morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5190] fix(scripts): ADB verifier leaves its pushed probe file on the device #3185

New issue

Closed

opened 2026-10-31 00:37:37 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:37:37 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 19, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5190

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Other: ADB developer verification

Observed behavior

The documented ADB verifier promises to remove its own device-side transfer probe, but the successful push/pull path never deletes it. The verifier can report all adb device checks passed while leaving its 30-byte probe in /data/local/tmp. Later runs with different timestamp-derived names leave additional files. This is a source-confirmed cleanup defect; no real device or emulator was used for runtime reproduction.

The verifier writes the fixed payload rea adb transfer verification\n, selects /data/local/tmp/rea-verify-${Date.now()}.txt, pushes with overwrite: false, checks its device digest, and pulls it back. Its two transfer-related finally blocks remove only host temporary directories. The final provider shutdown does not own the pushed device destination, so it cannot remove that file. There is no device-file removal call elsewhere in the verifier.

This is conclusive source reasoning for a successful transfer followed by successful checks and shutdown. Runtime reproduction against the real provider or a device was not run. Only the small probe's retention is established; device quota exhaustion or other consequential storage effects were not observed.

Reproduction

The following real-device invocation is source-derived and was not executed. The complete source proof is under Evidence.

In a source checkout, use the pinned development toolchain and locked dependencies. Supply a functioning caller-selected adb client and one connected usable device or emulator with a writable /data/local/tmp. The generated probe destination must initially be absent.
Run npm run verify:adb -- --serial SERIAL, using the attached device's actual serial. No --install-apk or --pull option is needed to reach the transfer phase. Assume the ordinary observation checks and transfer digest checks succeed.
After the verifier reports success, inspect the exact rea-verify-<timestamp>.txt destination created by its transfer phase. The implementation leaves that file on the device. A later successful run with a different generated timestamp leaves another destination.

The verifier and production provider were traced independently through request validation, dispatch, transfer, and shutdown in all source baselines below. This establishes the omission without claiming a device run or a measured population failure rate.

Expected behavior

A completed verifier run removes the device copy that it created for its push/pull roundtrip, as its transfer-phase comment explicitly promises. That cleanup belongs to the verifier: ordinary pull_adb_file is a copy operation and deliberately retains the device original.

Impact and scope

Each established leftover is a 30-byte verifier-owned probe. Runs with distinct generated timestamps leave distinct files. No consequential storage incident, incorrect analysis output, or blocked primary workflow was observed.

REA version

Hunt source: 9aca543f46085f502dbc5445002e129e5d2974e9.
Current main source: 2e5171e391b83f8a467d0861fd452c1f78621fd8, confirmed against the remote branch.
Latest published release: rea-agents-6.7.0, revision 27dc42d10249f0410904a75c0997842eb03b931c, confirmed with GitHub release metadata and the remote tag.

Runtime and platform

Production-provider verification is source-derived. No adb client version, Android device or emulator runtime was tested. Supplemental isolated verifier simulations used checksum-verified Node v24.18.0 on macOS arm64 with a fake service/provider.

Target and artifact context

The documented ADB developer verifier and its own generated transfer probe under the public Android temporary-file directory. No real device or private target data was used.

Interface

Other: documented developer verifier CLI

Earliest failure stage

Cleanup, cancellation, or lifecycle

Relevant output or evidence

Expected source: The documented verifier entry point establishes the supported command. The transfer block and its cleanup promise identify the verifier-owned device file and intended cleanup.
Failure source: The verifier finalization and success result, together with the production provider paths below, prove that successful completion does not remove the pushed device file.
Evidence provenance: static
Local verification: static-proof
Reproduction completeness: complete

The verifier and production provider source were independently inspected in each stated baseline. Runtime reproduction against adb or a device was not run. The generated absolute path, regular host payload, and overwrite: false pass the transfer schemas for a usable serial and absent destination. With successful transfers and checks, the reachable success path has no remote deletion.

The push implementation performs adb push and device sha256sum, then releases its host snapshot resources. It does not register the device destination for cleanup. The pull implementation performs adb pull, hashes the host copy, and explicitly reports that the device retains the original. The provider close implementation drains host resource scopes and retained host output-directory cleanup, with no device destination owner.

