morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5437] [Bug] Malformed attachment state hides all Inspector targets and blocks sibling observation #3299

New issue

Closed

opened 2026-10-31 00:38:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:38:55 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5437

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

One ordinary Node Inspector discovery row with attached: "unknown" makes list-javascript-runtime-targets fail for the entire endpoint. Observing an unaffected sibling by its exact ID also fails during discovery, before any WebSocket opens. Both CLI calls exit 1 with code: "unreadable_output" and details.reason: "invalid_endpoint_response".

Reproduction

An independent verifier ran a local HTTP/WebSocket fixture against the built CLI. The embedded reproduction was also replayed separately with the same results.

Serve /json/version as {"Browser":"node.js/v24.4.1","Protocol-Version":"1.3"} and /json/list as the following array, substituting the fixture's loopback port for PORT:

[
  {"id":"target-a","type":"node","url":"https://app.example/entry.js","attached":"unknown","webSocketDebuggerUrl":"ws://127.0.0.1:PORT/target-a"},
  {"id":"target-b","type":"node","url":"https://app.example/other.js","webSocketDebuggerUrl":"ws://127.0.0.1:PORT/target-b"}
]

From the built checkout, run these commands against that endpoint. Each verifier child used isolated HOME/XDG directories. The fixture acknowledged Inspector commands with {"id":<request id>,"result":{}}.

node scripts/rea.mjs list-javascript-runtime-targets http://127.0.0.1:PORT --json
node scripts/rea.mjs observe-javascript-runtime http://127.0.0.1:PORT target-b --runtime-kind node --observation-ms 0 --json

Both fail as above. Change only target-a.attached to null and repeat: listing returns both targets with attached: null, and observation of target-b succeeds, sending only Runtime.enable and Debugger.enable.

Expected behavior

Keep both eligible targets in the inventory and represent the unreportable attachment state as null; permit observation of target-b. At the tested revision, docs/javascript-runtime-observation.md:45-52 says booleans are reported only when discovery supplied a boolean, null represents omitted/unreportable state, and listing returns every available target inline. src/contracts/javascript/javascriptRuntimeObservationToolContracts.ts:16-20 promises every eligible target without attaching during listing. The separate requirement for a boolean on CDP worker-event records does not apply to these ordinary Node /json/list rows. Preserve rejection of explicitly attached targets.

Impact and scope

P2: one malformed optional field blocks inventory and observation of otherwise usable siblings at that endpoint. The malformed case failed in both the independent replay and the separate embedded-script replay. A caller controlling discovery can replace the value with null or omit it; both restored listing, and null restored sibling observation. No real Node/Electron producer emitting this string, production frequency, or broader runtime coverage was established. All target locations were synthetic metadata; no external service was contacted.

REA version

rea-agents 6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8.

Runtime and platform

Node.js v26.12.0 on macOS. Architecture: NOT_ENOUGH_INFO — the verifier did not record it. No Hopper/Ghidra provider was involved.

Target and artifact context

Caller-selected literal-loopback Inspector HTTP/WebSocket fixture with two synthetic ordinary Node targets. No real application or external service was exercised.

Interface

CLI

Earliest failure stage

Capture or observation

Relevant output or evidence

The verifier's recorded CLI results, reduced to the discriminating fields:

attached="unknown": list -> exit 1, unreadable_output / invalid_endpoint_response
attached="unknown": observe target-b -> exit 1, unreadable_output / invalid_endpoint_response; no WebSocket
attached=null:      list -> exit 0, target-a and target-b, both attached=null
attached=null:      observe target-b -> exit 0, only /target-b connected
attached=true:      list -> exit 0, both targets; target-a attached=true
attached=true:      observe target-a -> exit 1, target_unavailable / target_not_allowed; no WebSocket

Omitted and false attachment controls also listed both targets successfully. The verifier awaited all CLI children and closed the fixture servers.

Typed outcome or recovery expected

Successful inventory with both targets and nullable attachment state, followed by successful observation of target-b, as in the null control. Explicit attached: true must remain visible in listing and reject observation before opening a WebSocket.

Analysis or suspected cause

Source-derived: src/inspector/V8InspectorEndpoint.ts:20-32,53-69 validates the whole discovery array with attached: z.boolean().nullable().optional(), rejecting the string before target selection. src/inspector/V8InspectorProvider.ts:209-219,340-350 discovers before listing or exact-ID observation. src/browser/CdpEndpoint.ts:344-354 creates invalid_endpoint_response; src/domain/analysisErrorProjection.ts:158 maps it to unreadable_output. No post-baseline commits changed these cited files in the upstream check.

Additional context

Related but distinct: #2537 addressed missing debugger sockets, and its maintainer closure describes socket admission only. This fixture supplies valid same-port sockets for both targets and instead exercises nullable attachment metadata. No matching attachment-state issue or PR was found in searches across open and closed reports.

