[GH-ISSUE #7078] [Bug] IPS crash reports drop the terminating process, parent pid and metadata build/platform values #4268

New issue

Closed

opened 2026-10-31 00:48:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:48:20 +00:00

Owner

Originally created by @rodricksz4h5 on GitHub (Oct 25, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7078

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

Apple documents these members of a crash report:

termination.byPid, termination.byProc and termination.flags: the process that terminated the crashed process, and how;
the body's parentPid;
the metadata line's build_version and platform.

inspect-apple-ips keeps none of their values. They appear only by name, in termination.unlisted_keys, unlisted_body_keys and metadata.unlisted_keys, and coverage stays complete. So for a watchdog kill the result no longer says which process ended the app, and process keeps parentProc without its pid.

docs/apple-ips.md says documented fields are reproduced and only keys the documentation does not list go to unlisted_keys. #4297, the request this feature was built from, asks for termination members beyond namespace, code and indicator to be retained as recorded.

Reproduction

Built main 8e6a95788 on Linux (Debian bookworm, Node 24.22.1) and ran:

rea inspect-apple-ips /ips/watchdog.ips --json

on a crash report whose body has "parentProc":"launchd","parentPid":1 and

"termination":{"code":2343432205,"flags":6,"namespace":"FRONTBOARD","indicator":"scene-update watchdog transgression","byProc":"runningboardd","byPid":33,"reasons":["..."]}

and whose metadata line has "build_version":"42","platform":2.

The repository's fixture (tests/fixtures/binaryDiagnostics/appleIps.ts) also carries all six members. src/native/apple/AppleIpsParser.test.ts asserts that flags, byProc and byPid end up in termination.unlisted_keys.

Expected behavior

The values are kept as recorded:

termination.by_proc as text; termination.by_pid and termination.flags as recorded integers;
process.parent_pid as a recorded integer;
metadata.build_version as text and metadata.platform as a recorded integer.

None of them is listed in unlisted_keys any more.

Impact and scope

The terminating process is the fact that tells a watchdog kill (runningboardd, FrontBoard) apart from a jetsam kill or one by the user's own process, next to termination.code. Agents reading the result see that byProc exists but not its value.

REA version

6.7.0, revision 8e6a95788

Runtime and platform

Linux (Debian bookworm container), Node 24.22.1

Target and artifact context

A synthetic ReportCrash-shaped .ips file (above), and the repository's own fixture.

Interface

CLI

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

From main 8e6a95788 with the report above:

termination: {"namespace":"FRONTBOARD","code":{"decimal":"2343432205","hex":"0x8badf00d"},"indicator":"scene-update watchdog transgression","reasons":[...],"unlisted_keys":["flags","byProc","byPid"]}
process:     {"name":"Demo",...,"pid":{"decimal":"4242","hex":"0x1092"},"parent":"launchd",...}   (parentPid only in unlisted_body_keys)
metadata:    {...,"unlisted_keys":["app_name","app_version","slice_uuid","build_version","platform","share_with_app_devs","is_first_party"]}
coverage.status: complete

Typed outcome or recovery expected

No new error. A value with the wrong JSON type should be recorded in coverage.type_mismatches, like the other fields.

Analysis or suspected cause

The parser shapes in src/native/apple/AppleIpsJsonShape.ts do not list these members. This is the same cause as #7060 for usedImages[].name and frames[].symbolLocation. The termination, body and metadata objects keep unlisted_keys, so these members show up there by name only.

Additional context

Source for the member lists: the key tables in Apple's Interpreting the JSON format of a crash report, for the metadata, crash report, and termination objects.

Originally created by @rodricksz4h5 on GitHub (Oct 25, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7078 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior Apple documents these members of a crash report: - `termination.byPid`, `termination.byProc` and `termination.flags`: the process that terminated the crashed process, and how; - the body's `parentPid`; - the metadata line's `build_version` and `platform`. `inspect-apple-ips` keeps none of their values. They appear only by name, in `termination.unlisted_keys`, `unlisted_body_keys` and `metadata.unlisted_keys`, and coverage stays `complete`. So for a watchdog kill the result no longer says which process ended the app, and `process` keeps `parentProc` without its pid. `docs/apple-ips.md` says documented fields are reproduced and only keys the documentation does not list go to `unlisted_keys`. #4297, the request this feature was built from, asks for termination members beyond `namespace`, `code` and `indicator` to be retained as recorded. ### Reproduction Built main 8e6a95788 on Linux (Debian bookworm, Node 24.22.1) and ran: ```bash rea inspect-apple-ips /ips/watchdog.ips --json ``` on a crash report whose body has `"parentProc":"launchd","parentPid":1` and ```json "termination":{"code":2343432205,"flags":6,"namespace":"FRONTBOARD","indicator":"scene-update watchdog transgression","byProc":"runningboardd","byPid":33,"reasons":["..."]} ``` and whose metadata line has `"build_version":"42","platform":2`. The repository's fixture (`tests/fixtures/binaryDiagnostics/appleIps.ts`) also carries all six members. `src/native/apple/AppleIpsParser.test.ts` asserts that `flags`, `byProc` and `byPid` end up in `termination.unlisted_keys`. ### Expected behavior The values are kept as recorded: - `termination.by_proc` as text; `termination.by_pid` and `termination.flags` as recorded integers; - `process.parent_pid` as a recorded integer; - `metadata.build_version` as text and `metadata.platform` as a recorded integer. None of them is listed in `unlisted_keys` any more. ### Impact and scope The terminating process is the fact that tells a watchdog kill (`runningboardd`, FrontBoard) apart from a jetsam kill or one by the user's own process, next to `termination.code`. Agents reading the result see that `byProc` exists but not its value. ### REA version 6.7.0, revision `8e6a95788` ### Runtime and platform Linux (Debian bookworm container), Node 24.22.1 ### Target and artifact context A synthetic ReportCrash-shaped `.ips` file (above), and the repository's own fixture. ### Interface CLI ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence From main 8e6a95788 with the report above: ``` termination: {"namespace":"FRONTBOARD","code":{"decimal":"2343432205","hex":"0x8badf00d"},"indicator":"scene-update watchdog transgression","reasons":[...],"unlisted_keys":["flags","byProc","byPid"]} process: {"name":"Demo",...,"pid":{"decimal":"4242","hex":"0x1092"},"parent":"launchd",...} (parentPid only in unlisted_body_keys) metadata: {...,"unlisted_keys":["app_name","app_version","slice_uuid","build_version","platform","share_with_app_devs","is_first_party"]} coverage.status: complete ``` ### Typed outcome or recovery expected No new error. A value with the wrong JSON type should be recorded in `coverage.type_mismatches`, like the other fields. ### Analysis or suspected cause The parser shapes in `src/native/apple/AppleIpsJsonShape.ts` do not list these members. This is the same cause as #7060 for `usedImages[].name` and `frames[].symbolLocation`. The termination, body and metadata objects keep `unlisted_keys`, so these members show up there by name only. ### Additional context Source for the member lists: the key tables in Apple's [Interpreting the JSON format of a crash report](https://developer.apple.com/documentation/xcode/interpreting-the-json-format-of-a-crash-report), for the metadata, crash report, and termination objects.

bsakaguchi closed this issue

2026-10-31 00:48:20 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:14 +00:00

[PR #4268] [CLOSED] fix(dev): terminate the owned command on Windows cancellation (#4258) #6148