morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4709] [Bug] Electron inspection retains an out-of-range DOM parent without reporting invalid evidence #2458

New issue

Closed

opened 2026-10-17 21:05:00 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-17 21:05:00 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4709

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

inspect-electron-page returns three DOM nodes with the last parent_index equal to 99999 and no DOM invalid_protocol_value exclusion when a loopback stand-in supplies an otherwise aligned DOMSnapshot.captureSnapshot reply. The same public CLI behavior reproduced twice in each tested build. Both controls per build changed only that integer to 1 and retained the correct relationship. No real Electron or Chromium producer emitting this reply was established.

Reproduction

Use a clean checkout at the source revision below, select its .nvmrc Node version and packageManager npm version, run npm ci, then npm run build:cached. Both installation and build were executed for this report.
Save the following as tests/parent-index-probe.test.ts. It uses the repository's loopback HTTP/WebSocket CDP fixture and the public CLI; it does not call the DOM normalizer directly.

import { execFile } from 'node:child_process';
import { promisify } from 'node:util';
import { writeFile, mkdtemp, rm } from 'node:fs/promises';
import { pathToFileURL } from 'node:url';
import { join } from 'node:path';
import { expect, it } from 'vitest';
import { startFakeCdpBrowser } from './fixtures/fakeCdpBrowser.js';
const run = promisify(execFile);
it('compares valid and out-of-range DOM parents through the CLI', async () => {
 let attempt = 0;
 for (const parent of [1, 99999, 1, 99999]) {
  const home = await mkdtemp(join(process.env.HOME!, 'capture-'));
  const file = join(home, 'index.html');
  await writeFile(file, '<!doctype html><main>fixture</main>');
  const url = pathToFileURL(file).href;
  const browser = await startFakeCdpBrowser({electronFileUrl: url, commandResult: ({method}) => method === 'DOMSnapshot.captureSnapshot' ? {
   strings: [url, '#document', 'HTML', 'MAIN', ''],
   documents: [{documentURL: 0, nodes: {nodeType: [9,1,1], nodeName: [1,2,3], nodeValue: [4,4,4], parentIndex: [-1,0,parent], attributes: [[],[],[]]}}],
  } : undefined});
  try {
   const {stdout, stderr} = await run(process.execPath, [process.env.CLI_ENTRY ?? 'scripts/rea.mjs', 'inspect-electron-page', browser.endpoint, 'electron-page', '--observation-ms', '0', '--json'], {cwd: process.cwd(), env: {PATH: process.env.PATH!, HOME: home, NO_COLOR: '1'}, timeout: 20000, maxBuffer: 2000000});
   const result = JSON.parse(stdout).normalized_result;
   const summary = {supplied_parent: parent, total_nodes: result.dom.total_nodes, retained_nodes: result.dom.nodes.length, emitted_parent: result.dom.nodes[2].parent_index, invalid_dom_exclusions: result.completeness.excluded.filter((x: any) => x.section === 'dom' && x.reason === 'invalid_protocol_value')};
   console.log(JSON.stringify(summary));
   if (process.env.EVIDENCE_DIR) await writeFile(join(process.env.EVIDENCE_DIR, `result-${++attempt}.json`), stdout);
   expect(stderr).toBe('');
   expect(summary).toEqual({supplied_parent: parent, total_nodes: 3, retained_nodes: 3, emitted_parent: parent, invalid_dom_exclusions: []});
   expect(browser.commands.some(x => x.method === 'DOMSnapshot.captureSnapshot')).toBe(true);
  } finally { await browser.close(); await rm(home, {recursive: true, force: true}); }
 }
}, 60000);

Save this as parent-index-probe.config.mjs at the checkout root.

export default {test:{include:['tests/parent-index-probe.test.ts'],pool:'forks',maxWorkers:1,testTimeout:60000}};

From the checkout root with the pinned Node on PATH, run the source-build comparison and then the published-package comparison. Each comparison runs valid, malformed, valid, malformed. The test assertions describe the defective output; a passing test confirms reproduction, not restoration.

