morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4698] [Bug] Kuna session installation acquisition ignores cancellation #2451

New issue

Closed

opened 2026-10-17 21:04:50 +00:00 by bsakaguchi · 4 comments

bsakaguchi commented

2026-10-17 21:04:50 +00:00

Owner

Originally created by @morluto on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4698

Before submitting

Searched open and closed issues for related reports (Kuna cancellation; Kuna installation cancellation). #4689/#4693 address later attribution/projection, not acquisition lifetime.
No credentials or sensitive target data included.

Area

Native analysis or decompilation

Observed behavior

Source-only finding. Kuna session requests await shared installation acquisition without a cancellable wait. The acquisition itself calls the signal-aware installation inspector without a signal. Session close aborts the session controller and then joins active requests, so it cannot interrupt this installation probe through that controller. The default version-probe timeout is 10 seconds; this is a configured bound, not a measured cancellation delay.

Reproduction

NOT_ENOUGH_INFO: no runtime reproduction was run for this finding. Source inspection at 54c71313ae establishes the disconnected signal paths. Proposed bounded check: open a session with a working profile, make the subsequent version probe wait on a fixture gate, then cancel one health/search caller while a peer waits; separately close the session during acquisition. Check prompt independent caller settlement, exact reason, retained peer work and proven child/resource cleanup.

Expected behavior

A caller can leave shared acquisition without stopping a peer. Closing the owning session should cancel acquisition and join its cleanup. Preserve the producer's authored failure and exact cleanup dependency rather than reclassifying every late result from the latest signal. See repository lifecycle ownership/completion rules in docs/tool-design.md and AGENTS.md.

Impact and scope

Source-derived: cancellation cannot reach the session's installation inspector; health success also returns immediately after acquisition without a post-acquisition cancellation check. Actual delay, externally projected outcomes and real-provider behavior remain unverified. This concerns session acquisition, not the already signal-aware profile-resolution boundary.

REA version

Source 54c71313ae (package 6.5.0).

Runtime and platform

Source reviewed on Darwin arm64 / Node 24.18.0. No runtime fault exercise; cross-platform behavior unverified.

Target and artifact context

NOT_ENOUGH_INFO: no runtime target used for this source-only finding.

Interface

Other — shared AnalysisClient session boundary used by CLI/MCP.

Earliest failure stage

Cleanup, cancellation, or lifecycle.

Relevant output or evidence

Caller admission and direct installation wait: merged caller/session signal exists, but acquisition awaits #ensureInstallation directly; health returns after acquisition.
Session close: aborts session, then joins active requests.
Shared installation owner: inspectKunaInstallation receives fileCloseResources only.
Inspector signal and bounded version probe: supports options.signal for probe and fingerprint boundaries; default probe deadline is 10,000 ms.

Typed outcome or recovery expected

Caller cancellation retains the exact caller reason; session shutdown retains any owned cleanup failures and permits retry. A shared acquisition is owned by the session, not an arbitrary request.

Analysis or suspected cause

Source-derived: unlike shared inventory waits, the installation promise has no per-caller wait boundary, and its producer does not receive the session signal. Proposed repair must also keep all acquisition/descriptor ownership joinable after an individual caller leaves.

Originally created by @morluto on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4698 ### Before submitting - [x] Searched open and closed issues for related reports (Kuna cancellation; Kuna installation cancellation). #4689/#4693 address later attribution/projection, not acquisition lifetime. - [x] No credentials or sensitive target data included. ### Area Native analysis or decompilation ### Observed behavior **Source-only finding.** Kuna session requests await shared installation acquisition without a cancellable wait. The acquisition itself calls the signal-aware installation inspector without a signal. Session close aborts the session controller and then joins active requests, so it cannot interrupt this installation probe through that controller. The default version-probe timeout is 10 seconds; this is a configured bound, not a measured cancellation delay. ### Reproduction NOT_ENOUGH_INFO: no runtime reproduction was run for this finding. Source inspection at 54c71313aeb2cbdf21626af9557673a6f6397180 establishes the disconnected signal paths. Proposed bounded check: open a session with a working profile, make the subsequent version probe wait on a fixture gate, then cancel one health/search caller while a peer waits; separately close the session during acquisition. Check prompt independent caller settlement, exact reason, retained peer work and proven child/resource cleanup. ### Expected behavior A caller can leave shared acquisition without stopping a peer. Closing the owning session should cancel acquisition and join its cleanup. Preserve the producer's authored failure and exact cleanup dependency rather than reclassifying every late result from the latest signal. See repository lifecycle ownership/completion rules in docs/tool-design.md and AGENTS.md. ### Impact and scope Source-derived: cancellation cannot reach the session's installation inspector; health success also returns immediately after acquisition without a post-acquisition cancellation check. Actual delay, externally projected outcomes and real-provider behavior remain unverified. This concerns session acquisition, not the already signal-aware profile-resolution boundary. ### REA version Source 54c71313aeb2cbdf21626af9557673a6f6397180 (package 6.5.0). ### Runtime and platform Source reviewed on Darwin arm64 / Node 24.18.0. No runtime fault exercise; cross-platform behavior unverified. ### Target and artifact context NOT_ENOUGH_INFO: no runtime target used for this source-only finding. ### Interface Other — shared AnalysisClient session boundary used by CLI/MCP. ### Earliest failure stage Cleanup, cancellation, or lifecycle. ### Relevant output or evidence - [Caller admission and direct installation wait](https://github.com/morluto/rea/blob/54c71313aeb2cbdf21626af9557673a6f6397180/src/kuna/KunaSessionClient.ts#L303): merged caller/session signal exists, but acquisition awaits #ensureInstallation directly; health returns after acquisition. - [Session close](https://github.com/morluto/rea/blob/54c71313aeb2cbdf21626af9557673a6f6397180/src/kuna/KunaSessionClient.ts#L420): aborts session, then joins active requests. - [Shared installation owner](https://github.com/morluto/rea/blob/54c71313aeb2cbdf21626af9557673a6f6397180/src/kuna/KunaSessionClient.ts#L1309): inspectKunaInstallation receives fileCloseResources only. - [Inspector signal and bounded version probe](https://github.com/morluto/rea/blob/54c71313aeb2cbdf21626af9557673a6f6397180/src/kuna/KunaInstallation.ts#L131): supports options.signal for probe and fingerprint boundaries; default probe deadline is 10,000 ms. ### Typed outcome or recovery expected Caller cancellation retains the exact caller reason; session shutdown retains any owned cleanup failures and permits retry. A shared acquisition is owned by the session, not an arbitrary request. ### Analysis or suspected cause Source-derived: unlike shared inventory waits, the installation promise has no per-caller wait boundary, and its producer does not receive the session signal. Proposed repair must also keep all acquisition/descriptor ownership joinable after an individual caller leaves.

