[GH-ISSUE #6491] [Bug] inspect-native-api rejects Objective-C instance-method selectors as flags #3892

New issue

Closed

opened 2026-10-31 00:45:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:00 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6491

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Deduplication covered the open issue and PR inventories plus targeted tracker searches across open and closed issues for the command, Objective-C selectors, leading-dash arguments, and flag errors. No matching open report was found. Related #6467 concerns omitted selector requirements in other commands, rather than refusal of a supplied valid symbol.

Area

CLI

Observed behavior

inspect-native-api advertises a procedure name or address but parses an Objective-C instance-method name such as -[Widget run] as a short option. It exits 1 with Unknown flag: -[. Quoting the argument does not help. The usual -- separator is rejected, and this command has no named --procedure alternative. In the same initial probe, decompile --procedure='-[Widget run]' passed selector parsing and reached target admission.

The executed probes deliberately used an absent target to isolate argument parsing. Applicability to an existing native binary containing that symbol is source-derived: parsing fails before the command handler can examine or open its target. No real-provider analysis was run.

Reproduction

The following five argument combinations were each executed once against the centrally prepared build of the revision below, in a disposable working directory with isolated HOME/XDG/TMPDIR directories. absent.bin did not exist. From a prepared checkout, set REA_ENTRYPOINT to its absolute scripts/rea.mjs path, change into a fresh disposable directory, and run:

node "$REA_ENTRYPOINT" inspect-native-api absent.bin main --json
node "$REA_ENTRYPOINT" inspect-native-api absent.bin '-[Widget run]' --json
node "$REA_ENTRYPOINT" inspect-native-api absent.bin -- '-[Widget run]' --json
node "$REA_ENTRYPOINT" inspect-native-api absent.bin '--procedure=-[Widget run]' --json
node "$REA_ENTRYPOINT" decompile absent.bin '--procedure=-[Widget run]' --json

All five exited 1 with empty stderr. The first and fifth reached target admission and returned target_unavailable. The other three failed in argument parsing, with the exact messages below. The shared native procedure input schema was also evaluated once with {procedure:'-[Widget run]'} and returned success with the unchanged string. This establishes the parser defect without claiming a successful analysis of a real Objective-C target.

Proposed valid-target check, not executed: run inspect-native-api on a supported native binary with a provider-returned Objective-C instance-method symbol and a configured provider. The same current parser rejects the selector before opening that binary.

Expected behavior

Accept a supported procedure symbol unchanged and forward it to inspect_native_api, while retaining normal option validation. The CLI registration describes its selector as a procedure name or address and maps it directly to procedure. The canonical input permits a string procedure name, and the tool contract explicitly supports symbols as well as provider-returned addresses. Objective-C instance-method symbol spelling is represented in the project's metadata fixture.

Impact and scope

A caller cannot select a native API by an Objective-C instance-method name through this command, even when the name is quoted. The failure occurs before provider or target admission and writes no analysis data. Observed frequency is one failure for each of the three failing forms in the initial probe; no population frequency is claimed. Numeric provider-returned addresses and MCP are possible alternatives under the public contracts, but neither workaround was exercised with a real target. Other procedure-taking commands were not runtime-audited for this report.

REA version

6.7.0; source revision c106cf20cbfcec8e1fcd953ad8e52bdfbf8c3f9c.

Runtime and platform

Node.js v24.18.0, Linux x86_64; repository-pinned dependencies, including Incur 0.6.1. No Hopper, Ghidra, or other analysis provider was invoked.

Target and artifact context

Synthetic missing path absent.bin, intentionally used to distinguish parser rejection from target admission; synthetic selector -[Widget run]. No private binary or artifact was used.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Exact JSON diagnostics from the three failing forms:

{"code":"UNKNOWN","message":"Unknown flag: -["}
{"code":"UNKNOWN","message":"Unknown flag: --"}
{"code":"UNKNOWN","message":"Unknown flag: --procedure"}

Whitespace above is compacted; field values are unchanged. Both controls returned code: "target_unavailable" in their larger JSON results, showing that they passed parsing. The direct canonical-schema observation was:

{"success":true,"data":{"procedure":"-[Widget run]"}}

Expected source: CLI selector description and canonical symbol/address contract linked above.
Failure source: the initial five CLI invocations, plus the positional-only registration. No target check precedes parsing; the handler containing runDirectAnalysis is not entered for the rejected symbol.
Evidence provenance: observed parser diagnostics and controls; static proof that replacing the absent path with a supported existing target cannot change this earlier rejection.
Local verification: reproduced at the CLI parsing boundary. Real-target/provider reproduction was not run.
Reproduction completeness: complete for the parsing failure; no end-to-end native-analysis success claim.

