morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[GH-ISSUE #8285] [Bug] trace-native-values CLI cannot save the source Evidence it cites #6523

New issue

Open

opened 2026-11-01 21:11:55 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-11-01 21:11:55 +00:00

Owner

Originally created by @morluto on GitHub (Oct 31, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8285

Before submitting

I searched open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

rea trace-native-values emits a complete trace with evidence_links and per-procedure/node/edge source IDs, but has no advertised way to export the retained source dossiers before its one-shot process exits. Passing the --evidence_output option supported by rea function returned exit 1 and Unknown flag: --evidence_output; no bundle was created.

Reproduction

Using the source-owned fixture and read-only selected Ghidra project described in #8284:

Run rea trace-native-values <target> _audit_call_zero --provider ghidra --max-depth 1 --max-functions 4 --max-nodes 100 --max-edges 200 --limit 100 --format json --full-output. The command succeeds, with a trace citing separate caller and callee dossier IDs. Its --help offers paging and work limits but no Evidence output path.
Repeat with --evidence_output <new-path>: it fails with Unknown flag: --evidence_output and writes no bundle. This attempted option is not advertised by this command.
Control/workaround: separately run rea function <target> _audit_call_zero --provider ghidra --detail complete --evidence_output <caller-bundle> and the same command for the exact callee address, with identical selected-project settings. Each newly generated dossier ID matched the corresponding trace link. rea inspect-analysis-view succeeded for both references using the respective local bundles.

Separately, the same trace over MCP exported both sources in its session bundle. The two independently rerun function commands happened to reproduce identical IDs for this unchanged target and selected project; this does not prove replay will recover historical Evidence after the source or analysis state changes.

Expected behavior

Provide an explicit, bounded way for this CLI workflow to save the trace and its source Evidence closure during the same run, so the caller can later inspect exactly what produced the output. Reuse the existing no-overwrite Evidence-output conventions where suitable. Consider #8282's separate cached-source identity issue when checking closure. This is a proposed improvement; the current command does not advertise Evidence export.

Impact and scope

A one-shot CLI caller otherwise needs a live MCP session or must rerun function analyses using exact selectors and settings to try to reconstruct the cited sources. Only this command and one Ghidra selected-project trace were exercised; other CLI commands and providers are untested. No timing or cost comparison was measured.

REA version

b43c329df779708e43ae297f498a844e45d9c923 (source build). Later origin/main at 23de10bb2849cdce8ddbe70504aa7cc57de75a98 was not runtime tested.

Runtime and platform

Node 24.22.1, macOS 26.3 arm64, Ghidra 12.1.4, JDK 21.

Target and artifact context

Self-built arm64 Mach-O SHA-256 962cdd4d5f291d5859a7d0b4c9a2db5a41ee10c67ee8b08b794683412d6a9aa8. Target digest and all ten caller-owned project-file hashes remained unchanged. The target was not executed.

Interface

CLI

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

The trace's caller and callee links were ev_29615fce835389807ad3277b2511b7407c07682fcf252d9c84f2615f11cafce5 and ev_916cce5f172e52e9c7469e1ddc469203751ed550cb965890e3ecb2479660cbd1; separate CLI function calls returned those IDs and created viewable bundles. Source coreNativeCommands.ts configures trace-native-values without Evidence delivery options. The IDs are fixture-specific.

Originally created by @morluto on GitHub (Oct 31, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8285 ### Before submitting - [x] I searched open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area CLI ### Observed behavior `rea trace-native-values` emits a complete trace with `evidence_links` and per-procedure/node/edge source IDs, but has no advertised way to export the retained source dossiers before its one-shot process exits. Passing the `--evidence_output` option supported by `rea function` returned exit 1 and `Unknown flag: --evidence_output`; no bundle was created. ### Reproduction Using the source-owned fixture and read-only selected Ghidra project described in #8284: 1. Run `rea trace-native-values <target> _audit_call_zero --provider ghidra --max-depth 1 --max-functions 4 --max-nodes 100 --max-edges 200 --limit 100 --format json --full-output`. The command succeeds, with a trace citing separate caller and callee dossier IDs. Its `--help` offers paging and work limits but no Evidence output path. 2. Repeat with `--evidence_output <new-path>`: it fails with `Unknown flag: --evidence_output` and writes no bundle. This attempted option is not advertised by this command. 3. Control/workaround: separately run `rea function <target> _audit_call_zero --provider ghidra --detail complete --evidence_output <caller-bundle>` and the same command for the exact callee address, with identical selected-project settings. Each newly generated dossier ID matched the corresponding trace link. `rea inspect-analysis-view` succeeded for both references using the respective local bundles. Separately, the same trace over MCP exported both sources in its session bundle. The two independently rerun function commands happened to reproduce identical IDs for this unchanged target and selected project; this does not prove replay will recover historical Evidence after the source or analysis state changes. ### Expected behavior Provide an explicit, bounded way for this CLI workflow to save the trace and its source Evidence closure during the same run, so the caller can later inspect exactly what produced the output. Reuse the existing no-overwrite Evidence-output conventions where suitable. Consider #8282's separate cached-source identity issue when checking closure. This is a proposed improvement; the current command does not advertise Evidence export. ### Impact and scope A one-shot CLI caller otherwise needs a live MCP session or must rerun function analyses using exact selectors and settings to try to reconstruct the cited sources. Only this command and one Ghidra selected-project trace were exercised; other CLI commands and providers are untested. No timing or cost comparison was measured. ### REA version `b43c329df779708e43ae297f498a844e45d9c923` (source build). Later `origin/main` at `23de10bb2849cdce8ddbe70504aa7cc57de75a98` was not runtime tested. ### Runtime and platform Node 24.22.1, macOS 26.3 arm64, Ghidra 12.1.4, JDK 21. ### Target and artifact context Self-built arm64 Mach-O SHA-256 `962cdd4d5f291d5859a7d0b4c9a2db5a41ee10c67ee8b08b794683412d6a9aa8`. Target digest and all ten caller-owned project-file hashes remained unchanged. The target was not executed. ### Interface CLI ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence The trace's caller and callee links were `ev_29615fce835389807ad3277b2511b7407c07682fcf252d9c84f2615f11cafce5` and `ev_916cce5f172e52e9c7469e1ddc469203751ed550cb965890e3ecb2479660cbd1`; separate CLI function calls returned those IDs and created viewable bundles. Source [`coreNativeCommands.ts`](https://github.com/morluto/rea/blob/b43c329df779708e43ae297f498a844e45d9c923/src/cli/coreNativeCommands.ts) configures `trace-native-values` without Evidence delivery options. The IDs are fixture-specific.

