morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5690] [Bug] Apktool version-output overflow is reported as an unusable launcher #3440

New issue

Closed

opened 2026-10-31 00:40:30 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:40:30 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5690

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Provider or capability discovery

Observed behavior

inspect-apktool-client --json reports an executable launcher as unable to report a usable version when its version output exceeds the capture allowance. The public error omits the exceeded allowance, selected command, and captured diagnostics. The caller cannot distinguish incomplete output capture from an unrecognized version or unavailable provider.

Reproduction

From the built source checkout with locked dependencies installed, run:

work_dir="$(mktemp -d)"
mkdir -p "$work_dir/bin" "$work_dir/home" "$work_dir/cfg" \
  "$work_dir/data" "$work_dir/cache" "$work_dir/state" "$work_dir/tmp"
cat > "$work_dir/bin/apktool" <<'EOF'
#!/bin/sh
printf '2.9.3\n'
head -c 100000 /dev/zero | tr '\0' 'W' >&2
EOF
chmod +x "$work_dir/bin/apktool"
run_rea() {
  env -i PATH="$work_dir/bin:$PATH" HOME="$work_dir/home" \
    XDG_CONFIG_HOME="$work_dir/cfg" XDG_DATA_HOME="$work_dir/data" \
    XDG_CACHE_HOME="$work_dir/cache" XDG_STATE_HOME="$work_dir/state" \
    TMPDIR="$work_dir/tmp" REA_LOG_LEVEL=silent \
    REA_APKTOOL_COMMAND="$1" \
    node scripts/rea.mjs inspect-apktool-client --json
}
"$work_dir/bin/apktool" --version > "$work_dir/version.txt" 2> "$work_dir/warnings.txt"
wc -c "$work_dir/version.txt" "$work_dir/warnings.txt"
run_rea "$work_dir/bin/apktool"
printf 'REA exit: %s\n' "$?"

The launcher itself exits 0, with 6 stdout bytes and 100,000 stderr bytes. REA exits 1 with the error below. Then run this control, which suppresses that same launcher's stderr:

cat > "$work_dir/bin/apktool-quiet" <<'EOF'
#!/bin/sh
exec "$(dirname "$0")/apktool" "$@" 2>/dev/null
EOF
chmod +x "$work_dir/bin/apktool-quiet"
run_rea "$work_dir/bin/apktool-quiet"
printf 'REA control exit: %s\n' "$?"

The control exits 0 and returns normalized_result.client.apktool_version: "2.9.3". An independent verifier replayed these commands, and the submitter replayed them once more with the same failure and control success. The fixture needs no real Apktool or Java.

Expected behavior

Keep the resource bound, but report that version-output capture exceeded its allowance, including the 65,536-byte bound, selected launcher, and relevant bounded diagnostics. A valid version prefix does not require accepting incomplete output.

The source contract in AGENTS.md (Architecture and Cleanup) requires meaningful failure reasons and partial facts to survive boundaries; docs/tool-design.md:67-69 requires resource limits and partial failures to be reported. src/adb/AdbConfiguration.ts:144-157 already represents version-output overflow as a resource constraint.

Impact and scope

P2, supported: oversized version output receives a provider-unavailable result without the capture-limit cause needed for diagnosis and recovery. The stderr-suppressing wrapper is a verified workaround for this fixture. Real-launcher frequency is unknown. No data loss, process leak, or security-boundary crossing was observed. Real Apktool/JVM, APK decoding, MCP, and other platforms were not exercised; decode admission through the same probe is source-derived.

REA version

rea-agents 6.7.0, source commit 9d8e7803326a382cbbb3ffdb900f5e93e5442d68. Fetched and rechecked origin/main at 7dd6941393c852a3324cf01c2bd79a9dcff43728: no commits or content differences in the cited contract and failure-source files since the tested baseline. Runtime replay was at the baseline; current main was not separately built or executed. Latest published release is rea-agents-6.7.0.

Runtime and platform

Node.js v26.12.0; macOS 27.0.1; arm64. Source checkout with locked dependencies and built CLI.

Target and artifact context

Synthetic executable shell launcher selected by absolute REA_APKTOOL_COMMAND, isolated HOME/XDG/temporary directories, and no APK or analysis target.

Interface

CLI

Earliest failure stage

Setup or provider admission

Relevant output or evidence

The noisy-launcher invocation exits 1 and returns:

{"code":"capability_unavailable","category":"unsupported_provider","message":"The selected apktool launcher did not report a usable version.","retryable":false,"remediation":{"action":"The selected apktool launcher did not report a usable version."},"details":{"provider_id":"apktool","operation":"inspect_apktool_client","reason":"The selected apktool launcher did not report a usable version."}}

The public details contain no selected command, byte allowance, or indication that capture was incomplete. Evidence provenance: observed CLI failure and successful control; the conversion explanation below is source-derived.

