morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2145] [MERGED] fix(jeb): confine an invalid REA_JEB_MCP_URL to the JEB tools #5057

New issue

Closed

opened 2026-10-31 01:01:28 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:01:28 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2145
Author: @kaoru0822-kitauji
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/12/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/issue-2143

📝 Commits (1)

9ad3cac fix(jeb): confine an invalid REA_JEB_MCP_URL to the JEB tools

📊 Changes

3 files changed (+91 additions, -3 deletions)

View changed files

📝 src/composition/jeb.ts (+38 -3)
📝 tests/boundary/cli/jebCli.test.ts (+11 -0)
📝 tests/boundary/mcp/jebMcp.test.ts (+42 -0)

📄 Description

Summary

JebProvider's constructor throws when REA_JEB_MCP_URL fails parseJebMcpEndpoint. createJebAnalysisProvider runs eagerly from registerJebCommands in createCli, and from createServer for each MCP connection. So a malformed value, or the natural http://localhost:8425/mcp (rejected because the host is not a literal loopback address), took down REA as a whole:

every CLI command, including rea doctor and analyses unrelated to JEB, crashed with an AnalysisInputError stack trace;
every MCP connection failed with Internal server error, with nothing on stderr.

createJebAnalysisProvider now parses the endpoint itself. When the endpoint is unusable, it returns a JEB port that:

reports not_configured availability, with the reason;
returns a ConfigurationError naming REA_JEB_MCP_URL from every JEB operation, with the standard configuration remediation.

JebProvider itself is unchanged and still rejects unusable endpoints at construction, as its unit tests assert.

Fixes #2143

Before / after

$ REA_JEB_MCP_URL=http://localhost:8425/mcp rea inspect-go-binary /path/to/go-binary
before: AnalysisInputError stack trace (createCli → registerJebCommands → new JebProvider)
after:  normal Go build-info Evidence

$ REA_JEB_MCP_URL=http://localhost:8425/mcp rea inspect-jeb-client --json
after:  {"code":"configuration_invalid","message":"REA configuration is invalid: REA_JEB_MCP_URL: JEB MCP endpoint must use a literal loopback host (127.0.0.1 or ::1).", …}

Over stdio MCP, the same setting now lists all 173 tools, and inspect_jeb_client returns the configuration_invalid error.

Validation

New tests: tests/boundary/cli/jebCli.test.ts covers inspect-jeb-client reporting configuration_invalid while capabilities still succeeds; tests/boundary/mcp/jebMcp.test.ts covers the server listing tools and inspect_jeb_client returning the configuration error. Both fail on main and pass with this change. src/jeb/JebProvider.test.ts passes unchanged.
Separately checked other provider settings (REA_JADX_MCP_JAR, REA_WABT_BIN_DIRECTORY, REA_PWNTOOLS_PYTHON, REA_BROWSER_EXECUTABLE, REA_WAKARU_COMMAND, REA_BINWALK_COMMAND, …) with invalid values. None crashes CLI composition or MCP connections.
npm run lint passes.
npm test: 9153 passed, 14 failed in 7 files. These are the same environmental files that fail on clean origin/main on this host: Hopper not installed, Command Line Tools only (ibtool), hdiutil, and inspector target-location cases.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2145 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/12/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/issue-2143` --- ### 📝 Commits (1) - [`9ad3cac`](https://github.com/morluto/rea/commit/9ad3cace698e52d6c7bc648f21d5d640a97f8a45) fix(jeb): confine an invalid REA_JEB_MCP_URL to the JEB tools ### 📊 Changes **3 files changed** (+91 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/composition/jeb.ts` (+38 -3) 📝 `tests/boundary/cli/jebCli.test.ts` (+11 -0) 📝 `tests/boundary/mcp/jebMcp.test.ts` (+42 -0) </details> ### 📄 Description ## Summary `JebProvider`'s constructor throws when `REA_JEB_MCP_URL` fails `parseJebMcpEndpoint`. `createJebAnalysisProvider` runs eagerly from `registerJebCommands` in `createCli`, and from `createServer` for each MCP connection. So a malformed value, or the natural `http://localhost:8425/mcp` (rejected because the host is not a literal loopback address), took down REA as a whole: - every CLI command, including `rea doctor` and analyses unrelated to JEB, crashed with an `AnalysisInputError` stack trace; - every MCP connection failed with `Internal server error`, with nothing on stderr. `createJebAnalysisProvider` now parses the endpoint itself. When the endpoint is unusable, it returns a JEB port that: - reports `not_configured` availability, with the reason; - returns a `ConfigurationError` naming `REA_JEB_MCP_URL` from every JEB operation, with the standard configuration remediation. `JebProvider` itself is unchanged and still rejects unusable endpoints at construction, as its unit tests assert. Fixes #2143 ## Before / after ```text $ REA_JEB_MCP_URL=http://localhost:8425/mcp rea inspect-go-binary /path/to/go-binary before: AnalysisInputError stack trace (createCli → registerJebCommands → new JebProvider) after: normal Go build-info Evidence $ REA_JEB_MCP_URL=http://localhost:8425/mcp rea inspect-jeb-client --json after: {"code":"configuration_invalid","message":"REA configuration is invalid: REA_JEB_MCP_URL: JEB MCP endpoint must use a literal loopback host (127.0.0.1 or ::1).", …} ``` Over stdio MCP, the same setting now lists all 173 tools, and `inspect_jeb_client` returns the `configuration_invalid` error. ## Validation - New tests: `tests/boundary/cli/jebCli.test.ts` covers `inspect-jeb-client` reporting `configuration_invalid` while `capabilities` still succeeds; `tests/boundary/mcp/jebMcp.test.ts` covers the server listing tools and `inspect_jeb_client` returning the configuration error. Both fail on main and pass with this change. `src/jeb/JebProvider.test.ts` passes unchanged. - Separately checked other provider settings (`REA_JADX_MCP_JAR`, `REA_WABT_BIN_DIRECTORY`, `REA_PWNTOOLS_PYTHON`, `REA_BROWSER_EXECUTABLE`, `REA_WAKARU_COMMAND`, `REA_BINWALK_COMMAND`, …) with invalid values. None crashes CLI composition or MCP connections. - `npm run lint` passes. - `npm test`: 9153 passed, 14 failed in 7 files. These are the same environmental files that fail on clean `origin/main` on this host: Hopper not installed, Command Line Tools only (`ibtool`), `hdiutil`, and inspector target-location cases. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:01:28 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5057

No description provided.

Rows
Columns