morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5433] [Bug] trace-native-values hides the provider reason when its seed selector fails #3292

New issue

Closed

opened 2026-10-31 00:38:51 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:38:51 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5433

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

Source-derived report: when an unknown procedure selector fails seed analysis, trace-native-values discards the provider's actionable rejection and reports unreadable_output, with a generic instruction to run rea doctor. The equivalent function request preserves the unknown-selector reason and invalid_request classification.

Caller requests, with program standing for a valid Mach-O target successfully opened and analyzed by Hopper:

node scripts/rea.mjs function program definitely-not-a-function --provider hopper --json
node scripts/rea.mjs trace-native-values program definitely-not-a-function --provider hopper --json

These real-provider commands are a source-derived recipe, not an executed Hopper reproduction. The finding was independently verified by conclusive static proof. A supplemental controlled CLI/provider-fixture comparison reproduced the error replacement; its scope is described below.

Reproduction

No real Hopper runtime reproduction was executed. Static inspection follows the nonempty selector from src/cli/coreNativeCommands.ts:121-199 through DirectAnalysis.ts:434-458 and EnhancedTools.ts into the seed workflow. Hopper advertises analyze_function; no selector-resolution guard intercepts this request before the bridge.

The independent verifier also ran one temporary test through HopperFixtureLauncher, the public serveCli adapter, and the actual provider/session/workflow/projection code. It used an isolated Mach-O target and isolated HOME/XDG directories, injecting only an unsuccessful HopperClient.callTool response for analyze_function and the missing selector. The successful control used the normal socket-fixture dossier.

The verifier executed that temporary test with Vitest: one test passed, reproducing the direct/trace diagnostic difference once. The temporary test was removed afterward and is not shipped in the repository. The known fixture selector returned exit 0 with Provider has no native def-use model, confirming that missing def-use data alone does not cause the seed failure.

Expected behavior

Preserve the meaningful provider reason and request-failure classification so the caller can correct the selector. docs/cli.md:187-188 promises that provider failures retain their original reason; AGENTS.md also requires meaningful failure reasons to survive boundaries. Rejecting an unknown selector is appropriate, but a well-formed provider request rejection should not become a diagnosis of unreadable analysis output.

Impact and scope

Unknown seed selectors lose actionable diagnostics and machine-readable request classification, steering callers toward engine diagnostics instead of correcting the request. This is bounded to unsuccessful seed analysis. No valid-graph corruption, data loss, or security impact is established. Recovery workaround: request the same selector through function to obtain the original diagnostic, then correct the selector. The fixture comparison demonstrated diagnostic preservation on that direct path. Real Hopper frequency and Ghidra triggering remain untested.

REA version

6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8. Upstream checked at 052956af3416fa01d93837e54fdec3ad2739f6d1; no intervening changes to the cited contract/failure-path files.

Runtime and platform

Verifier: Node.js 26.12.0, macOS arm64, Vitest 5.0.3. Installed Hopper bundle reported 6.1.0-demo, but no actual Hopper analysis was started. NOT_ENOUGH_INFO: exact macOS version was not recorded; real-provider execution was not performed.

Target and artifact context

Disposable Mach-O target copied from the platform's true executable for the controlled fixture comparison. The source-derived path assumes a valid target whose Hopper initial analysis completes and a nonexistent nonhexadecimal selector. No private target is required.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Supplemental fixture comparison, both failing calls exiting 1:

function:
  code: invalid_request
  category: invalid_input
  message: Hopper analyze_function failed (-32000, invalid_request): Unknown Hopper address or name: definitely-not-a-function
  remediation.action: Correct the reported address, document, or arguments and retry.

trace-native-values:
  code: unreadable_output
  category: execution_failure
  details.reason: No seed function could be analyzed
  message: Analysis returned an unreadable result. Run `rea doctor` and review the reported details; repeating the unchanged request is not expected to succeed.

Static proof at the source revision above:

bridge/hopper_bridge.py:239-258,271-275,626-628,1113-1135: the absent nonhexadecimal name produces InvalidRequestError; the bridge preserves its reason and diagnostic type.
src/hopper/HopperProvider.ts:314-333: unsuccessful provider results pass through unchanged.
src/application/native/NativeValueTrace.ts:93-112: the failed seed's message is placed in a local unknown, then traversal continues with no pending seed.
NativeValueTrace.ts:347-354: no successful dossier assigned a target digest, so a new AnalysisOutputError replaces the original failure and discards the local unknown.
src/domain/analysisErrorProjection.ts:222-224 and analysisErrorPresentation.ts:372: the replacement becomes unreadable_output and the generic doctor guidance.

Typed outcome or recovery expected

Retain the selector-specific provider failure and appropriate request-correction guidance. Preserve the successful-dossier/no-def-use unknown result and existing cancellation and later-procedure partial-result behavior. The differing retryable flags are evidence of changed projection, not a claim that an unchanged invalid request should succeed on retry.

