morluto/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00
Code Issues 1.3k Projects Packages Wiki Activity

[PR #7365] [MERGED] fix(artifacts): classify bundle executables by their own name #7833

New issue
Closed
opened 2026-11-05 01:48:00 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-11-05 01:48:00 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7365
Author: @chordpli
Created: 10/27/2026
Status: ✅ Merged
Merged: 11/4/2026
Merged by: @morluto

Base: main ← Head: fix/bundle-executable-classification

📝 Commits (9)

  • 7cf864e fix(artifacts): classify bundle executables by their own name
  • 3b4af1c fix(artifacts): share the artifact identity across every artifact route
  • b83bc28 fix(artifacts): name the classification spelling at the resolver boundary
  • 148477c Merge remote-tracking branch 'origin/main' into fix/bundle-executable-classification
  • dbbd607 fix(artifacts): route bundle keyed archive reads by bundle facts
  • 9770575 Merge remote-tracking branch 'origin/main' into fix/bundle-executable-classification
  • cdadc10 Merge remote-tracking branch 'origin/main' into fix/bundle-executable-classification
  • 19ff5e2 Merge remote-tracking branch 'origin/main' into fix/bundle-executable-classification
  • 55bd343 refactor(artifacts): build the selected ESP flash identity from the shared owner

📊 Changes

5 files changed (+146 additions, -39 deletions)

View changed files

📝 src/application/BinaryTargetResolver.ts (+34 -35)
📝 src/artifacts/ArtifactProvider.ts (+5 -1)
📝 src/domain/apple/artifactTargetApplicability.ts (+3 -2)
📝 tests/boundary/filesystem/artifactSelectedName.test.ts (+56 -1)
📝 tests/boundary/filesystem/keyedArchiveSelection.test.ts (+48 -0)

📄 Description

Summary

Fixes #7362.

Since c27560e43, opening a directory bundle whose CFBundleExecutable is a name-classified artifact (JavaScript, plist, source map, ASAR) is refused with target_unavailable / unsupported_target ("Cannot open artifact: unsupported binary format."). The resolver resolves Fixture.app/ to its executable main.js but still classifies that executable by the bundle directory's name, which artifactNameForClassification treats as an App Pack alias. After classification is repaired, 2dd2ffcd4's admitted-source digest check fails next, because artifact-kind targets never carried bundleInfoPlist, so the check compared the directory instead of the executable.

Both failures were visible on main from c27560e43 until 1201c2554 (#7349), which switched the artifactInspectionCoverageMcp fixture to a Mach-O executable. tests/acceptance/applications/artifactComparisonCoverage.test.ts and tests/boundary/mcp/artifactInspectionCoverageMcp.test.ts therefore pass on current main, while the refusal itself is unchanged; the new cases in artifactSelectedName.test.ts reproduce it.

Problem and expected behavior

  • Trigger: rea open Fixture.app (or open_binary / inspect_artifact / compare_artifacts) where Fixture.app/Info.plist names main.js as CFBundleExecutable.
  • Violated invariant: a bundle directory is selected for its executable, so the executable's own name is the classification name; the bundle facts (bundleInfoPlist) belong to the resolved target regardless of its kind.
  • Expected: the target admits as kind: "artifact", format: "javascript" with path = the executable, artifactSelectedPath = the bundle directory and bundleInfoPlist set, as it did at 3515b2622.

