[PR #1682] [MERGED] feat(evidence): discover retained records without full payloads #4750

New issue

Closed

opened 2026-10-31 00:54:39 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:39 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1682
Author: @N0zoM1z0
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: feat/evidence-record-discovery-1247

📝 Commits (3)

d375017 feat(evidence): discover retained records without full payloads
0aec46e fix(evidence): guide oversized results to retained discovery
850e130 style(tests): format retained discovery recovery assertion

📊 Changes

15 files changed (+514 additions, -7 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+10 -0)
📝 docs/mcp-contracts.md (+17 -0)
➕ src/application/investigation/InspectEvidenceBundle.ts (+35 -0)
📝 src/cli/analysisViewCommands.ts (+53 -0)
📝 src/cliCommandNames.ts (+1 -0)
📝 src/contracts/sessionToolContracts.ts (+1 -1)
📝 src/contracts/sessionToolSchemas.ts (+6 -2)
📝 src/contracts/toolContractExamples.ts (+4 -0)
📝 src/contracts/toolOutputSchemaGroups.ts (+4 -1)
📝 src/domain/analysisErrorPresentation.ts (+1 -1)
➕ src/domain/evidenceRecordSummary.test.ts (+55 -0)
➕ src/domain/evidenceRecordSummary.ts (+166 -0)
📝 src/server/registerSessionRecordTools.ts (+3 -2)
📝 tests/boundary/cli/analysisViewCli.test.ts (+47 -0)
📝 tests/boundary/mcp/analysisViewMcp.test.ts (+111 -0)

📄 Description

Large retained function dossiers can make get_evidence_bundle itself exceed ordinary MCP framing, leaving analysts without a lightweight way to discover an existing parent before requesting a view. Add detail: "summary" to that existing tool and a shared inspect-evidence-bundle CLI workflow for portable files. Complete canonical bundle delivery remains the default.

Summary metadata returns every matching Evidence ID, subject/provider identity, analysis-profile digest and recorded native procedure identity. Exact filters select operation, target digest, profile digest, parent ID or procedure address. Complete-record retention is separate from observed native pcode truncation, unavailable analysis and missing/incompatible metadata. Payloads are neither copied nor transferred by the metadata projection. An invalid complete-delivery/filter combination returns a typed correction from the shared application layer. Transport-constraint recovery now points directly to metadata discovery and the following retained view.

{
  "name": "get_evidence_bundle",
  "arguments": {
    "detail": "summary",
    "filters": {
      "operation": "analyze_function",
      "procedure_address": "0x401136"
    }
  }
}

Use the returned result.records[].evidence_id with inspect_analysis_view. Portable CLI input uses the same detail/filters alongside an absolute bundle path; local file validation still materializes the complete file under the existing memory budget. This does not fix oversized snapshot import (#1680), the upstream SDK's catalog preparation cost, or Windows cold-start deadlines.

Verification:

npm run check:fast.
npm run test:focused -- src/domain/evidenceRecordSummary.test.ts tests/boundary/mcp/analysisViewMcp.test.ts tests/boundary/cli/analysisViewCli.test.ts (16 passed), including ordinary framing recovery, exact metadata selection, the following native page, typed semantic failure, portable CLI/default-complete behavior and partial legacy metadata.
npm run test:focused -- tests/boundary/mcp/toolSchemaValidity.test.ts tests/boundary/mcp/outputSchemaSemanticConstraints.test.ts tests/boundary/mcp/toolErrorSchemaDelivery.test.ts (9 passed): full advertised catalog, converted JSON Schemas and pinned SDK error delivery.
npm run docs:check.
Actual public CLI/stdio MCP with real Ghidra 12.1.4/Java 21 on a source-owned Linux ELF: 4,543,224-byte normalized dossier, default framing constraint, all 15 native collection first/last checks, real nonempty parameters/uses, unchanged nonempty observed analysis-run identity, snapshot save/close/reconnect, exact original view reuse and owned cleanup. High-pcode truncation and unrecorded unresolved calls stay explicit. Full first/last CLI parity was independently verified; this is not exhaustive pagination of the large fixture.
Fresh production MCP import of the real snapshot: complete bundle delivery is constrained, then discover without a parent ID, filter by all exact identities, inspect parameters, mismatch/invalid/close checks, and CLI/MCP metadata parity pass. Discovery responses were 2,458/2,820 bytes at 14.5/3.4 ms in one run; portable CLI includes complete 9 MB file validation (~5.1 s). Family RSS peaked at 1,426,448,384 bytes. No provider runtime was allocated during replay/discovery. These are single-run observations, not token savings or percentiles.

Real Hopper was not verified. Separate Windows main-package verification at f88c9902 passed real procedure/assembly views and exact cross-session snapshot replay with no provider runtime allocation. Its cold overview took 262.1 seconds under a 360-second SDK request; default 60-second and separate 240-second attempts timed out. That tiny-PE control does not verify the new discovery API on Windows or general cold-start recovery. See #1247 for the original/current native result distinction and #1680 for the larger saved-snapshot admission control.

