[PR #2808] [MERGED] fix(cli): refuse a JavaScript integrity policy the binary analyze lane cannot honor #5410

New issue

Closed

opened 2026-10-31 01:06:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:06:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2808
Author: @XiaoBinGan
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/integrity-policy-option

📝 Commits (8)

2bcc76c fix(cli): refuse an integrity policy the binary analyze lane cannot honor
4b2bf10 fix(cli): reject explicit default integrity policies for binaries
d3341fd fix(cli): keep an omitted integrity policy absent on the binary lane
f009be1 fix(cli): omit integrity defaults from binary option schema
40eec5c Merge remote-tracking branch 'origin/main' into fix/integrity-policy-option
690bd79 Merge remote-tracking branch 'origin/main' into pr-2808-fix
83b564b test(ci): isolate report fixtures and declare PowerPC Java bounds
ad2c0c5 chore: resolve main conflicts with shared CI fixture fixes

📊 Changes

2 files changed (+92 additions, -2 deletions)

View changed files

📝 src/cli/coreBinaryCommands.ts (+34 -2)
📝 tests/boundary/cli/javascriptIntegrityPolicyCli.test.ts (+58 -0)

📄 Description

Summary

Refuse analyze --integrity-policy on a binary target instead of accepting the flag and dropping it, matching how the same command already refuses --source-paths on that target. The lanes that can honor the option forward it to handling (for example extract-artifact and inspect-artifact do), so the binary lane was the only lane of analyze that declared it without a consumer.

Problem and expected behavior

analyze declares --integrity-policy for its JavaScript lane and forwards it only on that lane. On a binary target the request cannot take effect: the binary lane has no integrity handling, and binary_overview is a strict object with no input at all, so the value is discarded and the run proceeds exactly as if the caller had never asked. A caller who passes an integrity policy to a binary target gets a successful result that silently ignored their instruction, which is the outcome the repository forbids for caller choices.

Expected: the binary lane refuses the request with the typed input error the same command already uses for the sibling option, so the caller learns the policy does not apply rather than believing it did.

Change and scope

src/cli/coreBinaryCommands.ts adds the refusal to the existing binary-branch validation, next to the source_paths refusal that already covers the same target. The default is read from the owner schema rather than restated, because the option carries a default: the check compares against the schema's own default value so that an unset flag does not refuse every binary analyze.

tests/boundary/cli/javascriptIntegrityPolicyCli.test.ts adds the refusal case plus the control that an unset flag still analyzes a binary target.

No behavior changes on the JavaScript lane, and the sibling inspect path is untouched.

Contract and boundary impact

The CLI option contract narrows to what the lane can honor: a combination that previously reported success now reports a typed input error. The error type, code and shape are the ones the file already uses for the analogous refusal, so no new contract is introduced and no downstream consumer sees a new shape.

The JavaScript lane's contract is unchanged, including its default.

Evidence and regression coverage

npm run test:focused -- tests/boundary/cli/javascriptIntegrityPolicyCli.test.ts:

State	Result
with the change	5 passed
production half reverted to `main`	1 failed, 4 passed — `rejects the JavaScript integrity policy on a binary analyze target`

The regression case therefore fails without the change and pins the refusal, while the control case pins that the default does not trigger it.

npm run check:fast passed on macOS 26.5.1 arm64 with the pinned Node 24.18.0.

