morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5917] [Bug] Electron target-list Evidence omits the observed browser environment #3594

New issue

Closed

opened 2026-10-31 00:42:12 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:42:12 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5917

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

list-electron-targets returns successful Evidence with environment: null and omits the limitation Browser host platform and architecture were not observed., even though it retains the observed browser product and revision in normalized_result.browser.

I reproduced this through the built public CLI using the repository's simulated loopback HTTP/WebSocket CDP endpoint and one regular HTML file. Inspecting the same target returned an identical browser block and correctly populated the environment and limitation. No live Electron app was used.

Reproduction

With the baseline checkout already installed and built, save this test as tests/boundary/cli/electronEnvironment.test.ts. Set TEST_FIXTURE_ROOT to an existing writable disposable fixture directory, then run:

node node_modules/vitest/vitest.mjs run tests/boundary/cli/electronEnvironment.test.ts --maxWorkers 1

The following is the focused test that was executed. Its assertions describe the defective output, so a passing result confirms reproduction rather than a fix. It creates and removes index.html in the chosen directory; use a directory without an existing file by that name.

import { execFile } from "node:child_process";
import { writeFile, rm } from "node:fs/promises";
import { join } from "node:path";
import { pathToFileURL } from "node:url";
import { promisify } from "node:util";
import { expect, it } from "vitest";
import { startFakeCdpBrowser } from "../../fixtures/fakeCdpBrowser.js";

it("checks Electron list and inspect environment projection through the CLI", async () => {
  const page = join(process.env.TEST_FIXTURE_ROOT!, "index.html");
  await writeFile(page, "<html><body>fixture</body></html>");
  const browser = await startFakeCdpBrowser({ electronFileUrl: pathToFileURL(page).href });
  const execute = promisify(execFile);
  const run = async (args: string[]) => {
    const { stdout } = await execute(process.execPath, ["scripts/rea.mjs", ...args, "--json"], { maxBuffer: 16 * 1024 * 1024 });
    return JSON.parse(stdout);
  };
  try {
    const listed = await run(["list-electron-targets", browser.endpoint]);
    const inspected = await run(["inspect-electron-page", browser.endpoint, "electron-page", "--observation-ms", "0"]);
    const projection = (value: any) => ({ operation: value.operation, browser: value.normalized_result.browser, environment: value.environment, limitations: value.limitations });
    console.log(JSON.stringify({ listed: projection(listed), inspected: projection(inspected) }, null, 2));
    expect(listed.normalized_result.targets).toHaveLength(1);
    expect(listed.normalized_result.browser).toEqual(inspected.normalized_result.browser);
    expect(inspected.environment).toEqual({ id: `${listed.normalized_result.browser.product}@${listed.normalized_result.browser.revision}`, platform: "unknown", architecture: "unknown", isolation: "none" });
    expect(inspected.limitations).toContain("Browser host platform and architecture were not observed.");
    expect(listed.environment).toBeNull();
    expect(listed.limitations).not.toContain("Browser host platform and architecture were not observed.");
  } finally {
    await browser.close();
    await rm(page, { force: true });
  }
}, 20_000);

Result: one test passed. It invoked node scripts/rea.mjs list-electron-targets <endpoint> --json and node scripts/rea.mjs inspect-electron-page <endpoint> electron-page --observation-ms 0 --json; both exited successfully. The list returned one eligible target. The endpoint and file were cleaned up.

Expected behavior

List Evidence should preserve the browser environment already observed by the provider, using the same representation as inspect Evidence: product/revision as id, platform: "unknown", architecture: "unknown", and isolation: "none". It should retain the corresponding explicit host-platform limitation.

This follows the repository's identity and uncertainty preservation guidance, the fact that both Electron result schemas contain browser identity, and the existing browser list/inspect Evidence projection. No additional browser or host observation is needed.

Impact and scope

P2: this is a bounded Evidence correctness defect. Structured environment identity and an explicit observation gap are missing from the successful list result. The browser identity remains readable inside normalized_result.browser; target discovery itself succeeds.

Source-derived consequence: environment-constrained bundle matching rejects Evidence with a null environment, including an ID-only requirement. An end-to-end bundle failure was not executed. Real-world incidence and downstream use are unknown.

The CLI behavior was observed once with one eligible target. MCP uses the same service in source but was not executed. Empty inventories, cancellation and live Electron applications were not tested. Reading the nested browser block is available for manual attribution; it does not populate the missing structured field.

REA version

Source revision 52415975942a4b9c53a817915b313ccc404f280e; package manifest version 6.7.0.

Runtime and platform

macOS 27.0.1 arm64, Node v26.12.0, locked Vitest 5.0.3. Used the already installed dependencies and built CLI without rebuilding or updating the pinned checkout.