Prepared with AI assistance and independently reproduced by a separate verifier. NOT_ENOUGH_INFO: last known good version and real-world occurrence are unknown; the report is limited to the synthetic endpoint behavior above.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5437 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Process capture or runtime observation ### Observed behavior One ordinary Node Inspector discovery row with `attached: "unknown"` makes `list-javascript-runtime-targets` fail for the entire endpoint. Observing an unaffected sibling by its exact ID also fails during discovery, before any WebSocket opens. Both CLI calls exit 1 with `code: "unreadable_output"` and `details.reason: "invalid_endpoint_response"`. ### Reproduction An independent verifier ran a local HTTP/WebSocket fixture against the built CLI. The embedded reproduction was also replayed separately with the same results. 1. Serve `/json/version` as `{"Browser":"node.js/v24.4.1","Protocol-Version":"1.3"}` and `/json/list` as the following array, substituting the fixture's loopback port for `PORT`: ```json [ {"id":"target-a","type":"node","url":"https://app.example/entry.js","attached":"unknown","webSocketDebuggerUrl":"ws://127.0.0.1:PORT/target-a"}, {"id":"target-b","type":"node","url":"https://app.example/other.js","webSocketDebuggerUrl":"ws://127.0.0.1:PORT/target-b"} ] ``` 2. From the built checkout, run these commands against that endpoint. Each verifier child used isolated HOME/XDG directories. The fixture acknowledged Inspector commands with `{"id":<request id>,"result":{}}`. ```sh node scripts/rea.mjs list-javascript-runtime-targets http://127.0.0.1:PORT --json node scripts/rea.mjs observe-javascript-runtime http://127.0.0.1:PORT target-b --runtime-kind node --observation-ms 0 --json ``` 3. Both fail as above. Change only `target-a.attached` to `null` and repeat: listing returns both targets with `attached: null`, and observation of `target-b` succeeds, sending only `Runtime.enable` and `Debugger.enable`. ### Expected behavior Keep both eligible targets in the inventory and represent the unreportable attachment state as `null`; permit observation of `target-b`. At the tested revision, `docs/javascript-runtime-observation.md:45-52` says booleans are reported only when discovery supplied a boolean, `null` represents omitted/unreportable state, and listing returns every available target inline. `src/contracts/javascript/javascriptRuntimeObservationToolContracts.ts:16-20` promises every eligible target without attaching during listing. The separate requirement for a boolean on CDP worker-event records does not apply to these ordinary Node `/json/list` rows. Preserve rejection of explicitly attached targets. ### Impact and scope P2: one malformed optional field blocks inventory and observation of otherwise usable siblings at that endpoint. The malformed case failed in both the independent replay and the separate embedded-script replay. A caller controlling discovery can replace the value with `null` or omit it; both restored listing, and `null` restored sibling observation. No real Node/Electron producer emitting this string, production frequency, or broader runtime coverage was established. All target locations were synthetic metadata; no external service was contacted. ### REA version rea-agents 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. ### Runtime and platform Node.js v26.12.0 on macOS. Architecture: NOT_ENOUGH_INFO — the verifier did not record it. No Hopper/Ghidra provider was involved. ### Target and artifact context Caller-selected literal-loopback Inspector HTTP/WebSocket fixture with two synthetic ordinary Node targets. No real application or external service was exercised. ### Interface CLI ### Earliest failure stage Capture or observation ### Relevant output or evidence The verifier's recorded CLI results, reduced to the discriminating fields: ```text attached="unknown": list -> exit 1, unreadable_output / invalid_endpoint_response attached="unknown": observe target-b -> exit 1, unreadable_output / invalid_endpoint_response; no WebSocket attached=null: list -> exit 0, target-a and target-b, both attached=null attached=null: observe target-b -> exit 0, only /target-b connected attached=true: list -> exit 0, both targets; target-a attached=true attached=true: observe target-a -> exit 1, target_unavailable / target_not_allowed; no WebSocket ``` Omitted and `false` attachment controls also listed both targets successfully. The verifier awaited all CLI children and closed the fixture servers. ### Typed outcome or recovery expected Successful inventory with both targets and nullable attachment state, followed by successful observation of `target-b`, as in the null control. Explicit `attached: true` must remain visible in listing and reject observation before opening a WebSocket. ### Analysis or suspected cause Source-derived: `src/inspector/V8InspectorEndpoint.ts:20-32,53-69` validates the whole discovery array with `attached: z.boolean().nullable().optional()`, rejecting the string before target selection. `src/inspector/V8InspectorProvider.ts:209-219,340-350` discovers before listing or exact-ID observation. `src/browser/CdpEndpoint.ts:344-354` creates `invalid_endpoint_response`; `src/domain/analysisErrorProjection.ts:158` maps it to `unreadable_output`. No post-baseline commits changed these cited files in the upstream check. ### Additional context Related but distinct: #2537 addressed missing debugger sockets, and its maintainer closure describes socket admission only. This fixture supplies valid same-port sockets for both targets and instead exercises nullable attachment metadata. No matching attachment-state issue or PR was found in searches across open and closed reports. Prepared with AI assistance and independently reproduced by a separate verifier. NOT_ENOUGH_INFO: last known good version and real-world occurrence are unknown; the report is limited to the synthetic endpoint behavior above.

bsakaguchi closed this issue

2026-10-31 00:38:55 +00:00

bsakaguchi referenced this issue

2026-10-31 01:08:51 +00:00

[PR #3299] [MERGED] test(ci): correct Rizin readiness and Hopper launcher fixtures #5711

bsakaguchi referenced this issue

2026-10-31 01:08:51 +00:00

[PR #3304] [CLOSED] test(setup): use verified commands in positive uninstall fixtures #5714

bsakaguchi referenced this issue

2026-10-31 01:08:56 +00:00

[PR #3394] [CLOSED] test(javascript): assert wrapper ownership in the correct source mode #5721

bsakaguchi referenced this issue