[PR #6420] [CLOSED] fix(analysis): reject malformed procedure resolutions in navigation context #7345

Closed
opened 2026-11-01 21:47:13 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6420
Author: @viniciusdsandrade
Created: 10/23/2026
Status: ❌ Closed

Base: main ← Head: fix/5901-navigation-malformed-procedure-resolution


📝 Commits (3)

  • d21469f fix(analysis): reject malformed procedure resolutions in navigation context
  • a6371b0 test(mcp): reject malformed procedure resolutions in navigation context
  • 001924c Merge remote-tracking branch 'upstream/main' into fix/5901-navigation-malformed-procedure-resolution

📊 Changes

3 files changed (+81 additions, -16 deletions)

View changed files

📝 src/application/AnalysisContextQueries.test.ts (+6 -1)
📝 src/application/AnalysisContextQueries.ts (+13 -15)
📝 tests/boundary/mcp/navigationContextMcp.test.ts (+62 -0)

📄 Description

Summary

Fixes #5901

get_navigation_context returned success with procedure: null whenever a successful resolve_containing_procedure reply had an unrecognized shape. That is the documented outcome for a cursor outside every procedure, so a null reply, a found: true result with a null or nameless procedure, or a reply without found read as a valid absence, and the output schema could not tell the difference.

The query now parses the reply with containingProcedureResolution, the contract resolve_containing_procedure already publishes. A valid absent resolution still yields null, a valid found resolution still yields the procedure name, and any other reply is an AnalysisOutputError for resolve_containing_procedure (unreadable_output), as the query already reports malformed current_document and current_address observations.

Problem and expected behavior

  • Smallest trigger: a provider whose current_document and current_address succeed and whose resolve_containing_procedure succeeds with null, { "query_address": "0x401000", "found": true, "procedure": null }, a found procedure without name, or a reply without found.
  • Violated invariant: docs/mcp-contracts.md assigns procedure: null to a cursor outside a procedure. containingProcedureName returned null for every unrecognized shape, so an unreadable observation became a successful absence.
  • Expected: the four malformed shapes return unreadable_output naming resolve_containing_procedure; valid absence still returns null; a valid found procedure still returns its name.

Change and scope

  • src/application/AnalysisContextQueries.ts: getNavigationContext parses the reply with containingProcedureResolution from src/contracts/toolOutputSchemaPrimitives.ts, the schema behind the resolve_containing_procedure output contract. The superseded containingProcedureName shape probe is removed.
  • src/application/AnalysisContextQueries.test.ts: the empty-selection fixture gains query_address: "", which the contract requires; its expectation is unchanged.
  • tests/boundary/mcp/navigationContextMcp.test.ts: the four malformed shapes from the report and the two valid controls through the MCP server.
  • Provider compatibility, by reading: the Hopper bridge (_procedure_identity), the IDA runner (identity) and Ghidra (ghidraProcedureIdentitySchema, a stricter refinement of the same identity) all emit this shape, which resolve_containing_procedure output validation already requires.
  • Not included: inspectAddressContext keeps returning the raw reply as its procedure facet and only reads query_address with a fallback for bookmark matching; no absence claim is derived there. No documentation change: the documented null meaning is now the only way to obtain it.

Follow the contribution scope.
Scope decision: not applicable (ordinary fix within an existing aggregate query).

Contract and boundary impact

  • Semantic owner and earliest changed stage: getNavigationContext in src/application/AnalysisContextQueries.ts, the consumer of resolve_containing_procedure for get_navigation_context.
  • Contribution scope fit and linked maintainer decision: not applicable.
  • CLI and MCP/tool-catalog contract: schemas unchanged. Malformed resolver replies now produce unreadable_output with details.operation: "resolve_containing_procedure" instead of a success with procedure: null.
  • Provider, bridge, target-format, or platform compatibility: Hopper, IDA and Ghidra replies already satisfy the contract; no provider change.
  • Evidence, artifact, provenance, or reconstruction contract: unknown resolver output stays an error instead of becoming an absence claim.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: tests/boundary/mcp/navigationContextMcp.test.ts (four malformed shapes, valid absent and found controls); the empty-selection fixture in src/application/AnalysisContextQueries.test.ts.
  • Base reproduction or other evidence: source-derived. On the base revision containingProcedureName returns null for each malformed shape, so get_navigation_context succeeds and the new failure cases fail at parseMcpToolError. The issue reports the same successful procedure: null through the production MCP server with a simulated provider.
  • User-visible CLI/MCP output (if applicable): for a null reply, get_navigation_context now returns an unreadable_output error whose details are { "operation": "resolve_containing_procedure", "reason": "expected a containing-procedure resolution" }, by reading of the projection; not replayed here.
  • Remaining proof gaps: no real provider produced a malformed reply; the providers' current shapes were checked by reading only.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • No local test, build or typecheck commands were run; verification is source-derived and CI executes the test suite. The repository pre-commit hook ran oxlint --fix and oxfmt on the staged files without changes to the committed content.

Compatibility, safety, and release

  • Breaking changes or migration steps: none for valid providers. A provider that returned a reply outside the published resolve_containing_procedure contract now gets a typed failure instead of procedure: null.
  • Real Hopper/Ghidra, browser, or OS coverage: none run.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no change to target handling.