Analysis or suspected cause

Source-derived: the failed initial seed follows the same local-unknown path as a failed later procedure, but the final no-target-digest branch replaces all initial failure information with an output error. Hopper's missing native def-use model does not prevent this path because seed analysis occurs first.

Additional context

Prepared with AI assistance and independently verified by static proof, with a supplemental controlled CLI comparison that reproduced the replacement. No real Hopper run or Ghidra verification is claimed. NOT_ENOUGH_INFO: no last-known-good version or regression window was established.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5433 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior **Source-derived report:** when an unknown procedure selector fails seed analysis, `trace-native-values` discards the provider's actionable rejection and reports `unreadable_output`, with a generic instruction to run `rea doctor`. The equivalent `function` request preserves the unknown-selector reason and `invalid_request` classification. Caller requests, with `program` standing for a valid Mach-O target successfully opened and analyzed by Hopper: ```sh node scripts/rea.mjs function program definitely-not-a-function --provider hopper --json node scripts/rea.mjs trace-native-values program definitely-not-a-function --provider hopper --json ``` These real-provider commands are a source-derived recipe, not an executed Hopper reproduction. The finding was independently verified by conclusive static proof. A supplemental controlled CLI/provider-fixture comparison reproduced the error replacement; its scope is described below. ### Reproduction No real Hopper runtime reproduction was executed. Static inspection follows the nonempty selector from `src/cli/coreNativeCommands.ts:121-199` through `DirectAnalysis.ts:434-458` and `EnhancedTools.ts` into the seed workflow. Hopper advertises `analyze_function`; no selector-resolution guard intercepts this request before the bridge. The independent verifier also ran one temporary test through `HopperFixtureLauncher`, the public `serveCli` adapter, and the actual provider/session/workflow/projection code. It used an isolated Mach-O target and isolated HOME/XDG directories, injecting only an unsuccessful `HopperClient.callTool` response for `analyze_function` and the missing selector. The successful control used the normal socket-fixture dossier. The verifier executed that temporary test with Vitest: one test passed, reproducing the direct/trace diagnostic difference once. The temporary test was removed afterward and is not shipped in the repository. The known `fixture` selector returned exit 0 with `Provider has no native def-use model`, confirming that missing def-use data alone does not cause the seed failure. ### Expected behavior Preserve the meaningful provider reason and request-failure classification so the caller can correct the selector. `docs/cli.md:187-188` promises that provider failures retain their original reason; `AGENTS.md` also requires meaningful failure reasons to survive boundaries. Rejecting an unknown selector is appropriate, but a well-formed provider request rejection should not become a diagnosis of unreadable analysis output. ### Impact and scope Unknown seed selectors lose actionable diagnostics and machine-readable request classification, steering callers toward engine diagnostics instead of correcting the request. This is bounded to unsuccessful seed analysis. No valid-graph corruption, data loss, or security impact is established. Recovery workaround: request the same selector through `function` to obtain the original diagnostic, then correct the selector. The fixture comparison demonstrated diagnostic preservation on that direct path. Real Hopper frequency and Ghidra triggering remain untested. ### REA version 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. Upstream checked at `052956af3416fa01d93837e54fdec3ad2739f6d1`; no intervening changes to the cited contract/failure-path files. ### Runtime and platform Verifier: Node.js 26.12.0, macOS arm64, Vitest 5.0.3. Installed Hopper bundle reported 6.1.0-demo, but no actual Hopper analysis was started. NOT_ENOUGH_INFO: exact macOS version was not recorded; real-provider execution was not performed. ### Target and artifact context Disposable Mach-O target copied from the platform's `true` executable for the controlled fixture comparison. The source-derived path assumes a valid target whose Hopper initial analysis completes and a nonexistent nonhexadecimal selector. No private target is required. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence Supplemental fixture comparison, both failing calls exiting 1: ```text function: code: invalid_request category: invalid_input message: Hopper analyze_function failed (-32000, invalid_request): Unknown Hopper address or name: definitely-not-a-function remediation.action: Correct the reported address, document, or arguments and retry. trace-native-values: code: unreadable_output category: execution_failure details.reason: No seed function could be analyzed message: Analysis returned an unreadable result. Run `rea doctor` and review the reported details; repeating the unchanged request is not expected to succeed. ``` Static proof at the source revision above: - `bridge/hopper_bridge.py:239-258,271-275,626-628,1113-1135`: the absent nonhexadecimal name produces `InvalidRequestError`; the bridge preserves its reason and diagnostic type. - `src/hopper/HopperProvider.ts:314-333`: unsuccessful provider results pass through unchanged. - [`src/application/native/NativeValueTrace.ts:93-112`](https://github.com/morluto/rea/blob/074768901f3cdc8205b61773fb1faf6f6c7b3ca8/src/application/native/NativeValueTrace.ts#L93): the failed seed's message is placed in a local unknown, then traversal continues with no pending seed. - [`NativeValueTrace.ts:347-354`](https://github.com/morluto/rea/blob/074768901f3cdc8205b61773fb1faf6f6c7b3ca8/src/application/native/NativeValueTrace.ts#L347): no successful dossier assigned a target digest, so a new `AnalysisOutputError` replaces the original failure and discards the local unknown. - `src/domain/analysisErrorProjection.ts:222-224` and `analysisErrorPresentation.ts:372`: the replacement becomes `unreadable_output` and the generic doctor guidance. ### Typed outcome or recovery expected Retain the selector-specific provider failure and appropriate request-correction guidance. Preserve the successful-dossier/no-def-use unknown result and existing cancellation and later-procedure partial-result behavior. The differing retryable flags are evidence of changed projection, not a claim that an unchanged invalid request should succeed on retry. ### Analysis or suspected cause Source-derived: the failed initial seed follows the same local-unknown path as a failed later procedure, but the final no-target-digest branch replaces all initial failure information with an output error. Hopper's missing native def-use model does not prevent this path because seed analysis occurs first. ### Additional context Prepared with AI assistance and independently verified by static proof, with a supplemental controlled CLI comparison that reproduced the replacement. No real Hopper run or Ghidra verification is claimed. NOT_ENOUGH_INFO: no last-known-good version or regression window was established.

