morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8729] [Bug] Native session loses caller-selected symlink path #7526

New issue

Open

opened 2026-11-03 06:16:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 06:16:00 +00:00

Owner

Originally created by @morluto on GitHub (Nov 3, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8729

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

On macOS, opening a thin Mach-O through an explicitly selected symlink succeeds, but the successful open_binary result, binary_session status, and a subsequent procedure Evidence subject expose the canonical file path only. The selected symlink spelling is absent from those returned facts. The SHA-256 identifies the actual file correctly.

Reproduction

On REA main 9ebbe67e05af08b567e215340da993c08dae378f, create an owned arm64 Mach-O named arm64 and a sibling symlink caller-alias -> arm64. Start stdio MCP with Ghidra 12.1.4 or Kuna 1.989, call open_binary using the absolute caller-alias path and the provider, then call binary_session and procedure_address for a known function. In both compact and full schema profiles, all three responses use the canonical arm64 path; the alias does not appear. Successful responses were exercised with fetched SDK tool definitions. The target was not executed and SHA-256 0e0ecf82c96e4918ee2ca1287dc25513d8fd13d5ab7fa5b98db00ad342f03930 remained unchanged.

Two-alias session control

On the same target with Kuna 1.989, both compact and full MCP sessions opened one symlink, obtained procedure_address, then opened a second symlink to the same file and repeated the query. The analysis run ID and semantic Evidence ID remained the same. Neither response nor the exported retained record carried caller_input_path; both subjects held the canonical path and digest. This is an observed same-target fast-path control, not proof that the two aliases had different contents or that a caller-input field alone would preserve historical selection. A correct design must decide how a long-lived session attributes requests and how deduplicated records retain or separately represent multiple selection events.

Two-alias CLI-to-MCP handoff

With the same target and Kuna 1.989, separate CLI decompile calls through the two symlinks returned the same semantic Evidence ID while retaining their respective caller_input_path values. I constructed one-record bundles using the repository bundle producer, imported them in sequence into target-free real MCP sessions, and exported after each import. In both compact and full profiles there was one retained record: the first import exposed the first alias and the second import exposed the second alias under the same ID. Both source CLI records remain separate files. This is a controlled import behavior, not a claim that ordinary recordEvidence replaces metadata. It demonstrates that the existing single metadata field represents the most recently imported spelling, not a complete history of both selections. The target hash remained unchanged and it was not executed.

Kuna document-selector control

A separate Kuna 1.989 stdio MCP check opened /tmp/rea-universal-handoff/arm64 successfully and then supplied that exact spelling as the optional document in procedure_pseudo_code. The call was rejected because Kuna required the canonical /private/tmp/rea-universal-handoff/arm64; the error included that expected path, and retrying with it worked. On this macOS host /tmp resolves through a symlink. This demonstrates a concrete additional call caused by the selected/canonical distinction; it does not establish behavior for Ghidra, other aliases, or retargeting.

Expected behavior

Preserve the caller-selected spelling as a distinct fact where the session and Evidence need input provenance, while retaining the canonical path and digest for file identity. Do not substitute the alias for the canonical file or infer future symlink identity from a past observation. AGENTS.md says to preserve caller-selected paths and local evidence.

Impact and scope

An exported or handed-off MCP observation cannot identify which alias the analyst selected in this case. A separate real Kuna 1.989 CLI decompile control preserved the exact alias in existing caller_input_path, while its subject retained the canonical path and digest. This is one controlled POSIX symlink and one Mach-O; Windows, app bundles, symlink retargeting, cache/snapshot behavior, and real-world frequency are unverified.

REA version

9ebbe67e05af08b567e215340da993c08dae378f

Runtime and platform

macOS arm64, Node 24.22.1, Ghidra 12.1.4/JDK 21 and Kuna 1.989.

Target and artifact context

Self-built unexecuted arm64 Mach-O with a sibling symlink.

Interface

MCP

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

open_binary.result.path, binary_session.result.path, and procedure_address.subject.local_path all contain the canonical executable path; the subject digest matches the target. The selected alias is absent from these tested responses.

Analysis or suspected cause

Source-derived: BinaryTargetResolver resolves the canonical file and uses the canonical value as sourcePath on POSIX. It retains artifactSelectedPath for archive and artifact cases, but the executable target cases do not retain selectedPath. Direct CLI already uses withEvidenceCallerInputPath to retain the request spelling as non-semantic Evidence metadata; the observed MCP session path does not propagate that existing fact. Source inspection also shows ordinary duplicate Evidence recording keeps the existing metadata, whereas bundle import can replace display/request metadata for the same semantic ID. Simply decorating a later MCP response could therefore disagree with a previously retained record. Verify session identity, repeated selections, retention and Evidence export before choosing how to own the path across a long-lived session; no new duplicate-record behavior is asserted as observed here. This is not evidence that REA analyzed the wrong file.

Typed outcome or recovery expected

Preserve selected and canonical path semantics independently, including unknowns, without changing the digest or silently changing target selection. Exercise aliases, bundle inputs, failed switches, and snapshot/session behavior before integration.