Typed outcome or recovery expected

A valid symbol should reach the analysis workflow unchanged, producing its normal Evidence or a target/provider-specific refusal. Restoration signal: the exact Objective-C symbol reaches the handler as procedure, the absent-target parser fixture returns target_unavailable rather than Unknown flag, and an existing supported target can use its real provider-returned symbol. Keep positional main and numeric addresses working, and continue rejecting genuine unknown options. These are proposed checks, not post-report reruns.

Analysis or suspected cause

Source-derived: the command declares only the required positional address; its options contain native-open and snapshot selections, without an escaped/named procedure selector. The pinned Incur parser treats a token beginning with one dash as short options and does not provide a usable -- escape here, as directly observed. REA already supplies a named selector and conflict handling for decompile, which provides a concrete implementation direction for accepting this existing input contract. No provider change is needed to address the observed parsing boundary.

Additional context

NOT_ENOUGH_INFO: first affected release, last known good release, and real-provider behavior for the synthetic method were not established. The finding does not depend on a provider-specific parsing assumption. No report was rerun after drafting.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A documented symbol-selection path fails deterministically during CLI parsing for the ordinary Objective-C instance-method spelling; the observed failure is bounded to request admission and does not modify target data.
Workaround status: unverified
Workaround basis: The public contract also accepts provider-returned numeric addresses, and MCP accepts the string schema, but no real-target invocation through those alternatives was executed in this bounded adapter audit.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6491 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. Deduplication covered the open issue and PR inventories plus targeted tracker searches across open and closed issues for the command, Objective-C selectors, leading-dash arguments, and flag errors. No matching open report was found. Related #6467 concerns omitted selector requirements in other commands, rather than refusal of a supplied valid symbol. ### Area CLI ### Observed behavior `inspect-native-api` advertises a procedure name or address but parses an Objective-C instance-method name such as `-[Widget run]` as a short option. It exits 1 with `Unknown flag: -[`. Quoting the argument does not help. The usual `--` separator is rejected, and this command has no named `--procedure` alternative. In the same initial probe, `decompile --procedure='-[Widget run]'` passed selector parsing and reached target admission. The executed probes deliberately used an absent target to isolate argument parsing. Applicability to an existing native binary containing that symbol is source-derived: parsing fails before the command handler can examine or open its target. No real-provider analysis was run. ### Reproduction The following five argument combinations were each executed once against the centrally prepared build of the revision below, in a disposable working directory with isolated HOME/XDG/TMPDIR directories. `absent.bin` did not exist. From a prepared checkout, set `REA_ENTRYPOINT` to its absolute `scripts/rea.mjs` path, change into a fresh disposable directory, and run: ```sh node "$REA_ENTRYPOINT" inspect-native-api absent.bin main --json node "$REA_ENTRYPOINT" inspect-native-api absent.bin '-[Widget run]' --json node "$REA_ENTRYPOINT" inspect-native-api absent.bin -- '-[Widget run]' --json node "$REA_ENTRYPOINT" inspect-native-api absent.bin '--procedure=-[Widget run]' --json node "$REA_ENTRYPOINT" decompile absent.bin '--procedure=-[Widget run]' --json ``` All five exited 1 with empty stderr. The first and fifth reached target admission and returned `target_unavailable`. The other three failed in argument parsing, with the exact messages below. The shared native procedure input schema was also evaluated once with `{procedure:'-[Widget run]'}` and returned success with the unchanged string. This establishes the parser defect without claiming a successful analysis of a real Objective-C target. Proposed valid-target check, not executed: run `inspect-native-api` on a supported native binary with a provider-returned Objective-C instance-method symbol and a configured provider. The same current parser rejects the selector before opening that binary. ### Expected behavior Accept a supported procedure symbol unchanged and forward it to `inspect_native_api`, while retaining normal option validation. The [CLI registration](https://github.com/morluto/rea/blob/c106cf20cbfcec8e1fcd953ad8e52bdfbf8c3f9c/src/cli/coreNativeCommands.ts#L353-L377) describes its selector as a procedure name or address and maps it directly to `procedure`. The [canonical input](https://github.com/morluto/rea/blob/c106cf20cbfcec8e1fcd953ad8e52bdfbf8c3f9c/src/domain/native/nativeProcedureInput.ts#L3-L6) permits a string procedure