morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #6467] [Bug] decompile and related CLI schemas omit required selector choices #3877

New issue

Closed

opened 2026-10-31 00:44:51 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:44:51 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6467

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

decompile, function, instructions, trace, search, and xrefs advertise the positional selector and its named alternative as optional, without stating that a selector must be supplied. Their --schema --json output accepts a target path with empty options, but invoking that request exits 1 with invalid_request / missing_argument before target admission.

instrument-with-frida has the same discovery omission for a required choice: its schema accepts attach 1 without either script option, but the command exits 1 with a script issue saying exactly one of --script or --script-file is required. Neither its schema nor help states this rule.

Reproduction

From a fresh source checkout, prepare the specified baseline:

git checkout 9eb829aca34be36ff112826337996f6139f82eff
npm ci && npm run build:cached

Then run the following. Failed commands are expected; do not enable exit-on-error. The empty directory is an inert fixture sufficient to expose selector validation; no binary, GUI, device or configured provider is needed.

WORK=$(mktemp -d)
export HOME="$WORK/home"
mkdir -p "$HOME" "$WORK/target"

for command in decompile function instructions trace search xrefs; do
  node scripts/rea.mjs "$command" --schema --json
  node scripts/rea.mjs "$command" --help
  node scripts/rea.mjs "$command" "$WORK/target" --json
done

node scripts/rea.mjs instrument-with-frida --schema --json
node scripts/rea.mjs instrument-with-frida --help
node scripts/rea.mjs instrument-with-frida attach 1 --json

# Controls that pass selector validation, then stop safely at another check:
node scripts/rea.mjs function "$WORK/target" main --json
node scripts/rea.mjs function "$WORK/target" --procedure=main --json
node scripts/rea.mjs instrument-with-frida attach abc --script 'send(1)' --json

Each of the seven omitted-selection failures was observed twice. Schema/help and each control were observed once. Verification used already installed locked dependencies and a supplied built runtime; the fresh-checkout install/build lines above are preparation instructions, not a claim of a newly performed build.

Expected behavior

Discovery should state the existing required choice before invocation: at least one positional/named selector for binary commands, including decompile --file-offset, and exactly one script source for Frida. Individually optional alternatives are valid, but their combined requirement needs a constraint or explicit guidance. Do not make the positional selector mandatory in a way that rejects named-option callers.

The tool design contract calls for explicit required inputs and checking advertised schemas through consumers. Global help identifies --schema as “Show JSON Schema for command”; the discovery projection documentation in source connects command schemas to help and LLM manifests.

Impact and scope

P2: schema-driven scripts and agents can construct accepted-by-discovery requests that predictably fail before useful work. The errors provide a practical workaround: supply the named or positional selector, or one script source. No target actions or evidence corruption were observed. The function controls passed selector validation and reached target admission; they do not establish successful analysis. The Frida control reached PID validation without contacting a process.

REA version

6.7.0 (source 9eb829aca3)

Runtime and platform

Node.js v26.12.1; macOS 27.0.1; arm64. The repository's pinned Node.js version was not exercised. No Hopper, Ghidra or Frida provider was invoked.

Target and artifact context

An empty local directory for binary commands; PID text 1 only for Frida's missing-script validation, and deliberately invalid PID text abc for the script-present control. No process attachment occurred.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

All six binary schemas report args.required: ["path"], no options.required, and no selector-choice guidance. Ajv2020 compiled each complete emitted args/options schema and accepted {path: "<target-directory>"} and {} respectively. Frida likewise accepted {mode: "attach", target: "1"} and {}.

Help includes Usage: rea decompile <path> [address] [options]. The other binary help synopses also bracket the selector. Frida help lists both script flags without the required-choice rule. decompile --llms-full explicitly marks address as Required: no; its options and Frida's manifest omit the relationship.