Author readiness

Human owner: @viniciusdsandrade

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6420 **Author:** [@viniciusdsandrade](https://github.com/viniciusdsandrade) **Created:** 10/23/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/5901-navigation-malformed-procedure-resolution` --- ### 📝 Commits (3) - [`d21469f`](https://github.com/morluto/rea/commit/d21469f6c322f225b781fec1374b475e9c5e020a) fix(analysis): reject malformed procedure resolutions in navigation context - [`a6371b0`](https://github.com/morluto/rea/commit/a6371b0044983500b3250fa00e82d4f00522a234) test(mcp): reject malformed procedure resolutions in navigation context - [`001924c`](https://github.com/morluto/rea/commit/001924c05c450a4532ae2cde2289d32ce279b8f7) Merge remote-tracking branch 'upstream/main' into fix/5901-navigation-malformed-procedure-resolution ### 📊 Changes **3 files changed** (+81 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `src/application/AnalysisContextQueries.test.ts` (+6 -1) 📝 `src/application/AnalysisContextQueries.ts` (+13 -15) 📝 `tests/boundary/mcp/navigationContextMcp.test.ts` (+62 -0) </details> ### 📄 Description ## Summary Fixes #5901 `get_navigation_context` returned success with `procedure: null` whenever a successful `resolve_containing_procedure` reply had an unrecognized shape. That is the documented outcome for a cursor outside every procedure, so a `null` reply, a `found: true` result with a null or nameless procedure, or a reply without `found` read as a valid absence, and the output schema could not tell the difference. The query now parses the reply with `containingProcedureResolution`, the contract `resolve_containing_procedure` already publishes. A valid absent resolution still yields `null`, a valid found resolution still yields the procedure name, and any other reply is an `AnalysisOutputError` for `resolve_containing_procedure` (`unreadable_output`), as the query already reports malformed `current_document` and `current_address` observations. ## Problem and expected behavior - Smallest trigger: a provider whose `current_document` and `current_address` succeed and whose `resolve_containing_procedure` succeeds with `null`, `{ "query_address": "0x401000", "found": true, "procedure": null }`, a found procedure without `name`, or a reply without `found`. - Violated invariant: [docs/mcp-contracts.md](https://github.com/morluto/rea/blob/main/docs/mcp-contracts.md#aggregate-native-context) assigns `procedure: null` to a cursor outside a procedure. `containingProcedureName` returned `null` for every unrecognized shape, so an unreadable observation became a successful absence. - Expected: the four malformed shapes return `unreadable_output` naming `resolve_containing_procedure`; valid absence still returns `null`; a valid found procedure still returns its name. ## Change and scope - `src/application/AnalysisContextQueries.ts`: `getNavigationContext` parses the reply with `containingProcedureResolution` from `src/contracts/toolOutputSchemaPrimitives.ts`, the schema behind the `resolve_containing_procedure` output contract. The superseded `containingProcedureName` shape probe is removed. - `src/application/AnalysisContextQueries.test.ts`: the empty-selection fixture gains `query_address: ""`, which the contract requires; its expectation is unchanged. - `tests/boundary/mcp/navigationContextMcp.test.ts`: the four malformed shapes from the report and the two valid controls through the MCP server. - Provider compatibility, by reading: the Hopper bridge (`_procedure_identity`), the IDA runner (`identity`) and Ghidra (`ghidraProcedureIdentitySchema`, a stricter refinement of the same identity) all emit this shape, which `resolve_containing_procedure` output validation already requires. - Not included: `inspectAddressContext` keeps returning the raw reply as its `procedure` facet and only reads `query_address` with a fallback for bookmark matching; no absence claim is derived there. No documentation change: the documented `null` meaning is now the only way to obtain it. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Scope decision: not applicable (ordinary fix within an existing aggregate query). ## Contract and boundary impact - Semantic owner and earliest changed stage: `getNavigationContext` in `src/application/AnalysisContextQueries.ts`, the consumer of `resolve_containing_procedure` for `get_navigation_context`. - Contribution scope fit and linked maintainer decision: not applicable. - CLI and MCP/tool-catalog contract: schemas unchanged. Malformed resolver replies now produce `unreadable_output` with `details.operation: "resolve_containing_procedure"` instead of a success with `procedure: null`. - Provider, bridge, target-format, or platform compatibility: Hopper, IDA and Ghidra replies already satisfy the contract; no provider change. - Evidence, artifact, provenance, or reconstruction contract: unknown resolver output stays an error instead of becoming an absence claim. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `tests/boundary/mcp/navigationContextMcp.test.ts` (four malformed shapes, valid absent and found controls); the empty-selection fixture in `src/application/AnalysisContextQueries.test.ts`. - Base reproduction or other evidence: source-derived. On the base revision `containingProcedureName` returns `null` for each malformed shape, so `get_navigation_context` succeeds and the new failure cases fail at `parseMcpToolError`. The issue reports the same successful `procedure: null` through the production MCP server with a simulated provider. - User-visible CLI/MCP output (if applicable): for a `null` reply, `get_navigation_context` now returns an `unreadable_output` error whose details are `{ "operation": "resolve_containing_procedure", "reason": "expected a containing-procedure resolution" }`, by reading of the projection; not replayed here. - Remaining proof gaps: no real provider produced a malformed reply; the providers' current shapes were checked by reading only. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - No local test, build or typecheck commands were run; verification is source-derived and CI executes the test suite. The repository pre-commit hook ran `oxlint --fix` and `oxfmt` on the staged files without changes to the committed content. ## Compatibility, safety, and release - Breaking changes or migration steps: none for valid providers. A provider that returned a reply outside the published `resolve_containing_procedure` contract now gets a typed failure instead of `procedure: null`. - Real Hopper/Ghidra, browser, or OS coverage: none run. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no change to target handling. ## Author readiness Human owner: @viniciusdsandrade - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-01 21:47:13 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7345
No description provided.