[GH-ISSUE #7422] [Bug] Empty analyzer override rejects existing-project MCP startup #4428

New issue

Closed

opened 2026-10-31 00:49:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:49:43 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7422

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Provider or capability discovery

Observed behavior

Selecting a Ghidra project and passing a comma/space-only REA_GHIDRA_DISABLED_ANALYZERS value makes the MCP entrypoint exit 1 before serving requests. It reports that an analysis override cannot be combined with an existing project, although the analyzer-list parser normalizes that value to no override. The production CLI doctor command also reports runtime-configuration:REA_GHIDRA_DISABLED_ANALYZERS as config_drift for this input.

Independent calls to configuration parsing reproduced the same rejection for the empty string and a single space. All three blank values were accepted without the project selection. Leaving the analyzer variable absent was accepted with the project selection.

Reproduction

Use a clone at f8f7ac96de8a66a4ab9a23d87e04779bfcd11045, Node.js 24.22.1, and the locked dependencies installed with npm ci. The verifier used dependencies already installed in the baseline checkout. Run the following from the repository root. This executes the production source MCP entrypoint using the repository's verifier loader; it does not require building or installing the CLI.

probe_home=$(mktemp -d)
env -i PATH="$PATH" HOME="$probe_home" NODE_NO_WARNINGS=1 \
  REA_GHIDRA_PROJECT_PATH=/absolute/projects/app-analysis.gpr \
  REA_GHIDRA_DISABLED_ANALYZERS=' , ' \
  node --input-type=module <<'JS'
import { pathToFileURL } from 'node:url';
import { importVerifierSource } from './scripts/lib/verifier-source-loader.mjs';
const root = pathToFileURL(`${process.cwd()}/`);
const { runEntrypoint } = await importVerifierSource('./src/main.ts', root);
await runEntrypoint();
JS
status=$?
rmdir "$probe_home"
printf 'exit=%s\n' "$status"

The process writes the configuration error shown below to stderr, no stdout, and returns 1. The project marker is only a syntactically valid fixture: no project file, binary, Java runtime, or Ghidra installation is needed because configuration validation fails first. A second independent invocation of this source entrypoint reproduced the same result.

Expected behavior

A blank analyzer list should remain equivalent to an omitted override when an existing project is selected. Expected source: src/config/ghidraDisabledAnalyzers.ts:14 explicitly defines blank entries as discarded and a list without names as selecting no override; src/config/ghidraDisabledAnalyzers.ts:42 returns undefined in that case. src/ghidra/GhidraDisabledAnalyzers.test.ts:33 already checks empty and comma/space-only lists through configuration parsing. Existing-project selection is supported for CLI and MCP in docs/installation.md:1318.

MCP should pass this configuration check, and doctor should omit the analyzer-override conflict. Other provider-readiness checks can still fail independently. A nonempty analyzer override should remain incompatible with existing-project reuse.

Impact and scope

P2: an otherwise absent analyzer override causes a bounded startup failure and a misleading doctor diagnostic when the caller explicitly supplies a blank value alongside an existing-project selection. Removing REA_GHIDRA_DISABLED_ANALYZERS is a practical configuration workaround: the independent parser control succeeded and the doctor conflict disappeared with the project selection retained. Setting a real analyzer name is not a workaround; it is correctly rejected in this mode. Full provider operation after removing the variable was not tested. No target data was read or changed, and no security boundary was crossed.

REA version

6.8.0 from package.json; baseline f8f7ac96de.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; Darwin kernel 27.0.0; arm64. No Ghidra process was started.

Target and artifact context

Configuration-only fixture selecting /absolute/projects/app-analysis.gpr; the marker need not exist for this early rejection. No target binary or provider project was opened.

Interface

MCP

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Observed source MCP entrypoint result, with exit status 1 and zero stdout bytes:

REA configuration is invalid: REA_GHIDRA_DISABLED_ANALYZERS: Import and analysis overrides cannot be combined with an existing project.

The production source CLI was separately invoked with createCli(process.env).serve(['doctor', '--provider', 'ghidra']) under an isolated HOME and the same project/list settings. Its output included:

name: "runtime-configuration:REA_GHIDRA_DISABLED_ANALYZERS"
ok: false
classification: config_drift

Omitting the analyzer variable removed that diagnostic. Both doctor runs still reported the independent missing Ghidra installation; neither establishes real-provider readiness. The existing analyzer-setting test file passed all 10 tests.

Failure source: src/config/environment.ts:223 parses normalized values, but src/config/environment.ts:239 tests the raw environment for incompatible settings. src/config/parseConfig.ts:99 propagates the resulting error, and src/main.ts:93 rejects it before MCP admission. Doctor reaches the same validation through src/application/Doctor.ts:549 and projects its issues through src/application/DoctorDiagnostics.ts:231. These locators are source-derived evidence; the error and doctor outputs above were reproduced independently.

Typed outcome or recovery expected

Configuration parsing should succeed with no analyzer override selected. Doctor should not report an analyzer-setting conflict for that value. This expectation does not imply that a missing engine or invalid project should pass later admission.

Additional context

Verification covered the source entrypoints, configuration controls and existing analyzer tests at the stated commit; a built CLI dispatcher and a real Ghidra session were not exercised.

