[PR #5740] [CLOSED] fix(errors): advise on fixed input and report allowances, not memory or output #7038

New issue

Closed

opened 2026-11-01 21:44:53 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:44:53 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5740
Author: @8rulerstar
Created: 10/21/2026
Status: ❌ Closed

Base: main ← Head: fix/il2cpp-refusal-hints

📝 Commits (2)

fc7e378 fix(errors): advise on fixed input and report allowances, not memory or output
e9d105a test(electron): pin input allowance advice on oversized fuse artifacts

📊 Changes

8 files changed (+70 additions, -10 deletions)

View changed files

📝 src/domain/analysisErrorPresentation.ts (+19 -0)
📝 src/domain/analysisErrorProjection.test.ts (+25 -0)
📝 src/electron/ElectronFuseProvider.test.ts (+4 -0)
📝 src/go/GoBinaryProvider.ts (+1 -5)
📝 src/il2cpp/Il2cppMetadataProvider.ts (+2 -1)
📝 src/wasm/WabtFailures.ts (+0 -2)
📝 tests/boundary/cli/artifactInputLimits.test.ts (+2 -0)
📝 tests/boundary/il2cpp/il2cppMetadataProvider.test.ts (+17 -2)

📄 Description

Summary

Thank you @coygeek for both reports, the reproduction scripts, and for pointing at the Go control and the separate report-budget producer.

Fixes #5405
Fixes #5460

Two fixed byte allowances returned recovery advice that cannot help:

Input-size refusals (resource: file-size, maximum_input_bytes) from inspect-rust-binary and inspect-il2cpp-metadata advised a larger file-size allowance for the evidence reply.
The IL2CPP complete-report budget (maximum_report_bytes) was reported as resource: memory and advised worker or host memory.

Both now give advice about the fixed allowance, and the report budget is no longer a memory constraint.

Problem and expected behavior

Both producers raise AnalysisResourceConstraintError without remediationAction, so analysisErrorRemediationAction in src/domain/analysisErrorPresentation.ts picked advice from the resource kind alone. Its file-size text describes a worker output-write failure, and its memory text describes worker or host memory. A fixed input or report allowance is deterministic for the same input, so neither change admits it. Go and WASM already avoided the input case by repeating the same override text in each producer.

Change and scope

Shared owner: analysisErrorPresentation.ts gains fixedBudgetRemediation, consulted after an explicit remediationAction and before the per-resource fallback.
- file-size with maximum_input_bytes: the existing Go/WASM input text ("Select a suitable stable artifact within the reported input byte allowance. ...").
- Any resource with maximum_report_bytes: "Select an artifact whose complete report fits within the reported report byte allowance. Worker or host memory does not raise this fixed allowance; retrying the unchanged input will fail again."
- Everything else keeps its current advice. A file-size constraint without maximum_input_bytes (a real write failure) still gets the evidence-reply advice, and a memory constraint that only also lists maximum_input_bytes (for example the web capture decoder) still gets memory advice.
Producer: the IL2CPP reportLimit is now capacity with retryable: false, matching the other fixed byte-representation budgets (NativeMatchingAdmission, WasmInterfaceComparisonService) and the retryable note on AnalysisResourceConstraintError. The message, maximum_report_bytes and partial source Evidence are unchanged.
Cleanup: Go (GoBinaryProvider.ts) and WASM (WabtFailures.ts) drop their identical input-size override, since the owner now returns the same text. Their output is unchanged (the CLI test covers both).

Other tool sharing the input bug, now also fixed through the owner (replayed with a 1 GiB + 1 byte sparse file, since the Electron fuse input limit is 1 GiB): Electron fuse inspection (src/electron/ElectronFuseFailures.ts, file-size with maximum_input_bytes and no override). src/electron/ElectronFuseProvider.test.ts now pins its advice.

Not included, noted for maintainers:

The IL2CPP one-inspection-per-reader refusal (maximum_concurrent_inspections: 1) is also classified as memory; that is admission capacity, not part of these reports.
NativeMatchingAdmission and WasmInterfaceComparisonService report fixed byte budgets as capacity without retryable: false, so they advertise "Wait for an active analysis" and retryable: true. Same family, separate fix.