bsakaguchi added the

triage

bug

labels

2026-10-17 21:04:50 +00:00

bsakaguchi commented

2026-10-17 21:04:52 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Fixed in 988494abd, pushed to main.

The session now reuses SharedStartupAttempt for installation acquisition instead of awaiting a shared promise directly. Independent waiters retain their exact cancellation reasons; the final departing waiter stops the producer and joins finalization. Session close owns and joins that producer too. The signal reaches version probing/fingerprinting. Proven cancellation permits replacement only after settlement; physical failures and unresolved descriptor cleanup remain attached to the original outcome. A caller arriving during cancellation drain waits for completion before retrying.

Validation on Darwin arm64/Node 24.18:

Four new gated fake-process controls failed on the original source, then passed: departing peer, final-caller stop/retry with null/string reasons, and close during the version probe. Fake probe PIDs were checked gone after stop.
45 focused checks across six files passed, including exact descriptor ownership, cached failure attribution and inventory projections. A final overlapping 13-check run passed, including cancellation during fingerprint close/shebang read, a new caller during cancellation drain, and close refusal/blocking/retry. Build, typecheck/lint, docs checks (five README controls) and hooks passed.
Public CLI tiny-ELF/fake-Kuna SIGINT reproduction: original build waited for the 750 ms release backstop and returned after 808 ms; candidate returned after 14 ms with the fake probe absent. Both returned cancelled search_procedures with complete cleanup. Producer metadata now identifies health, where cancellation actually occurred. This is one controlled sample, not a real-provider latency claim.

Bounded equivalent completed malformed-inventory CLI tasks (same fake executable/input and replies): first-process baseline/candidate elapsed 1.554/1.267 s, CPU 1.316/1.340 s, sampled process-family RSS 530.3/527.7 MB; two alternating warm repeats gave medians elapsed 1.305/1.307 s, CPU 1.343/1.332 s, sampled family RSS 527.6/529.5 MB. Both replies were 86 raw cl100k tokens. No efficiency claim; one earlier contended run was excluded because typechecking overlapped it. CPU includes reaped children; sampled RSS can miss transients/reparenting. True cold, whole-agent/MCP/catalog/retry, real-engine and larger-output costs remain unmeasured.

No real Kuna/Windows/MCP-specific failure qualification or heavy profiling/stress. Remaining single-function/completion cancellation paths are still separate audit candidates. Remote main advanced with unrelated test changes during publication; this fix rebased cleanly and its runtime source fingerprint is unchanged.

