Files
reverse-engineering-anything/tests/acceptance/nonBinaryComposition.test.ts
T
morluto cbc0dd1e7c fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs (#1004)
* fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs

Follow-up to the session snapshot/export tightening: the same invisible server-cwd resolution applied to open_binary target paths (parseBinaryTarget(path, process.cwd())), import_evidence_bundle bundle reads, firmware input files (resolve(raw)), browser executable launch paths (resolve-then-spawn), Electron executable/application/root paths (realpath on raw input), and the expected server path check.

Each field gains the shared isAbsoluteLocalPath refinement plus a catalog-visible description, since JSON Schema cannot express the rule. Examples, scenario fixtures, and contract tests updated to absolute paths; new schema cases cover rejection/acceptance/omission per field.

Explicitly unchanged (verified rooted or out of scope): inspect_plist paths (resolved against the target bundle dir), firmware output_directory (already provider-enforced), filesystem observation paths (resolved against the caller-supplied working_directory), keyed-archive member paths (archive-relative), JS evidence member paths (evidence-relative under root_alias), provider-internal execution schemas, CLI-only doctor flows, and CLI options (own resolve against the operator cwd).

* fix(cli): resolve operator-relative paths before shared absolute-path validation

The contract tightening rejects relative paths, but three CLI commands forward operator-relative input into the shared schemas: firmware commands pass raw args to FirmwareAnalysisService, and the Electron/browser scenario commands validate parsed scenario JSON directly. CLI paths are relative to the operator shell, so resolve them against the working directory first: resolve() in firmwareCommands, and a shared resolveCliJsonPaths JSON key-path helper (cliJsonInput) applied in electronCommands and cliBrowserScenarioCommands. MCP behavior is unchanged — MCP callers must still send absolute paths.

Covers the regression with a relative-path firmware CLI acceptance test (asserts provider-stage capability_unavailable, not a validation error) and unit tests for the helper.
2026-10-08 00:52:37 +08:00