Typed outcome or recovery expected

Return resource_constraint with the exceeded version-output allowance, byte bound, selected command, and relevant bounded diagnostics. Recovery should explain the fixed capture allowance rather than invite an unchanged retry or unrelated configuration repair. Preserve the output bound and successful quiet control. No restoration has been tested.

Analysis or suspected cause

Source-derived: src/apktool/ApktoolConfiguration.ts:38 sets VERSION_MAX_OUTPUT_BYTES to 65,536. Its versionProbeFailure path at lines 521-549 converts OwnedCommandFailure with reason output-limit into version_unresolved, retaining selected_command and max_output_bytes internally. src/apktool/ApktoolProvider.ts:427-432 then calls src/domain/providerConfigurationRefusal.ts:12-20, which preserves only the message and optional remediation string in the public capability refusal. This agrees with the observed output.

Additional context

Prepared with AI assistance and independently verified. No known-good version or introducing commit was established.

Related reports cover different contracts: #5177 / PR #5180 concern non-executable launchers; #3347 concerns probe deadlines; #3337 concerns decode cleanup after overflow/cancellation. This version-output classification still reproduces after PR #3808, which fixed those deadline/cleanup reports and explicitly mapped output-limit failures to version_unresolved. This report does not assert a cleanup leak.

#5631 / merged PR #5633 change recovery text for already-typed resource constraints, including decode output; the Apktool version probe remains a capability refusal. #1952 concerns ADB configuration projection, and #5401 concerns objdump target acquisition rather than this executable launcher's capture limit.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5690 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Provider or capability discovery ### Observed behavior `inspect-apktool-client --json` reports an executable launcher as unable to report a usable version when its version output exceeds the capture allowance. The public error omits the exceeded allowance, selected command, and captured diagnostics. The caller cannot distinguish incomplete output capture from an unrecognized version or unavailable provider. ### Reproduction From the built source checkout with locked dependencies installed, run: ```sh work_dir="$(mktemp -d)" mkdir -p "$work_dir/bin" "$work_dir/home" "$work_dir/cfg" \ "$work_dir/data" "$work_dir/cache" "$work_dir/state" "$work_dir/tmp" cat > "$work_dir/bin/apktool" <<'EOF' #!/bin/sh printf '2.9.3\n' head -c 100000 /dev/zero | tr '\0' 'W' >&2 EOF chmod +x "$work_dir/bin/apktool" run_rea() { env -i PATH="$work_dir/bin:$PATH" HOME="$work_dir/home" \ XDG_CONFIG_HOME="$work_dir/cfg" XDG_DATA_HOME="$work_dir/data" \ XDG_CACHE_HOME="$work_dir/cache" XDG_STATE_HOME="$work_dir/state" \ TMPDIR="$work_dir/tmp" REA_LOG_LEVEL=silent \ REA_APKTOOL_COMMAND="$1" \ node scripts/rea.mjs inspect-apktool-client --json } "$work_dir/bin/apktool" --version > "$work_dir/version.txt" 2> "$work_dir/warnings.txt" wc -c "$work_dir/version.txt" "$work_dir/warnings.txt" run_rea "$work_dir/bin/apktool" printf 'REA exit: %s\n' "$?" ``` The launcher itself exits 0, with 6 stdout bytes and 100,000 stderr bytes. REA exits 1 with the error below. Then run this control, which suppresses that same launcher's stderr: ```sh cat > "$work_dir/bin/apktool-quiet" <<'EOF' #!/bin/sh exec "$(dirname "$0")/apktool" "$@" 2>/dev/null EOF chmod +x "$work_dir/bin/apktool-quiet" run_rea "$work_dir/bin/apktool-quiet" printf 'REA control exit: %s\n' "$?" ``` The control exits 0 and returns `normalized_result.client.apktool_version: "2.9.3"`. An independent verifier replayed these commands, and the submitter replayed them once more with the same failure and control success. The fixture needs no real Apktool or Java. ### Expected behavior Keep the resource bound, but report that version-output capture exceeded its allowance, including the 65,536-byte bound, selected launcher, and relevant bounded diagnostics. A valid version prefix does not require accepting incomplete output. The source contract in `AGENTS.md` (Architecture and Cleanup) requires meaningful failure reasons and partial facts to survive boundaries; `docs/tool-design.md:67-69` requires resource limits and partial failures to be reported. `src/adb/AdbConfiguration.ts:144-157` already represents version-output overflow as a resource constraint. ### Impact and scope P2, supported: oversized version output receives a provider-unavailable result without the capture-limit cause needed for diagnosis and recovery. The stderr-suppressing wrapper is a verified workaround for this fixture. Real-launcher frequency is unknown. No data loss, process leak, or security-boundary crossing was observed. Real Apktool/JVM, APK decoding, MCP, and other platforms were not exercised; decode admission through the same probe is source-derived. ### REA version `rea-agents` 6.7.0, source commit `9d8e7803326a382cbbb3ffdb900f5e93e5442d68`. Fetched and rechecked `origin/main` at `7dd6941393c852a3324cf01c2bd79a9dcff43728`: no commits or content differences in the cited contract and failure-source files since the tested baseline. Runtime replay was at the baseline; current main was not separately built or executed. Latest published release is `rea-agents-6.7.0`. ### Runtime and platform Node.js v26.12.0; macOS 27.0.1; arm64. Source checkout with locked dependencies and built CLI. ### Target and artifact context Synthetic executable shell launcher selected by absolute `REA_APKTOOL_COMMAND`, isolated HOME/XDG/temporary directories, and no APK or analysis target. ### Interface CLI ### Earliest failure stage Setup or provider admission ### Relevant output or evidence The noisy-launcher invocation exits 1 and returns: ```json {"code":"capability_unavailable","category":"unsupported_provider","message":"The selected apktool launcher did not report a usable version.","retryable":false,"remediation":{"action":"The selected apktool launcher did not report a usable version."},"details":{"provider_id":"apktool","operation":"inspect_apktool_client","reason":"The selected apktool launcher did not report a usable version."}} ``` The public details contain no selected command, byte allowance, or indication that capture was incomplete. Evidence provenance: observed CLI failure and successful control; the conversion explanation below is source-derived. ### Typed outcome or recovery expected Return `resource_constraint` with the exceeded version-output allowance, byte bound, selected command, and relevant bounded diagnostics. Recovery should explain the fixed capture allowance rather than invite an unchanged retry or unrelated configuration repair. Preserve the output bound and successful quiet control. No restoration has been tested. ### Analysis or suspected cause Source-derived: `src/apktool/ApktoolConfiguration.ts:38` sets `VERSION_MAX_OUTPUT_BYTES` to 65,536. Its `versionProbeFailure` path at lines 521-549 converts `OwnedCommandFailure` with reason `output-limit` into `version_unresolved`, retaining `selected_command` and `max_output_bytes` internally. `src/apktool/ApktoolProvider.ts:427-432` then calls `src/domain/providerConfigurationRefusal.ts:12-20`, which preserves only the message and optional remediation string in the public capability refusal. This agrees with the observed output. ### Additional context Prepared with AI assistance and independently verified. No known-good version or introducing commit was established. Related reports cover different contracts: #5177 / PR #5180 concern non-executable launchers; #3347 concerns probe deadlines; #3337 concerns decode cleanup after overflow/cancellation. This version-output classification still reproduces after PR #3808, which fixed those deadline/cleanup reports and explicitly mapped output-limit failures to `version_unresolved`. This report does not assert a cleanup leak. #5631 / merged PR #5633 change recovery text for already-typed resource constraints, including decode output; the Apktool version probe remains a capability refusal. #1952 concerns ADB configuration projection, and #5401 concerns objdump target acquisition rather than this executable launcher's capture limit.

