morluto/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00
Code Issues 1.3k Projects Packages Wiki Activity

[PR #2374] [MERGED] feat(ida): resolve containing procedures and report the admitted program as the document #5195

New issue
Closed
opened 2026-10-31 01:04:42 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-10-31 01:04:42 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2374
Author: @nikolay-dementiev
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: feat/ida-containing-procedure

📝 Commits (10+)

  • d8b802b test(mcp): expect trace_feature to report references the provider truncated
  • 41708b0 fix(mcp): report references a provider truncated in trace_feature
  • 5c01da3 refactor(ida): report reference truncation whenever the runner observed an xrefs cap
  • 6160b6e test(mcp): cover session forwarding, per-target state, native reports and failures of the trace coverage
  • 142f8ad test(mcp): format the session forwarding test
  • bfcb5af test(ida): expect headless IDA to resolve containing procedures from lookups and segment facts
  • 99ff05d test(ida): expect feature tracing and address context to work on headless IDA
  • 64701e8 test(mcp): expect trace_feature availability to follow the search operations it calls
  • a88a9ea fix(mcp): derive trace_feature availability from the search operations it calls
  • 6c46908 feat(ida): resolve containing procedures and report the admitted program as the document

📊 Changes

27 files changed (+1984 additions, -79 deletions)

View changed files

📝 docs/ida-provider.md (+2 -0)
📝 docs/testing.md (+3 -1)
➕ scripts/lib/ida-feature-trace.d.mts (+9 -0)
➕ scripts/lib/ida-feature-trace.mjs (+52 -0)
📝 scripts/verify-real-ida.mjs (+60 -1)
📝 src/application/AnalysisProvider.ts (+11 -0)
📝 src/application/CapabilityInventory.test.ts (+68 -0)
📝 src/application/CapabilityInventory.ts (+2 -2)
📝 src/application/EnhancedLiteralTracing.ts (+47 -17)
📝 src/application/EnhancedTools.ts (+2 -0)
📝 src/application/InvestigationProviders.ts (+3 -1)
📝 src/application/binary/AnalysisSnapshotCache.test.ts (+49 -0)
📝 src/application/binary/AnalysisSnapshotCache.ts (+3 -0)
➕ src/ida/IdaContainment.test.ts (+623 -0)
📝 src/ida/IdaNativeProtocol.test.ts (+30 -0)
📝 src/ida/IdaOperationRunner.ts (+86 -20)
📝 src/ida/IdaProtocolValues.ts (+50 -0)
📝 src/ida/IdaProviderCapabilities.ts (+48 -31)
➕ src/ida/IdaReferenceCoverage.test.ts (+96 -0)
📝 src/ida/IdaSessionClient.ts (+19 -0)

...and 7 more files

📄 Description

Summary

With the modern headless IDA profile, trace_feature failed with capability_unavailable for resolve_containing_procedure, and inspect_address_context failed for list_documents. The profile now implements both operations, so feature tracing and address context work on IDA. A containing function comes from upstream lookup_funcs; when no function contains the address, the database's own segments decide between the two negative reasons, and a missing or inconsistent segment fact fails the read instead of guessing a reason.

Fixes #2335

Builds on #2348 (trace_feature reference coverage); its commits appear in this branch until #2348 is merged. The capped-reference qualification it adds is exercised here end to end.

Problem and expected behavior

Observed on real IDA Professional 9.1 (headless idalib, ida-pro-mcp c133c3853faa111a9b00ee615c013b720d0c4acd) with a small arm64 Mach-O: trace_feature {"query": "sum_point"} and inspect_address_context {"address": "0x100000564"} both returned capability_unavailable naming those operations; with an explicit document, address context answered but every containment facet stayed unavailable. Upstream lookup_funcs returns the canonical containing function for an interior address (0x100000564 gave _use_wrapper at 0x100000560) and fn: null, error: "Not a function" for data, which does not say whether the address is mapped.

Expected: an entry, interior or tail address returns its canonical containing procedure (the body stays unavailable, as for other IDA identities); an address inside a segment but outside any function is not_in_procedure; an unmapped address is outside_segments; if segment membership cannot be established, the read fails. list_documents returns the single admitted program, so default document resolution works without enumerating unrelated upstream databases.

