morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8396] [Bug] Kuna xref name errors direct data lookups to procedure search #6582

New issue

Open

opened 2026-11-01 21:12:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:12:25 +00:00

Owner

Originally created by @morluto on GitHub (Oct 31, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8396

Before submitting

I searched open and closed issues for related reports.
I removed credentials, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

Kuna xrefs can resolve names of both functions and data from its inventory, but if a supplied name is absent from that inventory, the error says no procedure was found and suggests search_procedures, even when the requested name denotes exported data. The generic remediation also advises schema repair for an accepted string selector. Ambiguous names identify candidate addresses in the message but carry the same unrelated schema-repair remediation.

Reproduction

On REA 6e9ee97a69cb16c7150d8b550e705cba055ee4f0, Node 24.22.1, macOS arm64, Kuna 1.986, open a source-owned unexecuted C++ Mach-O with an exported data symbol _audit_global and overloaded audit_over functions.

MCP xrefs({address:"_audit_global"}) and rea xrefs <target> _audit_global --provider kuna --format json return invalid_request, message Kuna found no procedure named _audit_global; search_procedures finds similar names., with schema-inspection recovery.
On the same target, inspect_macho reports the exported symbol at 0x100004000; Kuna MCP xrefs({address:"0x100004000"}) returns two source addresses. This is a bounded export-to-address handoff, not proof that Kuna's inventory contains the symbol or that its xrefs are complete.
xrefs({address:"audit_over"}) reports two candidate addresses and asks to select one, but still carries schema-inspection recovery. Both MCP and CLI exhibit that error on this fixture.
On a different source-owned Mach-O, Kuna MCP and CLI xrefs with a known inventory data name global_count returned the same references as its exact resolved address; a known function name also worked. find_xrefs_to_name remains unavailable because Kuna does not declare the general list_names capability.

Expected behavior

Distinguish an inventory name not found from a missing procedure, and point to an appropriate route such as inspecting supported symbol/export inventory and using a verified address. For ambiguity, preserve the candidate addresses and recommend selecting one. Do not claim that a name is absent from the artifact, automatically choose a candidate, or imply complete references.

Impact and scope

The message may send an agent searching only functions for a data xref or editing a valid string input. The symbol's numeric address and provider limitation remain available through other workflows. One host and two self-built targets were tested; no agent decision, broad frequency, or other provider behavior is asserted.

REA version

6e9ee97a69cb16c7150d8b550e705cba055ee4f0

Runtime and platform

Node 24.22.1; macOS arm64; Kuna 1.986; TypeScript MCP SDK 2.3.1.

Target and artifact context

Unexecuted arm64 Mach-O C++ fixture, SHA-256 bce7eb96e644a202eaa0fb1e709f0e82d2ea6389c52244ae87433c0cf8039d74, and a separate arm64 Mach-O, SHA-256 ffad1b70c6a5a7ef3f7c3f59126be516520210777d949b35e97c9067f272aa2d. Target hashes unchanged during the current tests.

Interface

MCP and CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Observed MCP error: Kuna found no procedure named _audit_global; search_procedures finds similar names. Recovery says inspect_input_contract. Successful MCP results were validated against fetched compact output schemas. The export/address control was performed in an earlier real session on the same source-owned fixture; target hash was unchanged.

Typed outcome or recovery expected

Preserve invalid_request, caller-selected name and any candidates; distinguish the provider inventory's observed scope and offer conditional recovery without asserting global absence.

Analysis or suspected cause

Source-derived: KunaSessionClient.#referenceAddress deliberately accepts data names for xrefs, then shares #resolve's missing-name wording with procedure selectors. #resolve constructs AnalysisInputError without a contract-conforming recovery for either missing or ambiguous selector. This is a UX/projection issue, not evidence that Kuna should invent a general name inventory.

Additional context

Related #8183 concerns recovery from find_xrefs_to_name when general list_names is unavailable; #5908 concerns name ambiguity. Last known good: NOT_ENOUGH_INFO. Looping in @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0.