bsakaguchi closed this issue

2026-10-31 00:40:30 +00:00

bsakaguchi commented

2026-10-31 00:40:31 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 20, 2026):

Cross-referencing with canonical issue #3369 (ADB push reports checksum capture overflow as device unavailability) and sibling Android reports #5093, #5190, #5689.

Consolidated under Cluster AH (Android ADB Automation & Activity Execution Boundaries) in tracker #4330.

@matbrgz commented on GitHub (Oct 20, 2026): Cross-referencing with canonical issue #3369 (`ADB push reports checksum capture overflow as device unavailability`) and sibling Android reports #5093, #5190, #5689. Consolidated under **Cluster AH (Android ADB Automation & Activity Execution Boundaries)** in tracker #4330.

bsakaguchi commented

2026-10-31 00:40:31 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

Apktool version admission recognizes OwnedCommandFailure output-limit before generic version_unresolved. It emits resource_constraint with max_output_bytes, selected command/source, retained output when available, and fixed capture-budget guidance. The regression injects output-limit and asserts the resource classification and selected launcher.

Implementation: ApktoolConfiguration.ts, ApktoolVersionProbe.test.ts.

The relevant regression checks in ApktoolVersionProbe.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. Apktool version admission recognizes OwnedCommandFailure output-limit before generic version_unresolved. It emits resource_constraint with max_output_bytes, selected command/source, retained output when available, and fixed capture-budget guidance. The regression injects output-limit and asserts the resource classification and selected launcher. Implementation: [ApktoolConfiguration.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/apktool/ApktoolConfiguration.ts#L545), [ApktoolVersionProbe.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/apktool/ApktoolVersionProbe.test.ts#L216). The relevant regression checks in [ApktoolVersionProbe.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/apktool/ApktoolVersionProbe.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 01:09:06 +00:00

[PR #3440] [CLOSED] fix(security): pin CI actions, protect Hopper xauth and downloads, flag old apktool #5743

bsakaguchi referenced this issue

2026-10-31 01:12:01 +00:00

[PR #4199] [MERGED] ci: pin Cutter actions and guard workflow-only changes #6121

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425