Change and scope

  • src/ida/IdaProviderCapabilities.ts: IDA_OPERATIONS gains the two operations; idaProfileAdmits makes the modern headless profile the only one that declares them. The legacy and native attached profiles declare 12 operations, as before; the headless profile declares 14.
  • src/ida/IdaSessionClient.ts: refuses the operations outside the headless profile before any upstream call, records whether the server advertises survey_binary, and passes the admitted program path to the runner. The normal pre- and post-operation identity checks, cancellation draining and partial-observation retention apply unchanged.
  • src/ida/IdaOperationRunner.ts: the lookup_funcs row is parsed once into a function, an expected "missing" answer (exactly Not found or Not a function) or a producer failure; procedure selection keeps its previous semantics and messages, and containment reuses the same parsing. For an expected missing answer, survey_binary {detail_level: "minimal"} (scoped to the bound database) supplies segment intervals with exclusive ends; membership decides not_in_procedure versus outside_segments. A different query in the reply, a function together with an error, an unknown error text or neither a function nor an error is a producer failure and reads no segments. list_documents returns the admitted path, not the private workspace copy.
  • src/ida/IdaProtocolValues.ts: the survey reply is reduced to validated intervals. Any malformed coordinate, reversed or empty interval, size that disagrees with the bounds, segment count that disagrees with the survey statistics, absent or empty segment list rejects the whole reply. A transport-truncated preview is already rejected by the decoder. A server that does not advertise survey_binary can still answer positive lookups; a negative lookup fails with a precise message.
  • src/application/CapabilityInventory.ts: trace_feature requires search_strings and search_procedures, the operations the workflow actually calls (it listed list_strings and list_procedures).
  • src/application/EnhancedLiteralTracing.ts: a reference source that several matches share is resolved once.
  • docs/ida-provider.md, docs/testing.md: the coverage text describes the new operations and keeps every existing exclusion (binary_overview, whole-symbol inventory, typed reference edges, complete body ranges); the verification text lists the added real-lane checks.
  • scripts/verify-real-ida.mjs: for the headless profile, the real lane checks the admitted program as the single document, containment at the entry and a second instruction of the selected procedure, an unmapped address, a mapped non-function address when the target has strings, inspect_address_context with the default document, and trace_feature for the selected procedure's name.

Intentionally not included:

  • list_segments: the segment schema's provenance admits only Hopper and Ghidra sources, so an honest IDA reply would need a schema change.
  • read_bytes: upstream get_bytes fills unloaded bytes with zeros without an error and needs its own segment check.
  • address_to_file_offset: the pinned upstream exposes no file-region mapping.
  • Supporting Evidence for the primitive reads behind composed workflows.
  • Legacy attached and native profiles are unchanged.

Contract and boundary impact

  • Semantic owner and earliest changed stage: the IDA adapter (src/ida), at the profile's operation inventory and the operation runner.
  • CLI and MCP/tool-catalog contract: no tool, parameter, schema or error code changes. The two operations already have public contracts; capabilities and binary_session now report them as available for the headless IDA profile (14 declared operations, 13 available, instead of 12 and 11).
  • Provider, bridge, target-format, or platform compatibility: IDA modern headless profile only; checked on macOS arm64 with IDA 9.1.
  • Evidence, artifact, provenance, or reconstruction contract: new operations produce ordinary IDA Evidence with raw observations (lookup_funcs, survey_binary); existing Evidence is unchanged.
  • Process execution, authorization, cleanup, or containment impact: none; both operations are read-only and use the existing worker lifecycle. A negative containment read adds one survey_binary request (see Observed, not changed).
  • Generated metadata/package/installation impact: none to commit; the generated catalog reflects the new declarations.

