morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #1970] [Bug] Mach-O dylib-use commands are rejected as missing legacy timestamps #655

New issue

Closed

opened 2026-10-15 18:27:01 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:27:01 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1970

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation.

Observed behavior

rea inspect-macho --json fails with unreadable_output / execution_failure on a valid source-built Mach-O containing a delay-initialized dylib. The real macOS CLI/MCP verification lane captures successful otool -h -l output, but REA rejects its dylib-use command as missing time stamp.

Reproduction

Build a Mach-O with a delayed dylib dependency using the existing scripts/verify/apple/macos-bundle.mjs workflow.
Run rea inspect-macho /absolute/path/Fixture.app --json on macOS with the Apple command-line tools available.
Observe Malformed otool load-command output. Replaying the retained output into parseOtoolLoadCommands gives otool field time stamp is missing or repeated.

The relevant valid producer block is:

Load command 16
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name @rpath/libdelay.dylib (offset 28)
      options delay-init
      current version 0.0.0
compatibility version 1.0.0

Expected behavior

Accept the actual producer's dylib-use representation, preserve the install name and options in command evidence, and retain strict command count, byte count, duplicate-field and malformed multiline checks.

Impact and scope

Native Mach-O inspection fails for legal dylib-use commands. Legacy dylib commands carry time stamp; dylib-use commands carry options instead. Repeating setup or changing the target does not address the parser mismatch. No target execution or mutation is required.

REA version

6.4.0; regression introduced by main 108b5f942 and reproduced after integrating main 1d4c4eb03.

Runtime and platform

Node.js 24.18.0; actual macOS arm64 CLI/MCP verification job, with its retained output replayed on Linux. Full native macOS verification remains necessary after the fix.

Target and artifact context

Source-built arm64 Mach-O application with a delayed dylib dependency.

Interface

CLI and MCP.

Earliest failure stage

Native analysis or reconstruction: parsing successfully captured otool output.

Relevant output or evidence

The failed real-provider job is Real Apple artifact CLI/MCP E2E. Its retained 5,728-byte load-command capture contains 23 commands, including the dylib-use block above.

Typed outcome or recovery expected

Successful inspection Evidence with retained dependency and load-command fields. Ambiguous or malformed command framing should remain unreadable_output.

Analysis or suspected cause

Confirmed by replay and source inspection: scalarFields unconditionally requires time stamp for every dylib command, and validateDylibCommandLines does not allow options. The producer selects exactly one representation. Apple's producer implementation emits options for dylib_use_command and time stamp for legacy commands.

Additional context

Cover delay-init, empty options, and combined flags; retain rejection of missing/both representation fields, duplicate options, malformed fields and forged command framing. The existing Apple CLI/MCP verification should establish real-provider success.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1970 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation. ### Observed behavior `rea inspect-macho --json` fails with `unreadable_output` / `execution_failure` on a valid source-built Mach-O containing a delay-initialized dylib. The real macOS CLI/MCP verification lane captures successful `otool -h -l` output, but REA rejects its dylib-use command as missing `time stamp`. ### Reproduction 1. Build a Mach-O with a delayed dylib dependency using the existing `scripts/verify/apple/macos-bundle.mjs` workflow. 2. Run `rea inspect-macho /absolute/path/Fixture.app --json` on macOS with the Apple command-line tools available. 3. Observe `Malformed otool load-command output`. Replaying the retained output into `parseOtoolLoadCommands` gives `otool field time stamp is missing or repeated`. The relevant valid producer block is: ```text Load command 16 cmd LC_LOAD_DYLIB cmdsize 56 name @rpath/libdelay.dylib (offset 28) options delay-init current version 0.0.0 compatibility version 1.0.0 ``` ### Expected behavior Accept the actual producer's dylib-use representation, preserve the install name and options in command evidence, and retain strict command count, byte count, duplicate-field and malformed multiline checks. ### Impact and scope Native Mach-O inspection fails for legal dylib-use commands. Legacy dylib commands carry `time stamp`; dylib-use commands carry `options` instead. Repeating setup or changing the target does not address the parser mismatch. No target execution or mutation is required. ### REA version 6.4.0; regression introduced by main `108b5f942` and reproduced after integrating main `1d4c4eb03`. ### Runtime and platform Node.js 24.18.0; actual macOS arm64 CLI/MCP verification job, with its retained output replayed on Linux. Full native macOS verification remains necessary after the fix. ### Target and artifact context Source-built arm64 Mach-O application with a delayed dylib dependency. ### Interface CLI and MCP. ### Earliest failure stage Native analysis or reconstruction: parsing successfully captured `otool` output. ### Relevant output or evidence The failed real-provider job is [Real Apple artifact CLI/MCP E2E](https://github.com/morluto/rea/actions/runs/38176410166/job/114579755550). Its retained 5,728-byte load-command capture contains 23 commands, including the dylib-use block above. ### Typed outcome or recovery expected Successful inspection Evidence with retained dependency and load-command fields. Ambiguous or malformed command framing should remain `unreadable_output`. ### Analysis or suspected cause Confirmed by replay and source inspection: `scalarFields` unconditionally requires `time stamp` for every dylib command, and `validateDylibCommandLines` does not allow `options`. The producer selects exactly one representation. [Apple's producer implementation](https://github.com/apple-oss-distributions/cctools/blob/main/otool/ofile_print.c#L3650) emits `options` for `dylib_use_command` and `time stamp` for legacy commands. ### Additional context Cover delay-init, empty options, and combined flags; retain rejection of missing/both representation fields, duplicate options, malformed fields and forged command framing. The existing Apple CLI/MCP verification should establish real-provider success.

bsakaguchi

2026-10-15 18:27:01 +00:00

closed this issue
added the
area: providers

area: native

P1: high

triage

bug
labels

bsakaguchi commented

2026-10-15 18:27:01 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 11, 2026):

Resolved by the producing parser fix in #1967 and verified by #1972. The parser now accepts the observed dylib-use options layout while retaining rejection of repeated fields. #1972 replays the complete 23-command provider output and updates affected workflow fixture contracts.

All 31 checks passed on commit 31f6be299c3a654bfd5df20e2879ff4c0f590925, including the required CI gate, real Apple artifact CLI/MCP E2E, all four native package baselines and Windows workflows. Merged as 89f5e489adac69af2937fabc1a5ba283191d630a.

@N0zoM1z0 commented on GitHub (Oct 11, 2026): Resolved by the producing parser fix in #1967 and verified by #1972. The parser now accepts the observed dylib-use options layout while retaining rejection of repeated fields. #1972 replays the complete 23-command provider output and updates affected workflow fixture contracts. All 31 checks passed on commit `31f6be299c3a654bfd5df20e2879ff4c0f590925`, including the required CI gate, real Apple artifact CLI/MCP E2E, all four native package baselines and Windows workflows. Merged as `89f5e489adac69af2937fabc1a5ba283191d630a`.

bsakaguchi referenced this issue

2026-10-16 21:14:49 +00:00

[PR #655] [MERGED] docs: correct CLI examples and documentation checks #2141

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#655

No description provided.

Rows
Columns