@morluto commented on GitHub (Oct 17, 2026): Fixed in 988494abd, pushed to main. The session now reuses SharedStartupAttempt for installation acquisition instead of awaiting a shared promise directly. Independent waiters retain their exact cancellation reasons; the final departing waiter stops the producer and joins finalization. Session close owns and joins that producer too. The signal reaches version probing/fingerprinting. Proven cancellation permits replacement only after settlement; physical failures and unresolved descriptor cleanup remain attached to the original outcome. A caller arriving during cancellation drain waits for completion before retrying. Validation on Darwin arm64/Node 24.18: - Four new gated fake-process controls failed on the original source, then passed: departing peer, final-caller stop/retry with null/string reasons, and close during the version probe. Fake probe PIDs were checked gone after stop. - 45 focused checks across six files passed, including exact descriptor ownership, cached failure attribution and inventory projections. A final overlapping 13-check run passed, including cancellation during fingerprint close/shebang read, a new caller during cancellation drain, and close refusal/blocking/retry. Build, typecheck/lint, docs checks (five README controls) and hooks passed. - Public CLI tiny-ELF/fake-Kuna SIGINT reproduction: original build waited for the 750 ms release backstop and returned after 808 ms; candidate returned after 14 ms with the fake probe absent. Both returned cancelled search_procedures with complete cleanup. Producer metadata now identifies health, where cancellation actually occurred. This is one controlled sample, not a real-provider latency claim. Bounded equivalent completed malformed-inventory CLI tasks (same fake executable/input and replies): first-process baseline/candidate elapsed 1.554/1.267 s, CPU 1.316/1.340 s, sampled process-family RSS 530.3/527.7 MB; two alternating warm repeats gave medians elapsed 1.305/1.307 s, CPU 1.343/1.332 s, sampled family RSS 527.6/529.5 MB. Both replies were 86 raw cl100k tokens. No efficiency claim; one earlier contended run was excluded because typechecking overlapped it. CPU includes reaped children; sampled RSS can miss transients/reparenting. True cold, whole-agent/MCP/catalog/retry, real-engine and larger-output costs remain unmeasured. No real Kuna/Windows/MCP-specific failure qualification or heavy profiling/stress. Remaining single-function/completion cancellation paths are still separate audit candidates. Remote main advanced with unrelated test changes during publication; this fix rebased cleanly and its runtime source fingerprint is unchanged.

bsakaguchi commented

2026-10-17 21:04:52 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 17, 2026):

Good — folding installation acquisition into SharedStartupAttempt and having session close join the same producer closes the orphaned-acquisition hole. The 'replacement only after settlement' rule is the key invariant; worth documenting whether settlement here means producer completion or drain completion, since a caller arriving mid-drain blocks until completion and might otherwise time out. Also, since physical failures stay attached to the original outcome, consider exposing a way for a subsequent acquisition attempt to read the retained failure (e.g. a diagnostic surface) rather than re-discovering it.

@XinwangTao commented on GitHub (Oct 17, 2026): Good — folding installation acquisition into SharedStartupAttempt and having session close join the same producer closes the orphaned-acquisition hole. The 'replacement only after settlement' rule is the key invariant; worth documenting whether settlement here means producer completion or drain completion, since a caller arriving mid-drain blocks until completion and might otherwise time out. Also, since physical failures stay attached to the original outcome, consider exposing a way for a subsequent acquisition attempt to read the retained failure (e.g. a diagnostic surface) rather than re-discovering it.

bsakaguchi closed this issue

2026-10-31 00:34:06 +00:00

bsakaguchi commented

2026-10-31 00:34:07 +00:00

Author

Owner

@skyzhao1223 commented on GitHub (Oct 18, 2026):

Verified on current main (7c458f04b) that this no longer reproduces.

npm run test:focused -- tests/boundary/providers/kuna/kunaInstallationCancellation.test.ts passes (4 tests), including "lets one caller leave acquisition with its exact reason while a peer keeps the probe" and "joins the final caller's probe stop before retrying".

Fixed by 988494abd (fix(kuna): own cancellable installation startup), which is in the rea-agents-6.6.0 release. Verification only; no action requested.

@skyzhao1223 commented on GitHub (Oct 18, 2026): Verified on current `main` (`7c458f04b`) that this no longer reproduces. `npm run test:focused -- tests/boundary/providers/kuna/kunaInstallationCancellation.test.ts` passes (4 tests), including "lets one caller leave acquisition with its exact reason while a peer keeps the probe" and "joins the final caller's probe stop before retrying". Fixed by `988494abd` (`fix(kuna): own cancellable installation startup`), which is in the `rea-agents-6.6.0` release. Verification only; no action requested.

bsakaguchi commented

2026-10-31 00:34:07 +00:00

Author

Owner

@morluto commented on GitHub (Oct 18, 2026):

Closing as fixed on main after reconciling this report with the landed owner/consumer changes.

988494abd: fix(kuna): own cancellable installation startup.

Evidence scope: this closure uses the landed source, regression coverage and validation already recorded in the linked commits/thread. No new local tests or native-provider reproduction were run during this backlog pass; previously documented platform and real-provider gaps still apply.

@morluto commented on GitHub (Oct 18, 2026):  Closing as fixed on `main` after reconciling this report with the landed owner/consumer changes. - [988494abd](https://github.com/morluto/rea/commit/988494abdbb27fb91ca6bd80362c9f1a332f86c3): fix(kuna): own cancellable installation startup. Evidence scope: this closure uses the landed source, regression coverage and validation already recorded in the linked commits/thread. No new local tests or native-provider reproduction were run during this backlog pass; previously documented platform and real-provider gaps still apply.

bsakaguchi referenced this issue

2026-10-31 01:05:03 +00:00

[PR #2451] [CLOSED] test(agent): grade notes export facts against produced evidence #5239

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2451

No description provided.

Rows
Columns