187 lines
6.9 KiB
TypeScript

import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
import { writeFile } from "node:fs/promises";
import { join } from "node:path";
import { expect, onTestFinished } from "vitest";
import { createAndroidAnalysisProvider } from "../../src/composition/android.js";
import { createFirmwareAnalysisProvider } from "../../src/composition/firmware.js";
import { createJavaScriptRecoveryProvider } from "../../src/composition/javascriptRecovery.js";
import { createServer } from "../../src/server/createServer.js";
import { createTestBinarySession } from "../fixtures/binarySession.js";
import { writeOrderedZip } from "../fixtures/artifactEntryOrder.js";
import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
import { cliTest } from "../support/cli/cliFixture.js";
const connect = async (environment: NodeJS.ProcessEnv) => {
const session = createTestBinarySession(() => {
throw new Error("Target-free analysis must not acquire a deep provider");
});
const server = createServer(session, session, {
androidAnalysis: createAndroidAnalysisProvider(environment),
firmwareAnalysis: createFirmwareAnalysisProvider(environment),
javascriptRecovery: createJavaScriptRecoveryProvider(environment),
});
const client = new Client({ name: "composition-parity", version: "1" });
onTestFinished(async () => {
await client.close();
await server.close();
await session.close();
});
const [clientTransport, serverTransport] =
InMemoryTransport.createLinkedPair();
await server.connect(serverTransport);
await client.connect(clientTransport);
return client;
};
cliTest.skipIf(process.platform === "win32")(
"preserves the selected APK configuration through the compiled CLI and MCP factories",
async ({ cli }) => {
const root = await createTestTempDirectory("rea-android-composition-");
const apk = join(root, "fixture.apk");
await writeOrderedZip(apk, ["AndroidManifest.xml", "classes.dex"]);
const environment = {
REA_LOG_LEVEL: "silent",
JAVA_HOME: "relative-fixture-jdk",
};
const cliResult = await cli.run({
arguments: ["inspect-android-package", apk, "--json"],
environment,
timeoutMs: 10_000,
});
expect(cliResult.exitCode).toBe(1);
expect(cliResult.json).toMatchObject({ code: "capability_unavailable" });
const client = await connect(environment);
const response = await client.callTool({
name: "inspect_android_package",
arguments: { path: apk },
});
expect(response.isError).toBe(true);
expect(response.structuredContent).toEqual({ error: cliResult.json });
expect(JSON.stringify(response.structuredContent)).toContain("JAVA_HOME");
},
);
cliTest.skipIf(process.platform !== "linux")(
"preserves the missing firmware command reason through both caller paths",
async ({ cli }) => {
const root = await createTestTempDirectory("rea-firmware-composition-");
const path = join(root, "input.bin");
await writeFile(path, "firmware fixture");
const environment = { REA_LOG_LEVEL: "silent" };
const cliResult = await cli.run({
arguments: ["inspect-firmware-regions", path, "--json"],
environment,
timeoutMs: 10_000,
});
expect(cliResult.exitCode).toBe(1);
expect(cliResult.json).toMatchObject({ code: "capability_unavailable" });
const client = await connect(environment);
const response = await client.callTool({
name: "inspect_firmware_regions",
arguments: { path },
});
expect(response.isError).toBe(true);
expect(response.structuredContent).toEqual({ error: cliResult.json });
expect(JSON.stringify(response.structuredContent)).toContain(
"REA_BINWALK_COMMAND",
);
},
);
cliTest.skipIf(process.platform !== "linux")(
"resolves relative firmware CLI paths against the operator working directory",
async ({ cli }) => {
const root = await createTestTempDirectory("rea-firmware-cli-relative-");
await writeFile(join(root, "input.bin"), "firmware fixture");
const cliResult = await cli.run({
arguments: ["inspect-firmware-regions", "input.bin", "--json"],
cwd: root,
environment: { REA_LOG_LEVEL: "silent" },
timeoutMs: 10_000,
});
// A relative path must pass input validation and reach the provider,
// which reports the missing firmware engine — not a validation error.
expect(cliResult.exitCode).toBe(1);
expect(cliResult.json).toMatchObject({ code: "capability_unavailable" });
},
);
cliTest(
"preserves optional JavaScript recovery configuration through CLI and MCP",
async ({ cli }) => {
const root = await createTestTempDirectory("rea-recovery-composition-");
const path = join(root, "bundle.js");
await writeFile(path, "globalThis.fixture = 1;");
const environment = {
REA_LOG_LEVEL: "silent",
REA_WAKARU_COMMAND: "relative-unavailable-tool",
};
const cliResult = await cli.run({
arguments: [
"recover-javascript-sources",
path,
join(root, "output"),
"--json",
],
environment,
timeoutMs: 10000,
});
expect(cliResult.exitCode).toBe(1);
expect(cliResult.json).toMatchObject({ code: "capability_unavailable" });
const client = await connect(environment);
const response = await client.callTool({
name: "recover_javascript_sources",
arguments: { path, output_directory: join(root, "output") },
});
expect(response.isError).toBe(true);
expect(response.structuredContent).toEqual({ error: cliResult.json });
expect(JSON.stringify(response.structuredContent)).toContain(
"REA_WAKARU_COMMAND",
);
},
);
cliTest(
"returns recovery path diagnostics before missing-engine errors in CLI and MCP",
async ({ cli }) => {
const root = await createTestTempDirectory("rea-recovery-path-parity-");
const environment = {
REA_LOG_LEVEL: "silent",
REA_WAKARU_COMMAND: "relative-unavailable-tool",
};
const client = await connect(environment);
for (const field of ["path", "output_directory"] as const) {
const input = {
path: join(root, "bundle.js"),
output_directory: join(root, "output"),
[field]: "relative.js",
};
const result = await cli.run({
arguments: [
"recover-javascript-sources",
input.path,
input.output_directory,
"--json",
],
environment,
timeoutMs: 10_000,
});
const response = await client.callTool({
name: "recover_javascript_sources",
arguments: input,
});
expect(result.exitCode).toBe(1);
expect(response.isError).toBe(true);
expect(response.structuredContent).toEqual({ error: result.json });
expect(result.json).toMatchObject({
code: "invalid_request",
details: {
operation: "recover_javascript_sources",
issues: [{ path: [field], reason: "invalid_format" }],
},
});
}
},
);