trial="$(mktemp -d)"
node_bin="$(dirname "$(node -p process.execPath)")"
env -i PATH="$node_bin:$PATH" HOME="$trial" node node_modules/vitest/vitest.mjs run --config parent-index-probe.config.mjs
env -i PATH="$node_bin:$PATH" HOME="$trial" npm install --prefix "$trial/published" rea-agents@6.5.0
env -i PATH="$node_bin:$PATH" HOME="$trial" CLI_ENTRY="$trial/published/node_modules/rea-agents/scripts/rea.mjs" node node_modules/vitest/vitest.mjs run --config parent-index-probe.config.mjs
rm tests/parent-index-probe.test.ts parent-index-probe.config.mjs
rm -r "$trial"

Expected behavior

Normalized DOM structure should retain usable relationships and explicit uncertainty. An index outside the document cannot identify a parent in that document. Return explicit incomplete DOM coverage or a typed failure for this malformed evidence while preserving valid facts and their identities. This follows the documented normalized DOM/completeness contract and the repository guidance for unknown boundary values; it does not assume a conforming browser emits this reply.

Impact and scope

The observed impact is a false retained DOM relationship with no invalid-DOM exclusion, in two of two deliberately malformed replies per build. All four valid controls passed. Occurrence on conforming producers, normal-browser frequency, and downstream harm remain unknown. No real browser/application was launched or attached, and no target JavaScript or security-boundary behavior was exercised.

Impact level: P2
Assessment status: supported
Impact basis: The successful CLI result presents an unresolvable relationship as retained DOM structure without reporting the invalid relationship as unknown or incomplete; this is a bounded evidence-correctness defect.
Workaround status: unverified
Workaround basis: Supplying a valid index is a control, not an established practical recovery for callers receiving malformed producer replies.

REA version

Fresh main build at 5b243993872c2bcc70cb00060ffb79b347321370 and a separate newly installed latest npm package rea-agents@6.5.0. Both CLIs reported 6.5.0.

Runtime and platform

Node v24.18.0 and npm 11.16.0, matching the source toolchain pins; Darwin arm64; locked Vitest 5.0.3. Installation, build, test runner, and CLI calls used an isolated HOME. Each CLI call received only PATH, HOME, and NO_COLOR.

Target and artifact context

One disposable regular local HTML file and one selected page with three aligned nodes, empty attribute lists, and valid string-table references. Only the last parentIndex changes from 1 to 99999. The stand-in speaks real loopback HTTP/WebSocket transport and closes after each call; each child HOME and HTML file is removed afterward.

Interface

CLI

Earliest failure stage

Capture or observation

Relevant output or evidence

Expected source: AGENTS.md:19,31 requires identity, omission, uncertainty, partial facts, and meaningful boundary failures to be preserved; docs/electron-observation.md:57-59 describes normalized DOM structure and explicit completeness.
Failure source: The executed public CLI comparisons above; src/browser/CdpElectronInspection.ts:353-372 projects the parent, src/browser/CdpCaptureDocuments.ts:423-456,691-700 admits the aligned safe-integer arrays, and src/domain/javascript/electronObservation.ts:88-100 accepts the projected integer without an upper bound.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

Each build produced both summaries twice. All eight CLI calls exited successfully with empty stderr. Each focused one-test run passed its reproduction assertions.

{"supplied_parent":1,"total_nodes":3,"retained_nodes":3,"emitted_parent":1,"invalid_dom_exclusions":[]}
{"supplied_parent":99999,"total_nodes":3,"retained_nodes":3,"emitted_parent":99999,"invalid_dom_exclusions":[]}

The CLI call in every case was node <entry> inspect-electron-page <loopback-endpoint> electron-page --observation-ms 0 --json. MCP was not executed. These observations establish malformed-reply handling, not real-browser conformance or incidence.

Typed outcome or recovery expected

Repeat the same malformed and valid captures. Restoration requires that 99999 no longer appear as a valid retained relationship and that malformed DOM evidence produce explicit incomplete coverage or a typed failure. Preserve identities of any other retained facts. The valid controls must still retain three nodes with the last parent_index equal to 1 and no invalid-DOM exclusion.