bsakaguchi closed this issue

2026-10-31 00:38:52 +00:00

bsakaguchi commented

2026-10-31 00:38:53 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 21, 2026):

Independently reproduced an additional no-target trigger over the real stdio MCP server (REA 6.7.0, commit 9d8e7803326a382cbbb3ffdb900f5e93e5442d68, isolated HOME/XDG/TMPDIR, no target opened): {"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"trace_native_values","arguments":{"procedure":"0x1000","max_depth":3,"max_functions":16,"max_call_sites":256,"max_nodes":5000,"max_edges":10000,"offset":0,"limit":1000}}} uses the tool's advertised example and returns unreadable_output / execution_failure, details.reason: "No seed function could be analyzed", and rea doctor advice. The control procedure_info({"procedure":"main"}) on the same connection returns target_unavailable / unavailable with “No app is open” and open_binary guidance; the trace should preserve that missing-target diagnostic too. Source inspection shows this reaches the same error-replacement branch: the failed seed's cause is replaced by generic unreadable_output when no successful dossier supplies a target digest. No Hopper, Ghidra, or IDA was opened. After fetching main, the requested native/projection path check showed intervening commits: verified at baseline; main not re-run.

@coygeek commented on GitHub (Oct 21, 2026): Independently reproduced an additional no-target trigger over the real stdio MCP server (REA 6.7.0, commit `9d8e7803326a382cbbb3ffdb900f5e93e5442d68`, isolated HOME/XDG/TMPDIR, no target opened): `{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"trace_native_values","arguments":{"procedure":"0x1000","max_depth":3,"max_functions":16,"max_call_sites":256,"max_nodes":5000,"max_edges":10000,"offset":0,"limit":1000}}}` uses the tool's advertised example and returns `unreadable_output` / `execution_failure`, `details.reason: "No seed function could be analyzed"`, and `rea doctor` advice. The control `procedure_info({"procedure":"main"})` on the same connection returns `target_unavailable` / `unavailable` with “No app is open” and `open_binary` guidance; the trace should preserve that missing-target diagnostic too. Source inspection shows this reaches the same error-replacement branch: the failed seed's cause is replaced by generic `unreadable_output` when no successful dossier supplies a target digest. No Hopper, Ghidra, or IDA was opened. After fetching main, the requested native/projection path check showed intervening commits: verified at baseline; main not re-run.

bsakaguchi commented

2026-10-31 00:38:53 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

NativeValueTrace now returns the original seed failure immediately at depth zero. Later-procedure failures remain unknown trace observations, preserving partial-trace behavior. Tests inject unknown-selector AnalysisInputError, NoBinaryOpenError, resource failure and cancellation and require identity equality with the exact original object and only one seed attempt.

Implementation: NativeValueTrace.ts, NativeValueTrace.test.ts.

The relevant regression checks in NativeValueTrace.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. NativeValueTrace now returns the original seed failure immediately at depth zero. Later-procedure failures remain unknown trace observations, preserving partial-trace behavior. Tests inject unknown-selector AnalysisInputError, NoBinaryOpenError, resource failure and cancellation and require identity equality with the exact original object and only one seed attempt. Implementation: [NativeValueTrace.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/native/NativeValueTrace.ts#L104), [NativeValueTrace.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/native/NativeValueTrace.test.ts#L112). The relevant regression checks in [NativeValueTrace.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/native/NativeValueTrace.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 01:08:47 +00:00

[PR #3292] [CLOSED] fix(mcp): include every retained inventory substep in prompt completion #5704

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3292

No description provided.

Rows
Columns