Observed omission errors, reduced to relevant fields:

command(s)                           code             issue path   issue reason
decompile, function, instructions    invalid_request  procedure    missing_argument
trace                                invalid_request  query        missing_argument
search                               invalid_request  pattern      missing_argument
xrefs                                invalid_request  address      missing_argument
instrument-with-frida                invalid_request  script       invalid_value

Frida's issue message is Provide exactly one of --script or --script-file. Both function controls instead return target_unavailable with constraint: directory_requires_file. The script-present Frida control identifies target with attach mode needs a positive integer process ID.

Typed outcome or recovery expected

Keep missing/conflicting-selector validation and its actionable errors. Advertise the required choice so callers can supply it on their first call. Restoration should preserve both positional and named selector controls and Frida's rejection when both script sources are supplied. These are proposed checks, not a claimed repair.

Analysis or suspected cause

Source-derived: function registration declares both fields optional, then the shared selector resolver rejects omission inside the handler. The sibling binary commands use that resolver too. Frida's declarations are separately optional; its required-choice guard also runs after schema parsing. The emitted schemas reflect those declarations without exposing the later requirements.

Additional context

No duplicate found in the checked open/closed issue searches. Related reports cover different behavior: #1169 (defaulted fields wrongly required), #5845 (requiredness test oracle), #1186 (xrefs symbol-name admission), #2213 (missing Frida error diagnostics), and #5092 (MCP process-list device choice). NOT_ENOUGH_INFO: no last-known-good release or published-package runtime was tested.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6467 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area CLI ### Observed behavior `decompile`, `function`, `instructions`, `trace`, `search`, and `xrefs` advertise the positional selector and its named alternative as optional, without stating that a selector must be supplied. Their `--schema --json` output accepts a target path with empty options, but invoking that request exits 1 with `invalid_request` / `missing_argument` before target admission. `instrument-with-frida` has the same discovery omission for a required choice: its schema accepts `attach 1` without either script option, but the command exits 1 with a script issue saying exactly one of `--script` or `--script-file` is required. Neither its schema nor help states this rule. ### Reproduction From a fresh source checkout, prepare the specified baseline: ```sh git checkout 9eb829aca34be36ff112826337996f6139f82eff npm ci && npm run build:cached ``` Then run the following. Failed commands are expected; do not enable exit-on-error. The empty directory is an inert fixture sufficient to expose selector validation; no binary, GUI, device or configured provider is needed. ```sh WORK=$(mktemp -d) export HOME="$WORK/home" mkdir -p "$HOME" "$WORK/target" for command in decompile function instructions trace search xrefs; do node scripts/rea.mjs "$command" --schema --json node scripts/rea.mjs "$command" --help node scripts/rea.mjs "$command" "$WORK/target" --json done node scripts/rea.mjs instrument-with-frida --schema --json node scripts/rea.mjs instrument-with-frida --help node scripts/rea.mjs instrument-with-frida attach 1 --json # Controls that pass selector validation, then stop safely at another check: node scripts/rea.mjs function "$WORK/target" main --json node scripts/rea.mjs function "$WORK/target" --procedure=main --json node scripts/rea.mjs instrument-with-frida attach abc --script 'send(1)' --json ``` Each of the seven omitted-selection failures was observed twice. Schema/help and each control were observed once. Verification used already installed locked dependencies and a supplied built runtime; the fresh-checkout install/build lines above are preparation instructions, not a claim of a newly performed build. ### Expected behavior Discovery should state the existing required choice before invocation: at least one positional/named selector for binary commands, including `decompile --file-offset`, and exactly one script source for Frida. Individually optional alternatives are valid, but their combined requirement needs a constraint or explicit guidance. Do not make the positional selector mandatory in a way that rejects named-option callers. The [tool design contract](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/docs/tool-design.md#L46-L50) calls for explicit