[GH-ISSUE #1241] fix(process): default port normalization rewrites ordinary JSON numbers #437

New issue

Closed

opened 2026-10-15 18:25:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:25:03 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 9, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1241

Observed failure

capture_process_scenario replaces dimensions, byte counts and scores with <port> under its default normalization. It changes valid JSON into invalid JSON and the capture Evidence has no unmodified terminal payload to recover the numbers from. This can hide real differences in a capture comparison.

Reproduction

Call the real MCP tool with an absolute Node executable and an existing working directory:

{"executable":"/path/to/node","working_directory":"/path/to/fixture","arguments":["-e","console.log(JSON.stringify({pid:32,size:108,height:480,width:640,score:20}))"],"timeout_ms":8000,"idle_timeout_ms":8000,"settle_ms":100}

Observed retained frame:

{"pid":<port>,"size":<port>,"height":<port>,"width":<port>,"score":<port>}

Setting only pids:false leaves the failure unchanged. Setting normalization:{pids:false,ports:false,paths:false} preserves every number. The child exits 0 and cleanup succeeds in all three cases. The CLI uses the same harness and accepts this scenario as a file through rea capture-process scenario.json --json.

Required behavior

Preserve ordinary numeric output. Normalize a port only with adequate endpoint/field evidence or an explicit caller rule. Retain unmodified terminal observations alongside the normalized comparison projection, with actual resource limits and explicit coverage; do not try to infer sensitive data from numeric patterns.

Verify compact and spaced JSON, ordinary key=value counters, actual endpoint ports, and that a changed score remains visible to comparison. Keep explicit normalization settings in Evidence identity.

src/process/capture/ProcessNormalization.ts:35 applies /(?<=[:=])\d{2,5}\b/g without port context. Related: #61 and #48. Those comparison/capture capabilities are distinct from this reproduced data-loss defect.

Verification and scope

Reproduced through real stdio MCP on both the published package and current main, including the ports-only and disabled controls. No deep provider is required.

Audit date: 2026-10-09. Latest npm dist-tag verified as rea-agents@6.1.0; current main tested at f4c99ab8a53806dd57dc24b3d5a600905bcb4686. Linux x64, Node 24.18.0, MCP client SDK 2.3.1. Native observations use unmodified Ghidra 12.1.4 and JDK 21, two CPUs and a 512 MiB Java heap. No target execution or executable mutation was used for the static native checks.

Originally created by @N0zoM1z0 on GitHub (Oct 9, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1241 ### Observed failure `capture_process_scenario` replaces dimensions, byte counts and scores with `<port>` under its default normalization. It changes valid JSON into invalid JSON and the capture Evidence has no unmodified terminal payload to recover the numbers from. This can hide real differences in a capture comparison. ### Reproduction Call the real MCP tool with an absolute Node executable and an existing working directory: ```json {"executable":"/path/to/node","working_directory":"/path/to/fixture","arguments":["-e","console.log(JSON.stringify({pid:32,size:108,height:480,width:640,score:20}))"],"timeout_ms":8000,"idle_timeout_ms":8000,"settle_ms":100} ``` Observed retained frame: ```text {"pid":<port>,"size":<port>,"height":<port>,"width":<port>,"score":<port>} ``` Setting only `pids:false` leaves the failure unchanged. Setting `normalization:{pids:false,ports:false,paths:false}` preserves every number. The child exits 0 and cleanup succeeds in all three cases. The CLI uses the same harness and accepts this scenario as a file through `rea capture-process scenario.json --json`. ### Required behavior Preserve ordinary numeric output. Normalize a port only with adequate endpoint/field evidence or an explicit caller rule. Retain unmodified terminal observations alongside the normalized comparison projection, with actual resource limits and explicit coverage; do not try to infer sensitive data from numeric patterns. Verify compact and spaced JSON, ordinary `key=value` counters, actual endpoint ports, and that a changed score remains visible to comparison. Keep explicit normalization settings in Evidence identity. ### Source and related work [src/process/capture/ProcessNormalization.ts:35](https://github.com/morluto/rea/blob/f4c99ab8a53806dd57dc24b3d5a600905bcb4686/src/process/capture/ProcessNormalization.ts#L35) applies `/(?<=[:=])\d{2,5}\b/g` without port context. Related: #61 and #48. Those comparison/capture capabilities are distinct from this reproduced data-loss defect. ### Verification and scope Reproduced through real stdio MCP on both the published package and current main, including the ports-only and disabled controls. No deep provider is required. Audit date: 2026-10-09. Latest npm dist-tag verified as `rea-agents@6.1.0`; current main tested at `f4c99ab8a53806dd57dc24b3d5a600905bcb4686`. Linux x64, Node 24.18.0, MCP client SDK 2.3.1. Native observations use unmodified Ghidra 12.1.4 and JDK 21, two CPUs and a 512 MiB Java heap. No target execution or executable mutation was used for the static native checks.

bsakaguchi

2026-10-15 18:25:03 +00:00

closed this issue
added the
P1: high

triage

area: domain

bug
labels

bsakaguchi referenced this issue

2026-10-16 21:13:07 +00:00

[PR #437] [MERGED] feat: complete evidence-backed roadmap workflows #1986

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#437

No description provided.

Rows
Columns