Additional context

Related #5258 and #5479 cover other artifact families. @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

Originally created by @morluto on GitHub (Nov 3, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8729 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior On macOS, opening a thin Mach-O through an explicitly selected symlink succeeds, but the successful `open_binary` result, `binary_session` status, and a subsequent procedure Evidence subject expose the canonical file path only. The selected symlink spelling is absent from those returned facts. The SHA-256 identifies the actual file correctly. ### Reproduction On REA main `9ebbe67e05af08b567e215340da993c08dae378f`, create an owned arm64 Mach-O named `arm64` and a sibling symlink `caller-alias -> arm64`. Start stdio MCP with Ghidra 12.1.4 or Kuna 1.989, call `open_binary` using the absolute `caller-alias` path and the provider, then call `binary_session` and `procedure_address` for a known function. In both compact and full schema profiles, all three responses use the canonical `arm64` path; the alias does not appear. Successful responses were exercised with fetched SDK tool definitions. The target was not executed and SHA-256 `0e0ecf82c96e4918ee2ca1287dc25513d8fd13d5ab7fa5b98db00ad342f03930` remained unchanged. ### Two-alias session control On the same target with Kuna 1.989, both compact and full MCP sessions opened one symlink, obtained `procedure_address`, then opened a second symlink to the same file and repeated the query. The analysis run ID and semantic Evidence ID remained the same. Neither response nor the exported retained record carried `caller_input_path`; both subjects held the canonical path and digest. This is an observed same-target fast-path control, not proof that the two aliases had different contents or that a caller-input field alone would preserve historical selection. A correct design must decide how a long-lived session attributes requests and how deduplicated records retain or separately represent multiple selection events. ### Two-alias CLI-to-MCP handoff With the same target and Kuna 1.989, separate CLI `decompile` calls through the two symlinks returned the same semantic Evidence ID while retaining their respective `caller_input_path` values. I constructed one-record bundles using the repository bundle producer, imported them in sequence into target-free real MCP sessions, and exported after each import. In both compact and full profiles there was one retained record: the first import exposed the first alias and the second import exposed the second alias under the same ID. Both source CLI records remain separate files. This is a controlled import behavior, not a claim that ordinary `recordEvidence` replaces metadata. It demonstrates that the existing single metadata field represents the most recently imported spelling, not a complete history of both selections. The target hash remained unchanged and it was not executed. ### Kuna document-selector control A separate Kuna 1.989 stdio MCP check opened `/tmp/rea-universal-handoff/arm64` successfully and then supplied that exact spelling as the optional `document` in `procedure_pseudo_code`. The call was rejected because Kuna required the canonical `/private/tmp/rea-universal-handoff/arm64`; the error included that expected path, and retrying with it worked. On this macOS host `/tmp` resolves through a symlink. This demonstrates a concrete additional call caused by the selected/canonical distinction; it does not establish behavior for Ghidra, other aliases, or retargeting. ### Expected behavior Preserve the caller-selected spelling as a distinct fact where the session and Evidence need input provenance, while retaining the canonical path and digest for file identity. Do not substitute the alias for the canonical file or infer future symlink identity from a past observation. AGENTS.md says to preserve caller-selected paths and local evidence. ### Impact and scope An exported or handed-off MCP observation cannot identify which alias the analyst selected in this case. A separate real Kuna 1.989 CLI `decompile` control preserved the exact alias in existing `caller_input_path`, while its subject retained the canonical path and digest. This is one controlled POSIX symlink and one Mach-O; Windows, app bundles, symlink retargeting, cache/snapshot behavior, and real-world frequency are unverified. ### REA version `9ebbe67e05af08b567e215340da993c08dae378f` ### Runtime and platform macOS arm64, Node 24.22.1, Ghidra 12.1.4/JDK 21 and Kuna 1.989. ### Target and artifact context Self-built unexecuted arm64 Mach-O with a sibling symlink. ### Interface MCP ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence `open_binary.result.path`, `binary_session.result.path`, and `procedure_address.subject.local_path` all contain the canonical executable path; the subject digest matches the target. The selected alias is absent from these tested responses. ### Analysis or suspected cause Source-derived: `BinaryTargetResolver` resolves the canonical file and uses the canonical value as `sourcePath` on POSIX. It retains `artifactSelectedPath` for archive and artifact cases, but the executable target cases do not retain `selectedPath`. Direct CLI already uses `withEvidenceCallerInputPath` to retain the request spelling as non-semantic Evidence metadata; the observed MCP session path does not propagate that existing fact. Source inspection also shows ordinary duplicate Evidence recording keeps the existing metadata, whereas bundle import can replace display/request metadata for the same semantic ID. Simply decorating a later MCP response could therefore disagree with a previously retained record. Verify session identity, repeated selections, retention and Evidence export before choosing how to own the path across a long-lived session; no new duplicate-record behavior is asserted as observed here. This is not evidence that REA analyzed the wrong file. ### Typed outcome or recovery expected Preserve selected and canonical path semantics independently, including unknowns, without changing the digest or silently changing target selection. Exercise aliases, bundle inputs, failed switches, and snapshot/session behavior before integration. ### Additional context Related #5258 and #5479 cover other artifact families. @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

bsakaguchi added the

bug

triage

labels

2026-11-03 06:16:00 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7526

No description provided.

Rows
Columns