Change and scope

  • src/application/BinaryTargetResolver.ts
    • resolve() already knows whether the caller selected a file or a bundle directory, so it hands readOpenedBinaryTarget the spelling to classify by (classifiedAs): the caller's spelling for a file, the executable's own name for a bundle. The reader no longer infers this from bundleInfoPlist, and the bundle directory never reaches artifactNameForClassification's .app alias rule.
    • One identity() (canonical path, source path, bundle facts, digest) feeds every admitted route; the artifact routes layer artifactSelectedPath on it. main's ESP flash routes (#8228), the detected and the explicitly selected one, use the same identity after the merge in 19ff5e246 and 55bd343f8. ArtifactProvider's expectedRootSha256 (bundleInfoPlist === undefined ? sha256 : undefined) therefore applies to files, not to bundle executables, on every route.
  • src/domain/apple/artifactTargetApplicability.ts: inspect_asset_catalog, decode_interface_builder and inspect_keyed_archive accept any target that carries bundleInfoPlist. They read the bundle directory, so a bundle whose executable admitted as an artifact is an .app target too; before, it was refused with "requires an active .app bundle target" although the bundle facts were present.
  • src/artifacts/ArtifactProvider.ts: inspect_keyed_archive takes the standalone route only when the target carries no bundleInfoPlist. A bundle whose executable is itself a plist is read as a bundle (bundle-relative path, executable digest verified through withArtifactTargetIdentity), matching inspect_asset_catalog, which already routes by the bundle facts.
  • tests/boundary/filesystem/artifactSelectedName.test.ts: a directory bundle with CFBundleExecutable=main.js admits as artifact/javascript, and one whose executable is a script stub with an appended ZIP admits as archive/zip; both keep bundleInfoPlist and artifactSelectedPath.
  • Not included: HarmonyOS .app App Pack files keep their selected-spelling classification (they are files, not resolved bundles). Mach-O bundle executables were never affected because they skip name classification. For bundle targets expectedRootSha256 stays undefined, as main already does for executable bundles; binding bundle inventory to the admitted executable (for example re-checking bundleInfoPlist and the selected directory at inventory time) would be a separate change to 2dd2ffcd4's rule, not restored here.

Follow the contribution scope.
Unresolved scope, authority, side effects, or required verification block
integration. Link the required maintainer scope decision for new providers or
capabilities involving target execution, injection, mutation, or protection
recovery; ordinary fixes within existing boundaries may state "not applicable".
Draft PRs may leave the scope decision pending and the readiness and merge checklists
unchecked. Maintainers can help resolve open questions.

Contract and boundary impact

  • Semantic owner and earliest changed stage: resolve() / readOpenedBinaryTarget in src/application/BinaryTargetResolver.ts (target admission). Consumers: ArtifactProvider (expectedRootSha256), BinarySessionExecution.isArtifactBundleSubject and artifactTargetRefusal, which read bundleInfoPlist.
  • Contribution scope fit and linked maintainer decision: not applicable; ordinary fix within existing boundaries.
  • CLI and MCP/tool-catalog contract: no schema change. Bundle targets whose executable is an artifact admit again; BinaryTarget.bundleInfoPlist is now populated for artifact, archive and database kinds as it already was for executables, and the three .app bundle operations accept such targets.
  • Provider, bridge, target-format, or platform compatibility: macOS/Linux directory bundles. Windows not run.
  • Evidence, artifact, provenance, or reconstruction contract: artifactSelectedPath still records the caller's bundle spelling; no Evidence shape change.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): none.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated:
    • tests/boundary/filesystem/artifactSelectedName.test.ts: new cases for a directory bundle with a JavaScript executable (fails on main with unsupported binary format) and for a script-stub executable with a trailing archive (the fallback route Greptile flagged).
    • tests/boundary/filesystem/keyedArchiveSelection.test.ts: a bundle whose CFBundleExecutable is a plist is opened through the session and inspect_keyed_archive reads a bundle-relative archive (fails without the provider routing change with "Invalid analysis input", because the standalone route compared the bundle directory with the executable).
    • tests/acceptance/applications/artifactComparisonCoverage.test.ts and tests/boundary/mcp/artifactInspectionCoverageMcp.test.ts exercise the same resolver through MCP and the acceptance workflow; since 1201c2554 their fixture is a Mach-O executable, so they pass on main and here and no longer cover this bug.
  • Base reproduction or other evidence: git bisect between a7f50e338 (last green main CI) and ace4dbf36 on artifactInspectionCoverageMcp.test.ts: first bad c27560e43; parent 3515b2622 passes. The second blocker was isolated by applying only the classification change and observing integrity_mismatch "The opened file was replaced by a directory" from assertAdmittedRootDigest. At main a95b83c2b (after #7349) the two new artifactSelectedName cases still fail on unmodified main: 2 failed, unsupported binary format for the JavaScript executable and missing bundleInfoPlist for the script-stub bundle.
  • User-visible CLI/MCP output (if applicable): the two existing tests exercise inspect_artifact and compare_artifacts through the MCP and acceptance workflows.
  • Remaining proof gaps: not run on Windows or Linux locally (CI covers Linux). No real third-party .app with a JavaScript executable was tried.