Analysis or suspected cause

Source-derived reasoning: the shared parser preserves numeric-array positions and accepts the out-of-range value as a safe integer. The Electron projection adds that value to the document's retained base index. The output schema checks only the integer lower bound. The separate web DOM capture loop has an upper-bound check, but Electron does not use that loop. This fixture requires no array compaction.

Additional context

Related closed #2553 concerns malformed entries shifting facts between nodes. Its identified fix adds DOM bounds checks in web capture; its Electron change concerns frame admission. Closed #3379, delivered by merged #3901, concerns missing or malformed collection arrays and adds shared array admission. The aligned safe integer used here survives that admission. Inspected closed, unmerged #3125 and open #4040 concern capture uncertainty/frame ancestry and capture fidelity/frame generations respectively; neither changes this Electron DOM parent projection. A fresh all-state issue and PR search found no exact report or proposed fix for this retained out-of-range integer.

Originally created by @coygeek on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4709 ### Before submitting - [X] I searched the open and closed issues for a related report. - [X] I removed credentials, tokens, private paths, and sensitive target data. ### Area Process capture or runtime observation ### Observed behavior `inspect-electron-page` returns three DOM nodes with the last `parent_index` equal to `99999` and no DOM `invalid_protocol_value` exclusion when a loopback stand-in supplies an otherwise aligned `DOMSnapshot.captureSnapshot` reply. The same public CLI behavior reproduced twice in each tested build. Both controls per build changed only that integer to `1` and retained the correct relationship. No real Electron or Chromium producer emitting this reply was established. ### Reproduction 1. Use a clean checkout at the source revision below, select its `.nvmrc` Node version and `packageManager` npm version, run `npm ci`, then `npm run build:cached`. Both installation and build were executed for this report. 2. Save the following as `tests/parent-index-probe.test.ts`. It uses the repository's loopback HTTP/WebSocket CDP fixture and the public CLI; it does not call the DOM normalizer directly. ```ts import { execFile } from 'node:child_process'; import { promisify } from 'node:util'; import { writeFile, mkdtemp, rm } from 'node:fs/promises'; import { pathToFileURL } from 'node:url'; import { join } from 'node:path'; import { expect, it } from 'vitest'; import { startFakeCdpBrowser } from './fixtures/fakeCdpBrowser.js'; const run = promisify(execFile); it('compares valid and out-of-range DOM parents through the CLI', async () => { let attempt = 0; for (const parent of [1, 99999, 1, 99999]) { const home = await mkdtemp(join(process.env.HOME!, 'capture-')); const file = join(home, 'index.html'); await writeFile(file, '<!doctype html><main>fixture</main>'); const url = pathToFileURL(file).href; const browser = await startFakeCdpBrowser({electronFileUrl: url, commandResult: ({method}) => method === 'DOMSnapshot.captureSnapshot' ? { strings: [url, '#document', 'HTML', 'MAIN', ''], documents: [{documentURL: 0, nodes: {nodeType: [9,1,1], nodeName: [1,2,3], nodeValue: [4,4,4], parentIndex: [-1,0,parent], attributes: [[],[],[]]}}], } : undefined}); try { const {stdout, stderr} = await run(process.execPath, [process.env.CLI_ENTRY ?? 'scripts/rea.mjs', 'inspect-electron-page', browser.endpoint, 'electron-page', '--observation-ms', '0', '--json'], {cwd: process.cwd(), env: {PATH: process.env.PATH!, HOME: home, NO_COLOR: '1'}, timeout: 20000, maxBuffer: 2000000}); const result = JSON.parse(stdout).normalized_result; const summary = {supplied_parent: parent, total_nodes: result.dom.total_nodes, retained_nodes: result.dom.nodes.length, emitted_parent: result.dom.nodes[2].parent_index, invalid_dom_exclusions: result.completeness.excluded.filter((x: any) => x.section === 'dom' && x.reason === 'invalid_protocol_value')}; console.log(JSON.stringify(summary)); if (process.env.EVIDENCE_DIR) await writeFile(join(process.env.EVIDENCE_DIR, `result-${++attempt}.json`), stdout); expect(stderr).toBe(''); expect(summary).toEqual({supplied_parent: parent, total_nodes: 3, retained_nodes: 3, emitted_parent: parent, invalid_dom_exclusions: []}); expect(browser.commands.some(x => x.method === 'DOMSnapshot.captureSnapshot')).toBe(true); } finally { await browser.close(); await rm(home, {recursive: true, force: true}); } } }, 60000); ``` 3. Save this as `parent-index-probe.config.mjs` at the checkout root. ```js export default {test:{include:['tests/parent-index-probe.test.ts'],pool:'forks',maxWorkers:1,testTimeout:60000}}; ``` 4. From the checkout root with the pinned Node on PATH, run the source-build comparison and then the published-package comparison. Each comparison runs valid, malformed, valid, malformed. The test assertions describe the defective output; a passing test confirms reproduction, not restoration. ```sh trial="$(mktemp -d)" node_bin="$(dirname "$(node -p process.execPath)")" env -i PATH="$node_bin:$PATH" HOME="$trial" node node_modules/vitest/vitest.mjs run --config parent-index-probe.config.mjs env -i PATH="$node_bin:$PATH" HOME="$trial" npm install --prefix "$trial/published" rea-agents@6.5.0 env -i PATH="$node_bin:$PATH" HOME="$trial" CLI_ENTRY="$trial/published/node_modules/rea-agents/scripts/rea.mjs" node node_modules/vitest/vitest.mjs