Contract and boundary impact

Semantic owner and earliest changed stage: analysisErrorRemediationAction (error presentation); IL2CPP reportLimit producer.
Contribution scope fit and linked maintainer decision: ordinary fix within existing boundaries; not applicable.
CLI and MCP/tool-catalog contract: no schema change. remediation.action text changes for Rust, IL2CPP and Electron fuse input refusals and for the IL2CPP report budget; IL2CPP report budget details.resource changes from memory to capacity (retryable stays false).
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: unchanged; partial source Evidence is retained.
Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
Generated metadata, package, or installation impact: none.
Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added or updated:
- tests/boundary/cli/artifactInputLimits.test.ts: adds inspect-rust-binary and inspect-il2cpp-metadata to the existing Go/WASM 256 MiB sparse-file case (input advice, no "evidence reply").
- src/domain/analysisErrorProjection.test.ts: six cases at the owner, both directions: file-size+maximum_input_bytes gives input advice; file-size+file_size_bytes keeps evidence-reply advice; memory+maximum_input_bytes keeps memory advice; maximum_report_bytes under capacity and memory gives report advice; capacity admission keeps "Wait".
- tests/boundary/il2cpp/il2cppMetadataProvider.test.ts: the existing 1,100-method oversized-report case (the issue's layout) now asserts resource: capacity, retryable: false, maximum_report_bytes: 67108864 and report advice without memory or wait advice.
- src/electron/ElectronFuseProvider.test.ts: the existing 1 GiB + 1 byte sparse-file case now also asserts the projected remediation.action equals the shared input allowance text. On the pre-fix revision it fails (received the evidence-reply advice); with the change src/electron and src/domain/analysisErrorProjection.test.ts pass (6 files, 138 tests).
- On the base revision these fail (6 failed, 277 passed); with the change 283 passed, 1 skipped, across 14 files including Go, Rust, WASM and Electron fuse suites.
Base reproduction or other evidence: both issue scripts replayed on the built branch:

inspect-go-binary       1 resource_constraint retryable=false file-size {maximum_input_bytes: 268435456} Select a suitable stable artifact within the reported input byte allowance. ...
inspect-rust-binary     1 resource_constraint retryable=false file-size {maximum_input_bytes: 268435456} Select a suitable stable artifact within the reported input byte allowance. ...
inspect-il2cpp-metadata 1 resource_constraint retryable=false file-size {maximum_input_bytes: 268435456} Select a suitable stable artifact within the reported input byte allowance. ...
v29, 1 method:     exit 0, 1 method returned
v29, 1,100 methods: exit 1 resource_constraint retryable=false capacity {maximum_report_bytes: 67108864} Select an artifact whose complete report fits within the reported report byte allowance. Worker or host memory does not raise this fixed allowance; ... inventory_status=not-returned-as-complete

Also replayed: MCP stdio tools/call for inspect_il2cpp_metadata, inspect_rust_binary and inspect_electron_fuses returns the same code, resource, retryable and advice as the CLI. The #5460 version 39 example, rebuilt with the repository fixture (900,000 filler types), reports capacity with the report advice and the same validated row counts as the issue.
WASM and Go refusals replayed with the built CLI (8 MiB + 1 and 256 MiB + 1 sparse inputs): identical remediation.action text, file-size, retryable: false.
Remaining proof gaps: A genuine worker output-write failure was not induced; the owner unit test covers its advice.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run build:cached: passed
npm run test:focused -- the 14 files listed above: 283 passed, 1 skipped (base revision: 6 failed)
npm run check:fast (typecheck and lint): passed
npm run format:check: passed
npm run metadata:check: passed
npm run docs:check: passed
Issue CLI reproductions on the built branch: output above

Compatibility, safety, and release

Breaking changes or migration steps: none intended. Callers that matched details.resource: "memory" for the IL2CPP report budget now see capacity; retryable, the message and maximum_report_bytes are unchanged. The wire retryable stays false (it was already false for memory), so clients should keep using retryable rather than inferring retry from resource: "capacity", which some docs describe as a retryable admission refusal.
remediation.action text changes for file-size refusals that report maximum_input_bytes from Rust, IL2CPP and Electron fuses. Go and WASM output is identical because their removed override matched the shared text. Any memory error carrying maximum_report_bytes also gets the report hint; IL2CPP is the only current producer.
Real Hopper/Ghidra, browser, or OS coverage: not applicable; macOS arm64, Node 26.5.0.
Package or release metadata impact: none.
Security, privacy, process, or containment review: wording and classification only.