Evidence and regression coverage

  • Tests added or updated: src/ida/IdaContainment.test.ts (headless session client over the recording fake): descriptors per profile; the legacy profile and the native profile refuse both operations without any upstream call; an interior address resolves to the canonical entry without reading segments; a matrix of negative addresses at segment starts, last bytes, exclusive ends, adjacent segments, gaps and above 2^53 (a one-byte segment that a rounded number cannot tell apart) in ascending and descending survey order; every kind of survey defect (missing, null or empty list, malformed coordinate, reversed bounds, disagreeing size, disagreeing count, a malformed row after valid ones, tool error, transport preview, tool not advertised) fails with the completed replies retained; each lookup anomaly fails without reading segments; both accepted missing texts; cancellation between lookup and survey; invalid address and foreign document refused before any upstream call; list_documents returns exactly the admitted path (not a source alias), runs the identity checks, fails on a changed target and honours cancellation. tests/boundary/providers/ida/containment.test.ts: trace_feature attributes a reference to its containing procedure and keeps an upstream reference cap visible; inspect_address_context with and without the explicit document gives the same result with an available procedure facet and the other facets unavailable. tests/conformance/ida/providerContracts.test.ts: the contract matrix covers the new operations for the headless profile. src/application/CapabilityInventory.test.ts: each search prerequisite of trace_feature is required independently. src/ida/IdaNativeProtocol.test.ts: the native profile does not admit the operations.
  • Base reproduction or other evidence: the new tests fail on the parent commit (RED commits bfcb5afde, 99ff05d09, 64701e8f3: 28 failed in IdaContainment.test.ts, the four boundary tests failed with capability_unavailable, two inventory tests failed). Real run on macOS 26.5 arm64 with IDA Professional 9.1: npm run verify:ida with the extended headless scenario passed (all six checks), including containment at the entry and an interior instruction, an unmapped address and trace_feature.
  • Remaining proof gaps: only macOS arm64 with IDA 9.1 was run for real; a negative containment answer on real IDA depends on the fixture's mapped data and was exercised when the target has strings; Linux, Windows, other IDA releases and architectures were not run.
  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run check:fast, npm run check, npm run docs:check, npm run verify:test-discovery (968 files) - green
  • npm run test:fast - 409 files, 5359 passed, 7 skipped, 0 failed; npm run test:mcp - 103 files passed, 2 skipped, 448 passed, 3 skipped; npm run test:boundary -- tests/boundary/providers/ida after npm run build:cached - 18 passed
  • REA_IDA_MCP_CONFIG=$HOME/ida-mcp.json npm run verify:ida -- --target <inventory> --procedure _rea_fixture_add --report <path> - passed, mode headless, six checks; no IDA worker left running
  • Mutation checks, each reverted: dropping profile admission fails 2; an inclusive segment end fails 3; swapped reasons fail 9; dropping the bounds validation fails 2; an empty document list fails 3; treating any lookup error as "missing" fails 2; the previous inventory requirements fail 2; comparing addresses as numbers fails 1; scanning only the first segment fails 4

macOS arm64 only; Linux and Windows were not executed.

Compatibility, safety, and release

  • Breaking changes or migration steps: none. trace_feature and inspect_address_context now succeed on headless IDA instead of reporting capability_unavailable.
  • Real Hopper/Ghidra, browser, or OS coverage: real IDA 9.1 on macOS arm64; Hopper, Ghidra and browser not applicable.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: read-only upstream requests only; a hostile or malformed survey or lookup reply is rejected rather than trusted, and neither reply text nor private workspace paths reach the result.

Observed, not changed

  • A negative containment read issues one survey_binary request; the minimal survey still enumerates functions and hashes the input, so a trace_feature over many distinct reference sources that are not inside any function repeats it per distinct source. A source shared by several matches is resolved once. Caching the segment layout for the session would change the "live results" semantics and is left out.