run --config parent-index-probe.config.mjs rm tests/parent-index-probe.test.ts parent-index-probe.config.mjs rm -r "$trial" ``` ### Expected behavior Normalized DOM structure should retain usable relationships and explicit uncertainty. An index outside the document cannot identify a parent in that document. Return explicit incomplete DOM coverage or a typed failure for this malformed evidence while preserving valid facts and their identities. This follows the documented normalized DOM/completeness contract and the repository guidance for unknown boundary values; it does not assume a conforming browser emits this reply. ### Impact and scope The observed impact is a false retained DOM relationship with no invalid-DOM exclusion, in two of two deliberately malformed replies per build. All four valid controls passed. Occurrence on conforming producers, normal-browser frequency, and downstream harm remain unknown. No real browser/application was launched or attached, and no target JavaScript or security-boundary behavior was exercised. - Impact level: P2 - Assessment status: supported - Impact basis: The successful CLI result presents an unresolvable relationship as retained DOM structure without reporting the invalid relationship as unknown or incomplete; this is a bounded evidence-correctness defect. - Workaround status: unverified - Workaround basis: Supplying a valid index is a control, not an established practical recovery for callers receiving malformed producer replies. ### REA version Fresh `main` build at `5b243993872c2bcc70cb00060ffb79b347321370` and a separate newly installed latest npm package `rea-agents@6.5.0`. Both CLIs reported `6.5.0`. ### Runtime and platform Node v24.18.0 and npm 11.16.0, matching the source toolchain pins; Darwin arm64; locked Vitest 5.0.3. Installation, build, test runner, and CLI calls used an isolated HOME. Each CLI call received only PATH, HOME, and NO_COLOR. ### Target and artifact context One disposable regular local HTML file and one selected page with three aligned nodes, empty attribute lists, and valid string-table references. Only the last `parentIndex` changes from `1` to `99999`. The stand-in speaks real loopback HTTP/WebSocket transport and closes after each call; each child HOME and HTML file is removed afterward. ### Interface CLI ### Earliest failure stage Capture or observation ### Relevant output or evidence - Expected source: `AGENTS.md:19,31` requires identity, omission, uncertainty, partial facts, and meaningful boundary failures to be preserved; `docs/electron-observation.md:57-59` describes normalized DOM structure and explicit completeness. - Failure source: The executed public CLI comparisons above; `src/browser/CdpElectronInspection.ts:353-372` projects the parent, `src/browser/CdpCaptureDocuments.ts:423-456,691-700` admits the aligned safe-integer arrays, and `src/domain/javascript/electronObservation.ts:88-100` accepts the projected integer without an upper bound. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete Each build produced both summaries twice. All eight CLI calls exited successfully with empty stderr. Each focused one-test run passed its reproduction assertions. ```json {"supplied_parent":1,"total_nodes":3,"retained_nodes":3,"emitted_parent":1,"invalid_dom_exclusions":[]} {"supplied_parent":99999,"total_nodes":3,"retained_nodes":3,"emitted_parent":99999,"invalid_dom_exclusions":[]} ``` The CLI call in every case was `node <entry> inspect-electron-page <loopback-endpoint> electron-page --observation-ms 0 --json`. MCP was not executed. These observations establish malformed-reply handling, not real-browser conformance or incidence. ### Typed outcome or recovery expected Repeat the same malformed and valid captures. Restoration requires that `99999` no longer appear as a valid retained relationship and that malformed DOM evidence produce explicit incomplete coverage or a typed failure. Preserve identities of any other retained facts. The valid controls must still retain three nodes with the last `parent_index` equal to `1` and no invalid-DOM exclusion. ### Analysis or suspected cause Source-derived reasoning: the shared parser preserves numeric-array positions and accepts the out-of-range value as a safe integer. The Electron projection adds that value to the document's retained base index. The output schema checks only the integer lower bound. The separate web DOM capture loop has an upper-bound check, but Electron does not use that loop. This fixture requires no array compaction. ### Additional context Related closed [#2553](https://github.com/morluto/rea/issues/2553) concerns malformed entries shifting facts between nodes. Its identified [fix](https://github.com/morluto/rea/commit/bffdd91053fb5d076b762cf1b325e8dcb5ab2d8c) adds DOM bounds checks in web capture; its Electron change concerns frame admission. Closed [#3379](https://github.com/morluto/rea/issues/3379), delivered by merged [#3901](https://github.com/morluto/rea/pull/3901), concerns missing or malformed collection arrays and adds shared array admission. The aligned safe integer used here survives that admission. Inspected closed, unmerged [#3125](https://github.com/morluto/rea/pull/3125) and open [#4040](https://github.com/morluto/rea/pull/4040) concern capture uncertainty/frame ancestry and capture fidelity/frame generations respectively; neither changes this Electron DOM parent projection. A fresh all-state issue and PR search found no exact report or proposed fix for this retained out-of-range integer.