Author readiness

Human owner: @8rulerstar

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

Thanks again for the careful reports.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5740 **Author:** [@8rulerstar](https://github.com/8rulerstar) **Created:** 10/21/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/il2cpp-refusal-hints` --- ### 📝 Commits (2) - [`fc7e378`](https://github.com/morluto/rea/commit/fc7e378d4972b8c7740cd283a3850b211c8afd38) fix(errors): advise on fixed input and report allowances, not memory or output - [`e9d105a`](https://github.com/morluto/rea/commit/e9d105a6b87d2792895f377cd2d6f0f9aed0d19b) test(electron): pin input allowance advice on oversized fuse artifacts ### 📊 Changes **8 files changed** (+70 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/analysisErrorPresentation.ts` (+19 -0) 📝 `src/domain/analysisErrorProjection.test.ts` (+25 -0) 📝 `src/electron/ElectronFuseProvider.test.ts` (+4 -0) 📝 `src/go/GoBinaryProvider.ts` (+1 -5) 📝 `src/il2cpp/Il2cppMetadataProvider.ts` (+2 -1) 📝 `src/wasm/WabtFailures.ts` (+0 -2) 📝 `tests/boundary/cli/artifactInputLimits.test.ts` (+2 -0) 📝 `tests/boundary/il2cpp/il2cppMetadataProvider.test.ts` (+17 -2) </details> ### 📄 Description ## Summary Thank you @coygeek for both reports, the reproduction scripts, and for pointing at the Go control and the separate report-budget producer. Fixes #5405 Fixes #5460 Two fixed byte allowances returned recovery advice that cannot help: - Input-size refusals (`resource: file-size`, `maximum_input_bytes`) from `inspect-rust-binary` and `inspect-il2cpp-metadata` advised a larger file-size allowance for the evidence reply. - The IL2CPP complete-report budget (`maximum_report_bytes`) was reported as `resource: memory` and advised worker or host memory. Both now give advice about the fixed allowance, and the report budget is no longer a memory constraint. ## Problem and expected behavior Both producers raise `AnalysisResourceConstraintError` without `remediationAction`, so `analysisErrorRemediationAction` in `src/domain/analysisErrorPresentation.ts` picked advice from the resource kind alone. Its `file-size` text describes a worker output-write failure, and its `memory` text describes worker or host memory. A fixed input or report allowance is deterministic for the same input, so neither change admits it. Go and WASM already avoided the input case by repeating the same override text in each producer. ## Change and scope - Shared owner: `analysisErrorPresentation.ts` gains `fixedBudgetRemediation`, consulted after an explicit `remediationAction` and before the per-resource fallback. - `file-size` with `maximum_input_bytes`: the existing Go/WASM input text ("Select a suitable stable artifact within the reported input byte allowance. ..."). - Any resource with `maximum_report_bytes`: "Select an artifact whose complete report fits within the reported report byte allowance. Worker or host memory does not raise this fixed allowance; retrying the unchanged input will fail again." - Everything else keeps its current advice. A `file-size` constraint without `maximum_input_bytes` (a real write failure) still gets the evidence-reply advice, and a `memory` constraint that only also lists `maximum_input_bytes` (for example the web capture decoder) still gets memory advice. - Producer: the IL2CPP `reportLimit` is now `capacity` with `retryable: false`, matching the other fixed byte-representation budgets (`NativeMatchingAdmission`, `WasmInterfaceComparisonService`) and the `retryable` note on `AnalysisResourceConstraintError`. The message, `maximum_report_bytes` and partial source Evidence are unchanged. - Cleanup: Go (`GoBinaryProvider.ts`) and WASM (`WabtFailures.ts`) drop their identical input-size override, since the owner now returns the same text. Their output is unchanged (the CLI test covers both). Other tool sharing the input bug, now also fixed through the owner (replayed with a 1 GiB + 1 byte sparse file, since the Electron fuse input limit is 1 GiB): Electron fuse inspection (`src/electron/ElectronFuseFailures.ts`, `file-size` with `maximum_input_bytes` and no override). `src/electron/ElectronFuseProvider.test.ts` now pins its advice. Not included, noted for maintainers: - The IL2CPP one-inspection-per-reader refusal (`maximum_concurrent_inspections: 1`) is also classified as `memory`; that is admission capacity, not part of these reports. - `NativeMatchingAdmission` and `WasmInterfaceComparisonService` report fixed byte budgets as `capacity` without `retryable: false`, so they advertise "Wait for an active analysis" and `retryable: true`. Same family, separate fix. ## Contract and boundary impact - Semantic owner and earliest changed stage: `analysisErrorRemediationAction` (error presentation); IL2CPP `reportLimit` producer. - Contribution scope fit and linked maintainer decision: ordinary fix within existing boundaries; not applicable. - CLI and MCP/tool-catalog contract: no schema change. `remediation.action` text changes for Rust, IL2CPP and Electron fuse input refusals and for the IL2CPP report budget; IL2CPP report budget `details.resource` changes from `memory` to `capacity` (`retryable` stays `false`). - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: unchanged; partial source Evidence is retained. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable. - Generated metadata, package, or installation impact: none. - [ ] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [x] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: - `tests/boundary/cli/artifactInputLimits.test.ts`: adds `inspect-rust-binary` and `inspect-il2cpp-metadata` to the existing Go/WASM 256 MiB sparse-file case (input advice, no "evidence reply"). - `src/domain/analysisErrorProjection.test.ts`: six cases at the owner, both directions: `file-size`+`maximum_input_bytes` gives input advice; `file-size`+`file_size_bytes` keeps evidence-reply advice; `memory`+`maximum_input_bytes` keeps memory advice; `maximum_report_bytes` under `capacity` and `memory` gives report advice; `capacity` admission keeps "Wait". - `tests/boundary/il2cpp/il2cppMetadataProvider.test.ts`: the existing 1,100-method oversized-report case (the issue's layout) now asserts `resource: capacity`, `retryable: false`, `maximum_report_bytes: 67108864` and report advice without memory or wait advice. - `src/electron/ElectronFuseProvider.test.ts`: the existing 1 GiB + 1 byte sparse-file case now also asserts the projected `remediation.action` equals the shared input allowance text. On the pre-fix revision it fails (received the evidence-reply advice); with the change `src/electron` and `src/domain/analysisErrorProjection.test.ts` pass (6 files, 138 tests). - On the base revision these fail (6 failed, 277 passed); with the change 283 passed, 1 skipped, across 14 files including Go, Rust, WASM and Electron fuse suites. - Base reproduction or other evidence: both issue scripts replayed on the built branch: ```text inspect-go-binary 1 resource_constraint retryable=false file-size {maximum_input_bytes: 268435456} Select a suitable stable artifact within the reported input byte allowance. ... inspect-rust-binary 1 resource_constraint retryable=false file-size {maximum_input_bytes: 268435456} Select a suitable stable artifact within the reported input byte allowance. ... inspect-il2cpp-metadata 1 resource_constraint retryable=false file-size {maximum_input_bytes: 268435456} Select a suitable stable artifact within the reported input byte allowance. ... v29, 1 method: exit 0, 1 method returned v29, 1,100 methods: exit 1 resource_constraint retryable=false capacity {maximum_report_bytes: 67108864} Select an artifact whose complete report fits within the reported report byte allowance. Worker or host memory does not raise this fixed allowance; ... inventory_status=not-returned-as-complete ``` - Also replayed: MCP stdio `tools/call` for `inspect_il2cpp_metadata`, `inspect_rust_binary` and `inspect_electron_fuses` returns the same code, resource, retryable and advice as the CLI. The #5460 version 39 example, rebuilt with the repository fixture (900,000 filler types), reports `capacity` with the report advice and the same validated row counts as the issue. - WASM and Go refusals replayed with the built CLI (8 MiB + 1 and 256 MiB + 1 sparse inputs): identical `remediation.action` text, `file-size`, `retryable: false`. - Remaining proof gaps: A genuine worker output-write failure was not induced; the owner unit test covers its advice. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run build:cached`: passed - `npm run test:focused --` the 14 files listed above: 283 passed, 1 skipped (base revision: 6 failed) - `npm run check:fast` (typecheck and lint): passed - `npm run format:check`: passed - `npm run metadata:check`: passed - `npm run docs:check`: passed - Issue CLI reproductions on the built branch: output above ## Compatibility, safety, and release - Breaking changes or migration steps: none intended. Callers that matched `details.resource: "memory"` for the IL2CPP report budget now see `capacity`; `retryable`, the message and `maximum_report_bytes` are unchanged. The wire `retryable` stays `false` (it was already `false` for `memory`), so clients should keep using `retryable` rather than inferring retry from `resource: "capacity"`, which some docs describe as a retryable admission refusal. - `remediation.action` text changes for `file-size` refusals that report `maximum_input_bytes` from Rust, IL2CPP and Electron fuses. Go and WASM output is identical because their removed override matched the shared text. Any `memory` error carrying `maximum_report_bytes` also gets the report hint; IL2CPP is the only current producer. - Real Hopper/Ghidra, browser, or OS coverage: not applicable; macOS arm64, Node 26.5.0. - Package or release metadata impact: none. - Security, privacy, process, or containment review: wording and classification only. ## Author readiness Human owner: @8rulerstar - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. Thanks again for the careful reports. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:44:53 +00:00