name, and the [tool contract](https://github.com/morluto/rea/blob/c106cf20cbfcec8e1fcd953ad8e52bdfbf8c3f9c/src/contracts/functionWorkflowToolContracts.ts#L41-L44) explicitly supports symbols as well as provider-returned addresses. Objective-C instance-method symbol spelling is represented in the project's [metadata fixture](https://github.com/morluto/rea/blob/c106cf20cbfcec8e1fcd953ad8e52bdfbf8c3f9c/src/domain/native/objcSwiftMetadata.test.ts#L5-L14). ### Impact and scope A caller cannot select a native API by an Objective-C instance-method name through this command, even when the name is quoted. The failure occurs before provider or target admission and writes no analysis data. Observed frequency is one failure for each of the three failing forms in the initial probe; no population frequency is claimed. Numeric provider-returned addresses and MCP are possible alternatives under the public contracts, but neither workaround was exercised with a real target. Other procedure-taking commands were not runtime-audited for this report. ### REA version 6.7.0; source revision `c106cf20cbfcec8e1fcd953ad8e52bdfbf8c3f9c`. ### Runtime and platform Node.js v24.18.0, Linux x86_64; repository-pinned dependencies, including Incur 0.6.1. No Hopper, Ghidra, or other analysis provider was invoked. ### Target and artifact context Synthetic missing path `absent.bin`, intentionally used to distinguish parser rejection from target admission; synthetic selector `-[Widget run]`. No private binary or artifact was used. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence Exact JSON diagnostics from the three failing forms: ```json {"code":"UNKNOWN","message":"Unknown flag: -["} {"code":"UNKNOWN","message":"Unknown flag: --"} {"code":"UNKNOWN","message":"Unknown flag: --procedure"} ``` Whitespace above is compacted; field values are unchanged. Both controls returned `code: "target_unavailable"` in their larger JSON results, showing that they passed parsing. The direct canonical-schema observation was: ```json {"success":true,"data":{"procedure":"-[Widget run]"}} ``` - Expected source: CLI selector description and canonical symbol/address contract linked above. - Failure source: the initial five CLI invocations, plus the [positional-only registration](https://github.com/morluto/rea/blob/c106cf20cbfcec8e1fcd953ad8e52bdfbf8c3f9c/src/cli/coreNativeCommands.ts#L358-L374). No target check precedes parsing; the handler containing `runDirectAnalysis` is not entered for the rejected symbol. - Evidence provenance: observed parser diagnostics and controls; static proof that replacing the absent path with a supported existing target cannot change this earlier rejection. - Local verification: reproduced at the CLI parsing boundary. Real-target/provider reproduction was not run. - Reproduction completeness: complete for the parsing failure; no end-to-end native-analysis success claim. ### Typed outcome or recovery expected A valid symbol should reach the analysis workflow unchanged, producing its normal Evidence or a target/provider-specific refusal. Restoration signal: the exact Objective-C symbol reaches the handler as `procedure`, the absent-target parser fixture returns `target_unavailable` rather than `Unknown flag`, and an existing supported target can use its real provider-returned symbol. Keep positional `main` and numeric addresses working, and continue rejecting genuine unknown options. These are proposed checks, not post-report reruns. ### Analysis or suspected cause Source-derived: the command declares only the required positional `address`; its options contain native-open and snapshot selections, without an escaped/named procedure selector. The pinned Incur parser treats a token beginning with one dash as short options and does not provide a usable `--` escape here, as directly observed. REA already supplies a [named selector and conflict handling for decompile](https://github.com/morluto/rea/blob/c106cf20cbfcec8e1fcd953ad8e52bdfbf8c3f9c/src/cli/coreBinaryCommands.ts#L167-L207), which provides a concrete implementation direction for accepting this existing input contract. No provider change is needed to address the observed parsing boundary. ### Additional context NOT_ENOUGH_INFO: first affected release, last known good release, and real-provider behavior for the synthetic method were not established. The finding does not depend on a provider-specific parsing assumption. No report was rerun after drafting. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A documented symbol-selection path fails deterministically during CLI parsing for the ordinary Objective-C instance-method spelling; the observed failure is bounded to request admission and does not modify target data. - Workaround status: unverified - Workaround basis: The public contract also accepts provider-returned numeric addresses, and MCP accepts the string schema, but no real-target invocation through those alternatives was executed in this bounded adapter audit.

bsakaguchi closed this issue

2026-10-31 00:45:00 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:34 +00:00

[PR #4105] [MERGED] fix(apple): report __proto__ entries omitted from OpenStep property lists #6061