signature`. `src/native/NativeMacOSProvider.ts:586-615` admits the executable Mach-O and invokes snapshot binding. `src/native/SignatureTargetBinding.ts:105-118,301,348-350` allocates a private root and creates and writes the snapshot. These required effects are absent from both metadata declarations described above. ### Additional context Prepared with AI assistance and independently reproduced by a separate verifier. Submission-time comparison against upstream main found no change to the signature effect declarations or snapshot implementation since the reported revision; the only change in the cited files added an unrelated tool effect entry. No fix or post-fix restoration was tested. NOT_ENOUGH_INFO: the last known good version and first affected version have not been established.

bsakaguchi closed this issue

2026-10-31 00:38:48 +00:00

bsakaguchi commented

2026-10-31 00:38:49 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 20, 2026):

Cross-referencing with canonical issue #4293 ([Bug] Universal Mach-O signatures report one slice as the whole file) and sibling #5538 regarding signature inspection effects and discovery metadata. Cataloged under Cluster AY in consolidation tracker #4330.

@matbrgz commented on GitHub (Oct 20, 2026): Cross-referencing with canonical issue #4293 (`[Bug] Universal Mach-O signatures report one slice as the whole file`) and sibling #5538 regarding signature inspection effects and discovery metadata. Cataloged under Cluster AY in consolidation tracker #4330.

bsakaguchi commented

2026-10-31 00:38:49 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

Both declarations now disclose temporary writes: canonical TOOL_EFFECTS.inspect_signature sets writesFilesystem and NativeMacOSProviderMetadata sets mayWriteFilesystem for inspect_signature. The regression explicitly checks signature writesFilesystem, process launch and no target mutation. This directly restores discovery truthfulness and does not require changing denied-temp-storage behavior.

Implementation: toolEffects.ts, NativeMacOSProviderMetadata.ts.

The relevant regression checks in toolEffects.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. Both declarations now disclose temporary writes: canonical TOOL_EFFECTS.inspect_signature sets writesFilesystem and NativeMacOSProviderMetadata sets mayWriteFilesystem for inspect_signature. The regression explicitly checks signature writesFilesystem, process launch and no target mutation. This directly restores discovery truthfulness and does not require changing denied-temp-storage behavior. Implementation: [toolEffects.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/contracts/toolEffects.ts#L608), [NativeMacOSProviderMetadata.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/native/NativeMacOSProviderMetadata.ts#L65). The relevant regression checks in [toolEffects.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/contracts/toolEffects.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 01:08:45 +00:00

[PR #3286] [MERGED] docs(contributing): require human ownership and review readiness #5700

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3286

No description provided.

Rows
Columns