Target and artifact context

One disposable regular HTML file exposed as an eligible local file page by the repository's simulated CDP endpoint. Browser version response: product FakeChrome/1.0, revision fake-revision. No real browser or Electron process was attached.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

These fields were projected from the two actual CLI responses; browser metadata matched exactly:

{
  "listed": {
    "operation": "list_electron_targets",
    "browser": {
      "product": "FakeChrome/1.0",
      "protocol_version": "1.3",
      "revision": "fake-revision",
      "user_agent": "FakeChrome",
      "js_version": "13.0"
    },
    "environment": null,
    "limitations": [
      "Artifact identity is unavailable for this observation.",
      "Every local file page exposed by the selected loopback CDP endpoint is eligible for listing."
    ]
  },
  "inspected_environment": {
    "id": "FakeChrome/1.0@fake-revision",
    "platform": "unknown",
    "architecture": "unknown",
    "isolation": "none"
  },
  "inspected_host_platform_limitation_present": true
}

The shared Electron projector gates both environment and the limitation on "target" in result. List results have targets and browser, but no singular target. The list service validates the list and passes it to that projector.

Typed outcome or recovery expected

Return successful list Evidence with the observed browser environment and the explicit unknown-host limitation. This requires no new error or additional target interaction.

Analysis or suspected cause

The projection uses an inspect-only property as the condition for preserving a fact shared by list and inspect. Both input result types require browser, so presence of a selected singular target does not determine whether the browser version was observed.

The public CLI handler and MCP registration route through the same application service. The CLI route was executed; MCP applicability is source-derived.

Additional context

Fetched upstream main at bcfcd8b6e2ee0c44c7ac656688db5ceb61a847d5; the relevant projection, schemas, service and adapters were unchanged. No matching issue or PR was found in all-state searches for Electron target listing, environment projection and the host-platform limitation.