bsakaguchi commented

2026-10-17 21:05:03 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Published 70de70210 on main.

Root cause: Electron independently coerced missing/bad string and numeric fields to empty strings, zero or root parents, and did not check retained parent applicability. Its retained-node counter would also renumber later documents after omissions.

Structural fix: one snapshot owner decodes aligned columns, names, values, attributes and parent facts. It rejects out-of-range, self and cyclic parent facts, preserves source positions and independently unknown fields, and returns tagged row-admission results. Web/Electron consume those facts; SVG namespace interpretation consumes decoded names/attributes rather than reparsing string indexes. Removed superseded array, integer, string, attribute-resolution and duplicate-name helpers. Electron document offsets now count source slots, so omitted rows cannot change later identities. Valid empty-value sentinels, UTF-8 byte lengths, caller scope and other retained facts are preserved. Invalid required rows are omitted with explicit completeness coverage.

Executed validation: baseline compiled public CLI matrix had 4 failures / 1 valid control passing (out-of-range parent, self-parent, cycle, unresolved name before a second document). Final focused run: 103 checks across five files, including 15 owner controls, 56 URL/SVG controls and 5 compiled public CLI controls. The existing namespace capacity control completed in under a second. Final built CLI controls passed again, and all 5 passed after rebase. Late cancellation during final detach retained the completed observation (1 passed /20 skipped). check:fast, docs:check (5 checks), commit and push hooks passed. Initial fixture setup/table-parameter mistakes were corrected before the cited baseline/final results.