Unavailable coverage

The binary analysis itself was exercised through the repository's public CLI boundary rather than against a real Ghidra or IDA installation, because neither is available on this host; the refusal happens before any provider is selected, so provider behavior is not part of this change. The JavaScript lane's own integrity behavior is pre-existing and not re-verified here beyond the control case.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2808 **Author:** [@XiaoBinGan](https://github.com/XiaoBinGan) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/integrity-policy-option` --- ### 📝 Commits (8) - [`2bcc76c`](https://github.com/morluto/rea/commit/2bcc76ce09c6bbb543c6460f0dcf137a1b103988) fix(cli): refuse an integrity policy the binary analyze lane cannot honor - [`4b2bf10`](https://github.com/morluto/rea/commit/4b2bf106d09de7720f8e4e723934a1fef70febf6) fix(cli): reject explicit default integrity policies for binaries - [`d3341fd`](https://github.com/morluto/rea/commit/d3341fdcf532643385de2ec4923c065baedc035c) fix(cli): keep an omitted integrity policy absent on the binary lane - [`f009be1`](https://github.com/morluto/rea/commit/f009be13a6de9bb2914bb227c924cdc8e12fb2b8) fix(cli): omit integrity defaults from binary option schema - [`40eec5c`](https://github.com/morluto/rea/commit/40eec5c607c6a3f6336f5568a56b596c49fe1bee) Merge remote-tracking branch 'origin/main' into fix/integrity-policy-option - [`690bd79`](https://github.com/morluto/rea/commit/690bd796b88790e51b2ccbb228a1d26adb01907e) Merge remote-tracking branch 'origin/main' into pr-2808-fix - [`83b564b`](https://github.com/morluto/rea/commit/83b564bfadc9cfc83bd3ae9cf4a6965e263d3052) test(ci): isolate report fixtures and declare PowerPC Java bounds - [`ad2c0c5`](https://github.com/morluto/rea/commit/ad2c0c556d36b835a7f2599b9977bbea596ca670) chore: resolve main conflicts with shared CI fixture fixes ### 📊 Changes **2 files changed** (+92 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/cli/coreBinaryCommands.ts` (+34 -2) 📝 `tests/boundary/cli/javascriptIntegrityPolicyCli.test.ts` (+58 -0) </details> ### 📄 Description ## Summary Refuse `analyze --integrity-policy` on a binary target instead of accepting the flag and dropping it, matching how the same command already refuses `--source-paths` on that target. The lanes that can honor the option forward it to handling (for example `extract-artifact` and `inspect-artifact` do), so the binary lane was the only lane of `analyze` that declared it without a consumer. ## Problem and expected behavior `analyze` declares `--integrity-policy` for its JavaScript lane and forwards it only on that lane. On a binary target the request cannot take effect: the binary lane has no integrity handling, and `binary_overview` is a strict object with no input at all, so the value is discarded and the run proceeds exactly as if the caller had never asked. A caller who passes an integrity policy to a binary target gets a successful result that silently ignored their instruction, which is the outcome the repository forbids for caller choices. Expected: the binary lane refuses the request with the typed input error the same command already uses for the sibling option, so the caller learns the policy does not apply rather than believing it did. ## Change and scope `src/cli/coreBinaryCommands.ts` adds the refusal to the existing binary-branch validation, next to the `source_paths` refusal that already covers the same target. The default is read from the owner schema rather than restated, because the option carries a default: the check compares against the schema's own default value so that an unset flag does not refuse every binary analyze. `tests/boundary/cli/javascriptIntegrityPolicyCli.test.ts` adds the refusal case plus the control that an unset flag still analyzes a binary target. No behavior changes on the JavaScript lane, and the sibling `inspect` path is untouched. ## Contract and boundary impact The CLI option contract narrows to what the lane can honor: a combination that previously reported success now reports a typed input error. The error type, code and shape are the ones the file already uses for the analogous refusal, so no new contract is introduced and no downstream consumer sees a new shape. The JavaScript lane's contract is unchanged, including its default. ## Evidence and regression coverage `npm run test:focused -- tests/boundary/cli/javascriptIntegrityPolicyCli.test.ts`: | State | Result | | --- | --- | | with the change | 5 passed | | production half reverted to `main` | 1 failed, 4 passed — `rejects the JavaScript integrity policy on a binary analyze target` | The regression case therefore fails without the change and pins the refusal, while the control case pins that the default does not trigger it. `npm run check:fast` passed on macOS 26.5.1 arm64 with the pinned Node 24.18.0. ## Unavailable coverage The binary analysis itself was exercised through the repository's public CLI boundary rather than against a real Ghidra or IDA installation, because neither is available on this host; the refusal happens before any provider is selected, so provider behavior is not part of this change. The JavaScript lane's own integrity behavior is pre-existing and not re-verified here beyond the control case. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:06:25 +00:00