References

#5342 (closed) concerned a server-wide analyzer list naming a format-specific analyzer; this report is about a blank list combined with an existing project.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7422 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Provider or capability discovery ### Observed behavior Selecting a Ghidra project and passing a comma/space-only `REA_GHIDRA_DISABLED_ANALYZERS` value makes the MCP entrypoint exit 1 before serving requests. It reports that an analysis override cannot be combined with an existing project, although the analyzer-list parser normalizes that value to no override. The production CLI doctor command also reports `runtime-configuration:REA_GHIDRA_DISABLED_ANALYZERS` as `config_drift` for this input. Independent calls to configuration parsing reproduced the same rejection for the empty string and a single space. All three blank values were accepted without the project selection. Leaving the analyzer variable absent was accepted with the project selection. ### Reproduction Use a clone at `f8f7ac96de8a66a4ab9a23d87e04779bfcd11045`, Node.js 24.22.1, and the locked dependencies installed with `npm ci`. The verifier used dependencies already installed in the baseline checkout. Run the following from the repository root. This executes the production source MCP entrypoint using the repository's verifier loader; it does not require building or installing the CLI. ```sh probe_home=$(mktemp -d) env -i PATH="$PATH" HOME="$probe_home" NODE_NO_WARNINGS=1 \ REA_GHIDRA_PROJECT_PATH=/absolute/projects/app-analysis.gpr \ REA_GHIDRA_DISABLED_ANALYZERS=' , ' \ node --input-type=module <<'JS' import { pathToFileURL } from 'node:url'; import { importVerifierSource } from './scripts/lib/verifier-source-loader.mjs'; const root = pathToFileURL(`${process.cwd()}/`); const { runEntrypoint } = await importVerifierSource('./src/main.ts', root); await runEntrypoint(); JS status=$? rmdir "$probe_home" printf 'exit=%s\n' "$status" ``` The process writes the configuration error shown below to stderr, no stdout, and returns 1. The project marker is only a syntactically valid fixture: no project file, binary, Java runtime, or Ghidra installation is needed because configuration validation fails first. A second independent invocation of this source entrypoint reproduced the same result. ### Expected behavior A blank analyzer list should remain equivalent to an omitted override when an existing project is selected. Expected source: `src/config/ghidraDisabledAnalyzers.ts:14` explicitly defines blank entries as discarded and a list without names as selecting no override; `src/config/ghidraDisabledAnalyzers.ts:42` returns `undefined` in that case. `src/ghidra/GhidraDisabledAnalyzers.test.ts:33` already checks empty and comma/space-only lists through configuration parsing. Existing-project selection is supported for CLI and MCP in `docs/installation.md:1318`. MCP should pass this configuration check, and doctor should omit the analyzer-override conflict. Other provider-readiness checks can still fail independently. A nonempty analyzer override should remain incompatible with existing-project reuse. ### Impact and scope P2: an otherwise absent analyzer override causes a bounded startup failure and a misleading doctor diagnostic when the caller explicitly supplies a blank value alongside an existing-project selection. Removing `REA_GHIDRA_DISABLED_ANALYZERS` is a practical configuration workaround: the independent parser control succeeded and the doctor conflict disappeared with the project selection retained. Setting a real analyzer name is not a workaround; it is correctly rejected in this mode. Full provider operation after removing the variable was not tested. No target data was read or changed, and no security boundary was crossed. ### REA version 6.8.0 from package.json; baseline f8f7ac96de8a66a4ab9a23d87e04779bfcd11045. ### Runtime and platform Node.js v24.22.1; macOS 27.0.1; Darwin kernel 27.0.0; arm64. No Ghidra process was started. ### Target and artifact context Configuration-only fixture selecting `/absolute/projects/app-analysis.gpr`; the marker need not exist for this early rejection. No target binary or provider project was opened. ### Interface MCP ### Earliest failure stage Request parsing or validation ### Relevant output or evidence Observed source MCP entrypoint result, with exit status 1 and zero stdout bytes: ```text REA configuration is invalid: REA_GHIDRA_DISABLED_ANALYZERS: Import and analysis overrides cannot be combined with an existing project. ``` The production source CLI was separately invoked with `createCli(process.env).serve(['doctor', '--provider', 'ghidra'])` under an isolated HOME and the same project/list settings. Its output included: ```text name: "runtime-configuration:REA_GHIDRA_DISABLED_ANALYZERS" ok: false classification: config_drift ``` Omitting the analyzer variable removed that diagnostic. Both doctor runs still reported the independent missing Ghidra installation; neither establishes real-provider readiness. The existing analyzer-setting test file passed all 10 tests. Failure source: `src/config/environment.ts:223` parses normalized values, but `src/config/environment.ts:239` tests the raw environment for incompatible settings. `src/config/parseConfig.ts:99` propagates the resulting error, and `src/main.ts:93` rejects it before MCP admission. Doctor reaches the same validation through `src/application/Doctor.ts:549` and projects its issues through `src/application/DoctorDiagnostics.ts:231`. These locators are source-derived evidence; the error and doctor outputs above were reproduced independently. ### Typed outcome or recovery expected Configuration parsing should succeed with no analyzer override selected. Doctor should not report an analyzer-setting conflict for that value. This expectation does not imply that a missing engine or invalid project should pass later admission. ### Additional context Verification covered the source entrypoints, configuration controls and existing analyzer tests at the stated commit; a built CLI dispatcher and a real Ghidra session were not exercised. ## References - #5342 (closed) concerned a server-wide analyzer list naming a format-specific analyzer; this report is about a blank list combined with an existing project.

bsakaguchi closed this issue

2026-10-31 00:49:43 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:54 +00:00

[PR #4428] [MERGED] fix(snapshot): count newly retained workflow bindings on import #6235