[GH-ISSUE #5503] [Bug] trace_feature drops Hopper string encoding and termination qualifications #3351

New issue

Closed

opened 2026-10-31 00:39:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:39:26 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5503

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

MCP or agent integration

Observed behavior

With the Hopper provider, trace_feature called with {"query":"needle"} returns string matches without the provider display or string qualifications available from search_strings on the same open target. An independent verifier ran the production MCP sequence once: all three matching string address/value pairs survived, but each trace match contained only type, address, and value. The corresponding search rows retained provider_value, inferred encoding status, byte length, and termination. All calls succeeded; the trace also returned two procedure matches and eight references.

Reproduction

The independent verifier compiled this fixture on arm64 macOS:

cat > trace_fixture.c <<'C'
#include <stdio.h>
const char *needle_one = "needle feature alpha";
const char *needle_two = "needle feature beta";
static const char *dead_needle = "needle feature unreachable";
int needle_function(int x) { return x + 42; }
int unused_needle_function(int x) { return x + dead_needle[0]; }
int main(void) { printf("%s %s %d\n", needle_one, needle_two, needle_function(1)); return 0; }
C
clang -O0 -g -o trace_fixture trace_fixture.c

From the built source checkout, start node scripts/rea.mjs mcp through an MCP client, using isolated HOME, XDG configuration/data/cache/state directories and a disposable temporary runtime directory. The verified run used the installed Hopper launcher and no saved database.
Call open_binary with {"path":"<absolute path to trace_fixture>","provider_id":"hopper"}.
On the same connection, call search_strings with {"pattern":"needle","mode":"literal"}.
Call trace_feature with {"query":"needle"}. Compare its structuredContent.normalized_result.matches string entries with the search's structuredContent.normalized_result rows at the same addresses.
Call close_binary, then close the client and transport. The verified close succeeded.

This completed once through the real Hopper provider with no retry. A separate assertion over saved responses confirmed the three matching address/value pairs and missing qualifications. No CLI comparison was run.

Expected behavior

String trace matches should retain the available provider display and qualifications from the string rows they return. Source-derived expectation: docs/native-investigation.md:194-200 requires Hopper string results to retain provider display, encoding, byte length, termination, and applicable decoding uncertainty; AGENTS.md:19 requires consumers to preserve uncertainty and source evidence across boundaries; docs/tool-design.md:51-60 requires relevant confidence/limitations inline and preservation of partial provider facts.

Impact and scope

The tested trace loses meaningful string provenance and encoding/termination qualifications, requiring another call to interpret its matches accurately. All three tested strings were affected; addresses, text, and references remained available. The same-session search provides a verified workaround for these objects: join its rows to the trace by address. Other providers, undecodable strings, unterminated objects, and frequency beyond this single run were not tested. No security boundary crossing was established.

REA version

6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8, built with locked dependencies.

Runtime and platform

Node.js v26.12.0; macOS 27.0.1; arm64; Hopper Disassembler 6.1.0-demo, build 42.6295552.

Target and artifact context

Freshly compiled arm64 Mach-O C fixture above; no saved Hopper database.

Interface

MCP

Earliest failure stage

Transport or result projection

Relevant output or evidence

The verifier captured this pair from the successful same-session MCP calls:

{
  "search_row": {
    "address": "0x1000005b0",
    "value": "needle feature alpha",
    "provider_value": "needle feature alpha",
    "string": {
      "encoding": "utf-8",
      "encoding_status": "inferred",
      "termination": "present_or_not_required",
      "byte_length": 21
    }
  },
  "trace_match": {
    "type": "string",
    "address": "0x1000005b0",
    "value": "needle feature alpha"
  }
}

The other two search rows had byte lengths 20 and 27 and the same encoding/status/termination fields; their trace matches likewise omitted the qualifications. The probe exited 0 with empty captured stderr.

Typed outcome or recovery expected

Retain the original string matches and useful references while carrying through each search row's available provider_value and string qualifications. Procedure matches should not acquire fabricated string qualifications.

Analysis or suspected cause

Source-derived corroboration at the tested revision: src/application/EnhancedTools.ts:208-217 dispatches to traceLiteralFeature; src/application/EnhancedLiteralTracing.ts:85-110 parses search rows down to address/value and maps them to address/name, and line 132 constructs only type/address/value. The advertised match schema at src/contracts/toolOutputSchemaGroups.ts:233-242 likewise has only those three fields.

The upstream check fetched origin/main at c374c2fe7290b914d73d9e27af38b498753ec593. The tracing implementation, dispatch, and cited preservation contracts were unchanged from the tested revision. The later change to the output-schema file concerns other operations and leaves the trace match schema unchanged; no later runtime reproduction is claimed.

