[GH-ISSUE #7421] [Bug] Dispatch metadata and Apple IPS CLI inspections resolve an empty target to the working directory #4426

New issue

Closed

opened 2026-10-31 00:49:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:49:43 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7421

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

From a synthetic app bundle, inspect-native-dispatch-metadata "" --format json reads the working bundle Info.plist and reports target_unavailable because it lacks CFBundleExecutable. inspect-apple-ips "" --format json reports invalid_request because the working directory is not a regular report file. Both substitute cwd before rejecting the selected file, rather than rejecting the empty selection. Neither returned successful Evidence in this reproduction.

Reproduction

Use Node.js 24.22.1 at the source commit below. For a fresh checkout, run npm ci && npm run build:cached; the verifier rebuilt an already installed checkout with the unchanged lockfile. Run this block from the checkout root. All product state is isolated below $WORK.

REA_ENTRY="$PWD/scripts/rea.mjs"
WORK="${WORK:-$(mktemp -d)}"
export HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data"
export XDG_CACHE_HOME="$WORK/cache" XDG_STATE_HOME="$WORK/state" TMPDIR="$WORK/temp"
mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME" "$XDG_STATE_HOME" "$TMPDIR" "$WORK/Demo.app/Contents/Resources"
cat > "$WORK/Demo.app/Contents/Info.plist" <<'PLIST'
<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0"><dict><key>CFBundleIdentifier</key><string>com.example.empty-path</string><key>CFBundleName</key><string>EmptyPath</string></dict></plist>
PLIST
cd "$WORK/Demo.app"
node "$REA_ENTRY" inspect-native-dispatch-metadata "" --format json
printf 'dispatch exit=%s\n' "$?"
node "$REA_ENTRY" inspect-apple-ips "" --format json
printf 'ips exit=%s\n' "$?"
node "$REA_ENTRY" inspect-artifact "" --format json
printf 'control exit=%s\n' "$?"

This reduced replay reproduced once; an earlier independent CLI replay reproduced each command once on the same inline fixture, for two failures in two attempts per command. The empty inspect-artifact control rejected the selection in both runs.

Expected behavior

Reject the empty target before resolving or reading cwd, with an input error identifying path. docs/cli.md:42-45 expressly requires local inspections to reject empty paths before resolution and says an empty string never selects the working directory. The existing inspect-artifact declaration at src/cli/artifactCommands.ts:238 and its observed VALIDATION_ERROR provide a working CLI control.

Impact and scope

P2: an empty target variable causes dispatch inspection to read an unintended bundle plist and return misleading target-repair advice; IPS diagnostics describe an unintended directory instead of the missing selection. A safe caller workaround is to reject empty variables before invoking either command. The observed scope is these two built CLI entrypoints on macOS. Successful wrong-target dispatch analysis, other platforms and MCP behavior were not tested. The fixture contains no executable and no target was run or modified.

REA version

Exact node scripts/rea.mjs --version output: 6.8.0. Built source commit: 4de432d868293622794d66704de0939a05fbfc81.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1, build 26A434, arm64. No external analysis engine, device or live service was used.

Target and artifact context

Synthetic Demo.app with an XML Info.plist containing CFBundleIdentifier and CFBundleName, no CFBundleExecutable, and an empty Contents/Resources directory. No real crash report or binary is needed to expose the target-selection error.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Observed fields from complete CLI JSON responses, with the disposable fixture root generalized to $WORK:

inspect-native-dispatch-metadata "": exit 1
  code: target_unavailable
  details.path: $WORK/Demo.app/Contents/Info.plist
  details.reason: app Info.plist is malformed, unsupported, or lacks CFBundleExecutable: $WORK/Demo.app/Contents/Info.plist (CFBundleExecutable is missing)
inspect-apple-ips "": exit 1
  code: invalid_request
  details.issues[0].path: ["path"]
  details.issues[0].reason: invalid_format
  details.issues[0].message: Expected a regular file without a symlink: $WORK/Demo.app/
inspect-artifact "": exit 1
  code: VALIDATION_ERROR
  fieldErrors[0].path: path
  fieldErrors[0].code: too_small

Typed outcome or recovery expected

Reject an empty path before local target admission. Proposed restoration checks: replay both empty targets and require an empty-path input error; preserve each command’s existing behavior for a nonempty intended target. A later error about cwd does not restore the documented contract.

Analysis or suspected cause

Source-derived: src/cli/coreNativeCommands.ts:292 and src/cli/binaryDiagnosticsCommands.ts:88 admit plain strings. The former reaches src/application/BinaryTargetResolver.ts:144; the latter calls absoluteCallerPath(args.path) directly at src/cli/binaryDiagnosticsCommands.ts:110. src/filesystem/callerPath.ts:35-39 anchors an empty relative value to cwd. These separate command declarations do not use the nonempty local-path schema defined at src/domain/localPath.ts:20 before anchoring.