Boundary regressions covered:

  • Raw identity and normalization: the caller-selected bundle spelling (artifactSelectedPath) stays separate from the canonical executable path used for classification and digests (artifactSelectedName.test.ts).
  • Public success and error delivery: inspect_artifact and compare_artifacts through MCP and the acceptance workflow on a directory bundle (existing regressions).

Lifecycle regressions: not applicable; no resource acquisition or cleanup changes.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

At 55bd343f8 (main 2d5dec26c merged; one conflict in BinaryTargetResolver.ts, where main added a source-path argument to detectArtifactFormat and ESP flash routes that built path, source path and digest inline; they now use the shared identity(); macOS 26.5.2, Node 24.22.1):

  • npm run test:focused -- artifactSelectedName, keyedArchiveSelection, binaryTarget, espFlashImageMcp, BinarySessionBundleResources, TargetFormatVocabularies — 6 files, 188 passed, 2 skipped
  • npm run check:fast — passed
  • npm run format:check — passed
  • Not run at this head: npm run docs:check and the other files of the earlier nine-file set

At cdadc10b6 (main 18a8e71c9 merged; main added UnityFS and U-Boot uImage detection to detectArtifactFormat, no conflict; macOS 26.5.2, Node 24.22.1):

  • npm run test:focused -- the same nine files — 81 passed, 2 skipped
  • npm run check:fast — passed
  • npm run docs:check — passed

At 9770575ce (main 5ae77656e merged; main added Intel HEX / S-record detection to detectArtifactFormat in BinaryTargetResolver.ts, no conflict with the classification change; macOS 26.5.2, Node 24.22.1):

  • npm run test:focused -- the same nine files — 81 passed, 2 skipped
  • npm run check:fast — passed
  • npm run docs:check — passed

At dbbd607d7 (main a95b83c2b merged, macOS 26.5.2, Node 24.22.1):

  • npm run test:focused -- artifactSelectedName, keyedArchiveSelection, keyedArchiveStandaloneSelection, bundleResourceComposition, artifactMcp, keyedArchivePrototypeKeyMcp, dylibResolutionMcp, artifactInspectionCoverageMcp, artifactComparisonCoverage — 9 files, 81 passed, 2 skipped
  • keyedArchiveSelection.test.ts with src/artifacts/ArtifactProvider.ts reverted: the new bundle case fails ("Invalid analysis input for inspect_keyed_archive")
  • At 7cf864eb2 with src/application/BinaryTargetResolver.ts reverted: the three files fail as on main (4 failed: the three existing regressions and the new bundle case)
  • npm run check:fast — passed
  • npm run docs:check — passed
  • Built CLI E2E on main d1c88fab1 vs this branch: see the PR comment.

Compatibility, safety, and release

  • Breaking changes or migration steps: none. Restores the pre-c27560e43 admission of bundle directories; adds bundleInfoPlist to non-executable bundle targets.
  • Real Hopper/Ghidra, browser, or OS coverage: macOS only, local fixtures.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no new process or network access; the digest check now binds to the executable the caller's bundle resolved to.

