[GH-ISSUE #8321] [Design] Make static call-path investigation available to CLI users #6544

New issue

Open

opened 2026-11-01 21:12:06 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:12:06 +00:00

Owner

Originally created by @morluto on GitHub (Oct 31, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8321

Decision needed

Should the CLI offer the analyst task “find a static call path between these two functions,” reusing the existing shared traversal and Evidence contract? If not, how should CLI users discover the supported route to that result?

Context and evidence

On REA b43c329 (the relevant CLI and contract files are unchanged through origin/main 23de10b), an unexecuted arm64 Mach-O contains _audit_0 → _audit_1 → _audit_2. With real Ghidra 12.1.4 and Kuna 1.986 on macOS arm64, separate MCP sessions each returned goal_status: reached, three nodes and two edges from trace_call_path. Each also returned not_reached after examining the 20-node observed chain for a separately selected unrelated function; neither result proves runtime reachability.

On the same target, rea --help listed no call-path or call-graph command. rea trace-call-path ... returned COMMAND_NOT_FOUND; rea trace <path> _audit_0 _audit_2 rejected the second endpoint because rea trace is a literal-feature query. Two real Ghidra rea function calls for _audit_0 and _audit_1 did expose the respective callee edges, so a caller can manually assemble this short positive example. Those separate dossiers do not themselves supply the composed traversal result, its goal status, or its aggregate coverage. This is one small fixture and no autonomous-agent or performance measurement.

The request is motivated by a useful CLI investigation, not by a requirement to expose every MCP tool as a command. Source registration exposes trace_call_path in MCP, while the CLI's trace dispatches the different literal-feature workflow. The target digest was unchanged and neither provider executed the target.

Expected interaction with targets

Read a caller-selected binary and query the selected static provider. No execution or target mutation is proposed.

Boundary details (optional)

Reuse existing traversal semantics, selected provider, direction, Evidence and limitations. Preserve unknowns and provider-specific relationship coverage; a static path is not proof of runtime execution. Take into account the independently reported computed-call limitation in #8277 and avoid equating incomplete discovery with a complete negative. CLI is a one-shot session; do not imply retained in-memory state survives it.

Options and tradeoffs

Consider a dedicated task-level CLI command backed by the existing shared workflow, or documentation of an adequate existing CLI composition if one was missed. Avoid an unbounded command merely to mirror an API; caller-selected work budgets are discussed separately in #8236. Preserve output/Evidence handoff appropriate for one-shot CLI use.

Verification available so far

I have a prototype or observed results. The MCP positive and negative cases and CLI manual-edge control used one local fixture; CLI endpoint ambiguity, failure recovery, other formats/platforms, and any new command are untested. If adopted, exercise the public CLI and MCP against real providers and controlled incomplete relationships, including both directions and unreachable versus unknown.

References

Related: #8236 (caller-bounded traversal), #8200 (call-site context), #8277 (indirect-call completeness), #8281 (a different retained-dossier composition). @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

Originally created by @morluto on GitHub (Oct 31, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8321 ### Decision needed Should the CLI offer the analyst task “find a static call path between these two functions,” reusing the existing shared traversal and Evidence contract? If not, how should CLI users discover the supported route to that result? ### Context and evidence On REA `b43c329` (the relevant CLI and contract files are unchanged through `origin/main` `23de10b`), an unexecuted arm64 Mach-O contains `_audit_0` → `_audit_1` → `_audit_2`. With real Ghidra 12.1.4 and Kuna 1.986 on macOS arm64, separate MCP sessions each returned `goal_status: reached`, three nodes and two edges from `trace_call_path`. Each also returned `not_reached` after examining the 20-node observed chain for a separately selected unrelated function; neither result proves runtime reachability. On the same target, `rea --help` listed no call-path or call-graph command. `rea trace-call-path ...` returned `COMMAND_NOT_FOUND`; `rea trace <path> _audit_0 _audit_2` rejected the second endpoint because `rea trace` is a literal-feature query. Two real Ghidra `rea function` calls for `_audit_0` and `_audit_1` did expose the respective callee edges, so a caller can manually assemble this short positive example. Those separate dossiers do not themselves supply the composed traversal result, its goal status, or its aggregate coverage. This is one small fixture and no autonomous-agent or performance measurement. The request is motivated by a useful CLI investigation, not by a requirement to expose every MCP tool as a command. Source registration exposes `trace_call_path` in MCP, while the CLI's `trace` dispatches the different literal-feature workflow. The target digest was unchanged and neither provider executed the target. ### Expected interaction with targets Read a caller-selected binary and query the selected static provider. No execution or target mutation is proposed. ### Boundary details (optional) Reuse existing traversal semantics, selected provider, direction, Evidence and limitations. Preserve unknowns and provider-specific relationship coverage; a static path is not proof of runtime execution. Take into account the independently reported computed-call limitation in #8277 and avoid equating incomplete discovery with a complete negative. CLI is a one-shot session; do not imply retained in-memory state survives it. ### Options and tradeoffs Consider a dedicated task-level CLI command backed by the existing shared workflow, or documentation of an adequate existing CLI composition if one was missed. Avoid an unbounded command merely to mirror an API; caller-selected work budgets are discussed separately in #8236. Preserve output/Evidence handoff appropriate for one-shot CLI use. ### Verification available so far I have a prototype or observed results. The MCP positive and negative cases and CLI manual-edge control used one local fixture; CLI endpoint ambiguity, failure recovery, other formats/platforms, and any new command are untested. If adopted, exercise the public CLI and MCP against real providers and controlled incomplete relationships, including both directions and unreachable versus unknown. ### References Related: #8236 (caller-bounded traversal), #8200 (call-site context), #8277 (indirect-call completeness), #8281 (a different retained-dossier composition). @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

bsakaguchi added the

enhancement

triage

labels

2026-11-01 21:12:06 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6544

No description provided.

Rows
Columns