Closes #1247. Refs #1065, #1345, #1680.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1682 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `feat/evidence-record-discovery-1247` --- ### 📝 Commits (3) - [`d375017`](https://github.com/morluto/rea/commit/d375017a435e2fa2362f6bf67a355bb2bbbb3c8f) feat(evidence): discover retained records without full payloads - [`0aec46e`](https://github.com/morluto/rea/commit/0aec46e35c8d54b7454a4473bd17b25beb5281ff) fix(evidence): guide oversized results to retained discovery - [`850e130`](https://github.com/morluto/rea/commit/850e13061e8b0e029404280c52b48eb61db423a1) style(tests): format retained discovery recovery assertion ### 📊 Changes **15 files changed** (+514 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+10 -0) 📝 `docs/mcp-contracts.md` (+17 -0) ➕ `src/application/investigation/InspectEvidenceBundle.ts` (+35 -0) 📝 `src/cli/analysisViewCommands.ts` (+53 -0) 📝 `src/cliCommandNames.ts` (+1 -0) 📝 `src/contracts/sessionToolContracts.ts` (+1 -1) 📝 `src/contracts/sessionToolSchemas.ts` (+6 -2) 📝 `src/contracts/toolContractExamples.ts` (+4 -0) 📝 `src/contracts/toolOutputSchemaGroups.ts` (+4 -1) 📝 `src/domain/analysisErrorPresentation.ts` (+1 -1) ➕ `src/domain/evidenceRecordSummary.test.ts` (+55 -0) ➕ `src/domain/evidenceRecordSummary.ts` (+166 -0) 📝 `src/server/registerSessionRecordTools.ts` (+3 -2) 📝 `tests/boundary/cli/analysisViewCli.test.ts` (+47 -0) 📝 `tests/boundary/mcp/analysisViewMcp.test.ts` (+111 -0) </details> ### 📄 Description Large retained function dossiers can make `get_evidence_bundle` itself exceed ordinary MCP framing, leaving analysts without a lightweight way to discover an existing parent before requesting a view. Add `detail: "summary"` to that existing tool and a shared `inspect-evidence-bundle` CLI workflow for portable files. Complete canonical bundle delivery remains the default. Summary metadata returns every matching Evidence ID, subject/provider identity, analysis-profile digest and recorded native procedure identity. Exact filters select operation, target digest, profile digest, parent ID or procedure address. Complete-record retention is separate from observed native pcode truncation, unavailable analysis and missing/incompatible metadata. Payloads are neither copied nor transferred by the metadata projection. An invalid complete-delivery/filter combination returns a typed correction from the shared application layer. Transport-constraint recovery now points directly to metadata discovery and the following retained view. ```json { "name": "get_evidence_bundle", "arguments": { "detail": "summary", "filters": { "operation": "analyze_function", "procedure_address": "0x401136" } } } ``` Use the returned `result.records[].evidence_id` with `inspect_analysis_view`. Portable CLI input uses the same `detail`/`filters` alongside an absolute bundle `path`; local file validation still materializes the complete file under the existing memory budget. This does not fix oversized snapshot import (#1680), the upstream SDK's catalog preparation cost, or Windows cold-start deadlines. Verification: - `npm run check:fast`. - `npm run test:focused -- src/domain/evidenceRecordSummary.test.ts tests/boundary/mcp/analysisViewMcp.test.ts tests/boundary/cli/analysisViewCli.test.ts` (16 passed), including ordinary framing recovery, exact metadata selection, the following native page, typed semantic failure, portable CLI/default-complete behavior and partial legacy metadata. - `npm run test:focused -- tests/boundary/mcp/toolSchemaValidity.test.ts tests/boundary/mcp/outputSchemaSemanticConstraints.test.ts tests/boundary/mcp/toolErrorSchemaDelivery.test.ts` (9 passed): full advertised catalog, converted JSON Schemas and pinned SDK error delivery. - `npm run docs:check`. - Actual public CLI/stdio MCP with real Ghidra 12.1.4/Java 21 on a source-owned Linux ELF: 4,543,224-byte normalized dossier, default framing constraint, all 15 native collection first/last checks, real nonempty parameters/uses, unchanged nonempty observed analysis-run identity, snapshot save/close/reconnect, exact original view reuse and owned cleanup. High-pcode truncation and unrecorded unresolved calls stay explicit. Full first/last CLI parity was independently verified; this is not exhaustive pagination of the large fixture. - Fresh production MCP import of the real snapshot: complete bundle delivery is constrained, then discover without a parent ID, filter by all exact identities, inspect parameters, mismatch/invalid/close checks, and CLI/MCP metadata parity pass. Discovery responses were 2,458/2,820 bytes at 14.5/3.4 ms in one run; portable CLI includes complete 9 MB file validation (~5.1 s). Family RSS peaked at 1,426,448,384 bytes. No provider runtime was allocated during replay/discovery. These are single-run observations, not token savings or percentiles. Real Hopper was not verified. Separate Windows main-package verification at `f88c9902` passed real procedure/assembly views and exact cross-session snapshot replay with no provider runtime allocation. Its cold overview took 262.1 seconds under a 360-second SDK request; default 60-second and separate 240-second attempts timed out. That tiny-PE control does not verify the new discovery API on Windows or general cold-start recovery. See #1247 for the original/current native result distinction and #1680 for the larger saved-snapshot admission control. Closes #1247. Refs #1065, #1345, #1680. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:39 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:14:08 +00:00

[PR #4760] [CLOSED] fix(native): reject NativeAOT reads beyond declared PE header extents (#4750) #6394

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4750

No description provided.

Rows
Columns