Author readiness

Human owner: @chordpli

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7365 **Author:** [@chordpli](https://github.com/chordpli) **Created:** 10/27/2026 **Status:** ✅ Merged **Merged:** 11/4/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/bundle-executable-classification` --- ### 📝 Commits (9) - [`7cf864e`](https://github.com/morluto/rea/commit/7cf864eb2c8970cf353906e7e5e9e2b18950eb09) fix(artifacts): classify bundle executables by their own name - [`3b4af1c`](https://github.com/morluto/rea/commit/3b4af1ce5ac63976ccde385f2928e90036fed4ba) fix(artifacts): share the artifact identity across every artifact route - [`b83bc28`](https://github.com/morluto/rea/commit/b83bc288e7d3013133e97ff66f656d98ac2af638) fix(artifacts): name the classification spelling at the resolver boundary - [`148477c`](https://github.com/morluto/rea/commit/148477c2657942a1e293f931dda378e72725ca1d) Merge remote-tracking branch 'origin/main' into fix/bundle-executable-classification - [`dbbd607`](https://github.com/morluto/rea/commit/dbbd607d781836f8bcdda1c4480fe4be28233438) fix(artifacts): route bundle keyed archive reads by bundle facts - [`9770575`](https://github.com/morluto/rea/commit/9770575cefc8deaad2519266c76da1d9f499a45f) Merge remote-tracking branch 'origin/main' into fix/bundle-executable-classification - [`cdadc10`](https://github.com/morluto/rea/commit/cdadc10b6c3dc069b8dd52707e10b7a121ba698d) Merge remote-tracking branch 'origin/main' into fix/bundle-executable-classification - [`19ff5e2`](https://github.com/morluto/rea/commit/19ff5e2464e1ea0f660b8419159168f06daf8948) Merge remote-tracking branch 'origin/main' into fix/bundle-executable-classification - [`55bd343`](https://github.com/morluto/rea/commit/55bd343f865f8d7e5231c320a85065db794acd66) refactor(artifacts): build the selected ESP flash identity from the shared owner ### 📊 Changes **5 files changed** (+146 additions, -39 deletions) <details> <summary>View changed files</summary> 📝 `src/application/BinaryTargetResolver.ts` (+34 -35) 📝 `src/artifacts/ArtifactProvider.ts` (+5 -1) 📝 `src/domain/apple/artifactTargetApplicability.ts` (+3 -2) 📝 `tests/boundary/filesystem/artifactSelectedName.test.ts` (+56 -1) 📝 `tests/boundary/filesystem/keyedArchiveSelection.test.ts` (+48 -0) </details> ### 📄 Description ## Summary Fixes #7362. Since c27560e43, opening a directory bundle whose `CFBundleExecutable` is a name-classified artifact (JavaScript, plist, source map, ASAR) is refused with `target_unavailable` / `unsupported_target` ("Cannot open artifact: unsupported binary format."). The resolver resolves `Fixture.app/` to its executable `main.js` but still classifies that executable by the bundle directory's name, which `artifactNameForClassification` treats as an App Pack alias. After classification is repaired, 2dd2ffcd4's admitted-source digest check fails next, because artifact-kind targets never carried `bundleInfoPlist`, so the check compared the directory instead of the executable. Both failures were visible on `main` from c27560e43 until 1201c2554 (#7349), which switched the `artifactInspectionCoverageMcp` fixture to a Mach-O executable. `tests/acceptance/applications/artifactComparisonCoverage.test.ts` and `tests/boundary/mcp/artifactInspectionCoverageMcp.test.ts` therefore pass on current `main`, while the refusal itself is unchanged; the new cases in `artifactSelectedName.test.ts` reproduce it. ## Problem and expected behavior - Trigger: `rea open Fixture.app` (or `open_binary` / `inspect_artifact` / `compare_artifacts`) where `Fixture.app/Info.plist` names `main.js` as `CFBundleExecutable`. - Violated invariant: a bundle directory is selected for its executable, so the executable's own name is the classification name; the bundle facts (`bundleInfoPlist`) belong to the resolved target regardless of its kind. - Expected: the target admits as `kind: "artifact", format: "javascript"` with `path` = the executable, `artifactSelectedPath` = the bundle directory and `bundleInfoPlist` set, as it did at 3515b2622. ## Change and scope - `src/application/BinaryTargetResolver.ts` - `resolve()` already knows whether the caller selected a file or a bundle directory, so it hands `readOpenedBinaryTarget` the spelling to classify by (`classifiedAs`): the caller's spelling for a file, the executable's own name for a bundle. The reader no longer infers this from `bundleInfoPlist`, and the bundle directory never reaches `artifactNameForClassification`'s `.app` alias rule. - One `identity()` (canonical path, source path, bundle facts, digest) feeds every admitted route; the artifact routes layer `artifactSelectedPath` on it. `main`'s ESP flash routes (#8228), the