Research: Context7 DOMSnapshot guidance checked against the protocol definition: node fields are parallel arrays, parents refer to node positions, names/values refer to the shared string table, and attributes are flattened name/value references. Earlier DeepWiki research lacked detailed DOMSnapshot context; it was not used to infer extra protocol guarantees. Forward acyclic relationships remain accepted; no undocumented preorder constraint or count cap was added.

Controlled cost scope: completed production web DOM projection of 303 valid nodes; baseline79d2b7189, candidate before rebase. All six complete replies byte-identical, 9118 raw cl100k tokens each.

Phase/build	Elapsed s	CPU s	Sampled process-family peak RSS bytes
First/baseline	0.060510	0.047645	57737216
First/candidate	0.056841	0.044860	57933824
Warm median/baseline	0.058526	0.048821	57163776
Warm median/candidate	0.061026	0.050622	57319424

First processes separate from two alternating warm repeats; no true cold-cache or performance improvement claim. wait4 CPU and sampled PPID-family RSS can miss transients. Full Electron/public CLI/MCP/agent schema-retry, attribute-heavy and large-snapshot costs unmeasured. Decoded facts are retained per document; no universal memory reduction claim. Heavy AST/profiling work stayed stopped.

Scope: fake loopback CDP producers and generated local files with real compiled CLI/transport; no real Chromium/Electron, Windows or malformed-reply MCP qualification. Rebase included independent script-resource reconciliation, ADB, JavaScript and native plist work; affected DOM source/test hashes unchanged. Owned comparison worktree verified clean/inactive and removed normally.

Remaining audit: other CDP collection/scalar policies and broader provider/session lifecycles are not established by these checks. Existing XML/HTML document-kind inference and live namespace behavior retain their prior qualification limits; this change does not claim complete protocol conformance.

@morluto commented on GitHub (Oct 17, 2026): Published `70de70210` on main. Root cause: Electron independently coerced missing/bad string and numeric fields to empty strings, zero or root parents, and did not check retained parent applicability. Its retained-node counter would also renumber later documents after omissions. Structural fix: one snapshot owner decodes aligned columns, names, values, attributes and parent facts. It rejects out-of-range, self and cyclic parent facts, preserves source positions and independently unknown fields, and returns tagged row-admission results. Web/Electron consume those facts; SVG namespace interpretation consumes decoded names/attributes rather than reparsing string indexes. Removed superseded array, integer, string, attribute-resolution and duplicate-name helpers. Electron document offsets now count source slots, so omitted rows cannot change later identities. Valid empty-value sentinels, UTF-8 byte lengths, caller scope and other retained facts are preserved. Invalid required rows are omitted with explicit completeness coverage. Executed validation: baseline compiled public CLI matrix had 4 failures / 1 valid control passing (out-of-range parent, self-parent, cycle, unresolved name before a second document). Final focused run: 103 checks across five files, including 15 owner controls, 56 URL/SVG controls and 5 compiled public CLI controls. The existing namespace capacity control completed in under a second. Final built CLI controls passed again, and all 5 passed after rebase. Late cancellation during final detach retained the completed observation (1 passed /20 skipped). check:fast, docs:check (5 checks), commit and push hooks passed. Initial fixture setup/table-parameter mistakes were corrected before the cited baseline/final results. Research: Context7 DOMSnapshot guidance checked against [the protocol definition](https://github.com/ChromeDevTools/devtools-protocol/blob/master/pdl/domains/DOMSnapshot.pdl): node fields are parallel arrays, parents refer to node positions, names/values refer to the shared string table, and attributes are flattened name/value references. Earlier DeepWiki research lacked detailed DOMSnapshot context; it was not used to infer extra protocol guarantees. Forward acyclic relationships remain accepted; no undocumented preorder constraint or count cap was added. Controlled cost scope: completed production web DOM projection of 303 valid nodes; baseline79d2b7189, candidate before rebase. All six complete replies byte-identical, 9118 raw cl100k tokens each. | Phase/build | Elapsed s | CPU s | Sampled process-family peak RSS bytes | | --- | ---: | ---: | ---: | | First/baseline | 0.060510 | 0.047645 | 57737216 | | First/candidate | 0.056841 | 0.044860 | 57933824 | | Warm median/baseline | 0.058526 | 0.048821 | 57163776 | | Warm median/candidate | 0.061026 | 0.050622 | 57319424 | First processes separate from two alternating warm repeats; no true cold-cache or performance improvement claim. wait4 CPU and sampled PPID-family RSS can miss transients. Full Electron/public CLI/MCP/agent schema-retry, attribute-heavy and large-snapshot costs unmeasured. Decoded facts are retained per document; no universal memory reduction claim. Heavy AST/profiling work stayed stopped. Scope: fake loopback CDP producers and generated local files with real compiled CLI/transport; no real Chromium/Electron, Windows or malformed-reply MCP qualification. Rebase included independent script-resource reconciliation, ADB, JavaScript and native plist work; affected DOM source/test hashes unchanged. Owned comparison worktree verified clean/inactive and removed normally. Remaining audit: other CDP collection/scalar policies and broader provider/session lifecycles are not established by these checks. Existing XML/HTML document-kind inference and live namespace behavior retain their prior qualification limits; this change does not claim complete protocol conformance.