Originally created by @morluto on GitHub (Oct 31, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8396 ### Before submitting - [x] I searched open and closed issues for related reports. - [x] I removed credentials, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior Kuna `xrefs` can resolve names of both functions and data from its inventory, but if a supplied name is absent from that inventory, the error says no **procedure** was found and suggests `search_procedures`, even when the requested name denotes exported data. The generic remediation also advises schema repair for an accepted string selector. Ambiguous names identify candidate addresses in the message but carry the same unrelated schema-repair remediation. ### Reproduction On REA `6e9ee97a69cb16c7150d8b550e705cba055ee4f0`, Node 24.22.1, macOS arm64, Kuna 1.986, open a source-owned unexecuted C++ Mach-O with an exported data symbol `_audit_global` and overloaded `audit_over` functions. 1. MCP `xrefs({address:"_audit_global"})` and `rea xrefs <target> _audit_global --provider kuna --format json` return `invalid_request`, message `Kuna found no procedure named _audit_global; search_procedures finds similar names.`, with schema-inspection recovery. 2. On the same target, `inspect_macho` reports the exported symbol at `0x100004000`; Kuna MCP `xrefs({address:"0x100004000"})` returns two source addresses. This is a bounded export-to-address handoff, not proof that Kuna's inventory contains the symbol or that its xrefs are complete. 3. `xrefs({address:"audit_over"})` reports two candidate addresses and asks to select one, but still carries schema-inspection recovery. Both MCP and CLI exhibit that error on this fixture. 4. On a different source-owned Mach-O, Kuna MCP and CLI `xrefs` with a known inventory data name `global_count` returned the same references as its exact resolved address; a known function name also worked. `find_xrefs_to_name` remains unavailable because Kuna does not declare the general `list_names` capability. ### Expected behavior Distinguish an inventory name not found from a missing *procedure*, and point to an appropriate route such as inspecting supported symbol/export inventory and using a verified address. For ambiguity, preserve the candidate addresses and recommend selecting one. Do not claim that a name is absent from the artifact, automatically choose a candidate, or imply complete references. ### Impact and scope The message may send an agent searching only functions for a data xref or editing a valid string input. The symbol's numeric address and provider limitation remain available through other workflows. One host and two self-built targets were tested; no agent decision, broad frequency, or other provider behavior is asserted. ### REA version `6e9ee97a69cb16c7150d8b550e705cba055ee4f0` ### Runtime and platform Node 24.22.1; macOS arm64; Kuna 1.986; TypeScript MCP SDK 2.3.1. ### Target and artifact context Unexecuted arm64 Mach-O C++ fixture, SHA-256 `bce7eb96e644a202eaa0fb1e709f0e82d2ea6389c52244ae87433c0cf8039d74`, and a separate arm64 Mach-O, SHA-256 `ffad1b70c6a5a7ef3f7c3f59126be516520210777d949b35e97c9067f272aa2d`. Target hashes unchanged during the current tests. ### Interface MCP and CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence Observed MCP error: `Kuna found no procedure named _audit_global; search_procedures finds similar names.` Recovery says `inspect_input_contract`. Successful MCP results were validated against fetched compact output schemas. The export/address control was performed in an earlier real session on the same source-owned fixture; target hash was unchanged. ### Typed outcome or recovery expected Preserve `invalid_request`, caller-selected name and any candidates; distinguish the provider inventory's observed scope and offer conditional recovery without asserting global absence. ### Analysis or suspected cause Source-derived: `KunaSessionClient.#referenceAddress` deliberately accepts data names for `xrefs`, then shares `#resolve`'s missing-name wording with procedure selectors. `#resolve` constructs `AnalysisInputError` without a contract-conforming recovery for either missing or ambiguous selector. This is a UX/projection issue, not evidence that Kuna should invent a general name inventory. ### Additional context Related #8183 concerns recovery from `find_xrefs_to_name` when general `list_names` is unavailable; #5908 concerns name ambiguity. Last known good: NOT_ENOUGH_INFO. Looping in @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0.

bsakaguchi added the

bug

triage

labels

2026-11-01 21:12:25 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6582

No description provided.

Rows
Columns