detected and the explicitly selected one, use the same identity after the merge in `19ff5e246` and `55bd343f8`. `ArtifactProvider`'s `expectedRootSha256` (`bundleInfoPlist === undefined ? sha256 : undefined`) therefore applies to files, not to bundle executables, on every route. - `src/domain/apple/artifactTargetApplicability.ts`: `inspect_asset_catalog`, `decode_interface_builder` and `inspect_keyed_archive` accept any target that carries `bundleInfoPlist`. They read the bundle directory, so a bundle whose executable admitted as an artifact is an `.app` target too; before, it was refused with "requires an active .app bundle target" although the bundle facts were present. - `src/artifacts/ArtifactProvider.ts`: `inspect_keyed_archive` takes the standalone route only when the target carries no `bundleInfoPlist`. A bundle whose executable is itself a plist is read as a bundle (bundle-relative `path`, executable digest verified through `withArtifactTargetIdentity`), matching `inspect_asset_catalog`, which already routes by the bundle facts. - `tests/boundary/filesystem/artifactSelectedName.test.ts`: a directory bundle with `CFBundleExecutable=main.js` admits as `artifact`/`javascript`, and one whose executable is a script stub with an appended ZIP admits as `archive`/`zip`; both keep `bundleInfoPlist` and `artifactSelectedPath`. - Not included: HarmonyOS `.app` App Pack files keep their selected-spelling classification (they are files, not resolved bundles). Mach-O bundle executables were never affected because they skip name classification. For bundle targets `expectedRootSha256` stays undefined, as `main` already does for executable bundles; binding bundle inventory to the admitted executable (for example re-checking `bundleInfoPlist` and the selected directory at inventory time) would be a separate change to 2dd2ffcd4's rule, not restored here. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Unresolved scope, authority, side effects, or required verification block integration. Link the required maintainer scope decision for new providers or capabilities involving target execution, injection, mutation, or protection recovery; ordinary fixes within existing boundaries may state "not applicable". Draft PRs may leave the scope decision pending and the readiness and merge checklists unchecked. Maintainers can help resolve open questions. ## Contract and boundary impact - Semantic owner and earliest changed stage: `resolve()` / `readOpenedBinaryTarget` in `src/application/BinaryTargetResolver.ts` (target admission). Consumers: `ArtifactProvider` (`expectedRootSha256`), `BinarySessionExecution.isArtifactBundleSubject` and `artifactTargetRefusal`, which read `bundleInfoPlist`. - Contribution scope fit and linked maintainer decision: not applicable; ordinary fix within existing boundaries. - CLI and MCP/tool-catalog contract: no schema change. Bundle targets whose executable is an artifact admit again; `BinaryTarget.bundleInfoPlist` is now populated for artifact, archive and database kinds as it already was for executables, and the three `.app` bundle operations accept such targets. - Provider, bridge, target-format, or platform compatibility: macOS/Linux directory bundles. Windows not run. - Evidence, artifact, provenance, or reconstruction contract: `artifactSelectedPath` still records the caller's bundle spelling; no Evidence shape change. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): none. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: - `tests/boundary/filesystem/artifactSelectedName.test.ts`: new cases for a directory bundle with a JavaScript executable (fails on `main` with `unsupported binary format`) and for a script-stub executable with a trailing archive (the fallback route Greptile flagged). - `tests/boundary/filesystem/keyedArchiveSelection.test.ts`: a bundle whose `CFBundleExecutable` is a plist is opened through the session and `inspect_keyed_archive` reads a bundle-relative archive (fails without the provider routing change with "Invalid analysis input", because the standalone route compared the bundle directory with the executable). - `tests/acceptance/applications/artifactComparisonCoverage.test.ts` and `tests/boundary/mcp/artifactInspectionCoverageMcp.test.ts` exercise the same resolver through MCP and the acceptance workflow; since 1201c2554 their fixture is a Mach-O executable, so they pass on `main` and here and no longer cover this bug. - Base reproduction or other evidence: `git bisect` between a7f50e338 (last green main CI) and ace4dbf36 on `artifactInspectionCoverageMcp.test.ts`: first bad c27560e43; parent 3515b2622 passes. The second blocker was isolated by applying only the