required inputs and [checking advertised schemas through consumers](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/docs/tool-design.md#L180-L190). Global help identifies `--schema` as “Show JSON Schema for command”; the [discovery projection documentation in source](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/src/cli/omittableDefaults.ts#L10-L17) connects command schemas to help and LLM manifests. ### Impact and scope P2: schema-driven scripts and agents can construct accepted-by-discovery requests that predictably fail before useful work. The errors provide a practical workaround: supply the named or positional selector, or one script source. No target actions or evidence corruption were observed. The function controls passed selector validation and reached target admission; they do not establish successful analysis. The Frida control reached PID validation without contacting a process. ### REA version 6.7.0 (source 9eb829aca34be36ff112826337996f6139f82eff) ### Runtime and platform Node.js v26.12.1; macOS 27.0.1; arm64. The repository's pinned Node.js version was not exercised. No Hopper, Ghidra or Frida provider was invoked. ### Target and artifact context An empty local directory for binary commands; PID text `1` only for Frida's missing-script validation, and deliberately invalid PID text `abc` for the script-present control. No process attachment occurred. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence All six binary schemas report `args.required: ["path"]`, no `options.required`, and no selector-choice guidance. Ajv2020 compiled each complete emitted args/options schema and accepted `{path: "<target-directory>"}` and `{}` respectively. Frida likewise accepted `{mode: "attach", target: "1"}` and `{}`. Help includes `Usage: rea decompile <path> [address] [options]`. The other binary help synopses also bracket the selector. Frida help lists both script flags without the required-choice rule. `decompile --llms-full` explicitly marks `address` as `Required: no`; its options and Frida's manifest omit the relationship. Observed omission errors, reduced to relevant fields: ```text command(s) code issue path issue reason decompile, function, instructions invalid_request procedure missing_argument trace invalid_request query missing_argument search invalid_request pattern missing_argument xrefs invalid_request address missing_argument instrument-with-frida invalid_request script invalid_value ``` Frida's issue message is `Provide exactly one of --script or --script-file.` Both function controls instead return `target_unavailable` with `constraint: directory_requires_file`. The script-present Frida control identifies `target` with `attach mode needs a positive integer process ID.` ### Typed outcome or recovery expected Keep missing/conflicting-selector validation and its actionable errors. Advertise the required choice so callers can supply it on their first call. Restoration should preserve both positional and named selector controls and Frida's rejection when both script sources are supplied. These are proposed checks, not a claimed repair. ### Analysis or suspected cause Source-derived: [function registration](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/src/cli/coreBinaryCommands.ts#L338-L374) declares both fields optional, then [the shared selector resolver](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/src/cli/analysisSelector.ts#L18-L27) rejects omission inside the handler. The sibling binary commands use that resolver too. [Frida's declarations](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/src/cli/fridaCommands.ts#L177-L182) are separately optional; [its required-choice guard](https://github.com/morluto/rea/blob/9eb829aca34be36ff112826337996f6139f82eff/src/cli/fridaCommands.ts#L222-L239) also runs after schema parsing. The emitted schemas reflect those declarations without exposing the later requirements. ### Additional context No duplicate found in the checked open/closed issue searches. Related reports cover different behavior: #1169 (defaulted fields wrongly required), #5845 (requiredness test oracle), #1186 (xrefs symbol-name admission), #2213 (missing Frida error diagnostics), and #5092 (MCP process-list device choice). NOT_ENOUGH_INFO: no last-known-good release or published-package runtime was tested.

bsakaguchi closed this issue

2026-10-31 00:44:52 +00:00

bsakaguchi commented

2026-10-31 00:44:52 +00:00

Author

Owner

@mvanhorn commented on GitHub (Oct 23, 2026):

Implemented in https://github.com/morluto/rea/pull/6759.

@mvanhorn commented on GitHub (Oct 23, 2026): Implemented in https://github.com/morluto/rea/pull/6759.

bsakaguchi referenced this issue

2026-10-31 00:45:37 +00:00

[GH-ISSUE #6572] [Bug] Invalid managed signature type references are reported decoded with complete coverage #3963