[mhamzasakhi]

Summary

Fixes #6076. inspect-managed-artifact, inspect-managed-members and inspect-managed-native-boundaries refused a readable non-PE executable as capability_unavailable / unsupported_provider, and the selected path was missing from the error details. The refusal is about the target's format, not a missing provider capability.

Problem and expected behavior

ManagedStaticClient.execute in src/dotnet/ManagedStaticProvider.ts returned AnalysisCapabilityUnavailableError for a non-PE target. That is the same type as the adjacent guard for operations the provider does not implement.

AnalysisUnsupportedTargetError is documented for exactly this case: "a readable supplied artifact lies outside this operation's supported target formats". It is already projected as unsupported_target, with operation, path and reason details and format-based recovery advice.

Change and scope

• The non-PE guard now returns AnalysisUnsupportedTargetError(operation, target.path, reason). The reason text, including the observed format, is unchanged.
• The unimplemented-operation guard keeps AnalysisCapabilityUnavailableError.
• No new remediation text. The existing unsupported_target default already gives the advice the issue asks for.
• CLI and MCP both reach this producer, through runManagedProviderExecution, so both adapters change together. BinarySession runtime-availability marking is not on this path.
• Not included: managed inspection still supports PE/CLI only.

Contribution scope: an ordinary error-classification fix within existing boundaries; a maintainer scope decision is not applicable.

Contract and boundary impact

• Semantic owner and earliest changed stage: the managed static provider's format guard.

• Contribution scope fit and linked maintainer decision: in scope; not applicable.

• CLI and MCP/tool-catalog contract: no schema change. For non-PE inputs, the error changes from capability_unavailable / unsupported_provider to unsupported_target / unsupported_target, with details.path added. details.provider_id is no longer present for this refusal.

• Provider, bridge, target-format, or platform compatibility: none.

• Evidence, artifact, provenance, or reconstruction contract: none. The refusal happens before any read of the target's bytes.

• Target selection, authority, upstream behavior, and cleanup details: not applicable.

• Generated metadata, package, or installation impact: none.

• Read existing files or captured data.

• Launch or attach to a process.

• Inject instrumentation or run scripts/code.

• Change process memory, registers, files, or configuration.

• Contact network services.

• Recover protected code or work around protections.

• Documentation or usability only; no target interaction.

• Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

• Tests added or updated:

  • tests/acceptance/managedCliOutput.test.ts (public CLI): all three commands, each on an ELF64 and a thin Mach-O fixture. Each must return unsupported_target, non-retryable, with the default remediation and exact operation, path and reason details.
  • tests/boundary/mcp/managedMcp.test.ts: inspect_managed_artifact with a non-PE path through the registered MCP tool returns the same typed error. The reporter did not test the MCP transport.
  • tests/boundary/providers/managed/managedStaticProvider.test.ts: the existing ELF case asserted the old AnalysisCapabilityUnavailableError. It now asserts the corrected error, with operation, path and reason.

• Base reproduction (executed): with only ManagedStaticProvider.ts reverted, all three changed tests fail.

• User-visible CLI output (executed on Linux x64; ELF, which the original Mach-O report did not cover). rea inspect-managed-members /usr/bin/true --json:

  {"error":"Analysis failed","code":"unsupported_target","category":"unsupported_target","message":"Unsupported target for inspect_managed_members at /usr/bin/true: Managed static triage requires a PE target; observed elf.","retryable":false,"remediation":{"action":"Select a target supported by this operation or choose an operation supporting the reported target format."},"details":{"operation":"inspect_managed_members","path":"/usr/bin/true","reason":"Managed static triage requires a PE target; observed elf."}}

  Before this change, the same command returned capability_unavailable / unsupported_provider with provider_id and no path.

• Remaining proof gaps: macOS and Windows were not run. The universal Mach-O case from the report is covered only through the same producer, with a thin Mach-O fixture.

• Observed, derived, and inferred claims remain distinguishable.

• Artifact identity, source provenance, and failed attempts remain preserved.

• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Run on Ubuntu 24.04 x64 with Node 24.18.0 and npm 11.16.0:

• npm run test:focused -- with the 3 changed test files: 19 passed. With the fix reverted: 3 failed.
• npm run test:focused -- with every test file that references managed inspection (35 files): 517 passed, 0 failed.
• npm run check:fast: passed.
• rea inspect-managed-members /usr/bin/true --json: output shown above.

Compatibility, safety, and release

• Breaking changes or migration steps: callers that matched capability_unavailable for non-PE managed inputs will now see unsupported_target. That is the documented classification for this condition, and the error details now carry the selected path.
• Real Hopper/Ghidra, browser, or OS coverage: not applicable (static provider). Linux only.
• Package or release metadata impact: none.
• Security, privacy, process, or containment review: no new reads, execution, or network access.

Author readiness

Human owner: @mhamzasakhi

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-22T08:40:16.953716Z We couldn’t complete this review. Comment @codex review to try again.	ed86a0a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge; no actionable issues were found.

Summary

Corrects non-PE refusals in ManagedStaticProvider at the shared producer, so CLI and MCP callers receive unsupported_target with the target path.

• Managed inspection reports non-PE files as unsupported targets.

_{Reviews (1) · Last reviewed commit: "fix(managed): refuse non-PE inputs as un..." · Reviewed by Greptile}

[morluto]

Thanks for correcting the managed-inspection errors, @mhamzasakhi. Reporting a non-PE file as an unsupported target, with its selected path, gives CLI and MCP callers useful guidance about the input format. Welcome to REA!