classification change and observing `integrity_mismatch` "The opened file was replaced by a directory" from `assertAdmittedRootDigest`. At `main` a95b83c2b (after #7349) the two new `artifactSelectedName` cases still fail on unmodified `main`: 2 failed, `unsupported binary format` for the JavaScript executable and missing `bundleInfoPlist` for the script-stub bundle. - User-visible CLI/MCP output (if applicable): the two existing tests exercise `inspect_artifact` and `compare_artifacts` through the MCP and acceptance workflows. - Remaining proof gaps: not run on Windows or Linux locally (CI covers Linux). No real third-party `.app` with a JavaScript executable was tried. Boundary regressions covered: - Raw identity and normalization: the caller-selected bundle spelling (`artifactSelectedPath`) stays separate from the canonical executable path used for classification and digests (`artifactSelectedName.test.ts`). - Public success and error delivery: `inspect_artifact` and `compare_artifacts` through MCP and the acceptance workflow on a directory bundle (existing regressions). Lifecycle regressions: not applicable; no resource acquisition or cleanup changes. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed At `55bd343f8` (`main` `2d5dec26c` merged; one conflict in `BinaryTargetResolver.ts`, where `main` added a source-path argument to `detectArtifactFormat` and ESP flash routes that built path, source path and digest inline; they now use the shared `identity()`; macOS 26.5.2, Node 24.22.1): - `npm run test:focused --` `artifactSelectedName`, `keyedArchiveSelection`, `binaryTarget`, `espFlashImageMcp`, `BinarySessionBundleResources`, `TargetFormatVocabularies` — 6 files, 188 passed, 2 skipped - `npm run check:fast` — passed - `npm run format:check` — passed - Not run at this head: `npm run docs:check` and the other files of the earlier nine-file set At `cdadc10b6` (`main` `18a8e71c9` merged; `main` added UnityFS and U-Boot uImage detection to `detectArtifactFormat`, no conflict; macOS 26.5.2, Node 24.22.1): - `npm run test:focused --` the same nine files — 81 passed, 2 skipped - `npm run check:fast` — passed - `npm run docs:check` — passed At `9770575ce` (`main` `5ae77656e` merged; `main` added Intel HEX / S-record detection to `detectArtifactFormat` in `BinaryTargetResolver.ts`, no conflict with the classification change; macOS 26.5.2, Node 24.22.1): - `npm run test:focused --` the same nine files — 81 passed, 2 skipped - `npm run check:fast` — passed - `npm run docs:check` — passed At `dbbd607d7` (`main` `a95b83c2b` merged, macOS 26.5.2, Node 24.22.1): - `npm run test:focused --` `artifactSelectedName`, `keyedArchiveSelection`, `keyedArchiveStandaloneSelection`, `bundleResourceComposition`, `artifactMcp`, `keyedArchivePrototypeKeyMcp`, `dylibResolutionMcp`, `artifactInspectionCoverageMcp`, `artifactComparisonCoverage` — 9 files, 81 passed, 2 skipped - `keyedArchiveSelection.test.ts` with `src/artifacts/ArtifactProvider.ts` reverted: the new bundle case fails ("Invalid analysis input for inspect_keyed_archive") - At `7cf864eb2` with `src/application/BinaryTargetResolver.ts` reverted: the three files fail as on `main` (4 failed: the three existing regressions and the new bundle case) - `npm run check:fast` — passed - `npm run docs:check` — passed - Built CLI E2E on `main` `d1c88fab1` vs this branch: see the PR comment. ## Compatibility, safety, and release - Breaking changes or migration steps: none. Restores the pre-c27560e43 admission of bundle directories; adds `bundleInfoPlist` to non-executable bundle targets. - Real Hopper/Ghidra, browser, or OS coverage: macOS only, local fixtures. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no new process or network access; the digest check now binds to the executable the caller's bundle resolved to. ## Author readiness Human owner: @chordpli - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-05 01:48:00 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels   
area: bridge

   
area: bridge

   
area: build

   
area: build

   
area: build

   
area: cli

   
area: domain

   
area: evidence

   
area: mcp

   
area: native

   
area: providers

   
area: runtime

   
area: server

   
area: setup

   
area: tests

   
bug

   
design

   
documentation

   
enhancement

   
enhancement

   
enhancement

   
experiment

   
help wanted

   
i18n

   
invalid

   
P0: critical

   
P1: high

   
P2: medium

   
P2: medium

   
P2: medium

   
P3: low

   
performance

   
provider-request

   
pull-request
Mirrored from GitHub Pull Request

  
question

   
roadmap

   
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7833
No description provided.