Originally created by @coygeek on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5917 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Process capture or runtime observation ### Observed behavior `list-electron-targets` returns successful Evidence with `environment: null` and omits the limitation `Browser host platform and architecture were not observed.`, even though it retains the observed browser product and revision in `normalized_result.browser`. I reproduced this through the built public CLI using the repository's simulated loopback HTTP/WebSocket CDP endpoint and one regular HTML file. Inspecting the same target returned an identical browser block and correctly populated the environment and limitation. No live Electron app was used. ### Reproduction With the baseline checkout already installed and built, save this test as `tests/boundary/cli/electronEnvironment.test.ts`. Set `TEST_FIXTURE_ROOT` to an existing writable disposable fixture directory, then run: ```sh node node_modules/vitest/vitest.mjs run tests/boundary/cli/electronEnvironment.test.ts --maxWorkers 1 ``` The following is the focused test that was executed. Its assertions describe the defective output, so a passing result confirms reproduction rather than a fix. It creates and removes `index.html` in the chosen directory; use a directory without an existing file by that name. ```ts import { execFile } from "node:child_process"; import { writeFile, rm } from "node:fs/promises"; import { join } from "node:path"; import { pathToFileURL } from "node:url"; import { promisify } from "node:util"; import { expect, it } from "vitest"; import { startFakeCdpBrowser } from "../../fixtures/fakeCdpBrowser.js"; it("checks Electron list and inspect environment projection through the CLI", async () => { const page = join(process.env.TEST_FIXTURE_ROOT!, "index.html"); await writeFile(page, "<html><body>fixture</body></html>"); const browser = await startFakeCdpBrowser({ electronFileUrl: pathToFileURL(page).href }); const execute = promisify(execFile); const run = async (args: string[]) => { const { stdout } = await execute(process.execPath, ["scripts/rea.mjs", ...args, "--json"], { maxBuffer: 16 * 1024 * 1024 }); return JSON.parse(stdout); }; try { const listed = await run(["list-electron-targets", browser.endpoint]); const inspected = await run(["inspect-electron-page", browser.endpoint, "electron-page", "--observation-ms", "0"]); const projection = (value: any) => ({ operation: value.operation, browser: value.normalized_result.browser, environment: value.environment, limitations: value.limitations }); console.log(JSON.stringify({ listed: projection(listed), inspected: projection(inspected) }, null, 2)); expect(listed.normalized_result.targets).toHaveLength(1); expect(listed.normalized_result.browser).toEqual(inspected.normalized_result.browser); expect(inspected.environment).toEqual({ id: `${listed.normalized_result.browser.product}@${listed.normalized_result.browser.revision}`, platform: "unknown", architecture: "unknown", isolation: "none" }); expect(inspected.limitations).toContain("Browser host platform and architecture were not observed."); expect(listed.environment).toBeNull(); expect(listed.limitations).not.toContain("Browser host platform and architecture were not observed."); } finally { await browser.close(); await rm(page, { force: true }); } }, 20_000); ``` Result: one test passed. It invoked `node scripts/rea.mjs list-electron-targets <endpoint> --json` and `node scripts/rea.mjs inspect-electron-page <endpoint> electron-page --observation-ms 0 --json`; both exited successfully. The list returned one eligible target. The endpoint and file were cleaned up. ### Expected behavior List Evidence should preserve the browser environment already observed by the provider, using the same representation as inspect Evidence: product/revision as `id`, `platform: "unknown"`, `architecture: "unknown"`, and `isolation: "none"`. It should retain the corresponding explicit host-platform limitation. This follows the repository's [identity and uncertainty preservation guidance](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/AGENTS.md#L17-L21), the fact that [both Electron result schemas contain browser identity](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/javascript/electronObservation.ts#L55-L74), and the existing [browser list/inspect Evidence projection](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/application/BrowserEvidence.ts#L83-L97). No additional browser or host observation is needed. ### Impact and scope P2: this is a bounded Evidence correctness defect. Structured environment identity and an explicit observation gap are missing from the successful list result. The browser identity remains readable inside `normalized_result.browser`; target discovery itself succeeds. Source-derived consequence: [environment-constrained bundle matching rejects Evidence with a null environment](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/evidenceBundle.ts#L504-L515), including an ID-only requirement. An end-to-end bundle failure was not executed. Real-world incidence and downstream use are unknown. The CLI behavior was observed once with one eligible target. MCP uses the same service in source but was not executed. Empty inventories, cancellation and live Electron applications were not tested. Reading the nested browser block is available for manual attribution; it does not populate the missing structured field. ### REA version Source revision `52415975942a4b9c53a817915b313ccc404f280e`; package manifest version `6.7.0`. ### Runtime and platform macOS 27.0.1 arm64, Node v26.12.0, locked Vitest 5.0.3. Used the already installed dependencies and built CLI without rebuilding or updating the pinned checkout. ### Target and artifact context One disposable regular HTML file exposed as an eligible local file page by the repository's simulated CDP endpoint. Browser version response: product `FakeChrome/1.0`, revision `fake-revision`. No real browser or Electron process was attached. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence These fields were projected from the two actual CLI responses; browser metadata matched exactly: ```json { "listed": { "operation": "list_electron_targets", "browser": { "product": "FakeChrome/1.0", "protocol_version": "1.3", "revision": "fake-revision", "user_agent": "FakeChrome", "js_version": "13.0" }, "environment": null, "limitations": [ "Artifact identity is unavailable for this observation.", "Every local file page exposed by the selected loopback CDP endpoint is eligible for listing." ] }, "inspected_environment": { "id": "FakeChrome/1.0@fake-revision", "platform": "unknown", "architecture": "unknown", "isolation": "none" }, "inspected_host_platform_limitation_present": true } ``` The [shared Electron projector](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/application/javascript/ElectronEvidence.ts#L33-L46) gates both environment and the limitation on `"target" in result`. List results have `targets` and `browser`, but no singular `target`. The [list service](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/application/javascript/ElectronObservationService.ts#L27-L60) validates the list and passes it to that projector. ### Typed outcome or recovery expected Return successful list Evidence with the observed browser environment and the explicit unknown-host limitation. This requires no new error or additional target interaction. ### Analysis or suspected cause The projection uses an inspect-only property as the condition for preserving a fact shared by list and inspect. Both input result types require `browser`, so presence of a selected singular target does not determine whether the browser version was observed. The public [CLI handler](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/cli/electronCommands.ts#L210-L239) and [MCP registration](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/server/registerElectronTools.ts#L65-L84) route through the same application service. The CLI route was executed; MCP applicability is source-derived. ### Additional context Fetched upstream main at `bcfcd8b6e2ee0c44c7ac656688db5ceb61a847d5`; the relevant projection, schemas, service and adapters were unchanged. No matching issue or PR was found in all-state searches for Electron target listing, environment projection and the host-platform limitation.

bsakaguchi closed this issue

2026-10-31 00:42:13 +00:00

bsakaguchi commented

2026-10-31 00:42:13 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

Electron Evidence now always projects the browser product/revision environment and explicit unknown-host limitation from result.browser, without checking for a singular target. The MCP regression calls list then inspect on the same simulated endpoint, asserts the list environment/limitation and equality with inspect. This addresses the original successful-list omission without additional target observation.

Implementation: ElectronEvidence.ts, ElectronEvidence.ts.

The relevant regression checks in electronMcp.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. Electron Evidence now always projects the browser product/revision environment and explicit unknown-host limitation from result.browser, without checking for a singular target. The MCP regression calls list then inspect on the same simulated endpoint, asserts the list environment/limitation and equality with inspect. This addresses the original successful-list omission without additional target observation. Implementation: [ElectronEvidence.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/javascript/ElectronEvidence.ts#L33), [ElectronEvidence.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/javascript/ElectronEvidence.ts#L41). The relevant regression checks in [electronMcp.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/mcp/electronMcp.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 01:10:00 +00:00

[PR #3643] [CLOSED] feat(captures): decrypt TLS in recorded packet captures with a caller-supplied key log #5862

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471