bsakaguchi added the

bug

triage

labels

2026-11-01 21:11:55 +00:00

bsakaguchi commented

2026-11-01 21:11:55 +00:00

Author

Owner

@morluto commented on GitHub (Oct 31, 2026):

Looping in @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0 for visibility on the REA tool-design investigation.

@morluto commented on GitHub (Oct 31, 2026): Looping in @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0 for visibility on the REA tool-design investigation.

bsakaguchi commented

2026-11-01 21:11:56 +00:00

Author

Owner

@morluto commented on GitHub (Oct 31, 2026):

Neighboring UI workflow control

For scope, real rea trace-native-ui-action with Ghidra on an owned compiled AppKit UI fixture succeeded and returned evidence_links: []; the action, selector, handler and direct-call graph carried their supporting resource, binary-metadata and provider observations inline. Its help also does not advertise --evidence_output, but this result is different from trace-native-values, which emits source dossier IDs that a caller needs to follow. This single UI case does not establish closure behavior for other inputs or workflows. A separate handler coordinate issue in the same result is tracked in #8198.

@morluto commented on GitHub (Oct 31, 2026): ### Neighboring UI workflow control For scope, real `rea trace-native-ui-action` with Ghidra on an owned compiled AppKit UI fixture succeeded and returned `evidence_links: []`; the action, selector, handler and direct-call graph carried their supporting resource, binary-metadata and provider observations inline. Its help also does not advertise `--evidence_output`, but this result is different from `trace-native-values`, which emits source dossier IDs that a caller needs to follow. This single UI case does not establish closure behavior for other inputs or workflows. A separate handler coordinate issue in the same result is tracked in #8198.

bsakaguchi commented

2026-11-01 21:11:56 +00:00

Author

Owner

@morluto commented on GitHub (Oct 31, 2026):

Saved-snapshot handoff control: on the same owned Mach-O used in #8282's cross-server reproduction, rea trace-native-values with the same bounded graph options and limit:3 succeeded without a snapshot and returned the two cold procedure Evidence IDs. This command's public help does not advertise --snapshot; explicitly supplying the existing REA snapshot returned exit 1, Unknown flag: --snapshot. The target and existing snapshot hashes were unchanged.

Thus the saved-snapshot instance of #8282 was reproduced through MCP, not the CLI. If a future CLI workflow exposes a snapshot input or Evidence-closure output, test the actual retained source IDs and selected target/profile together; the current lack of --snapshot is a capability/design gap, not a violation of an advertised option. Separate rea function --snapshot support does not automatically provide this trace workflow.

@morluto commented on GitHub (Oct 31, 2026): Saved-snapshot handoff control: on the same owned Mach-O used in #8282's cross-server reproduction, `rea trace-native-values` with the same bounded graph options and `limit:3` succeeded without a snapshot and returned the two cold procedure Evidence IDs. This command's public help does not advertise `--snapshot`; explicitly supplying the existing REA snapshot returned exit 1, `Unknown flag: --snapshot`. The target and existing snapshot hashes were unchanged. Thus the saved-snapshot instance of #8282 was reproduced through MCP, not the CLI. If a future CLI workflow exposes a snapshot input or Evidence-closure output, test the actual retained source IDs and selected target/profile together; the current lack of `--snapshot` is a capability/design gap, not a violation of an advertised option. Separate `rea function --snapshot` support does not automatically provide this trace workflow.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6523

No description provided.

Rows
Columns