Supplemental isolated simulations ran the unmodified verifier against a fake service/provider on each source baseline. Six successful attempts reported passing checks and retained the simulated probe; three injected provider-close failures correctly failed. No adb client, device or emulator was contacted. This distinguishes the omitted device-file cleanup from the provider-shutdown reporting defect fixed under issue #4260.

Restoration check

After a successful verifier-owned push/pull roundtrip, the exact device file created by that run must be absent before the verifier reports passing completion. Two runs with different generated paths must leave no probe accumulation. Keep the transfer digest assertions and the ordinary pull operation's retention of caller-owned originals. A cleanup failure must remain visible instead of producing an unqualified success result. No restored implementation has been tested.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: The established defect leaves a 30-byte verifier-owned artifact after a successful run, with accumulation when subsequent runs use distinct names. No consequential storage incident, incorrect analysis result, or blocked primary workflow is established.
Workaround status: unverified
Workaround basis: Removal of the exact verifier-created device file may avoid the leftover, but no real-device cleanup procedure or ownership check was exercised. No wildcard removal is asserted safe.

Originally created by @coygeek on GitHub (Oct 19, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5190 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Other: ADB developer verification ## Observed behavior The documented ADB verifier promises to remove its own device-side transfer probe, but the successful push/pull path never deletes it. The verifier can report `all adb device checks passed` while leaving its 30-byte probe in `/data/local/tmp`. Later runs with different timestamp-derived names leave additional files. This is a source-confirmed cleanup defect; no real device or emulator was used for runtime reproduction. The verifier writes the fixed payload `rea adb transfer verification\n`, selects `/data/local/tmp/rea-verify-${Date.now()}.txt`, pushes with `overwrite: false`, checks its device digest, and pulls it back. Its two transfer-related `finally` blocks remove only host temporary directories. The final provider shutdown does not own the pushed device destination, so it cannot remove that file. There is no device-file removal call elsewhere in the verifier. This is conclusive source reasoning for a successful transfer followed by successful checks and shutdown. Runtime reproduction against the real provider or a device was not run. Only the small probe's retention is established; device quota exhaustion or other consequential storage effects were not observed. ## Reproduction The following real-device invocation is source-derived and was not executed. The complete source proof is under Evidence. 1. In a source checkout, use the pinned development toolchain and locked dependencies. Supply a functioning caller-selected adb client and one connected usable device or emulator with a writable `/data/local/tmp`. The generated probe destination must initially be absent. 2. Run `npm run verify:adb -- --serial SERIAL`, using the attached device's actual serial. No `--install-apk` or `--pull` option is needed to reach the transfer phase. Assume the ordinary observation checks and transfer digest checks succeed. 3. After the verifier reports success, inspect the exact `rea-verify-<timestamp>.txt` destination created by its transfer phase. The implementation leaves that file on the device. A later successful run with a different generated timestamp leaves another destination. The verifier and production provider were traced independently through request validation, dispatch, transfer, and shutdown in all source baselines below. This establishes the omission without claiming a device run or a measured population failure rate. ## Expected behavior A completed verifier run removes the device copy that it created for its push/pull roundtrip, as its transfer-phase comment explicitly promises. That cleanup belongs to the verifier: ordinary `pull_adb_file` is a copy operation and deliberately retains the device original. ## Impact and scope Each established leftover is a 30-byte verifier-owned probe. Runs with distinct generated timestamps leave distinct files. No consequential storage incident, incorrect analysis output, or blocked primary workflow was observed. ## REA version - Hunt source: `9aca543f46085f502dbc5445002e129e5d2974e9`. - Current `main` source: `2e5171e391b83f8a467d0861fd452c1f78621fd8`, confirmed against the remote branch. - Latest published release: `rea-agents-6.7.0`, revision `27dc42d10249f0410904a75c0997842eb03b931c`, confirmed with GitHub release metadata and the remote tag. ## Runtime and platform Production-provider verification is source-derived. No adb client version, Android device or emulator runtime was tested. Supplemental isolated verifier simulations used checksum-verified Node v24.18.0 on macOS arm64 with a fake service/provider. ## Target and artifact context The documented ADB developer verifier