Review checklist

  • The change addresses a concrete problem, not an unscoped refactor.
  • The PR has one focused outcome, and the title follows type(scope): outcome.
  • Related issue is linked.
  • Tests cover changed behavior and failure paths.
  • Owning docs, contracts, and generated metadata are updated.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2374 **Author:** [@nikolay-dementiev](https://github.com/nikolay-dementiev) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `feat/ida-containing-procedure` --- ### 📝 Commits (10+) - [`d8b802b`](https://github.com/morluto/rea/commit/d8b802b3a035a762d49793cec03dbd9d627509cf) test(mcp): expect trace_feature to report references the provider truncated - [`41708b0`](https://github.com/morluto/rea/commit/41708b0928055da57e4595532eb36ad273e914b3) fix(mcp): report references a provider truncated in trace_feature - [`5c01da3`](https://github.com/morluto/rea/commit/5c01da3dbf80212e557ef9335c3237c76a6716af) refactor(ida): report reference truncation whenever the runner observed an xrefs cap - [`6160b6e`](https://github.com/morluto/rea/commit/6160b6eb8ee9f51a44ba534712cec0640a06e3c9) test(mcp): cover session forwarding, per-target state, native reports and failures of the trace coverage - [`142f8ad`](https://github.com/morluto/rea/commit/142f8ad693b4a32e80a2f15e14892802973bff72) test(mcp): format the session forwarding test - [`bfcb5af`](https://github.com/morluto/rea/commit/bfcb5afdeaf2663ac9a1b9d8a0ada03d371f0584) test(ida): expect headless IDA to resolve containing procedures from lookups and segment facts - [`99ff05d`](https://github.com/morluto/rea/commit/99ff05d09d2fcc77b52e4b728f3058be64581ade) test(ida): expect feature tracing and address context to work on headless IDA - [`64701e8`](https://github.com/morluto/rea/commit/64701e8f39fadedcd984e0829fe31e3fa2bd366d) test(mcp): expect trace_feature availability to follow the search operations it calls - [`a88a9ea`](https://github.com/morluto/rea/commit/a88a9ea22567984bfdea3e12c274fc346fbd4e64) fix(mcp): derive trace_feature availability from the search operations it calls - [`6c46908`](https://github.com/morluto/rea/commit/6c46908341754e263aa3987e5df0fb9c600a2d0b) feat(ida): resolve containing procedures and report the admitted program as the document ### 📊 Changes **27 files changed** (+1984 additions, -79 deletions) <details> <summary>View changed files</summary> 📝 `docs/ida-provider.md` (+2 -0) 📝 `docs/testing.md` (+3 -1) ➕ `scripts/lib/ida-feature-trace.d.mts` (+9 -0) ➕ `scripts/lib/ida-feature-trace.mjs` (+52 -0) 📝 `scripts/verify-real-ida.mjs` (+60 -1) 📝 `src/application/AnalysisProvider.ts` (+11 -0) 📝 `src/application/CapabilityInventory.test.ts` (+68 -0) 📝 `src/application/CapabilityInventory.ts` (+2 -2) 📝 `src/application/EnhancedLiteralTracing.ts` (+47 -17) 📝 `src/application/EnhancedTools.ts` (+2 -0) 📝 `src/application/InvestigationProviders.ts` (+3 -1) 📝 `src/application/binary/AnalysisSnapshotCache.test.ts` (+49 -0) 📝 `src/application/binary/AnalysisSnapshotCache.ts` (+3 -0) ➕ `src/ida/IdaContainment.test.ts` (+623 -0) 📝 `src/ida/IdaNativeProtocol.test.ts` (+30 -0) 📝 `src/ida/IdaOperationRunner.ts` (+86 -20) 📝 `src/ida/IdaProtocolValues.ts` (+50 -0) 📝 `src/ida/IdaProviderCapabilities.ts` (+48 -31) ➕ `src/ida/IdaReferenceCoverage.test.ts` (+96 -0) 📝 `src/ida/IdaSessionClient.ts` (+19 -0) _...and 7 more files_ </details> ### 📄 Description ## Summary With the modern headless IDA profile, `trace_feature` failed with `capability_unavailable` for `resolve_containing_procedure`, and `inspect_address_context` failed for `list_documents`. The profile now implements both operations, so feature tracing and address context work on IDA. A containing function comes from upstream `lookup_funcs`; when no function contains the address, the database's own segments decide between the two negative reasons, and a missing or inconsistent segment fact fails the read instead of guessing a reason. Fixes #2335 Builds on #2348 (`trace_feature` reference coverage); its commits appear in this branch until #2348 is merged. The capped-reference qualification it adds is exercised here end to end. ## Problem and expected behavior Observed on real IDA Professional 9.1 (headless idalib, ida-pro-mcp `c133c3853faa111a9b00ee615c013b720d0c4acd`) with a small arm64 Mach-O: `trace_feature {"query": "sum_point"}` and `inspect_address_context {"address": "0x100000564"}` both returned `capability_unavailable` naming those operations; with an explicit `document`, address context answered but every containment facet stayed unavailable. Upstream `lookup_funcs` returns the canonical containing function for an interior address (`0x100000564` gave `_use_wrapper` at `0x100000560`) and `fn: null, error: "Not a function"` for data, which does not say whether the address is mapped. Expected: an entry, interior or tail address returns its canonical containing procedure (the body stays unavailable, as for other IDA identities); an address inside a segment but outside any function is `not_in_procedure`; an unmapped address is `outside_segments`; if segment membership cannot be established, the read fails. `list_documents` returns