Additional context

Prepared with AI assistance and independently reproduced by a separate verifier through the real Hopper MCP provider. This report claims runtime evidence only for the three decodable UTF-8 objects above; source inspection corroborates the projection loss. A proposed restoration check is to repeat the same-session comparison and retain each matching row's available qualifications without dropping matches or references.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5503 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area MCP or agent integration ### Observed behavior With the Hopper provider, `trace_feature` called with `{"query":"needle"}` returns string matches without the provider display or string qualifications available from `search_strings` on the same open target. An independent verifier ran the production MCP sequence once: all three matching string address/value pairs survived, but each trace match contained only `type`, `address`, and `value`. The corresponding search rows retained `provider_value`, inferred encoding status, byte length, and termination. All calls succeeded; the trace also returned two procedure matches and eight references. ### Reproduction The independent verifier compiled this fixture on arm64 macOS: ```sh cat > trace_fixture.c <<'C' #include <stdio.h> const char *needle_one = "needle feature alpha"; const char *needle_two = "needle feature beta"; static const char *dead_needle = "needle feature unreachable"; int needle_function(int x) { return x + 42; } int unused_needle_function(int x) { return x + dead_needle[0]; } int main(void) { printf("%s %s %d\n", needle_one, needle_two, needle_function(1)); return 0; } C clang -O0 -g -o trace_fixture trace_fixture.c ``` 1. From the built source checkout, start `node scripts/rea.mjs mcp` through an MCP client, using isolated HOME, XDG configuration/data/cache/state directories and a disposable temporary runtime directory. The verified run used the installed Hopper launcher and no saved database. 2. Call `open_binary` with `{"path":"<absolute path to trace_fixture>","provider_id":"hopper"}`. 3. On the same connection, call `search_strings` with `{"pattern":"needle","mode":"literal"}`. 4. Call `trace_feature` with `{"query":"needle"}`. Compare its `structuredContent.normalized_result.matches` string entries with the search's `structuredContent.normalized_result` rows at the same addresses. 5. Call `close_binary`, then close the client and transport. The verified close succeeded. This completed once through the real Hopper provider with no retry. A separate assertion over saved responses confirmed the three matching address/value pairs and missing qualifications. No CLI comparison was run. ### Expected behavior String trace matches should retain the available provider display and qualifications from the string rows they return. Source-derived expectation: `docs/native-investigation.md:194-200` requires Hopper string results to retain provider display, encoding, byte length, termination, and applicable decoding uncertainty; `AGENTS.md:19` requires consumers to preserve uncertainty and source evidence across boundaries; `docs/tool-design.md:51-60` requires relevant confidence/limitations inline and preservation of partial provider facts. ### Impact and scope The tested trace loses meaningful string provenance and encoding/termination qualifications, requiring another call to interpret its matches accurately. All three tested strings were affected; addresses, text, and references remained available. The same-session search provides a verified workaround for these objects: join its rows to the trace by address. Other providers, undecodable strings, unterminated objects, and frequency beyond this single run were not tested. No security boundary crossing was established. ### REA version 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`, built with locked dependencies. ### Runtime and platform Node.js v26.12.0; macOS 27.0.1; arm64; Hopper Disassembler 6.1.0-demo, build 42.6295552. ### Target and artifact context Freshly compiled arm64 Mach-O C fixture above; no saved Hopper database. ### Interface MCP ### Earliest failure stage Transport or result projection ### Relevant output or evidence The verifier captured this pair from the successful same-session MCP calls: ```json { "search_row": { "address": "0x1000005b0", "value": "needle feature alpha", "provider_value": "needle feature alpha", "string": { "encoding": "utf-8", "encoding_status": "inferred", "termination": "present_or_not_required", "byte_length": 21 } }, "trace_match": { "type": "string", "address": "0x1000005b0", "value": "needle feature alpha" } } ``` The other two search rows had byte lengths 20 and 27 and the same encoding/status/termination fields; their trace matches likewise omitted the qualifications. The probe exited 0 with empty captured stderr. ### Typed outcome or recovery expected Retain the original string matches and useful references while carrying through each search row's available `provider_value` and `string` qualifications. Procedure matches should not acquire fabricated string qualifications. ### Analysis or suspected cause Source-derived corroboration at the tested revision: `src/application/EnhancedTools.ts:208-217` dispatches to `traceLiteralFeature`; `src/application/EnhancedLiteralTracing.ts:85-110` parses search rows down to address/value and maps them to address/name, and line 132 constructs only type/address/value. The advertised match schema at `src/contracts/toolOutputSchemaGroups.ts:233-242` likewise has only those three fields. The upstream check fetched `origin/main` at `c374c2fe7290b914d73d9e27af38b498753ec593`. The tracing implementation, dispatch, and cited preservation contracts were unchanged from the tested revision. The later change to the output-schema file concerns other operations and leaves the trace match schema unchanged; no later runtime reproduction is claimed. ### Additional context Prepared with AI assistance and independently reproduced by a separate verifier through the real Hopper MCP provider. This report claims runtime evidence only for the three decodable UTF-8 objects above; source inspection corroborates the projection loss. A proposed restoration check is to repeat the same-session comparison and retain each matching row's available qualifications without dropping matches or references.

bsakaguchi closed this issue

2026-10-31 00:39:26 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:43 +00:00

[PR #4144] [CLOSED] fix(managed): match Windows module paths independently of the host #6084