bsakaguchi commented

2026-10-17 21:05:04 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 17, 2026):

Good structural fix — a single snapshot owner that decodes aligned columns and rejects out-of-range, self, and cyclic parent facts is much safer than each provider independently coercing bad fields. Two follow-ups worth considering: first, since Web and Electron now share admission, document the parent_index contract (0..count-1, plus a designated root sentinel) at the protocol definition so future providers know the boundary before writing a converter; second, add a regression that feeds the exact loopback reply with parent_index=99999 alongside a self-cycle and a renumbered-retained-node case, to pin the tagged row-admission behavior so the counter can never silently renumber later documents again.

@XinwangTao commented on GitHub (Oct 17, 2026): Good structural fix — a single snapshot owner that decodes aligned columns and rejects out-of-range, self, and cyclic parent facts is much safer than each provider independently coercing bad fields. Two follow-ups worth considering: first, since Web and Electron now share admission, document the `parent_index` contract (0..count-1, plus a designated root sentinel) at the protocol definition so future providers know the boundary before writing a converter; second, add a regression that feeds the exact loopback reply with `parent_index=99999` alongside a self-cycle and a renumbered-retained-node case, to pin the tagged row-admission behavior so the counter can never silently renumber later documents again.

bsakaguchi referenced this issue

2026-10-31 00:31:50 +00:00

[GH-ISSUE #4102] [Feature] Let inspect_go_binary / inspect_rust_binary select a slice of a universal Mach-O without lipo #1619

bsakaguchi closed this issue

2026-10-31 00:34:11 +00:00

bsakaguchi commented

2026-10-31 00:34:12 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 18, 2026):

Closing as addressed on main by 70de70210. The shared DOM snapshot admission now rejects out-of-range, self and cyclic parent facts, records invalid DOM completeness, and preserves source node identities across omissions and documents. I verified the committed source and regression coverage; I have not rerun the runtime reproduction.

@coygeek commented on GitHub (Oct 18, 2026): Closing as addressed on `main` by [70de70210](https://github.com/morluto/rea/commit/70de702109fd492306d35d70a920616256804885). The shared DOM snapshot admission now rejects out-of-range, self and cyclic parent facts, records invalid DOM completeness, and preserves source node identities across omissions and documents. I verified the committed source and regression coverage; I have not rerun the runtime reproduction.

bsakaguchi referenced this issue

2026-10-31 00:41:44 +00:00

[GH-ISSUE #5853] [Bug] Large JVM class files receive a FAT-specific target refusal #3548

bsakaguchi referenced this issue

2026-10-31 01:05:05 +00:00

[PR #2458] [MERGED] fix(go): classify JVM class files instead of universal Mach-O for CAFEBABE bytes #5241