the single admitted program, so default document resolution works without enumerating unrelated upstream databases. ## Change and scope - `src/ida/IdaProviderCapabilities.ts`: `IDA_OPERATIONS` gains the two operations; `idaProfileAdmits` makes the modern headless profile the only one that declares them. The legacy and native attached profiles declare 12 operations, as before; the headless profile declares 14. - `src/ida/IdaSessionClient.ts`: refuses the operations outside the headless profile before any upstream call, records whether the server advertises `survey_binary`, and passes the admitted program path to the runner. The normal pre- and post-operation identity checks, cancellation draining and partial-observation retention apply unchanged. - `src/ida/IdaOperationRunner.ts`: the `lookup_funcs` row is parsed once into a function, an expected "missing" answer (exactly `Not found` or `Not a function`) or a producer failure; procedure selection keeps its previous semantics and messages, and containment reuses the same parsing. For an expected missing answer, `survey_binary {detail_level: "minimal"}` (scoped to the bound database) supplies segment intervals with exclusive ends; membership decides `not_in_procedure` versus `outside_segments`. A different query in the reply, a function together with an error, an unknown error text or neither a function nor an error is a producer failure and reads no segments. `list_documents` returns the admitted path, not the private workspace copy. - `src/ida/IdaProtocolValues.ts`: the survey reply is reduced to validated intervals. Any malformed coordinate, reversed or empty interval, size that disagrees with the bounds, segment count that disagrees with the survey statistics, absent or empty segment list rejects the whole reply. A transport-truncated preview is already rejected by the decoder. A server that does not advertise `survey_binary` can still answer positive lookups; a negative lookup fails with a precise message. - `src/application/CapabilityInventory.ts`: `trace_feature` requires `search_strings` and `search_procedures`, the operations the workflow actually calls (it listed `list_strings` and `list_procedures`). - `src/application/EnhancedLiteralTracing.ts`: a reference source that several matches share is resolved once. - `docs/ida-provider.md`, `docs/testing.md`: the coverage text describes the new operations and keeps every existing exclusion (`binary_overview`, whole-symbol inventory, typed reference edges, complete body ranges); the verification text lists the added real-lane checks. - `scripts/verify-real-ida.mjs`: for the headless profile, the real lane checks the admitted program as the single document, containment at the entry and a second instruction of the selected procedure, an unmapped address, a mapped non-function address when the target has strings, `inspect_address_context` with the default document, and `trace_feature` for the selected procedure's name. Intentionally not included: - `list_segments`: the segment schema's provenance admits only Hopper and Ghidra sources, so an honest IDA reply would need a schema change. - `read_bytes`: upstream `get_bytes` fills unloaded bytes with zeros without an error and needs its own segment check. - `address_to_file_offset`: the pinned upstream exposes no file-region mapping. - Supporting Evidence for the primitive reads behind composed workflows. - Legacy attached and native profiles are unchanged. ## Contract and boundary impact - Semantic owner and earliest changed stage: the IDA adapter (`src/ida`), at the profile's operation inventory and the operation runner. - CLI and MCP/tool-catalog contract: no tool, parameter, schema or error code changes. The two operations already have public contracts; `capabilities` and `binary_session` now report them as available for the headless IDA profile (14 declared operations, 13 available, instead of 12 and 11). - Provider, bridge, target-format, or platform compatibility: IDA modern headless profile only; checked on macOS arm64 with IDA 9.1. - Evidence, artifact, provenance, or reconstruction contract: new operations produce ordinary IDA Evidence with raw observations (`lookup_funcs`, `survey_binary`); existing Evidence is unchanged. - Process execution, authorization, cleanup, or containment impact: none; both operations are read-only and use the existing worker lifecycle. A negative containment read adds one `survey_binary` request (see Observed, not changed). - Generated metadata/package/installation impact: none to commit; the generated catalog reflects the new declarations. ## Evidence and regression coverage - Tests added or updated: `src/ida/IdaContainment.test.ts` (headless session client over the recording fake): descriptors per profile; the legacy profile and the native profile refuse both operations without any upstream call; an interior address resolves to the canonical entry without reading segments; a matrix of negative addresses at segment starts, last bytes, exclusive ends, adjacent segments, gaps and above 2^53 (a one-byte segment that a rounded number cannot tell apart) in ascending and descending survey order; every kind of