Additional context

Open #7406 already covers the reproduced decode-interface-builder equivalent, so it is excluded here. Open #7377, #7404 and #7280 cover other command declarations. Closed #6757 concerns desktop inspection; merged PR #2687 covered analyze and inspect-artifact. Their command-specific acceptance scopes do not cover either entrypoint above. No open duplicate for these two commands was found in live open/closed issue and PR searches or the local issue snapshot.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7421 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area CLI ## Observed behavior From a synthetic app bundle, `inspect-native-dispatch-metadata "" --format json` reads the working bundle Info.plist and reports `target_unavailable` because it lacks CFBundleExecutable. `inspect-apple-ips "" --format json` reports `invalid_request` because the working directory is not a regular report file. Both substitute cwd before rejecting the selected file, rather than rejecting the empty selection. Neither returned successful Evidence in this reproduction. ## Reproduction Use Node.js 24.22.1 at the source commit below. For a fresh checkout, run `npm ci && npm run build:cached`; the verifier rebuilt an already installed checkout with the unchanged lockfile. Run this block from the checkout root. All product state is isolated below `$WORK`. ```sh REA_ENTRY="$PWD/scripts/rea.mjs" WORK="${WORK:-$(mktemp -d)}" export HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" export XDG_CACHE_HOME="$WORK/cache" XDG_STATE_HOME="$WORK/state" TMPDIR="$WORK/temp" mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME" "$XDG_STATE_HOME" "$TMPDIR" "$WORK/Demo.app/Contents/Resources" cat > "$WORK/Demo.app/Contents/Info.plist" <<'PLIST' <?xml version="1.0" encoding="UTF-8"?> <plist version="1.0"><dict><key>CFBundleIdentifier</key><string>com.example.empty-path</string><key>CFBundleName</key><string>EmptyPath</string></dict></plist> PLIST cd "$WORK/Demo.app" node "$REA_ENTRY" inspect-native-dispatch-metadata "" --format json printf 'dispatch exit=%s\n' "$?" node "$REA_ENTRY" inspect-apple-ips "" --format json printf 'ips exit=%s\n' "$?" node "$REA_ENTRY" inspect-artifact "" --format json printf 'control exit=%s\n' "$?" ``` This reduced replay reproduced once; an earlier independent CLI replay reproduced each command once on the same inline fixture, for two failures in two attempts per command. The empty inspect-artifact control rejected the selection in both runs. ## Expected behavior Reject the empty target before resolving or reading cwd, with an input error identifying `path`. `docs/cli.md:42-45` expressly requires local inspections to reject empty paths before resolution and says an empty string never selects the working directory. The existing `inspect-artifact` declaration at `src/cli/artifactCommands.ts:238` and its observed `VALIDATION_ERROR` provide a working CLI control. ## Impact and scope P2: an empty target variable causes dispatch inspection to read an unintended bundle plist and return misleading target-repair advice; IPS diagnostics describe an unintended directory instead of the missing selection. A safe caller workaround is to reject empty variables before invoking either command. The observed scope is these two built CLI entrypoints on macOS. Successful wrong-target dispatch analysis, other platforms and MCP behavior were not tested. The fixture contains no executable and no target was run or modified. ## REA version Exact `node scripts/rea.mjs --version` output: `6.8.0`. Built source commit: `4de432d868293622794d66704de0939a05fbfc81`. ## Runtime and platform Node.js `v24.22.1`; macOS `27.0.1`, build `26A434`, `arm64`. No external analysis engine, device or live service was used. ## Target and artifact context Synthetic `Demo.app` with an XML Info.plist containing CFBundleIdentifier and CFBundleName, no CFBundleExecutable, and an empty Contents/Resources directory. No real crash report or binary is needed to expose the target-selection error. ## Interface CLI ## Earliest failure stage Request parsing or validation ## Relevant output or evidence Observed fields from complete CLI JSON responses, with the disposable fixture root generalized to `$WORK`: ```text inspect-native-dispatch-metadata "": exit 1 code: target_unavailable details.path: $WORK/Demo.app/Contents/Info.plist details.reason: app Info.plist is malformed, unsupported, or lacks CFBundleExecutable: $WORK/Demo.app/Contents/Info.plist (CFBundleExecutable is missing) inspect-apple-ips "": exit 1 code: invalid_request details.issues[0].path: ["path"] details.issues[0].reason: invalid_format details.issues[0].message: Expected a regular file without a symlink: $WORK/Demo.app/ inspect-artifact "": exit 1 code: VALIDATION_ERROR fieldErrors[0].path: path fieldErrors[0].code: too_small ``` ## Typed outcome or recovery expected Reject an empty `path` before local target admission. Proposed restoration checks: replay both empty targets and require an empty-path input error; preserve each command’s existing behavior for a nonempty intended target. A later error about cwd does not restore the documented contract. ## Analysis or suspected cause Source-derived: `src/cli/coreNativeCommands.ts:292` and `src/cli/binaryDiagnosticsCommands.ts:88` admit plain strings. The former reaches `src/application/BinaryTargetResolver.ts:144`; the latter calls `absoluteCallerPath(args.path)` directly at `src/cli/binaryDiagnosticsCommands.ts:110`. `src/filesystem/callerPath.ts:35-39` anchors an empty relative value to cwd. These separate command declarations do not use the nonempty local-path schema defined at `src/domain/localPath.ts:20` before anchoring. ## Additional context Open [#7406](https://github.com/morluto/rea/issues/7406) already covers the reproduced decode-interface-builder equivalent, so it is excluded here. Open [#7377](https://github.com/morluto/rea/issues/7377), [#7404](https://github.com/morluto/rea/issues/7404) and [#7280](https://github.com/morluto/rea/issues/7280) cover other command declarations. Closed [#6757](https://github.com/morluto/rea/issues/6757) concerns desktop inspection; merged [PR #2687](https://github.com/morluto/rea/pull/2687) covered analyze and inspect-artifact. Their command-specific acceptance scopes do not cover either entrypoint above. No open duplicate for these two commands was found in live open/closed issue and PR searches or the local issue snapshot.

bsakaguchi closed this issue

2026-10-31 00:49:43 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:53 +00:00

[PR #4427] feat(setup): add FutureOS client support #6234

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471