mirror of
https://github.com/morluto/rea.git
synced 2026-11-05 06:45:22 +00:00
[GH-ISSUE #3993] [Bug] A quoted executable pathname containing groups=[ prevents GDB session closure #1588
Closed
opened 2026-10-16 21:07:32 +00:00 by bsakaguchi
·
4 comments
No Branch/Tag specified
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
Mirrored from GitHub Pull Request
question
roadmap
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set.
Reference
morluto/rea#1588
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @coygeek on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3993
Before submitting
Area
Process capture or runtime observation
Observed behavior
Closing a GDB session fails when its complete inferior inventory contains
groups=[inside a quoted executable pathname, even when no inferior has a live PID. The MCP close returnscleanup_incomplete, leaves the owned debugger session ready, and does not send the normal exit command. The failure was reproduced with a simulated provider through the registered production MCP tools; real GDB output generation was not tested.In the completed four-case probe,
fixture/plain.out,fixture/groups=.out, andfixture/bracket[.outeach closed successfully, returnednone_observed, and sent-gdb-exit. Onlyfixture/groups=[.outfailed. Its first close issued two inventory requests, sent no exit command, and returned the following relevant error fields:A status request after the failed close still returned
state: "ready". The subsequentfileconsole call returned an error without dispatching the command to the simulated provider, and a repeated close returnedcleanup_incompleteagain. An earlier probe attempt reproduced the same failure but failed its own assertion that clearing the file would recover; the completed probe checks the observed failed recovery instead. These are observations of REA's behavior against a simulated production boundary, not measurements of a real GDB session.Reproduction
Use the baseline under Runtime or environment with its dependencies installed and compiled runtime prepared. From the repository root, run the following command. It uses the repository's simulated-process approach and the production tool registration. The Linux platform option permits the Linux-only lifecycle on the test host; the process is an in-memory event emitter, and its kill method affects only simulated streams. It does not open an executable or run a real target.
The probe starts a fresh session for each filename, selects the file through
gdb_console, then closes and checks session status. The simulated provider returns a complete MI inventory with the selected path in a quoted executable field and no PID. For the failing case, it also attemptsgdb_consolewithfileand retries close.Expected behavior
A complete, valid inventory with no live PID should allow
close_gdb_sessionto release its owned debugger and returntarget_state: "none_observed". Literal text in a quoted executable pathname should remain a string value when interpreting the inventory. The durable output TTY requirement applies to live inferiors, so it does not apply to these inputs.Impact and scope
A bounded class of executable pathnames makes ordinary shutdown fail for an idle debugger and retains the session. The attempted console recovery and repeated close also failed in the simulation. Severe harm, target termination, and data loss were not observed; real-provider incidence is unmeasured.
Workaround status: unverified. All three fresh-session control filenames closed successfully, but that does not recover an already retained session. Clearing the selected file through MCP after the failure was blocked, and no alternative recovery route was verified.
REA version
rea 6.5.0 at source commit
4692bb3330Runtime and platform
Node 24.18.0; macOS arm64
Target and artifact context
Registered MCP GDB tools with an in-memory simulated Linux GDB process on macOS; no real debugger, inferior, or executable ran.
Interface
MCP
Earliest failure stage
Cleanup, cancellation, or lifecycle
Relevant output or evidence
src/contracts/gdbToolContracts.ts:112, the close contract andnone_observedresult;docs/reverse-engineering-tools.md:28, Linux GDB lifecycle;AGENTS.md, Architecture and Cleanup, format-aware parsing and preservation of source values.src/gdb/GdbSessionManager.ts:159,closeat line 1072, and#detachInferiorat line 1534 explains the result.The cause is source-derived: after scanning past quoted text, the parser separately searches the raw list body for
groups=[and rejects the whole inventory. The prepared compiled runtime contains the same search. Cleanup repeats the rejected inventory query. The registration's cleanup admission retries the retained failure before allowing a subsequent console command.An existing case at
tests/boundary/providers/GdbSessionManagerCoverage.test.ts:56is named "nested groups field", but its input puts the marker inside a quotedextrastring and expects rejection. That expectation does not distinguish a genuine nested field from literal string contents. The production server installs these tools atsrc/server/createServer.ts:481; this probe uses that same registration with its optional binary-analysis admission absent.Typed outcome or recovery expected
A complete valid inventory without a live PID should close with target_state: "none_observed", release the owned debugger and remove the session. Preserve rejection of genuinely malformed/nested inventories.