and its own generated transfer probe under the public Android temporary-file directory. No real device or private target data was used. ## Interface Other: documented developer verifier CLI ## Earliest failure stage Cleanup, cancellation, or lifecycle ## Relevant output or evidence - Expected source: The [documented verifier entry point](https://github.com/morluto/rea/blob/2e5171e391b83f8a467d0861fd452c1f78621fd8/docs/adb-device-analysis.md#L219-L227) establishes the supported command. The [transfer block and its cleanup promise](https://github.com/morluto/rea/blob/2e5171e391b83f8a467d0861fd452c1f78621fd8/scripts/verify-adb.mjs#L238-L271) identify the verifier-owned device file and intended cleanup. - Failure source: The [verifier finalization and success result](https://github.com/morluto/rea/blob/2e5171e391b83f8a467d0861fd452c1f78621fd8/scripts/verify-adb.mjs#L373-L403), together with the production provider paths below, prove that successful completion does not remove the pushed device file. - Evidence provenance: static - Local verification: static-proof - Reproduction completeness: complete The verifier and production provider source were independently inspected in each stated baseline. Runtime reproduction against adb or a device was not run. The generated absolute path, regular host payload, and `overwrite: false` pass the transfer schemas for a usable serial and absent destination. With successful transfers and checks, the reachable success path has no remote deletion. The [push implementation](https://github.com/morluto/rea/blob/2e5171e391b83f8a467d0861fd452c1f78621fd8/src/adb/AdbProvider.ts#L2375-L2537) performs `adb push` and device `sha256sum`, then releases its host snapshot resources. It does not register the device destination for cleanup. The [pull implementation](https://github.com/morluto/rea/blob/2e5171e391b83f8a467d0861fd452c1f78621fd8/src/adb/AdbProvider.ts#L2278-L2374) performs `adb pull`, hashes the host copy, and explicitly reports that the device retains the original. The [provider close implementation](https://github.com/morluto/rea/blob/2e5171e391b83f8a467d0861fd452c1f78621fd8/src/adb/AdbProvider.ts#L877-L939) drains host resource scopes and retained host output-directory cleanup, with no device destination owner. Supplemental isolated simulations ran the unmodified verifier against a fake service/provider on each source baseline. Six successful attempts reported passing checks and retained the simulated probe; three injected provider-close failures correctly failed. No adb client, device or emulator was contacted. This distinguishes the omitted device-file cleanup from the provider-shutdown reporting defect fixed under issue #4260. ## Restoration check After a successful verifier-owned push/pull roundtrip, the exact device file created by that run must be absent before the verifier reports passing completion. Two runs with different generated paths must leave no probe accumulation. Keep the transfer digest assertions and the ordinary pull operation's retention of caller-owned originals. A cleanup failure must remain visible instead of producing an unqualified success result. No restored implementation has been tested. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: The established defect leaves a 30-byte verifier-owned artifact after a successful run, with accumulation when subsequent runs use distinct names. No consequential storage incident, incorrect analysis result, or blocked primary workflow is established. - Workaround status: unverified - Workaround basis: Removal of the exact verifier-created device file may avoid the leftover, but no real-device cleanup procedure or ownership check was exercised. No wildcard removal is asserted safe.

bsakaguchi closed this issue

2026-10-31 00:37:37 +00:00

bsakaguchi commented

2026-10-31 00:37:38 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 19, 2026):

Confirmed by the source trace — the verifier owns the probe it created but no path removes it, so successful runs accumulate distinct timestamped files. Agree with the fix shape: delete the exact verifier-created destination on the success path (no wildcard removal), keep pull_adb_file's deliberate retention of caller-owned originals, and let a cleanup failure surface as a failure instead of an unqualified success. Good that the isolated simulations separate this from the #4260 shutdown-reporting defect.

@XinwangTao commented on GitHub (Oct 19, 2026): Confirmed by the source trace — the verifier owns the probe it created but no path removes it, so successful runs accumulate distinct timestamped files. Agree with the fix shape: delete the exact verifier-created destination on the success path (no wildcard removal), keep pull_adb_file's deliberate retention of caller-owned originals, and let a cleanup failure surface as a failure instead of an unqualified success. Good that the isolated simulations separate this from the #4260 shutdown-reporting defect.

bsakaguchi referenced this issue

2026-10-31 00:38:52 +00:00

[GH-ISSUE #5434] [Bug] Missing working directory leaves native observation cleanup stuck until MCP restart #3293

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3185

No description provided.

Rows
Columns