survey defect (missing, null or empty list, malformed coordinate, reversed bounds, disagreeing size, disagreeing count, a malformed row after valid ones, tool error, transport preview, tool not advertised) fails with the completed replies retained; each lookup anomaly fails without reading segments; both accepted missing texts; cancellation between lookup and survey; invalid address and foreign document refused before any upstream call; `list_documents` returns exactly the admitted path (not a source alias), runs the identity checks, fails on a changed target and honours cancellation. `tests/boundary/providers/ida/containment.test.ts`: `trace_feature` attributes a reference to its containing procedure and keeps an upstream reference cap visible; `inspect_address_context` with and without the explicit document gives the same result with an available procedure facet and the other facets unavailable. `tests/conformance/ida/providerContracts.test.ts`: the contract matrix covers the new operations for the headless profile. `src/application/CapabilityInventory.test.ts`: each search prerequisite of `trace_feature` is required independently. `src/ida/IdaNativeProtocol.test.ts`: the native profile does not admit the operations. - Base reproduction or other evidence: the new tests fail on the parent commit (RED commits `bfcb5afde`, `99ff05d09`, `64701e8f3`: 28 failed in `IdaContainment.test.ts`, the four boundary tests failed with `capability_unavailable`, two inventory tests failed). Real run on macOS 26.5 arm64 with IDA Professional 9.1: `npm run verify:ida` with the extended headless scenario passed (all six checks), including containment at the entry and an interior instruction, an unmapped address and `trace_feature`. - Remaining proof gaps: only macOS arm64 with IDA 9.1 was run for real; a negative containment answer on real IDA depends on the fixture's mapped data and was exercised when the target has strings; Linux, Windows, other IDA releases and architectures were not run. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check:fast`, `npm run check`, `npm run docs:check`, `npm run verify:test-discovery` (968 files) - green - `npm run test:fast` - 409 files, 5359 passed, 7 skipped, 0 failed; `npm run test:mcp` - 103 files passed, 2 skipped, 448 passed, 3 skipped; `npm run test:boundary -- tests/boundary/providers/ida` after `npm run build:cached` - 18 passed - `REA_IDA_MCP_CONFIG=$HOME/ida-mcp.json npm run verify:ida -- --target <inventory> --procedure _rea_fixture_add --report <path>` - passed, mode headless, six checks; no IDA worker left running - Mutation checks, each reverted: dropping profile admission fails 2; an inclusive segment end fails 3; swapped reasons fail 9; dropping the bounds validation fails 2; an empty document list fails 3; treating any lookup error as "missing" fails 2; the previous inventory requirements fail 2; comparing addresses as numbers fails 1; scanning only the first segment fails 4 macOS arm64 only; Linux and Windows were not executed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. `trace_feature` and `inspect_address_context` now succeed on headless IDA instead of reporting `capability_unavailable`. - Real Hopper/Ghidra, browser, or OS coverage: real IDA 9.1 on macOS arm64; Hopper, Ghidra and browser not applicable. - Package or release metadata impact: none. - Security, privacy, process, or containment review: read-only upstream requests only; a hostile or malformed survey or lookup reply is rejected rather than trusted, and neither reply text nor private workspace paths reach the result. ## Observed, not changed - A negative containment read issues one `survey_binary` request; the minimal survey still enumerates functions and hashes the input, so a `trace_feature` over many distinct reference sources that are not inside any function repeats it per distinct source. A source shared by several matches is resolved once. Caching the segment layout for the session would change the "live results" semantics and is left out. ## Review checklist - [x] The change addresses a concrete problem, not an unscoped refactor. - [x] The PR has one focused outcome, and the title follows `type(scope): outcome`. - [x] Related issue is linked. - [x] Tests cover changed behavior and failure paths. - [x] Owning docs, contracts, and generated metadata are updated. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 01:04:42 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels   
area: bridge

   
area: bridge

   
area: build

   
area: build

   
area: build

   
area: cli

   
area: domain

   
area: evidence

   
area: mcp

   
area: native

   
area: providers

   
area: runtime

   
area: server

   
area: setup

   
area: tests

   
bug

   
design

   
documentation

   
enhancement

   
enhancement

   
enhancement

   
experiment

   
help wanted

   
i18n

   
invalid

   
P0: critical

   
P1: high

   
P2: medium

   
P2: medium

   
P2: medium

   
P3: low

   
performance

   
provider-request

   
pull-request
Mirrored from GitHub Pull Request

  
question

   
roadmap

   
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#5195
No description provided.