Analysis or suspected cause
Source-derived: src/gdb/GdbSessionManager.ts:159 searches the raw inventory body for groups=[ after its scanner has skipped quoted text. close at line 1072 and detach at line 1534 consume that rejection. Cleanup admission retries the failure before permitting a subsequent console command.
Additional context
Freshness check: the cited failing implementation is unchanged on origin/main at
fc712b3750. The only change to a cited reproduction entry point normalizes global CLI flag syntax. The baseline reproduction was not rerun on that revision.Restoration check: Run the same MCP lifecycle for all four filenames. Each valid inventory without a live PID must close successfully with
none_observed, release the owned debugger, and leave no retained session. Confirm that literal marker text inside a quoted field is accepted while genuinely malformed or unsupported nested inventories still produce an unknown result and retain ownership when safe cleanup cannot be established. Keep the successful control cases so passing cannot come from bypassing inferior-state verification.@XinwangTao commented on GitHub (Oct 15, 2026):
Confirmed: the pathname parsing treats the [ inside a quoted executable field as the start of a groups= marker, so the inferior list never resolves and close cannot verify detach — leaving the session ready with no exit command sent. The literal-marker-inside-quoted-field case should be treated as plain text (or bracket-escaped) when building the inventory, with genuinely malformed lists still rejected.
@yankikucuk commented on GitHub (Oct 15, 2026):
Working on this. Reproduced at the manager boundary with the simulated inventory: an idle session whose quoted executable is
fixture/groups=[.outcould not be closed. The parser no longer searches the raw list body for the marker after its quote-aware scan; a nestedgroups=field is still refused when the unquoted field name precedes a[, while the same text inside a quoted value is read as a string. The idle close now returnsnone_observedand sends-gdb-exit; malformed and genuinely nested inventories are still rejected. Real GDB was not run. Draft PR follows shortly.@XinwangTao commented on GitHub (Oct 16, 2026):
yankikucuk, the quote-aware scan is the right fix — the groups= marker should only be meaningful outside quoted fields, so searching the raw list body after the scan mis-reads it. Keeping genuinely nested groups= rejected while treating quoted occurrences as plain text preserves both the safety check and the quoted-pathname case. Good that the idle close now sends -gdb-exit.
@N0zoM1z0 commented on GitHub (Oct 16, 2026):
Verified on current main
d72d856f58d4747c5eb4307426e80d20934e017cusing real GNU GDB 13.1 on Linux, through both native CLI/MI output and the actual stdio MCP server. The reported pathname no longer reproduces the failure.All six names passed:
plain.out,groups=[.out,groups=.out,bracket[.out, a space-containing name and a quote-containing name. For each, an authored ELF was selected without launching an inferior, GDB emitted its real recursive inventory, REA parsed no live PIDs, and MCPclose_gdb_sessionreturnedtarget_state: none_observed. A fresh subsequent session also opened/closed; all executable digests stayed unchanged (20 tool calls total).Smallest actual MI example, with only the fixture directory shortened:
Source history identifies the format-aware inventory validation in d9aa06d93; the current parser distinguishes quoted values from structural fields. This is a source-derived explanation plus current-version runtime verification, not a claim to have run the original older revision against real GDB.
Completed matrix: 5.46 s elapsed, 6.23 s CPU, 717 MiB sampled process-family peak; two CPU cores. No target execution or external attach was used, and no other-OS claim. Full MI records, calls and checks remain in
/tmp/rea-3993-gdb-inventory-20261016/.Closing as verified on current main; no additional production change or duplicate PR is necessary. Follow-up evidence also contributes to #4227.